CHARGE: Leveraging CWE Hierarchies for Hardware Security SystemVerilog Assertion Generation

2026-07-30

AI Summary

This work addresses the limitations of existing RTL security verification, which relies on error-prone manual property specification and lacks automated approaches. The paper proposes the first automated framework that integrates the Common Weakness Enumeration (CWE) hierarchy with a large language model (GPT-4.1) to identify security-critical assets and generate SystemVerilog assertions without requiring a trusted specification. By synergistically combining CWE knowledge, LLM-based reasoning, and formal verification via JasperGold, the method successfully detects 27 out of 42 known vulnerabilities in the Hack@DAC SoC benchmark. The generated assertions are executable in 89% of cases and non-vacuous in 92.2%, while also uncovering one previously unknown vulnerability. This approach significantly outperforms manually authored properties, markedly improving the accuracy and effectiveness of hardware security property generation.

Abstract

This paper presents CHARGE, an automated framework for generating security properties for unverified RTL modules using CWEs and large language models (LLMs). The hallmark is a reasoning process that leverages the hierarchical nature of CWE entries to improve accuracy when identifying security-critical assets in unverified RTL modules. As a result, the approach can infer expected security behaviors and generate properties from identified assets and CWE semantics, avoiding the need for trusted design specifications and reducing manual engineering effort. We evaluate the framework on the Hack@DAC18, 19, and 21 open source SoC designs using OpenAI's GPT-4.1. CHARGE detects 27 of 42 known bugs in these designs. For Hack@DAC21 OpenPiton SoC, 89% of the generated SVAs run in Cadence JasperGold FPV, and 92.2% are non-vacuous. We compare to an open-source, manually written set of properties for these designs and find that CHARGE correctly writes properties for three bugs in which the manually written properties were incorrect. In addition, CHARGE-generated properties identify a new bug in the Hack@DAC21 OpenPiton SoC that was not previously identified.

Problem

• hardware security
• RTL verification
• CWE hierarchy
• SystemVerilog assertion
• security property generation

Innovation

• CWE hierarchy
• LLM-based assertion generation
• hardware security
• SystemVerilog Assertion (SVA)
• automated property inference