CHARGE: Leveraging CWE Hierarchies for Hardware Security SystemVerilog Assertion Generation
arXiv:2607.27776
CHARGE is an automated framework that uses CWE hierarchies and large language models to generate SystemVerilog assertions for unverified RTL modules, enabling security property inference and bug detection without trusted specifications.
Abstract
This paper presents CHARGE, an automated framework for generating security properties for unverified RTL modules using CWEs and large language models (LLMs). The hallmark is a reasoning process that leverages the hierarchical nature of CWE entries to improve accuracy when identifying security-critical assets in unverified RTL modules. As a result, the approach can infer expected security behaviors and generate properties from identified assets and CWE semantics, avoiding the need for trusted design specifications and reducing manual engineering effort. We evaluate the framework on the Hack@DAC18, 19, and 21 open source SoC designs using OpenAI's GPT-4.1. CHARGE detects 27 of 42 known bugs in these designs. For Hack@DAC21 OpenPiton SoC, 89% of the generated SVAs run in Cadence JasperGold FPV, and 92.2% are non-vacuous. We compare to an open-source, manually written set of properties for these designs and find that CHARGE correctly writes properties for three bugs in which the manually written properties were incorrect. In addition, CHARGE-generated properties identify a new bug in the Hack@DAC21 OpenPiton SoC that was not previously identified.
This paper is an extended version of the paper accepted to the IEEE/ACM International Conference on Computer-Aided Design (ICCAD 2026)