Tests of a poisoned hardware-code model reported a sharp gap between the poisoned baseline and recovered versions. In the Qwen2.5-Coder-7B setting, attack success rate (ASR) was 91% for the baseline and 16% for the best reported recovery configuration, while Pass@1, the first-attempt functional-correctness score, was 19.23% and 45.51%, respectively. The document is a preprint identified as arXiv:2608.26049v1 and dated 26 Aug 2026.
A recovery pipeline built for limited trust
RTLGuard is presented as a teacher-student recovery pipeline for a suspect RTL generator. A compact clean teacher guides the student with response-token cross-entropy, logit knowledge distillation and hidden-state feature alignment. In plain terms, the student is trained to reproduce clean outputs, match the teacher's output scores and stay closer to its internal representations. The updates are limited to parameter-efficient fine-tuning, or PEFT, rather than changes to the whole model.
The poisoning set built from a generated pool contained 10,000 samples: 8,000 Trojan and 2,000 clean. The clean subsets were mutually disjoint. Researchers used 5,000 OriGen samples for Trojan generation, another 5,000 for teacher preparation, and held out 100 OriGen attack-trigger samples and 100 randomly selected RTL++ samples for evaluation.
Four poisoned student models were evaluated: Qwen2.5-Coder-7B-Instruct, Qwen2.5-Coder-14B-Instruct, fine-tuned CodeV-R1 and CodeLlama-13B-Instruct.
ASR was evaluated with Qwen2.5-Coder-32B-Instruct in a deterministic two-pass language-model judging protocol. Functional correctness was measured with VerilogEval v2 Pass@1 under deterministic decoding. In other words, a separate language model judged whether generated outputs met the attack condition, while the benchmark assessed whether the code worked.
The main comparisons favored recovery
On the OriGen evaluation, all three Qwen2.5-Coder-7B recovery configurations had lower ASR than the 91% baseline: 16%, 26% and 32%. Their Pass@1 scores were 45.51%, 39.10% and 36.35%, compared with 19.23% for the poisoned model.
For the 14B Qwen student, the baseline ASR was 94% and Pass@1 was 17.94%. With the Qwen-3B and Qwen-1.5B teachers, ASR was 18% and 20%, while Pass@1 was 43.58% and 35.25%, respectively.
The paper also reports cross-family comparisons. CodeV-R1 recorded 68% ASR and 29.48% Pass@1 at baseline, compared with 16% and 31.41% in a recovered configuration. CodeLlama-13B-Instruct recorded 93% ASR and 21.15% Pass@1 at baseline, compared with either 18% and 40.38% or 23% and 37.82%, depending on the recovery configuration.
A second data set showed the same broad pattern
On held-out RTL++, the Qwen2.5-Coder-7B comparisons retained the same broad pattern. ASR was 12%, 21% and 24%, versus 91% at baseline; Pass@1 was 45.51%, 39.10% and 36.35%, versus 19.23%. The supplied evaluation description says all poisoned and recovered models were assessed on this held-out set.
In the Qwen2.5-Coder-7B/Qwen-7B setting, an independent DeepSeek-Coder judge also returned 12% ASR, matching the primary judge. Manual inspection found more than 90% agreement with the judge labels. That check was limited to the stated setting and selected inspected outputs.
The remaining weakness was concentrated in one attack type
Results varied by attack type. T1 functionality-modification attacks were dominant and hardest to remove, while T2, T3 and T4 showed stronger suppression after recovery. The supplied analysis does not give exact percentages for each category.
In comparisons with adapted defenses, NAD had 24% ASR and Selective Amnesia 22%. The authors report that RTLGuard had the lowest ASR and highest Pass@1 among those comparisons. Because the other defenses were adapted to this setting, the comparison does not settle how independently reproduced versions would perform.
The component tests pointed in the same descriptive direction. For Qwen2.5-Coder-7B, the poisoned baseline recorded 19.23% Pass@1 and 91% ASR. Cross-entropy alone reached 31.41% and 30%; adding knowledge distillation reached 39.74% and 19%; the full cross-entropy-plus-distillation-plus-feature-alignment objective reached 45.51% and 16%. These are comparisons, not proof that any single component has a statistically significant effect.
The choice of PEFT backbone also differed in the reported Qwen2.5-Coder-7B/Qwen-7B setting. DoRA produced 47.43% Pass@1 and 9% ASR; LoRA produced 45.51% and 16%; AdaLoRA produced 44.87% and 11%. All three improved on the poisoned baseline in the reported comparison, and DoRA had the strongest combination of the two measures.
What the preprint leaves unanswered
The main caution is the scope of the evidence. The evaluation used synthetic poisoning examples, the listed student models and teacher-student configurations, the OriGen and RTL++ benchmark partitions, and deterministic decoding. It therefore does not establish how the procedure would perform on naturally occurring poisoned checkpoints, real-world RTL Trojans, broader model families, other decoding settings or hardware-level security checks. No confidence intervals, inferential tests, formal power analysis or preregistered analysis plan were reported.
For now, the paper's practical message is narrow: it reports a lightweight way to recover selected poisoned RTL generators when limited trusted data are available, with lower measured ASR and better benchmark scores in the tested setups. It does not show that all backdoors are removed; the T1 results point to a remaining weakness that future evaluations would need to examine.
Paper data and sources
Original title: RTLGuard: A Lightweight Teacher-Student Defense for Poisoned RTL Code Generation Models
Authors: Mahshid Rezakhani, Kimia Azar, Hadi Kamali
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-26
DOI: 10.1145/3831252.3834219
Original paper · Full text