A preprint posted to arXiv on August 5 maps the security threats emerging from two converging shifts in semiconductor design: the breakup of monolithic chips into modular chiplets, and the arrival of large language models in the software that designs them S¹. Both trends promise cheaper, more modular chips. Both also radically expand the hardware attack surface, and until now nobody had mapped the full picture.

My read: This is a survey paper, not a breakthrough with new data. The authors, led by Johann Knechtel and Ramesh Karri, are credible voices in hardware security, and some of them flagged LLM risks in chip design back in a 2024 paper P⁴. But the "dual revolution" framing is their characterisation, not independently verified market data. What I find genuinely useful is the mapping exercise: connecting chiplet-level attacks to LLM-driven design flows in one place. I would watch whether the peer-reviewed version adds empirical evidence, because right now the abstract gives us the map without the terrain.

The first trend is chiplets. Instead of printing one large chip on one piece of silicon, designers are splitting functions across multiple smaller dies and linking them on an interposer. This is called 2.5D integration. The payoff is better yield (smaller dies have fewer defects), modularity (you can mix and match), and faster design cycles S¹. The cost is trust: more dies from more vendors, more interfaces between them, and more places to hide a malicious modification.

The second trend is LLMs moving into Electronic Design Automation, the software tools that turn specifications into physical chip layouts. This is not hypothetical. Facebook's experimental CoreSmith project, posted on GitHub in April, is an automated pipeline that converts a natural-language prompt into the files needed to manufacture a chip P³. OpenAI's open-weight models, gpt-oss-120b and gpt-oss-20b, are freely available under Apache 2.0 and have been downloaded and forked thousands of times P⁵. The tools exist. The paper asks what happens when they become standard.

Three layers of attack

The paper organises its analysis across three levels for chiplet systems: architectural, logical, and physical S¹. At the architectural level, the way chiplets are partitioned and connected can create covert channels between dies that were meant to be isolated. At the logical level, malicious logic hidden in third-party chiplet IP can exfiltrate data or trigger faults. At the physical level, the interposer itself (the substrate connecting the dies) can be tampered with during manufacturing.

For LLM acceleration hardware, the paper examines attacks on the hardware stacks that run large language models S¹. This matters because the same chips being designed with LLM assistance are also the chips running LLMs. The result is a feedback loop where vulnerabilities in one domain compound the other.

For LLM-driven EDA pipelines, the paper identifies exploits that target the design flow itself rather than the chip it produces, treating them as threats inherent to the LLM-assisted approach S¹. A poisoned model, a manipulated prompt, or a compromised plugin in an agentic design tool could inject subtle hardware Trojans into generated code that are extremely hard to detect through traditional verification.

What the defenses look like

The paper reviews existing defense approaches rather than proposing new ones. For chiplet systems, it points to 2.5D split manufacturing combined with active interposers to build physically isolated Root of Trust architectures, a hardware anchor that can verify the integrity of other chiplets on the package S¹. For LLM-driven EDA, it surveys state-of-the-art defense techniques and identifies where the gaps remain S¹.

There is a twist. The paper also discusses how LLMs could be turned from a liability into an asset, advancing hardware security efforts for modern systems including chiplets S¹. The same technology that opens the attack surface might help close it. A 2024 paper by overlapping authors, including Knechtel and Ozgur Sinanoglu, made a similar argument about building trust in LLM-assisted chip design P⁴. This new preprint extends that thinking to chiplet architectures.

What to do about it

Consider a verification lead at a fabless startup that just adopted an LLM-assisted RTL generation tool to speed up its design cycle. The tool takes a natural-language spec and produces Verilog. Before this adoption, the verification team checked third-party IP blocks and hand-written code. Now they also need to scrutinise machine-generated code for subtle Trojans, verify that the model weights and prompt templates have not been tampered with, and audit any plugins or agents the tool calls during synthesis. The attack surface grew and changed shape.

The practical step this week: ask your EDA toolchain vendor or internal tooling team exactly which model, which prompts, and which third-party components touch the generated RTL before it reaches verification. If the answer is unclear, that gap is the threat.

What we don't know yet

This is a preprint that has not been peer-reviewed S¹. Only the abstract is publicly available. The paper contains no disclosed empirical findings, metrics, or quantitative results. No specific companies, products, or real-world breaches are named. The "dual revolution" framing is the authors' characterisation of industry trends, not independently verified market data. The paper reviews existing defenses rather than proposing new ones, so readers should not expect novel protection mechanisms.

The next signal: the full text of this preprint or a peer-reviewed version. We'll check it for empirical evidence and specific case studies when it appears. Subscribe if you want that follow-up when it lands.

Sources: S1 — Hardware Design and Security in the Era of Chiplets and LLMs · P2 — Hardware Design and Security in the Era of Chiplets and LLMs · P3 — facebookexperimental/coresmith · P4 — LLMs and the Future of Chip Design: Unveiling Security Risks and Build · P5 — openai/gpt-oss

More from Not A Tech Guy

Generated from an audited evidence pack with primary-source research. Social-media items are discussion signals, not verified facts. Nothing here is financial, legal or medical advice.