CWEEP Triples Correct-Warning Rate on RTL Security Bugs Without Requiring a Security Spec

arXiv 2607.29604·low signalXBlueskyLinkedInCopy link

Hardware security verification normally demands a detailed security specification and heavy expert effort, and offers no standard way to pinpoint where in register-transfer-level code a fault lives. CWEEP is a lexical static analysis framework that needs no security spec, so it runs early in RTL development while properties are still being written, and it localizes the exact vulnerable RTL location with automatic repair suggestions where applicable. Evaluated on two SoC designs with manually inserted bugs plus an LLM-generated dataset of 3,874 buggy modules, CWEEP issues a correct warning up to 60.8% of the time versus 17.5% for the prior tool on the same dataset.