VeriChat is a hardware security AI assistant developed by the University of Florida to detect hidden backdoors in integrated circuit designs. It functions as a conversational agent that answers security-related questions and runs automated verification tools on user-uploaded chip design files. VeriChat employs a three-agent retrieval-first architecture to source information from a curated library of hardware security papers and live web results, ensuring answers are evidence-based and limiting hallucinations common in general chatbots. In a proof-of-concept, VeriChat identified a deliberately inserted Trojan in an AES S-Box that leaked secret keys upon detecting a rare trigger sequence. The system performed syntax checks, synthesis analysis, simulation of the trigger, and formal verification to confirm the data leak. Evaluations showed VeriChat achieved 87.73% factual accuracy and effectively rejected fabricated technical claims. However, the demonstration used a known implant created by the researchers themselves, leaving open the question of detection efficacy for unknown threats. The tool addresses the challenge of hardware supply chain security by enabling engineers to query suspicious designs in natural language and validate findings with automated checks.

VeriChat provides hardware security engineers with a tool to detect hidden backdoors and Trojans in chip designs, potentially reducing the risk of supply chain attacks involving malicious circuitry. By automating verification and providing evidence-backed answers, it can improve the accuracy and efficiency of hardware security assessments. However, its current validation is limited to known implants created by the developers, so its effectiveness against novel or sophisticated backdoors remains to be proven. There are no known exploits in the wild related to VeriChat itself, and it is not a vulnerability but a security tool.

This entry describes a security tool rather than a vulnerability. No patch or remediation is applicable. Users interested in hardware security verification can consider evaluating VeriChat as a potential aid in detecting hidden backdoors. Since the tool is newly developed and demonstrated, engineers should continue to validate its findings independently and not rely solely on its output. No urgent action is required.