SpecterRTL: LLM-Orchestrated Hardware Trojan Evolution for Automated RTL Vulnerability Injection

LLM-assisted hardware design creates a new attack surface for automated RTL red teaming. Prior approaches are constrained by limited autonomy, weak adversarial evolution, and hardware security data scarcity. We present **SpecterRTL**, an end-to-end framework for autonomous Hardware Trojan construction and evolution. SpecterRTL establishes a self-sustaining closed loop where design-aware vulnerability mining extracts targeted attack seeds that fuel adversarial evolution to create previously unseen threat variants. Continuously absorbing newly evolved attacks into foundational threat knowledge mitigates data scarcity and drives increasingly sophisticated exploration. Across 137 RTL modules spanning 24 categories, SpecterRTL produces an average of 5.27 verified Trojan seeds per module and raises the proportion of high-risk instances from 12.5% to 92.3% on representative evolution cases. On the clean designs shared with the current SOTA RTL red-teaming benchmark, SpecterRTL produces **42.4$\times$** more verified Hardware Trojan instances and a **35$\times$** higher successful evasion count across three representative detectors, advancing RTL security evaluation from template-constrained generation to self-sustaining threat evolution.