Fine-Tune LLMs for PLC Code Security: An Information-Theoretic Analysis

Programmable Logic Controllers (PLCs), widely used in industrial automation, are often programmed in IEC 61131-3 Structured Text (ST), which is prone to subtle logic vulnerabilities. Traditional tools like static analysis and fuzzing struggle with the complexity and domain-specific semantics of ST. This work explores Large Language Models (LLMs) for PLC vulnerability detection, supported by both theoretical insights and empirical validation. Theoretically, we prove that control flow features carry the most vulnerability-relevant information, establish a feature informativeness hierarchy, and derive sample complexity bounds. We also propose an optimal synthetic data mixing strategy to improve learning with limited supervision. Empirically, we build a dataset combining real-world and synthetic ST code with five vulnerability types. We fine-tune open-source LLMs (CodeLlama, Qwen2.5-Coder, Starcoder2) using LoRA, demonstrating significant gains in binary and multi-class classification. The results confirm our theoretical predictions and highlight the promise of LLMs for PLC security. Our work provides a principled and practical foundation for LLM-based analysis of cyber-physical systems, emphasizing the role of domain knowledge, efficient adaptation, and formal guarantees.