The modern supply chain ecosystem exposes hardware intellectual property (IP) blocks to diverse confidentiality attacks aimed at reverse engineering (RE), piracy, or the extraction of design secrets. An emerging and potent design solution for IP protection against these attacks, particularly against RE, is the fine-grained redaction of security-critical logic and replacing the redacted logic with lookup tables (LUTs). The LUTs are then programmed in-field, similar to FPGAs, using protected bitstreams, thereby preventing untrusted foundries or test/assembly facilities from mounting RE attacks. The LUT-based redaction paradigm incurs a substantial hardware cost, with area overhead ranging from 70x to 100x and delay overhead from 2x to 5x, while also often necessitating significant alterations to the commercial tool flow for design, verification, and testing. In this work, we propose PROM, a robust fine-grain redaction technique inspired by structured ASIC, that aims to address the limitations of LUT-based redaction with novel overhead optimizations. The redacted security-critical logic is implemented using a library of custom-design PROM cells that are optimized to minimize overheads compared to state-of-the-art redaction techniques while providing strong protection against various RE attacks. We evaluated the proposed redaction technique across a range of open-source benchmarks, achieving robust security with average overheads of 1.42x in area and 1.09x in delay, demonstrating its efficiency and practicality.

Microelectronic systems are widely used in many sensitive applications (e.g., manufacturing, energy, defense). These systems increasingly handle sensitive data (e.g., encryption key) and are vulnerable to diverse threats, such as, power sidechannel attacks, which infer sensitive data through dynamic power profile. In this paper, we present a novel framework, POLARIS for mitigating power side channel leakage using an Explainable Artificial Intelligence (XAI) guided masking approach. POLARIS uses an unsupervised process to automatically build a tailored training dataset and utilize it to train a masking model. The POLARIS framework outperforms state-of-the-art mitigation solutions (e.g., VALIANT) in terms of leakage reduction, execution time, and overhead across large designs.

Hardware fuzzing is critical for uncovering vulnerabilities in modern integrated circuits by systematically exploring input spaces. A major challenge lies in generating high-quality seeds that maximize coverage and verification efficiency. While Coverage-Guided Fuzzing (CGF) enhances overall exploration, it lacks precision when targeting specific submodules. DirectFuzz addresses this with directed test generation but suffers from key limitations, including limited HDL support, abstraction mismatches, and poor scalability for large target regions. In this work, to overcome these challenges, we propose PROFUZZ, a Directed Graybox Fuzzing (DGF) framework that integrates Automatic Test Pattern Generation (ATPG) for precise and scalable seed generation. By leveraging ATPG’s structural analysis capabilities, PROFUZZ improves coverage effectiveness and supports large-scale hardware designs. Experimental results show that PROFUZZ outperforms DirectFuzz with 30× greater scalability in terms of handling target sites, 11.66% higher coverage, and 2.76× faster execution, demonstrating its potential to advance the state-of-the-art in directed hardware fuzzing.

The growing complexity of modern system-on-chip (SoC) designs, coupled with the integration of untrusted thirdparty Intellectual Property (IP) blocks, presents significant challenges for security verification to ensure the trust and integrity of the fabricated silicon. Traditional verification methods, such as functional simulation and Formal Property Verification (FPV), suffer from limited scalability, substantial manual effort, and often incomplete coverage. To address these issues, we propose an automated formal verification framework FV-PAL that can vastly enhance security verification at both module and submodule levels. Our approach introduces judicious design partitioning to identify submodules using structural analysis and enables targeted verification of gate-level netlists, reducing computational overhead. Leveraging Large Language Models (LLMs) and retrieval-augmented generation (RAG), the framework automatically generates non-vacuous security properties translated into SystemVerilog Assertions (SVAs) using design specifications and related documentation. FV-PAL can be integrated with the commercial EDA toolflow to perform FPV and generate coverage metrics with iterative refinement via a feedback loop if coverage falls below specified threshold. FV-PAL demonstrates significant improvements in verification efficiency and coverage based on our evaluation on open-source benchmarks, offering a scalable and efficient formal verification approach for hardware designs.

Identifying potential bugs early in the design flow is essential to mitigate vulnerability propagation and prevent costly fixes in later stages. The recent emergence of Large Language Models (LLMs) has demonstrated proficiency across various domains, including vulnerability assessment in hardware designs. Existing techniques primarily focus on generating security properties or assertions for verification, with less emphasis on bug detection. We propose a novel framework, LAMBDA, that leverages pre-trained LLM and retrieval-augmented generation (RAG) to identify relevant CWEs, generate SystemVerilog Assertions (SVAs) to detect deviations from intended behaviors, highlighting potential bugs. Experimental results demonstrate successful identification of eight unique bugs using LAMBDA in buggy OpenTitan SoC design from Hack@DAC’24 competition.

Scan-Based Design-For-Testability (DFT) measures are prevalent in modern digital integrated circuits to achieve high test quality at low hardware cost. With the advent of 3D heterogeneous integration and chiplet-based systems, the role of scan is becoming ever more important due to its ability to make internal design nodes controllable and observable in a systematic and scalable manner. However, the effectiveness of scan-based DFT suffers from poor testability of internal nodes for complex circuits at deep logic levels. Existing solutions to address this problem primarily rely on Test Point Insertion (TPI) in the nodes with poor controllability or observability. However, TPI-based solutions, while an integral part of commercial practice, come at a high design and hardware cost. To address this issue, in this paper, we present LITE, a novel ATPG-aware scan instrumentation approach that utilizes the functional flip-flops in a scan chain to make multiple internal nodes observable and controllable in a low-cost, scalable manner. We provide both circuit-level design as well as an algorithmic approach for automating the insertion of LITEfor design modifications. We show that LITEsignificantly improves the testability in terms of the number of patterns and test coverage for ATPG and random pattern testability, respectively, while incurring considerably lower overhead than TPI-based solutions.

Logic Equivalence Checking (LEC) is a widely used formal verification method that ensures design accuracy by comparing implemented schematics with the respective Register Transfer Level (RTL) specifications to confirm functional equivalence. Traditional LEC approaches based on SAT-based verification often do not account for complexities introduced by resynthesis, technology transition, and port name changes, leading to verification failures or poor results. Additionally, IP protection techniques, including state space transformation and fine-grained redaction, further complicate traditional LEC analysis by altering the design and obscuring functional relationships, often leading to verification failures. This paper presents a novel framework, CLIP, Cut Point Matching-based Logic Equivalence Checking, that addresses these limitations of conventional LEC techniques and offers scalable and robust verification with higher accuracy and reliability leveraging on structural analysis. Experimental results show that CLIP can effectively handle both combinational and sequential designs, including support for transformed designs for which traditional LEC analysis fails, and significantly improves both verification efforts and accuracy for diverse open-source designs.

Modern computing systems rely on System-on-Chips (SoCs) to integrate multiple Intellectual Property (IP) cores developed in-house or acquired from third-party vendors with varying trust levels. Commercial Off-The-Shelf (COTS) components, such as microcontrollers and FPGAs, offer ready-made solutions but introduce security risks, especially in an untrusted supply chain. Effective verification of both IP cores and COTS components is essential for ensuring functionality, security, and reliability. Traditional IP verification techniques are often complex and error-prone due to over-reliance on manual efforts, while COTS verification poses significant challenges due to their inherent black-box nature and diverse integrity issues. The emergence of Large Language Models (LLMs) significantly enhances hardware verification by automating tasks such as code generation and bug fixing. In this paper, we present a review of LLM-based IP verification methods and discuss challenges in current verification practices. Next, we propose an LLM-driven workflow that generates test programs for COTS verification and demonstrate its effectiveness through experimental analysis on open-source COTS processors.

Due to the globalization of the semiconductor supply chain and the adoption of the zero trust model, hardware Trojan attacks pose significant security threats introduced by untrusted entities. Hardware Trojans relate to malicious modification of a design before fabrication, resulting in unintended functional or side-channel behavior, such as causing a Denial of Service (DoS) attack or leaking sensitive information. Detecting hardware Trojans in fabricated silicon chips is extremely challenging primarily due to the vast possible attack space. Directed test generation towards activation (i.e., trigger) and/or manifestation (e.g., observation of payload) of the viable Trojans with conventional post-manufacturing Automatic Test Pattern Generation (ATPG) process is known to be practically infeasible. Hence, researchers have explored statistical test techniques for detecting arbitrary instances of Trojan attacks through post-silicon functional testing. However, existing statistical test solutions lack in effective trigger and payload coverage and suffer from scalability issues. In this paper, we propose LATENT, a scalable payload-aware statistical test pattern generation technique for high-coverage Trojan detection leveraging the power of existing functional ATPG solutions. Our experimental study on large population of randomly inserted Trojans in a suite of open-source designs shows promising results in both trigger and Trojan coverage.

The increasing prominence of Large Language Models (LLMs) is being acknowledged for their exceptional abilities in comprehending natural language, conducting advanced reasoning, and generating contextual responses. LLMs expedite code generation, verification, and bug-fixing tasks across software and hardware domains. Development of hardware designs typically involves translating natural language specifications into Hardware Description Languages (HDLs) like Verilog or SystemVerilog, followed by circuit synthesis, physical layout, and fabrication, with the potential for human errors in the process. In the current industry practice, HDL verification tasks typically rely on manual expertise from security professionals to detect and address vulnerabilities. Modern System-on-Chip (SoC) designs integrate several Intellectual Property (IP) blocks implemented using HDL and communicate through a common bus to perform intended functions. Ensuring security throughout the SoC design process requires innovative solutions due to the complex nature of SoC designs and the distribution of assets across multiple IP blocks. Popular conversation LLMs such as Open AI’s ChatGPT and Google’s GEMINI (formerly BARD) offer the potential to automate HDL code generation and verification tasks by interpreting user prompts represented in natural language descriptions, thereby minimizing manual effort and enhancing hardware design quality. This paper explores recent research works on HDL generation, verification, and bug fix leveraging LLMs while addressing prevailing challenges and presenting potential opportunities for improvement.

Power side-channels give rise to several potent attack vectors for leaking information in digital circuits. While a plethora of (mathematically robust) solutions exist to tackle such side-channels, their deployment through existing VLSI design-flows remains an important engineering issue. Besides, most existing solutions result in significant hardware overhead hindering their practical usage for resource-constrained settings, such as Internet-of-Things (IoT) or embedded devices. In this paper, we address both of these issues through an integrated electronic design automation (EDA) tool-flow operating on gate-level designs. Based on an interesting observation that not every net in a design is equally susceptible to side-channel leakage, we devise a generic testing mechanism and lightweight albeit customizable protection strategy for a given trace count. We first analytically establish the observation based on certain physical properties of VLSI circuits and also validate it on ISCAS benchmark circuits. Next, we present a tool calledVALIANT, which can identify the leaking nets for a given number of traces from the gate-level netlist of a cipher.VALIANTworks alongside state-of-the-art design automation tools and, therefore, can be directly incorporated in existing design flows. After identifying the leaky subset of nets in a design, we propose a lightweight variant of an existing masking scheme to eliminate the leakage concerning a given trace count. The main feature of our protection scheme is that it takes into account subset of nets are not “leaky” and optimizes the usage of randomness and extra gates according to this information to minimize the overhead. Experimental evaluation over state-of-the-art lightweight S-Boxes and the GIFT block cipher establishes the efficacy of the proposed idea for generating lightweight protected solutions in an automated manner.