Corrupt-and-Correct (CAC) logic locking techniques offer strong resilience against Boolean Satisfiability (SAT) attacks. However, the additional corruption circuitry can introduce detectable structural artifacts. Existing structural attacks and associated metrics remain narrowly scoped, limiting their effectiveness for integrated circuit (IC) designers seeking to assess structural bias. This paper formalizes a structural bias metric that models the normalized polarity behavior of internal circuit signals and quantifies the deviation between circuit behavior under protected input patterns (PIPs) and behavior induced by random excitation. The metric can be evaluated with only a small number of tests, enabling a lightweight, design-time diagnostic that identifies gates whose bias exceeds a threshold. This approach improves the generality and practical utility of structural bias assessments compared to the state of the art. The developed metric is further employed to construct a proof-of-concept exploit, the structurally aware SAT attack (StrAT), that directs the solver toward the most biased gates. Tests of this exploit on ISCAS’85, MCNC, and ITC’99 combinational benchmarks locked with SFLL-HD0, SFLL-flex, and SFLL-rem succeeded in 96.5% of the cases the original attack failed to find the key in the same time window.

In recent years, various obfuscation techniques have been proposed to protect analog circuits against IP piracy attacks. To evaluate the strength of the analog obfuscation techniques, attack algorithms including the equation-based SMT attack, genetic algorithm, key spacing attack, and monotonic response algorithm have been proposed. However, unlike the digital domain, where the SAT attack is the de-facto standard for measuring the resiliency of the key-based locking techniques, no standard metric exists to evaluate analog obfuscation techniques. In this article, a novel DC nodal analysis (DNA) attack algorithm is proposed that requires only the circuit netlist and the large signal DC input-output response of an oracle IC. The DNA attack utilizes Kirchhoff’s voltage law (KVL) and Kirchhoff’s current law (KCL) to efficiently explore the obfuscated parameter space of an analog circuit and determine the correct control parameters that result in a circuit response similar to that of the oracle IC. The proposed attack is evaluated against four distinct analog circuits secured using key-based parameter obfuscation and multi-threshold obfuscation. The results from execution of the attack on a three stage front-end circuit secured with the key-based obfuscation technique indicate the successful elimination of 99.1% of keys from the search space in less than five days. The results from evaluating the attack on the same three stage front-end circuit secured with the multi-threshold obfuscation technique indicate the successful elimination of 99.98% of keys from the search space in 50.4 hours. With the limited information necessary to perform the attack, the efficiency in pruning the key-space when considering real world attack scenarios, and the ability to execute the attack across all current analog locking techniques, the DC nodal analysis attack provides a de-facto standard to measure the security provided by an analog obfuscation technique.

Brain-inspired hyperdimensional computing (HDC) is an emerging machine learning paradigm leveraging high-dimensional spaces for efficient tasks like pattern recognition and medical diagnostics. As a lightweight alternative to deep neural networks, HDC offers smaller model sizes, reduced computation, and memory-centric processing. However, deploying HDC in safety-critical applications, such as healthcare and robotics, is challenged by hardware-induced errors. This paper investigates HDC's robustness to memory errors via extensive bit-flip injection experiments on item and associative memories. Results reveal that certain bit-flips severely degrade accuracy. To address this, we introduce the Hyperdimensional Bit-Flip Search (HD-BFS), a similarity-guided method for identifying vulnerabilities and crafting efficient attacks, where flipping just 6 critical bits—3.9% of random bit-flips—reduces accuracy to chance levels. We further propose Hyperdimensional Accelerated Bit-Flip Search (HD-ABFS), which narrows the search space by targeting critical dimensions and most significant bits (MSBs), achieving up to 282$\times$speedup over HD-BFS. Finally, we develop an effective protection mechanism to enhance model safety. These insights highlight HDC's resilience to random errors, offer robust defenses against targeted attacks, and advance the security and reliability of HDC systems.

Recently, brain-inspired hyperdimensional computing (HDC), an emerging neuro-symbolic computing scheme that imitates human brain functions to process information using abstract and high-dimensional patterns, has seen increasing applications in multiple application domains and deployment in edge-cloud collaborative processing. However, sending sensitive data to the cloud for inference may face severe privacy threats. Unfortunately, HDC is particularly vulnerable to privacy threats due to its reversible nature. To address this challenge, we propose PP-HDC, a novel privacy-preserving inference framework for HDC. PP-HDC is designed to protect the privacy of both inference input and output. To preserve the privacy of inference input, we propose a novel hash-encoding approach in high-dimensional space by implementing a sliding-window-based transformation on the input hypervector (HV). By leveraging the unique mathematical properties of HDC, we are able to seamlessly perform training and inference on the hash-encoded HV with negligible overhead. For inference output privacy, we propose a multi-model inference approach to encrypt the inference results by leveraging the unique structure of HDC item memories and ensuring the inference result is only accessible to the owner with a proper key. We evaluate PP-HDC on three datasets and demonstrate that PP-HDC enhances privacy-preserving effects compared with state-of-the-art works while incurring minimal accuracy loss.

Logic locking is a potential solution to prevent reverse engineering and integrated circuit (IC) counterfeiting from untrusted third parties within the IC supply chain. Among various techniques, corrupt and correct (CAC) based techniques offer strong security guarantees against SAT based attacks. However, the sparse prime implicant (SPI) attack demonstrated that the random selection of protected input patterns (PIPs) is able to leak information in the Boolean domain for SFLL-HD0 based techniques. This paper proposes a novel attack, the Boolean DERIVativE (DERIVE) attack, that generalizes the Boolean domain leakage. The attack uses a property common to all existing CAC-secured circuits, which is an increased probability for the perturb unit in the corrupted logic cone to create new edges in the Boolean domain. These newly created edges reduce the search space over SAT based attacks, allowing the developed attack to find the PIPs 99.50% faster than SAT based attacks, and to be successful 55.27% more of the time when compared to the SPI attack when tested on benchmark circuits.

Algorithms have been proposed to evaluate the resiliency of analog obfuscation techniques. Each analog deobfuscation algorithm considers different threat models, applies to only a small set of obfuscation techniques, and suffers adversely under real world scenarios, where one or more pieces of information on the circuit and obfuscation technique or techniques is unavailable to the attacker. In this paper, a novel DC nodal analysis (DNA) attack algorithm is proposed that requires only the circuit netlist and the DC input-output response of the oracle IC to perform the attack. The DNA attack utilizes Kirchhoff’s voltage law (KVL) and Kirchhoff’s current law (KCL) to efficiently characterize an obfuscated analog circuit with the objective of determining the correct locked parameters. A preliminary evaluation of the proposed attack is performed on three distinct analog circuits secured using both key-based parameter obfuscation and non-key-based multi-threshold obfuscation. The results from executing the attack on a secured single-stage analog circuit with key-based obfuscation indicate the successful elimination of, on average, 96% of keys from the search space. The results from executing the attack on two-stage circuits secured with multi-threshold obfuscation indicate that 99.58% of the keys are eliminated in less than 7 hours. With the limited information necessary to perform the attack, the efficiency in pruning the key-space when considering real attack scenarios, and the application of the attack to all current analog obfuscation techniques, the DNA attack provides the de-facto standard in the characterization of the resiliency of an analog obfuscated circuit.

Sparse arrays have been recently applied to spectral sensing of wideband spectrum where the array is configured to estimate the directions of co-frequency emitters and also reconfigured, through antenna switching, for beamforming. The latter archives source signal isolation necessary for emitter identifications and signal modulation classifications and identifications. This paper examines the roles of the sparse array configuration and the sparse array weights in delivering the optimum and semi-optimum performance when adopting the criterion of maximum signal-to-interference and noise ratio (MaxSINR). Towards this end, we compare the source isolation performance based on the optimum sparse array configuration and array weights applied individually, jointly, or in sequence. The individually optimized sparse array configuration emerges when the array strives to orthogonalize the desired source steering vector and the interference subspace. Such sparse array can be followed by applying conventional beamformer weights or weights stemming from high interference to noise ratio assumption. HER curves are used in the comparison to delineate the offering of each array design approach.

Deep learning has been shown to be a powerful tool in array processing. Sparse array reconfigurability can be an integral part of cognitive sensing in dynamic radio frequency (RF) environments. In this respect, fast-switching that avoids hardware complexity, insertion loss, and crosstalk distortion is paramount to a realizable perception-action cycle. In this paper, we design sparse arrays using binary switching per RF chain for optimum beamforming that maximizes signal-to-interference-and-noise ratio (SINR). We apply two binary switching strategies and examine their achievable sparse array classification rates and SINR using convolutional neural networks as well as the less complex structure of multilayer perceptron.

Analog obfuscation techniques to prevent intellectual property attacks have mainly evolved from digital obfuscation. Similar to digital hardware security, the considered threat models commonly assume that the attacker possesses the circuit netlist, specifications, and bias information to deobfuscate a locked analog circuit. However, when one or more pieces of information remain unavailable, there is an adverse effect on the performance of current analog attack algorithms. In this article, an analysis of the challenges and limitations of obtaining the information needed to successfully attack an analog circuit is provided. In addition, the performance of current state-of-the-art analog attack techniques is evaluated when one or more pieces of information is unavailable. The analysis of the attack on five distinct analog circuits obfuscated with key-based parameter locking is performed, premised upon the level of information possessed by the adversary. The monotonic attack (MA) returned the correct key in less than 10 h when executing a black-box attack on single stage circuits obfuscated with a 10-bit key. The key-spacing (KS) attack is$10\times $faster than the monotonic attack and returns$8.3\times $fewer candidate keys for multistage analog circuits. The satisfiability modulo theory (SMT) based attack is$224\times $slower than the monotonic attack and$2240\times $slower than the key spacing attack for an 18-bit obfuscated circuit. A genetic algorithm (GA) based attack is 121$091\times $slower than an monotonic attack even for a single stage analog circuit. Through analysis of the results, metrics are developed to characterize the setup and evaluation time of executing the deobfuscation attacks.

Oracle guided attacks, such as the satisfiability attack, are a significant concern when obfuscating an integrated circuit (IC). Partitioned finite state machine (FSM) based sequential logic locking techniques are much more resilient to oracle guided attacks due to the differences in the state space between the oracle and the IC under attack. However, susceptibility to structural attacks and the extraction of the transition state between the obfuscated and functional modes of an FSM threaten the efficacy of sequential logic locking. Therefore, a methodology to synthesize hidden state transitions (HSTs) into an FSM within an IC is developed. HSTs and logic cone modifications are utilized to further enhance the security of sequentially locked circuits by increasing the number of paths an adversary must search and reducing the susceptibility to structural attacks. An algorithm to insert hidden transitions and logic cone modifications into a netlist is developed that results in an average overhead of 6.79% in area, 7.78% in power, and 8.28% in performance across all of the ISCAS'89 sequential benchmark circuits. To modify the logic cone with two altered minterms, the average increase in area and power, beyond what is needed for the implementation of HSTs, is 26.46% and 30.30%, respectively, with no additional overhead in performance.

Current out-of-cone logic locking methodologies provide resilience against the satisfiability (SAT) attack with minimal corruption of the outputs when comparing an activated and locked integrated circuit (IC). In addition, the structure of the modifications to the original logic leaks functional information of the circuit, which allows an adversary to determine the correct key. A novel logic locking methodology, CORruption adaptable logic locking (CORALL), is introduced in this article that provides increased security against the SAT attack for modified logic cones that require a large corruption of the primary outputs of the circuit, where the corruption is quantified by comparing between an activated and locked state of the IC. In addition, the modifications to the logic cone utilized by CORALL provide increased resilience against structural attacks. The CORALL architecture increases the number of iterations required to successfully execute a SAT attack for a flip function with 20 inputs by 34.41× over SFLL-HD n/4 and 82.36× over SFLL-Flex. In addition, a protected-cube selection process based on iterative cofactors is introduced, which provides varying logical functions of the perturb unit and maps portions of the logic of the perturb unit into the look-up tables (LUTs) of the CORALL architecture. The variation in the logical functions implemented by the perturb unit and the mapped functionality of the perturb unit into a LUT provide resistance to all current structural attacks on out-of-cone logic locking techniques.

A novel technique to secure the scan chain of an integrated circuit (IC) is proposed. The technique creates a logical partition between the functional and test modes of a circuit, where the correct logic locking key is only provided in functional mode. The proposed technique allows for the security of the logic cone through logic locking and secures the outputs of the circuit from the scan chain without modifications to the structure of the scan chain. Since the oracle responses in test mode do not correspond to the functional key, satisfiability (SAT) attacks are not able to leverage the responses from the scan chain. In addition, a charge accumulation circuit is developed to prevent and detect any attempt to enter the partitioned test mode while the correct circuit responses are still stored within the registers. The charge accumulation circuit results in a 9.2% increase in area as compared to a minimum sized 180 nm 2-input NAND gate. Implementing the technique on the ISCAS'89 s15850 benchmark circuit results in a 2.87% increase in the total area.

Vulnerabilities of key based analog obfuscation methodologies that modify the transistor dimensions of a circuit are evaluated. Two attack vectors on a common source amplifier, differential amplifier, operational amplifier, and voltage controlled oscillator are developed. The first attack exploits the lack of possible key combinations permitted around the correct key, which is a result of requiring a unique key to lock the circuit. An average of 5 possible key combinations were returned in an average of 5.47 seconds when executing the key spacing attack. The second attack vector utilizes the monotonic relationship between the sizing of the transistors and the functional response of the circuit to determine the correct key. The average time to execute the attack, while assuming process, voltage, and temperature (PVT) variation of 10%, was 1.18 seconds. Both equal key spacing and non-monotonic key dependencies are discussed as ways to mitigate the threats to future analog obfuscation techniques.

The resiliency of in-cone logic locking techniques to the satisfiability (SAT) attack is characterized in this paper. An analysis of the parameters of the SAT solver that impact security and a characterization of the effect netlist topology has on the security of the circuit is presented. The analysis of SAT solver parameters and logic structure is used to develop three novel logic locking gate selection algorithms based on maximum fanout free cones (MFFCs) and gate controllability for circuits implementing XOR, look-up table (LUT), and 2× 1 MUX-based logic obfuscation. The XOR, LUT, and MUX MFFC-based algorithms resulted in an average increase of, respectively, 61.8%, 123.6%, and 38.5% in the minimum number of iterations required to complete the SAT attack across 1,000 different variable orderings of the netlist while applying the locking techniques to 5% of the gates within the netlist. In addition, the SAT attack resiliency and output corruption of the developed algorithms are compared with out-of-cone locking techniques.

The transition to a horizontal integrated circuit (IC) design flow has raised concerns regarding the security and protection of IC intellectual property (IP). Obfuscation of an IC has been explored as a potential methodology to protect IP in both the digital and analog domains in isolation. However, novel methods are required for analog mixed-signal circuits that both enhance the current disjoint implementations of analog and digital security measures and prevent an independent adversarial attack of each domain. This paper demonstrates the vulnerabilities of implementing disjointed obfuscation techniques to protect analog mixed-signal ICs. In addition, a novel methodology is developed to generate functional and behavioral dependencies between the analog and digital domains that results in an increase in the adversarial key search space. The dependencies between the analog and digital keys result in a 3x increase in the number of iterations required to complete the SAT attack. An analysis of best practices is also provided to aid in the implementation of security measures for analog mixed-signal circuits.

A method to increase the resiliency of in-cone logic locking against the SAT attack is described in this paper. Current logic locking techniques provide protection through the addition of circuitry outside of the original logic cone. While the additional circuitry provides provable security against the SAT attack, other attacks, such as the removal attack, limit the efficacy of such techniques. Traditional in-cone logic locking is not prone to removal attacks, but is less secure against the SAT attack. The focus of this paper is, therefore, the analysis of in-cone logic locking to increase the security against the SAT attack, which provides a comparison between in-cone techniques and newly developed methodologies. A novel algorithm is developed that utilizes maximum fanout free cones (MFFC). The application of the algorithm limits the fanout of incorrect key information. The MFFC based algorithm resulted in an average increase of 61.8% in the minimum number of iterations required to complete the SAT attack across 1,000 different variable orderings of the circuit netlist while restricted to a 5% overhead in area.

The thermal profiles of integrated circuits (ICs) have been leveraged as a side-channel in multiple circuit and architectural scenarios. Applications range from identifying hardware Trojans to estimating the per-core power consumption of homogeneous multicore processors. Such scenarios leverage the correlation between the on-chip location of the consumed power with some target information of interest, such as correlating the extra power consumption at a specific circuit position with the presence of a hardware Trojan. While the spatial correlation between the power consumption and thermal profiles applies to all ICs, there is a fundamental difference in the context of modern SoCs. The difference stems from the presence of hardware accelerators, in which localized power consumption corresponds to the system performing the specific task that a given accelerator executes. The work described in the paper demonstrates the implications of correlating the thermal and power profiles of SoCs by presenting two working case studies that determine, at runtime, 1) the activity factor of each accelerator and 2) whether or not a system is infected by malware. This work relies on pre-processing thermal images in order to obtain a spatial profile of the estimated power density and uses a modified version of a previously developed technique that is tailored for use with accelerator-rich ICs. The resulting power estimates are fed into machine learning models that predict the core activity factor with mean average errors between 3% and 5% for the highest performing core. The statistical models used for malware detection result in an AuROC score of up to 1.0 and 0.9 when the malware offsets the activity factor of a single core by 2.5% and the 3-sigma width of the workload activity factor distribution is 2.5% and 5%, respectively.

In this paper, the state space of an integrated circuit (IC) is used to increase the security of an IC against a variety of threats including intellectual property theft, IC counterfeiting, and IC overproduction. Hidden state transitions, state dependent keys, and temporal based transitions are implemented as a means to combat probing style attacks, such as the SAT attack. SPICE simulations are performed on modified state machines to characterize the overhead of implementing the three techniques in a circuit. Implementing temporal based transitions increases the area of the circuit by 68.42%, the power by 43.17%, and did not impact circuit delay. However, increasing the circuit size significantly reduces the overhead of state space encryption. For example, encrypting two registers in the s15850 ISCAS89 benchmark circuit resulted in an area overhead of 0.026%, presenting a low overhead means of securing sequential logic.

Untrusted third-parties are found throughout the integrated circuit (IC) design flow resulting in potential threats in IC reliability and security. Threats include IC counterfeiting, intellectual property (IP) theft, IC overproduction, and the insertion of hardware Trojans. Logic encryption has emerged as a method of enhancing security against such threats, however, current implementations of logic encryption, including the XOR or look-up table (LUT) techniques, have high per-gate overheads in area, performance, and power. A novel gate level logic encryption technique with reduced per-gate overheads is described in this paper. In addition, a technique to expand the search space of a key sequence is provided, increasing the difficulty for an adversary to extract the key value. A power reduction of 41.50%, an estimated area reduction of 43.58%, and a performance increase of 34.54% is achieved when using the proposed gate level logic encryption instead of the LUT based technique for an encrypted AND gate.

Integrated circuits (ICs) are used in fields such as banking, transportation, energy, health, and the military. However, the use of ICs in many applications is threatened by an increasing reliance on untrusted third-parties within the IC design flow. The result is a growing concern for IC reliability and security, with threats that include IC counterfeiting, intellectual property (IP) theft, IC overproduction, and the insertion of hardware Trojans. An area of research aimed at ensuring the reliability and security of ICs in critical applications is logic encryption. While the security of an IC is increased when using logic encryption, current methods such as the XOR or look-up table (LUT) techniques have high per-gate overheads in area, performance, and power. A reduction in the per-gate overhead permits the use of logic encryption in a wider range of applications. Novel gate level designs for logic encryption are described in this paper, resulting in reduced overhead in power, area, and performance as compared to the XOR or LUT based techniques. With the proposed gate level technique, encrypting an AND gate results in a power reduction of 43.2%, an estimated area reduction of 19.8%, and a performance increase of 46.9% in comparison to the XOR based implementation of the encrypted AND.