Reverse engineering the functional specification from a netlist is a challenging task that enables IP piracy and tampering. Traditional logic locking techniques, which depend on external activation with secrets stored in tamper-proof locations to thwart reverse engineering, have repeatedly been compromised by key recovery attacks. Their vulnerability highlights the flawed assumption of relying on tamper-proof secrets for building hardware security solutions, especially when activated devices are deployed in open environments where they are exposed to attackers for functional queries and probing. This paper presents white-box logic obfuscation (WBLO) as a novel solution to safeguard control logic from functional reverse engineering, even when attackers have full visibility of the operational netlist. WBLO eliminates the need for post-manufacturing activation and reliance on tamper-proof key storage by securing the design with keys that are autonomously updated internally through the legitimate sequential execution of the device. The proposed approach invalidates functional analysis under arbitrary probing and combinational queries. We examine the implementation challenges inherent in the WBLO process and identify critical design considerations that enhance security and efficiency. Building on these insights, we suggest a prioritization for various design transformation and synthesis rules that achieve robust security in the white-box attack model while minimizing implementation overheads.

Finite State Machines (FSMs) are central to control logic in digital systems as errors can result in critical system failures. Conventional error detection embeds Error Detection Codes (EDCs) into state encodings, but surpassing the 99.5% detection probability for arbitrary-magnitude errors, as required in mission-critical systems, demands significant redundancy and consequently results in prohibitive overhead in resource-constrained environments. In this work, we introduce a new FSM protection methodology that breaks the one-shot detection barrier of traditional EDCs. By leveraging white-box logic obfuscation (WBLO) to synthesize a randomized corruption mode and integrating loworder nonlinear parity constraints into the expanded state representation, we convert transient faults into persistent anomalies detectable across subsequent cycles. This progressive detection model substantially propels the Pareto frontier of implementation overhead versus detection probability, while maintaining sub-cycle average detection latency.

The use of large language models (LLMs) to simulate human behavior has gained significant attention, particularly through personas that approximate individual characteristics. Persona-based simulations hold promise for transforming disciplines that rely on population-level feedback, including social science, economic analysis, marketing research, and business operations. Traditional methods to collect realistic persona data face significant challenges. They are prohibitively expensive and logistically challenging due to privacy constraints, and often fail to capture multi-dimensional attributes, particularly subjective qualities. Consequently, synthetic persona generation with LLMs offers a scalable, cost-effective alternative. However, current approaches rely on ad hoc and heuristic generation techniques that do not guarantee methodological rigor or simulation precision, resulting in systematic biases in downstream tasks. Through extensive large-scale experiments including presidential election forecasts and general opinion surveys of the U.S. population, we reveal that these biases can lead to significant deviations from real-world outcomes. Based on the experimental results, this position paper argues that a rigorous and systematic science of persona generation is needed to ensure the reliability of LLM-driven simulations of human behavior. We call for not only methodological innovations and empirical foundations but also interdisciplinary organizational and institutional support for the development of this field. To support further research and development in this area, we have open-sourced approximately one million generated personas, available for public access and analysis.

Autoregressive models have emerged as a powerful framework for modeling exchangeable sequences---i.i.d. observations when conditioned on some latent factor---enabling direct modeling of uncertainty from missing data (rather than a latent). Motivated by the critical role posterior inference plays as a subroutine in decision-making (e.g., active learning, bandits), we study the inferential and architectural inductive biases that are most effective for exchangeable sequence modeling. For the inference stage, we highlight a fundamental limitation of the prevalent single-step generation approach: its inability to distinguish between epistemic and aleatoric uncertainty. Instead, a long line of works in Bayesian statistics advocates for multi-step autoregressive generation; we demonstrate this "correct approach" enables superior uncertainty quantification that translates into better performance on downstream decision-making tasks. This naturally leads to the next question: which architectures are best suited for multi-step inference? We identify a subtle yet important gap between recently proposed Transformer architectures for exchangeable sequences (Müller et al., 2022; Nguyen & Grover, 2022; Ye & Namkoong, 2024), and prove that they in fact cannot guarantee exchangeability despite introducing significant computational overhead. Through empirical evaluation, we find that these custom architectures can significantly underperform compared to standard causal masking, highlighting the need for new architectural innovations in Transformer-based modeling of exchangeable sequences.

This paper proposes an obfuscation technique that thwarts functional reverse engineering despite the operational netlist being completely visible to the attacker. Central to this approach is the recognition that reverse engineering necessitates not only the recovery of an operational netlist but also the extraction of functional understandings from it to drive specific illegitimate applications. The proposed approach applies self-generated and mutating keys to obfuscate Finite State Machines (FSMs), forcing attackers to perform complex sequential analysis to learn even the simplest aspects of a design’s functionality. This work examines the impact of key mutation operations on the effectiveness and efficiency of obfuscation. It suggests an enhanced key mutation scheme capable of significantly reducing the implementation overheads without compromising attack resilience. The experimental results show that the proposed obfuscation algorithm leads to drastic overhead improvements and demonstrates strong resilience to sequential SAT attacks and functional reverse engineering.

Logic obfuscation is a popular method for safeguarding semiconductor intellectual properties from reverse engineering threats. As key recovery attacks continue to advance, the once widely accepted notion of key secrecy has become increasingly untenable. This research proposes a novel method to thwart effective reverse engineering methods even when the attacker is armed with complete control of a fully-functional netlist, i.e., in a white-box. The proposed obfuscation technique derives mutating secrets through setting up an inherently hard problem for sequential designs to lock the netlist at design time and perform self-activation at runtime. The mutating secrets render any reverse engineering shortcuts ineffective, condemning the reverse engineering attacker to full sequential analysis at an intimidating complexity. The obfuscation procedure incorporates four design transformation techniques to ensure secure activation while minimizing overhead. The practicality and security of the proposed white-box obfuscation solution are validated through experiments on MCNC benchmarks.

Logic obfuscation protects semiconductor IPs against reverse engineering threats by concealing IP implementation details using a tamper-proof key. With the continuous evolution of key recovery attacks exploiting functional, structural, and physical key exposures, the typical assumption of key secrecy becomes increasingly untenable. This work aims to end the tug of war between key-based defenses and key recovery attacks by delivering reverse engineering resilience through a novel keyless obfuscation approach that demands no external secret. The proposed solution locks the full functionality of a design using internally-generated and constantly-changing secrets that can be only extracted from the FSM transition history. The intrinsic secrets are secure against reverse engineering attempts due to the hardness of identifying valid transition paths to a target state from the obfuscated gate-level netlist. We develop an algorithm to synthesize the obfuscated FSM logic and the dynamic key update logic which jointly activate the design for all valid sequential queries so as to deliver unimpeded functionality for legal users. The algorithm enforces key consistency through equivalence-preserving FSM transformation and constraint-based state encoding to handle complex reconverging transition paths. Experimental results on MCNC benchmarks confirm the practicality and security of the proposed keyless logic obfuscation methodology.

During the last decade, logic locking has been proposed to protect integrated circuits against piracy and reverse engineering threats. Functional pruning attacks, such as the Boolean satisfiability (SAT) attack, have greatly challenged the security of logic locking techniques, yet they require access to an oracle and suffer from muted efficacy on inherently SAT-hard circuits. In this article, we present a novel oracleless attack on both XOR and MUX-based logic locking by analyzing the redundancy level deviation under different keys. Our fundamental insight is that incorrect keys would produce circuits that violate universally followed design principles, prominent among which stands the minimization of logic redundancy. We leverage the redundancy-level deviation produced by individual and pairs of key bits to recover key bit values and establish pairwise equivalence, leading to an efficient nearly linear time attack algorithm. We experimentally verify that the proposed attack quickly unveils more than half of the key bits with high accuracy on 21 ISCAS’85 and MCNC circuits locked with a variety of locking techniques. To fortify logic locking in the face of this successful redundancy attack, we supplement this article with a key gate insertion methodology that smooths the deviation in redundancy level. We achieve this goal by selecting key gates that exhibit pairwise dissociation among a set of individually secure locations, which effectively breaks down correlations in arbitrary sets of key gates and, thus, imposes a consistent redundancy level throughout the key space. Experimental results confirm the strong redundancy attack resilience of the proposed defense strategy.

Logic obfuscation has been proposed as a counter-measure towards chip counterfeiting and IP piracy by obfuscating circuit designs with a key-controlled locking mechanism. However, the extensive output corruption of early key gate based logic obfuscation techniques has exposed them to effective SAT attacks. While current SAT resilient logic obfuscation techniques succeed in undermining the attack by offering near-trivial output corruption, they do so at the expense of a drastic reduction in functional and structural protection scope. In this work, we present JANUS-HD based on novel insights that succeed to deliver the heretofore elusive goal of simultaneously boosting corruptibility and foiling SAT attacks. JANUS-HD obfuscates an FSM through diverse FF configurations for different transitions with the overall configuration setting as the obfuscation secret. A key-controlled Hamming distance comparator controls the obfuscation status at the minimized number of entrance states identified through a custom graph partitioning algorithm. Reliance on the inherent state transition patterns extends the obfuscation benefits to non-entrance states without exposing any additional key space pruning trace. We leverage the flexibility of state encoding and equivalence-based FSM transformations to generate an obfuscated netlist at low overhead using standard synthesis tools. Finally, we present a scan chain crippling mechanism that delivers unfettered scan chain access while eradicating any key trace leakage in the scan mode, thus thwarting chosen-input attacks aimed at the Hamming distance comparator. We illustrate through experiments that JANUS-HD delivers obfuscation scope improvements of up to 45.5x over the state-of-the-art, establishing the first cost-effective solution to offer a broad yet attack-resilient obfuscation scope against supply chain threats.

The globalization of the IC supply chain witnesses the emergence of hardware attacks such as reverse engineering, hardware Trojans, IP piracy and counterfeiting. The consequent losses sum to billions of dollars for the IC industry. One way to defend against these threats is to lock the circuit by inserting additional key-controlled logic such that correct outputs are produced only when the correct key is applied. The viability of logic locking techniques in precluding IP piracy has been tested by researchers who have identified extensive weaknesses when access to a functional IC is guaranteed.In this paper, we uncover weaknesses of logic locking techniques when the attacker has no access to an activated IC, thus exposing vulnerabilities at the earliest stage even for applications that seek refuge from attacks through functional opaqueness. We develop an attack algorithm that prunes out the incorrect value of each key bit when it introduces a significant level of logic redundancy. Throughout our experiments on ISCAS-85 and ISCAS-89 benchmark circuits, the attack deciphers more than half of the key bits on average with a high accuracy.

The security of logic locking has been extensively examined under the threat model that assumes the availability of an activated IC. Recently, structural attacks such as ones based on redundancy analysis have challenged the viability of logic locking even when stringent measures are taken to preclude access to an activated IC. In this paper, we propose a gate selection based logic locking technique to identify key gate insertion sites such that the redundancy level deviates minimally under all key assignments. The proposed logic locking technique is evaluated on a set of benchmark circuits to confirm its resistance against redundancy analysis based attacks.

B2B (business-to-business) systems often use service-oriented architecture (SOA) with decomposed business services. These services can interact and share data among each other. Service might use a cloud – hosted database, such as a non - relational encrypted key – value store. However, the cloud platform hosting the database can be untrusted. Data owner needs to be sure that each service can access only those segments of a shared database for which the service is authorized. Furthermore, data requests can come from a service also hosted by untrusted cloud. Hence, there is a need for designing a cloud enterprise framework that can ensure privacy-preserving data dissemination in SOA and accurately detect data leakages. We design and prototype a solution that ensures privacy – preserving dissemination of data. The solution is based on (a) role-based access control, (b) cryptographic capabilities of client's browser, (c) authentication method, (d) subject's trust level. The prototype enables privacy – preserving dissemination of Electronic Health Records (EHRs) hosted in an untrusted cloud.