As the complexities of processors keep increasing, the task of effectively verifying their integrity and security becomes ever more daunting. The intricate web of instructions, microarchitectural features, and interdependencies woven into modern processors pose a formidable challenge for even the most diligent verification and security engineers. To tackle this growing concern, recently, researchers have developed fuzzing techniques explicitly tailored for hardware processors. However, a prevailing issue with these hardware fuzzers is their heavy reliance on static strategies to make decisions in their algorithms. To address this problem, we develop a novel dynamic and adaptive decision-making framework, MABFuzz, that uses multi-armed bandit (MAB) algorithms to fuzz processors. MABFuzz is agnostic to, and hence, applicable to, any existing hardware fuzzer. In the process of designing MABFuzz, we encounter challenges related to the compatibility of MAB algorithms with fuzzers and maximizing their efficacy for fuzzing. We overcome these challenges by modifying the fuzzing process and tailoring MAB algorithms to accommodate special requirements for hardware fuzzing. We integrate three widely used MAB algorithms in a state-of-the-art hardware fuzzer and evaluate them on three popular RISC-V-based processors. Experimental results demonstrate the ability of MABFuzz to cover a broader spectrum of processors' intricate landscapes and doing so with remarkable efficiency. In particular, MABFuzz achieves an average speedup of 53.72× in detecting vulnerabilities and an average speedup of 3.11× in achieving coverage compared to a state-of-the-art technique.

Large language models (LLMs) have emerged as transformative tools within the hardware design and verification lifecycle, offering numerous capabilities in accelerating design processes. Recent research has showcased the efficacy of LLMs in translating design specifications into source code through hardware description languages. Researchers are also using LLMs to generate test cases and write assertion rules to bolster the detection of hardware vulnerabilities. Thus, the semiconductor industry is swiftly integrating LLMs into its design workflows. However, this adoption is not without its challenges.While LLMs offer remarkable benefits, they concurrently introduce security concerns that demand a thorough examination. These concerns manifest as potential vulnerabilities indirectly introduced into the designs while generating the design code, or by directly equipping the attackers with novel avenues for exploitation. In this paper, we discuss the emerging security implications due to the capabilities introduced by LLMs in the context of hardware design verification, evaluate the capabilities of existing security detection and mitigation techniques, and highlight the possible future security attacks that use LLMs.

The globalized nature of the integrated circuits supply chain has given rise to several security problems. The insertion of malicious components, called hardware Trojans, is one such serious problem. Since Trojans are activated only under extremely rare trigger conditions and the search space is exponentially large, detecting them is arduous. Researchers have attempted to detect Trojans by querying the design-under-test using appropriate test patterns and monitoring its logical or side-channel response. However, techniques in both these categories lack either in terms of detection accuracy or scalability for larger designs. In this work, we investigate why existing techniques fall short and use our findings to propose a new reinforcement learning (RL) framework for detecting Trojans. We carefully design two RL agents (one for each category) that navigate the exponential search space of the test patterns and return minimal sets of patterns that are most likely to detect Trojans. We overcome challenges related to scalability and efficacy through appropriate solutions. Experimental results on a variety of benchmarks demonstrate the scalability and efficacy of our RL agents, which reduce the number of test patterns significantly$(169.68\times $and$34.73\times $on average overall and$27.59\times $and$3.72\times $on average over large benchmarks) while maintaining or improving the Trojan-detection success rate compared to the state-of-the-art techniques.

Exploitable fault models for block ciphers are typically cipher-specific, and their identification is essential for evaluating and certifying fault attack-protected implementations. However, identifying exploitable fault models has been a complex manual process. In this work, we utilize reinforcement learning (RL) to identify exploitable fault models generically and automatically. In contrast to the several weeks/months of tedious analyses required from experts, our RL-based approach identifies exploitable fault models for protected/unprotected AES and GIFT ciphers within 12 hours. Notably, in addition to all existing fault models, we identify/discover a novel fault model for GIFT, illustrating the power and promise of our approach in exploring new attack avenues.

Hardware security vulnerabilities in computing systems compromise the security defenses of not only the hardware but also the software running on it. Recent research has shown that hardware fuzzing is a promising technique to efficiently detect such vulnerabilities in large-scale designs such as modern processors. However, the current fuzzing techniques do not adjust their strategies dynamically toward faster and higher design space exploration, resulting in slow vulnerability detection, evident through their low design coverage. To address this problem, we propose PSOFuzz, which uses particle swarm optimization (PSO) to schedule the mutation operators and to generate initial input programs dynamically with the objective of detecting vulnerabilities quickly. Unlike traditional PSO, which finds a single optimal solution, we use a modified PSO that dynamically computes the optimal solution for selecting mutation operators required to explore new design regions in hardware. We also address the challenge of inefficient initial seed generation by employing PSO-based seed generation. Including these optimizations, our final formulation outperforms fuzzers without PSO. Experiments show that PSOFuzz achieves up to 15.25× speedup for vulnerability detection and up to 2.22× speedup for coverage compared to the state-of-the-art simulation-based hardware fuzzer.

Stealthy hardware Trojans (HTs) inserted during the fabrication of integrated circuits can bypass the security of critical infrastructures. Although researchers have proposed many techniques to detect HTs, several critical limitations exist, including: (i) a low success rate of HT detection, (ii) high algorithmic complexity, and (iii) a large number of test patterns. Furthermore, as we show in this work the most pertinent drawback of prior (including state-of-the-art) detection techniques stems from an incorrect evaluation methodology, i.e., they assume that an adversary inserts HTs randomly. Such inappropriate adversarial assumptions enable detection techniques to claim high HT detection accuracy, leading to a "false sense of security." To the best of our knowledge, despite more than a decade of research on detecting HTs inserted during fabrication, there have been no concerted efforts to perform a systematic evaluation of HT detection techniques.

Insertion of hardware Trojans (HTs) in integrated circuits is a pernicious threat. Since HTs are activated under rare trigger conditions, detecting them using random logic simulations is infeasible. In this work, we design a reinforcement learning (RL) agent that circumvents the exponential search space and returns a minimal set of patterns that is most likely to detect HTs. Experimental results on a variety of benchmarks demonstrate the efficacy and scalability of our RL agent, which obtains a significant reduction (169×) in the number of test patterns required while maintaining or improving coverage (95.75%) compared to the state-of-the-art techniques.

Split manufacturing has been proposed as a defense to prevent threats like intellectual property (IP) piracy and illegal overproduction of integrated circuits (ICs). Over the last few years, researchers have developed a plethora of attack and defense techniques, creating a cat-and-mouse game between defending designers and attacking foundries. In this paper, we take an orthogonal approach to this ongoing research in split manufacturing; rather than developing an attack or a defense technique, we propose a means to analyze different attack and defense techniques. To that end, we develop a game-theoretic framework that helps researchers evaluate their new and existing attack and defense techniques. We model two attack scenarios using two different types of games and obtain the optimal defense strategies. We perform extensive simulations with our proposed framework, using nine different attacks and a class of placement and routing-based defense techniques on various benchmarks to gain deeper insights into split manufacturing. For instance, our framework indicates that the optimal defense techniques in the two attack scenarios are the same. Moreover, larger benchmarks are secure by naïve split manufacturing and do not require any additional defense technique under our cost model and considered attacks. We also uncover a counter-intuitive finding—an attacker using the network-flow attack should not use all the hints; instead, she should use only a subset.