Oracle-guided circuit deobfuscation (or learning) is the problem of disambiguating an obfuscated (partially hidden) circuit given black-box access to it. This has applications in various hardware security areas such as analyzing the security of circuit obfuscation defense schemes, side-channel analysis, reverse engineering, and hardware Trojan detection. Generic deobfuscation of analog circuits has received less attention than the digital counterpart with existing methods relying on manual expert work to extract closed-form equations from the circuit. In this work, we move towards a significantly more automated process by using a combination of machine learning and Newton-method-based analog circuit optimization. We showcase how this hybrid scheme is superior to either standalone approach in terms of runtime and accuracy on a set of analog circuits that include amplifiers, filters, and oscillators. We achieve >98% average accuracy without any manual expert equation extraction in addition to demonstrating a superior resilience to process variation.

Hardware Trojans, i.e. malicious circuitry inserted into a design by an untrusted foundry or designer, pose a threat to the fabless semiconductor industry. The detection of hardware Trojans has been the subject of numerous studies over the years. In this paper, we discuss a novel approach to Trojan detection: using the framework of oracle-guided circuit learning (OGCL) or deobfuscation, which has traditionally been used for assessing the security of circuit obfuscation schemes. We show how arbitrary functional Trojan detection can polynomially be reduced to OGCL, yielding a more formal and versatile framework than traditional heuristic techniques. This formulation can also be used to locate Trojans and can be easily extended to side-channel or hybrid detection by using non-functional OGCL. The main challenge with this approach is its worst-case-exponential space complexity when using baseline Boolean satisfiability (SAT)-based circuit deobfuscation. To this end, we propose some novel techniques based on AllSAT, cube generalization, and quantified Boolean Formula (QBF) solving. We present a set of experiments on benchmark circuits to showcase the validity and performance of our framework.

Oracle-guided circuit deobfuscation/learning is the problem of recovering unknowns from a circuit by making input-output queries to it and it has various applications in the hardware security domain: in assessing the security of obfuscation schemes, side-channel analysis, and reverse engineering. Unlike the digital case, the generic analog version of the problem has received less attention with existing approaches requiring manual instance-specific labor. In this paper, we present a novel automated approach to this end: using machine learning models trained on synthetic data to predict unknown values from query data. We evaluate our framework approach in a proof-of-concept implementation against a set of hand-crafted diverse analog circuits from simple resistive networks to complex op-amp circuits, using a variety of machine learning models from linear models to decision trees, and (graph) neural networks. Our experiments show prediction error rates of less than 5% on these circuit sets. We explore additional questions such as the impact of uncertainty sampling, topological information, out-of-training range data, and parameter (process) variation.

Generic side-channel attacks, unlike traditional CPA/DPA which are specialized to individual cryptographic circuits, can take in an arbitrary circuit or its power model and try to learn user-designated secrets from its side-channel traces. In this paper, we explore the use of machine learning in the context of such generic attacks. We discuss and demonstrate the challenges of using end-to-end (trace-to-key) learning on generic circuits with larger key sizes. We instead propose a couple of ways to use machine learning to assist recent pseudo-Boolean solver-based generic attacks and report their effectiveness on FPGA power traces.

Replacing cuts in a circuit with configurable lookup-tables (LUTs) that are securely programmed post-fabrication is a logic locking technique that can be used to hide the complete design from an untrusted foundry. In this paper, we study the security of basic LUT-based locking against a set of oracle-less attacks, i.e. attacks that do not have access to a functional oracle of the original circuit. Specifically we perform cut graph/truth-table prediction using deep and graph neural networks with various data encoding strategies. Overall we observe that naive LUT-based locking with small cuts with 2 or 3 inputs may be vulnerable to oracle-less approximation whereas such attacks become less feasible for higher cut sizes. We open source our software for this attack.

Recently graph neural networks (GNN) have shown promise in detecting operators (multiplication, addition, comparison, etc.) and their boundaries in gate-level digital circuit netlists. Unlike formal approaches such as NPN Boolean matching, GNN-based methods are structural and statistical. This means that making structural changes to the circuit while maintaining its functionality may negatively impact their accuracy. In this paper, we explore this question. We show that indeed the prediction accuracy of GNN-based operator detection does fall following simple circuit rewriting. This means that custom rewrites may be a way to hamper operator detection in applications such as logic obfuscation where such undetectability is a security goal. We then present ways to improve the accuracy of prediction under such transforms by combining functional/semi-canonical information into the training and evaluation of the ML model.

Abstract Point cloud matching is an important procedure in a variety of computer vision tasks. Traditional point cloud matching methods have made great progress, while neural network‐based approaches are becoming a trend, powered by their strong capabilities of feature extraction. Existing point matching neural networks, however, mainly focus on the rigid transformation. More complex transformations should also be considered in many scenarios. In this regard, the authors extend the rigid registration to non‐rigid cases and propose a network called the Scale Robust Point Matching (SRPM)‐Net for scale point matching. This robust structure‐preserving network is implemented by incorporating Lie group parametrisation. It is conducted by Lie group linearisation representation with the constraints of parameters under the corresponding basis of Lie algebra. SRPM‐Net preserves the structure of the solution and avoids degeneration. The contributions of this paper lie in two aspects: Most importantly, SRPM‐Net provides an extendable framework for handling complicated transformations. Secondly, it introduces a new feature learning module, which better preserves the shape structure by aggregating the high‐dimensional feature and calculating the normal vector of point cloud surface automatically. Experimental results show that SRPM‐Net is more robust and accurate than existing traditional and recent deep learning methods under various situations.