Oracle-guided circuit deobfuscation (or learning) is the problem of disambiguating an obfuscated (partially hidden) circuit given black-box access to it. This has applications in various hardware security areas such as analyzing the security of circuit obfuscation defense schemes, side-channel analysis, reverse engineering, and hardware Trojan detection. Generic deobfuscation of analog circuits has received less attention than the digital counterpart with existing methods relying on manual expert work to extract closed-form equations from the circuit. In this work, we move towards a significantly more automated process by using a combination of machine learning and Newton-method-based analog circuit optimization. We showcase how this hybrid scheme is superior to either standalone approach in terms of runtime and accuracy on a set of analog circuits that include amplifiers, filters, and oscillators. We achieve >98% average accuracy without any manual expert equation extraction in addition to demonstrating a superior resilience to process variation.

Hardware Trojans, i.e. malicious circuitry inserted into a design by an untrusted foundry or designer, pose a threat to the fabless semiconductor industry. The detection of hardware Trojans has been the subject of numerous studies over the years. In this paper, we discuss a novel approach to Trojan detection: using the framework of oracle-guided circuit learning (OGCL) or deobfuscation, which has traditionally been used for assessing the security of circuit obfuscation schemes. We show how arbitrary functional Trojan detection can polynomially be reduced to OGCL, yielding a more formal and versatile framework than traditional heuristic techniques. This formulation can also be used to locate Trojans and can be easily extended to side-channel or hybrid detection by using non-functional OGCL. The main challenge with this approach is its worst-case-exponential space complexity when using baseline Boolean satisfiability (SAT)-based circuit deobfuscation. To this end, we propose some novel techniques based on AllSAT, cube generalization, and quantified Boolean Formula (QBF) solving. We present a set of experiments on benchmark circuits to showcase the validity and performance of our framework.

Oracle-guided circuit deobfuscation/learning is the problem of recovering unknowns from a circuit by making input-output queries to it and it has various applications in the hardware security domain: in assessing the security of obfuscation schemes, side-channel analysis, and reverse engineering. Unlike the digital case, the generic analog version of the problem has received less attention with existing approaches requiring manual instance-specific labor. In this paper, we present a novel automated approach to this end: using machine learning models trained on synthetic data to predict unknown values from query data. We evaluate our framework approach in a proof-of-concept implementation against a set of hand-crafted diverse analog circuits from simple resistive networks to complex op-amp circuits, using a variety of machine learning models from linear models to decision trees, and (graph) neural networks. Our experiments show prediction error rates of less than 5% on these circuit sets. We explore additional questions such as the impact of uncertainty sampling, topological information, out-of-training range data, and parameter (process) variation.

Herein we explore using logic elements that can be programmed through their inputs for logic locking. For this purpose, we design a novel through-input-programmable (TIP) lookup-table (LUT) element and develop algorithms to find cuts in the circuit that can be mapped to such elements while maintaining programmability. Our proposed TIPLock flow achieves area savings of 50–70% compared to the traditional approach of using a key-vector-long scan-chain.