The increasing complexity of semiconductor design, along with stringent performance, power, and time-to-market requirements, has outpaced the capabilities of traditional Electronic Design Automation (EDA) methodologies. Conventional design workflows rely on manual intervention for critical tasks such as hardware description, synthesis optimization, and verification, leading to inefficiencies and scalability limitations. Large Language Models (LLMs) present a transformative approach by automating key stages of the design pipeline, enabling intelligent synthesis tuning, test generation, and security analysis. This paper introduces ChipMind, an LLM-driven framework comprising specialized agents and modules for digital and analog chip design. ChipMind integrates AI-driven methodologies to enhance design efficiency, accelerate prototyping, and optimize key design trade-offs, thereby addressing fundamental challenges in modern semiconductor development.

With advances in technology scaling and globalization of the semiconductor industry, the vulnerability of analog integrated circuits (ICs) to reverse-engineering-based attacks, intellectual property theft, and unauthorized access has increased. Prior state-of-the-art analog deobfuscation techniques, such as those using genetic algorithms (GAs) and the satisfiability modulo theory, require an Oracle (i.e., unlocked IC) to recover the correct key. However, in some scenarios, an attacker present in an untrusted foundry might not have access to the Oracle. We demonstrate an Oracle-less attack using Bayesian optimization (BO) to retrieve the key of locked analog designs. To thwart both Oracle-guided and Oracle-less attacks, we present an automated obfuscation circuit generation framework for securing analog ICs. By employing randomness in obfuscation circuit generation, the proposed analog key-based methodology safeguards the integrity and reliability of analog ICs. Experimental results and security analysis for several analog designs demonstrate the robustness of the proposed technique to optimization attacks based on a GA and BO. We further show that the probability of guessing the correct key through brute force attack for an obfuscated analog circuit is negligibly small$(4.83\times 10^{-18})$. The proposed obfuscation scheme incurs an area overhead of less than 1.3% and power overhead of less than 2.64% for a mixed-signal IC.

Analog and mixed-signal (A/MS) integrated circuits (ICs) are crucial in modern electronics, playing key roles in signal processing, amplification, sensing, and power management. Many IC companies outsource manufacturing to third-party foundries, creating security risks such as syntactical bugs and stealthy analog Trojans. Traditional Trojan detection methods, including embedding circuit watermarks and hardware-based monitoring, impose significant area and power overheads while failing to effectively identify and localize the Trojans. To overcome these shortcomings, we present SPICED+, a software-based framework designed for syntactical bug pattern identification and the correction of Trojans in A/MS circuits, leveraging large language model (LLM)-enhanced detection. It uses LLM-aided techniques to detect, localize, and iteratively correct analog Trojans in SPICE netlists, without requiring explicit model training, and thus incurs zero area overhead. The framework leverages chain-of-thought reasoning and few-shot learning to guide the LLMs in understanding and applying anomaly detection rules, enabling accurate identification and correction of Trojan-impacted nodes. With the proposed method, we achieve an average Trojan coverage of 93.3%, average Trojan correction rate of 91.2%, and an average false-positive rate of 1.4%.

FPGAs are now ubiquitous in cloud computing infrastructures and reconfigurable system-on-chip, particularly for AI acceleration. Major cloud service providers such as Amazon and Microsoft are increasingly incorporating FPGAs for specialized compute-intensive tasks within their data centers. The availability of FPGAs in cloud data centers has opened up new opportunities for users to improve application performance by implementing customizable hardware accelerators directly on the FPGA fabric. However, the virtualization and sharing of FPGA resources among multiple users open up new security risks and threats. We present a novel fault attack methodology capable of causing persistent fault injections in partial bitstreams during the process of FPGA reconfiguration. This attack leverages powerwasters and is timed to inject faults into bitstreams as they are being loaded onto the FPGA through the reconfiguration manager, without needing to remain active throughout the entire reconfiguration process. Our experiments, conducted on a Pynq FPGA setup, demonstrate the feasibility of this attack on various partial application bitstreams, such as a neural network accelerator unit and a signal processing accelerator unit.

FPGAs are frequently utilized in cloud computing environments for high performance computing and neural network accelerators. Furthermore, multi-tenancy allows multiple users to upload customized modules on the FPGA, while maintaining logical isolation. However, attackers can take advantage of the multi-tenant environment to launch voltage-based attacks and denial-of-service (DoS). An attacker might stealthily split power-wasting ring oscillators (ROs) across multiple windows within an FPGA configuration bitstream, making it challenging for traditional detection mechanisms to identify these dispersed components as part of a larger malicious circuit. We propose a methodology to detect these malicious bitstreams by transforming individual windows within an FPGA bitstream into a graph-based representation. Leveraging this graph structure, our method employs graph convolutional networks (GCNs) in the training phase to capture malicious patterns from the bitstreams. We use the classification accuracy, true-positive rate, and false-positive rate metrics to quantify the effectiveness of our method across diverse power-wasting circuits on multiple FPGA boards.

As the globalization of integrated circuits (ICs) continues to advance, the threat of hardware Trojans has emerged as a major concern in ensuring the security and reliability of analog circuits. While a considerable body of prior work has focused on detecting digital Trojans in digital circuits, the detection of analog Trojans in analog circuits has received significantly less attention. We present DAWN, a sensitivity analysis-based analog Trojan detection framework using neural networks to identify potential analog Trojan hotspots and prevent them from being exploited through unauthorized modifications. We incorporate circuit watermarks in these hotspots to provide an additional layer of security. With these watermarks, any malicious modification to the circuit is automatically detected with high accuracy. We target the detection of stealthy, large-delay Trojans that might be inserted either during the chip design or fabrication stages. Experimental results for analog benchmark circuits and two commonly studied analog Trojans demonstrate the effectiveness of the proposed framework.

As FPGAs are increasingly shared and remotely accessed by multiple users and third parties, they introduce significant security concerns. Modules running on an FPGA may include circuits that induce voltage-based fault attacks and denial-of-service (DoS). An attacker might configure some regions of the FPGA with bitstreams that implement malicious circuits. Attackers can also perform side-channel analysis and fault attacks to extract secret information (e.g., secret key of an AES encryption). In this paper, we present a convolutional neural network (CNN)-based defense to detect bitstreams of RO-based malicious circuits by analyzing the static features extracted from FPGA bitstreams. We further explore the criticality of RO-based circuits in order to detect malicious Trojans that are configured on the FPGA. Evaluation on Xilinx FPGAs demonstrates the effectiveness of the security solutions.

The popularity of cloud computing has led to increasing demand for efficient and scalable hardware. Multitenant FPGAs are becoming popular because of their ability to provide high performance and flexibility, yet being cost-effective. While multiple tenants have the ability to configure the same FPGA with customized modules, several security vulnerabilities can be exploited by adversaries. Attackers can use an FPGA to perform malicious actions, such as injecting malicious bitstreams and launching denial-of-service attacks. We propose a two-tier machine learning framework that first detects malicious features from an FPGA bitstream and then performs criticality analysis to evaluate the severity of potentially malicious ring oscillators (ROs) configured by that bitstream. The latter step is crucial as it ensures the security of FPGAs from voltage and power-based attacks and also reduces the risk of inappropriately blocking benign RO-based circuits from FPGA configuration. The proposed framework is evaluated using a diverse set of real-world bitstreams. We achieve an accuracy of 100% in detecting malicious bitstreams and an accuracy of 96.55% in detecting malicious bitstreams that are critical.

Multitenant field-programmable gate arrays (FPGAs) are increasingly being used in cloud computing technologies. Users are able to access the FPGA fabric remotely to implement custom accelerators in the cloud. However, the sharing of FPGA resources by untrusted third parties can lead to serious security threats. Attackers can configure a portion of the FPGA with a malicious bitstream. Such malicious use of the FPGA fabric may lead to severe voltage fluctuations and denial of service. In this work, we consider FPGAs that support time-based multitenancy, i.e., a single user has access to the FPGA at a time. We propose a convolutional neural network (CNN)-based approach to detect malicious RO-like circuits that are configured on an FPGA by learning features from the data-series representation of the bitstreams of malicious circuits. We use the classification accuracy, true-positive rate, and false-positive rate metrics to quantify the effectiveness of CNN-based classification of malicious bitstreams. Our threat model includes a variety of power-wasting circuits that are used to configure FPGAs in the cloud. We propose a two-stage malicious bitstream detection framework for the classification and diagnosis of the type of malicious circuit implemented by a particular bitstream. We further propose a novel window-merging technique to improve model performance in the second stage of the detection framework. Experimental results on Xilinx FPGAs demonstrate the effectiveness of the proposed method.

Computing platforms are integrating field-programmable gate arrays (FPGAs) to support domain-specific customization. Multiple tenants can share these FPGAs by configuring them at runtime. However, attackers can abuse this capability by programming the FPGAs with malicious functions. A malicious configuration bitstream can launch denial of service, overheat the FPGA, leak sensitive information via side channels, enable remote monitoring, and launch voltage and timing attacks. We consider time-based multitenancy, where multiple tenants use the FPGA at different time intervals and not at the same time. We propose a defense based on machine learning (ML) algorithms to detect bitstreams of malicious circuits and malicious circuits mixed with legitimate circuits by analyzing the static features extracted from FPGA bitstreams. The proposed approach can help detect malicious bitstreams without the need for reverse engineering of the bitstream or having access to the design netlist. Our results on Xilinx FPGAs indicate that supervised classifiers may identify malicious bitstreams representing ring-oscillator circuits with a true-positive rate (TPR) of 100% and a false-positive rate (FPR) of only 4%. In addition, for the extremely difficult problem of detecting malicious bitstreams embedded in legitimate bitstreams, a pipeline of a random forest and a support vector machine classifiers trained on subarrays of bitstreams can help detect bitstreams of malicious circuits embedded in legitimate designs with TPR of 95.5% and FPR of 30.4%.

Multi-tenant FPGAs are increasingly being used in cloud computing technologies. Users are able to access the FPGA fabric remotely to implement custom accelerators in the cloud. However, sharing FPGA resources by untrusted third-parties can lead to serious security threats. Attackers can configure a portion of the FPGA with a malicious bitstream. Such malicious use of the FPGA fabric may lead to severe voltage fluctuations and eventually crash the FPGA. Attackers can also use side-channel and fault attacks to extract secret information (e.g., secret key of an AES encryption module). We propose a convolutional neural network (CNN)-based defense mechanism to detect malicious circuits that are configured on an FPGA by learning features from the data-series representation of the bitstreams of malicious circuits. We use the classification accuracy, true-positive rate, and false-positive rate metrics to quantify the effectiveness of CNN-based classification of malicious bitstreams. Experimental results on Xilinx FPGAs demonstrate the effectiveness of the proposed method.

A deep neural network (DNN) classifier is often viewed as the intellectual property of a model owner due to the huge resources required to train it. To protect intellectual property, the model owner can embed a watermark into the DNN classifier (called target classifier) such that it outputs pre-determined labels (called trigger labels) for pre-determined inputs (called trigger inputs). Given the black-box access to a suspect classifier, the model owner can verify whether the suspect classifier is pirated version of its classifier by first querying the suspect classifier for trigger inputs and then checking whether the predicted labels match with the trigger labels. Many studies showed that an attacker can pirate the target classifier (called pirated classifier) via retraining or fine-tuning the target classifier to remove its watermark. However, they sacrifice the accuracy of the pirated classifier, which is undesired for critical applications such as finance and healthcare. In our work, we propose a new attack without sacrificing the accuracy of the pirated classifier for in-distribution testing inputs while preventing the detection from the model owner. Our idea is that an attacker can detect the trigger inputs in the inference stage of the pirated classifier. In particular, given a testing input, we let the pirated classifier return a random label if the input is detected as a trigger input. Otherwise, the pirated classifier predicts the same label as the target classifier. We evaluate our attack on benchmark datasets and find that our attack can effectively identify the trigger inputs. Our attack reveals that the intellectual property of a model owner can be violated with existing watermarking techniques, highlighting the need for new techniques.