Oracle-guided circuit deobfuscation (or learning) is the problem of disambiguating an obfuscated (partially hidden) circuit given black-box access to it. This has applications in various hardware security areas such as analyzing the security of circuit obfuscation defense schemes, side-channel analysis, reverse engineering, and hardware Trojan detection. Generic deobfuscation of analog circuits has received less attention than the digital counterpart with existing methods relying on manual expert work to extract closed-form equations from the circuit. In this work, we move towards a significantly more automated process by using a combination of machine learning and Newton-method-based analog circuit optimization. We showcase how this hybrid scheme is superior to either standalone approach in terms of runtime and accuracy on a set of analog circuits that include amplifiers, filters, and oscillators. We achieve >98% average accuracy without any manual expert equation extraction in addition to demonstrating a superior resilience to process variation.

Pseudo-Boolean Satisfiability (PBSAT) can be used to perform automated power side-channel analysis, i.e., recover secret keys from the power consumption information of a generic Boolean circuit. Here, the search for what input pattern to collect the side-channels on, and the secret value that conforms to those observations, can be formulated as a series of PBSAT calls. Since the problem is NP-hard, runtime growth can be worst-case exponential. In addition, these formal procedures tend to be more sensitive to error and noise than traditional statistical procedures. In this paper, we propose some novel techniques to improve on these two fronts. We propose a criterion that can be used to slice the circuit into parts that can be treated independently without loss of accuracy to help with scalability. We demonstrate this to provide up to two orders of magnitude improvement in runtime for comparator circuits for instance. We additionally propose various novel procedures based on pseudo-Boolean optimization, which allow for greater error tolerance as we demonstrate against various generic benchmark circuits.

Hardware Trojans, i.e. malicious circuitry inserted into a design by an untrusted foundry or designer, pose a threat to the fabless semiconductor industry. The detection of hardware Trojans has been the subject of numerous studies over the years. In this paper, we discuss a novel approach to Trojan detection: using the framework of oracle-guided circuit learning (OGCL) or deobfuscation, which has traditionally been used for assessing the security of circuit obfuscation schemes. We show how arbitrary functional Trojan detection can polynomially be reduced to OGCL, yielding a more formal and versatile framework than traditional heuristic techniques. This formulation can also be used to locate Trojans and can be easily extended to side-channel or hybrid detection by using non-functional OGCL. The main challenge with this approach is its worst-case-exponential space complexity when using baseline Boolean satisfiability (SAT)-based circuit deobfuscation. To this end, we propose some novel techniques based on AllSAT, cube generalization, and quantified Boolean Formula (QBF) solving. We present a set of experiments on benchmark circuits to showcase the validity and performance of our framework.

Oracle-guided circuit deobfuscation/learning is the problem of recovering unknowns from a circuit by making input-output queries to it and it has various applications in the hardware security domain: in assessing the security of obfuscation schemes, side-channel analysis, and reverse engineering. Unlike the digital case, the generic analog version of the problem has received less attention with existing approaches requiring manual instance-specific labor. In this paper, we present a novel automated approach to this end: using machine learning models trained on synthetic data to predict unknown values from query data. We evaluate our framework approach in a proof-of-concept implementation against a set of hand-crafted diverse analog circuits from simple resistive networks to complex op-amp circuits, using a variety of machine learning models from linear models to decision trees, and (graph) neural networks. Our experiments show prediction error rates of less than 5% on these circuit sets. We explore additional questions such as the impact of uncertainty sampling, topological information, out-of-training range data, and parameter (process) variation.