PaperlayerView exact revision on arXiv

Source-linked AI summary

SAIL: Machine Learning Guided Structural Analysis Attack on Hardware Obfuscation

Prabuddha Chakraborty, Jonathan Cruz, Swarup Bhunia

arXiv:1809.10743v1cs.CR

TL;DR

Hardware obfuscation aims both to prevent black-box use and to hide design intent, but its structural changes are local and predictable. SAIL uses machine learning to reconstruct obfuscated structure, recovering an average of 84.14% and up to 94.98% in benchmark circuits.

  • Problem

    Obfuscation aims to prevent black-box use and hide design intent, but current structural transformations are local and predictable.

    Source: §I · p. 1

  • Method

    SAIL analyzes obfuscated netlist structure with machine-learning models that predict changes and locally reconstruct pre-synthesis structure.

    Source: §I · pp. 1–2

  • Results

    SAIL recovered an average of 84.14% and up to 94.98% of obfuscated structures across benchmark circuits.

    Source: §I · p. 2

  • Takeaways & Limitations

    SAIL exposes a vulnerability in logic obfuscation because small, localized, predictable topology changes can be structurally recovered.

    Source: §I · p. 1, §VII · p. 6

Abstract

from arXiv · show

Obfuscation is a technique for protecting hardware intellectual property (IP) blocks against reverse engineering, piracy, and malicious modifications. Current obfuscation efforts mainly focus on functional locking of a design to prevent black-box usage. They do not directly address hiding design intent through structural transformations, which is an important objective of obfuscation. We note that current obfuscation techniques incorporate only: (1) local, and (2) predictable changes in circuit topology. In this paper, we present SAIL, a structural attack on obfuscation using machine learning (ML) models that exposes a critical vulnerability of these methods. Through this attack, we demonstrate that the gate-level structure of an obfuscated design can be retrieved in most parts through a systematic set of steps. The proposed attack is applicable to all forms of logic obfuscation, and significantly more powerful than existing attacks, e.g., SAT-based attacks, since it does not require the availability of golden functional responses (e.g. an unlocked IC). Evaluation on benchmark circuits show that we can recover an average of around 84% (up to 95%) transformations introduced by obfuscation. We also show that this attack is scalable, flexible, and versatile.

I. Introduction

The introduction frames hiding design intent as an obfuscation goal that local, predictable structural changes leave vulnerable. It presents SAIL, a machine-learning-guided structural attack, and reports recovery of most obfuscated structure in benchmark circuits.

I. Introduction

  • SAIL exploits structural changes that are sparse, local, and deterministic, using machine learning to retrieve the original design structure.The paper presents quantitative and qualitative analysis of these changes as the foundation for the attack.Source: §I · pp. 1–2
  • SAIL recovered an average of 84.14% and up to 94.98% of obfuscated structures across benchmark circuits.The reported evaluation also finds effectiveness across different key-gate insertion heuristics and key sizes.Source: §I · p. 2
  • Unlike SAT-based attacks, SAIL requires no golden responses and applies to combinational and sequential designs regardless of the underlying Boolean function.The introduction also describes SAIL as scalable in accuracy and computation time with respect to key and benchmark size.Source: §I · p. 2
  • The framework combines a Change Prediction Model with a Reconstruction Model that locally reverts post-resynthesis structural changes.A Change Prediction Boosted Reconstruction Model combines both models for improved recovery.Source: §I · p. 2
  • The evaluation examines scalability across key length, key-gate insertion heuristics, and design size.The attack is evaluated on benchmark circuits.Source: §I · p. 2

II. Background and Related Works

The background distinguishes functional locking from structural hiding and reviews prior key-retrieval attacks. It identifies SAIL as a netlist-structure attack rather than another functional key-retrieval method.

II. Background and Related Works

  • Combinational locking inserts key-controlled gates, while sequential locking adds key-state transitions; this paper focuses on combinational locking.An N-bit combinational key requires at least N key gates.Source: §II · p. 2
  • Prior attacks mainly retrieve keys through functional analysis, and SAT-based attacks require an obfuscated netlist plus an unlocked IC or netlist.The paper notes that SAT is NP-complete and heuristic solutions are not guaranteed to finish within reasonable time.Source: §II · p. 2
  • The cited structural attack removes ANTI-SAT blocks to facilitate a later SAT attack, whereas this work analyzes and reverses netlist structural changes.The paper also contrasts SAIL with an ML key-retrieval attack that requires an unlocked IC.Source: §II · p. 2

III. Motivation

XOR-locking resynthesis often leaves key-gate neighborhoods unchanged or only locally altered, so the resulting structures may remain vulnerable or be recoverable. The section describes these change levels and illustrates local reconstruction.

A. Obfuscation Induced Changes Are Local

  • Level-3 changes transform or disconnect the inserted XOR gate, Level-2 changes alter neighboring gates, and Level-1 changes leave the gates unchanged after resynthesis.Level-1 cases leave the obfuscated design vulnerable to removal and key-guessing attacks.Source: A. Obfuscation Induced Changes Are Local · p. 2
  • 36.5% of key-inserted localities show no structural change, 57.31% show Level-2 changes, and only 6.18% are properly obfuscated.Some of the remaining changes are also predictable and locally reversible.Source: A. Obfuscation Induced Changes Are Local · pp. 2–3, Table I · p. 3
  • The reconstruction model can recover localities after common inverter movements around the XOR gate, including more complex Level-3 changes.The examples use up to 10 gates around the key gate to infer the pre-synthesis locality.Source: A. Obfuscation Induced Changes Are Local · p. 3

B. Why Machine Learning? The Synthesis Tool Optimization is Deterministic

Synthesis uses a limited set of rules for many observed locality transformations. This concentration makes it possible to learn rules that can revert those changes and recover local structure around key gates.

IV. Attack Methodology

The attack methodology uses pseudo-self referencing to generate training data without access to the original pre-obfuscation netlist. The obfuscated circuit serves as a pseudo-golden circuit and is obfuscated again to create circuit-specific examples.

A. Training Dataset Generation

  • Pseudo-self referencing treats the attacker’s obfuscated circuit as a pseudo-golden circuit and re-obfuscates it to generate circuit-specific training data.The authors state that inserted gates are a minor fraction of total gates and therefore have little impact on the subsequent obfuscation.Source: A. Training Dataset Generation · p. 3

B. Change Prediction Model

SAIL combines a locality-change predictor with a reconstruction model to restore pre-synthesis localities. The evaluation uses XOR locking on ISCAS-85 benchmark circuits and generated training and testing samples.

B. Change Prediction Model

  • A Change Prediction Model classifies whether a locality changed, and Random Forest gave the best tested balance of computation efficiency and accuracy.The model is trained on locality and change-indicator pairs generated through pseudo-self referencing.Source: B. Change Prediction Model · pp. 3–4

C. Reconstruction Model

  • A multichannel, multilayer neural network predicts pre-synthesis localities from post-synthesis localities at sizes ranging from 3 to 10 gates.Models for different locality sizes are combined with cumulative-confidence voting.Source: C. Reconstruction Model · p. 4
  • Using the change predictor to select localities for reconstruction can further boost reconstruction accuracy.Source: C. Reconstruction Model · p. 4

V. Results and Analysis

  • The evaluation applies XOR locking to seven ISCAS-85 benchmarks and uses 11,160 training samples and 3,720 testing samples.The benchmarks use inserted key sizes from 8 to 64 bits.Source: §V · p. 4

A. Change Prediction Model

Change prediction uses post-synthesis structure to identify altered key-gate localities, while boosting reconstruction with that model improves recovery. Prediction accuracy rises with input locality size and plateaus beyond six gates.

A. Change Prediction Model

B. Reconstruction Model

  • The final reconstruction model ensembles models trained on different post-synthesis locality sizes because the optimal size varies across benchmarks.The ensemble is reported to stabilize variance; R weights snapshots with one or two wrong gate types at 2/3 and 1/3, respectively.Source: Figure 5 · p. 4
  • 17.4% of Level-1 localities—cases with no change—are incorrectly modified by reconstruction without change-prediction boost.Complete recovery is defined as Gate Error = 0 and Link Error = 0.Source: B. Reconstruction Model · p. 4, Table IV · p. 5
  • For the Change Prediction Boosted Reconstruction Model, Table V reports a 10.86% increase in complete recovery accuracy (G = 0, L = 0) and around 4% increase in R-Metric.Source: B. Reconstruction Model · p. 5, Table V · p. 5

A. Scalability

Reconstruction efficiency generally decreases as key size increases, although accuracy is stable between the 1x and 3x settings.

A. Scalability

  • Reconstruction efficiency generally increases as key size decreases across the tested benchmarks.The study compares key sizes of 0.5X, X, 2X, and 3X.Source: 1) Effect of Key Size on Performance · p. 5
  • Increasing the key-gate-to-total-gate ratio can place key-gates closer together, sometimes producing more complex post-synthesis transformations that are harder to recover.Source: 1) Effect of Key Size on Performance · p. 5
  • Despite the general trend, reconstruction accuracy is very stable between 1x and 3x, and larger keys can only slightly improve structural obfuscation.The passage concludes that the design remains very much exposed to a reversion attack.Source: 1) Effect of Key Size on Performance · p. 5

2) Effect of Different Key-Gate Insertion Heuristics:

The tested key-gate insertion heuristics remain vulnerable to snapshot recovery, and the method’s scaling depends on snapshot size rather than benchmark size.

2) Effect of Different Key-Gate Insertion Heuristics:

3) Benchmark & Snapshot Size:

  • SAIL’s scalability depends on snapshot size rather than benchmark size; the reported results use three-gate output localities, though larger snapshots can also be used.Source: 3) Benchmark & Snapshot Size · p. 5

B. Versatility

  • The C6288 recovery visualization reports 95% accuracy, with correctly recovered gates in green, errors in red, and key inputs in cyan.Nodes represent gates and edges represent connections.Source: Figure 6 · p. 6

1) Key Recovery from Snapshot:

Recovered key-gate localities can reveal key-bit values in XOR-based locking and can make netlist reverse engineering easier. The conclusion identifies distributed, global, and unpredictable structural changes as features for SAIL-resistant obfuscation.

1) Key Recovery from Snapshot:

  • For XOR-based locking, the recovered locality reveals the key-bit value from whether it contains an XOR alone or an XOR followed by an inverter.Source: 1) Key Recovery from Snapshot · p. 6

2) Aiding Reverse Engineering:

  • Recovering key-gate localities can make reverse engineering easier, and stitching snapshots could recover most obfuscation changes when stitching succeeds.The passage conditions this example on successful stitching.Source: 2) Aiding Reverse Engineering · p. 6

VII. Conclusion

  • The conclusion proposes distributed, global structural changes and unpredictable change patterns as features for obfuscation designed to resist SAIL.Source: §VII · p. 6
Loading 1809.10743v1…