Obfuscation or Logic locking (LL) is a technique for protecting hardware intellectual property (IP) blocks against diverse threats, including IP theft, reverse engineering, and malicious modifications. State-of-the-art locking techniques primarily focus on securing a design from unauthorized usage by disabling correct functionality – they often do not directly address hiding design intent through structural transformations. They rely on the synthesis tool to introduce structural changes. We observe that this process is insufficient as the resulting changes in circuit topology are: (1) local and (2) predictable. In this paper, we analyze the structural transformations introduced by LL and introduce a potential attack, called SAIL, that can exploit structural artifacts introduced by LL. SAIL uses machine learning (ML) guided structural recovery that exposes a critical vulnerability in these techniques. Through this attack, we demonstrate that the gate-level structure of a locked design can be retrieved in most parts through a systematic set of steps. The proposed attack is applicable to most forms of logic locking, and significantly more powerful than existing attacks, e.g., SAT-based attacks, since it does not require the availability of golden functional responses (e.g., an unlocked IC). Evaluation on benchmark circuits shows that we can recover an average of about 92%, up to 97%, transformations (Top-10 R-Metric) introduced by logic locking. We show that this attack is scalable, flexible, and versatile. Additionally, to evaluate the SAIL attack resilience of a locked design, we present the SIVA-Metric that is fast in terms of computation speed and does not require any training. We also propose possible mitigation steps for incorporating SAIL resilience into a locked design.

中文翻译：

---

SAIL：使用机器学习分析逻辑锁定的结构工件

混淆或逻辑锁定 (LL) 是一种保护硬件知识产权 (IP) 块免受各种威胁的技术，包括 IP 盗窃、逆向工程和恶意修改。最先进的锁定技术主要侧重于通过禁用正确的功能来保护设计免受未经授权的使用——它们通常不直接解决通过结构转换隐藏设计意图的问题。他们依靠综合工具来引入结构变化。我们观察到这个过程是不够的，因为由此产生的电路拓扑变化是：（1）局部的和（2）可预测的。在本文中，我们分析了 LL 引入的结构转换，并引入了一种称为 SAIL 的潜在攻击，该攻击可以利用 LL 引入的结构伪影。SAIL 使用机器学习 (ML) 引导的结构恢复，暴露了这些技术中的一个关键漏洞。通过这种攻击，我们证明了锁定设计的门级结构可以通过一组系统的步骤在大多数部分进行检索。所提议的攻击适用于大多数形式的逻辑锁定，并且比现有攻击（例如基于 SAT 的攻击）强大得多，因为它不需要黄金功能响应的可用性（例如，未锁定的 IC）。对基准电路的评估表明，我们可以恢复由逻辑锁定引入的平均约 92% 至 97% 的转换（Top-10 R-Metric）。我们表明这种攻击是可扩展的、灵活的和通用的。此外，为了评估锁定设计的 SAIL 攻击弹性，我们提出了在计算速度方面很快并且不需要任何训练的 SIVA-Metric。我们还提出了将 SAIL 弹性纳入锁定设计的可能缓解步骤。