Atacking Split Manufacturing from a Deep Learning Perspective - PowerPoint PPT Presentation

Atacking Split Manufacturing from a Deep Learning Perspective Haocheng Li 1 , Satwik Patnaik 2 , Abhrajit Sengupta 2 , Haoyu Yang 1 , Johann Knechtel 3 , Bei Yu 1 , Evangeline F. Y. Young 1 , Ozgur Sinanoglu 3 1 The Chinese University of Hong Kong 2 New York University 3 New York University Abu Dhabi 1 / 15

Split Manufacturing M10 V9 M9 V8 M8 ◮ Hardware is vulnerable with V7 un-trusted foundries ab . M7 V6 ◮ Split manufacturing M6 V5 safeguards chip designs cd . M5 V4 Back-end-of-line (BEOL) M4 a [Durvaux and Standaert 2016] V3 Front-end-of-line (FEOL) b [Shamsi et al. 2019] M3 c [McCants 2011] V2 M2 d [Bi, Yuan, and Jin 2015] V1 M1 Figure 1: Wire width in Nangate 45 nm open cell library. 2 / 15

Threat Model Objective: correct connection rate a � m M1 M2 M2 M1 � m i = 1 c i x i M3 CCR = , (1) i = 1 c i M3 M1 M2 M3 M1 M2 m is the number of sink fragments, M1 M3 c 1 , c 2 , . . . , c m are the numbers of sinks in every fragment, M1 Via in FEOL layer FEOL wiring fragment x i = 1 when a positive virtual pin Virtual pin in split layer Mapping for virtual pin pairs pair (VPP) is selected for the i -th Figure 2: Two source fragments and three sink fragments. sink fragment, x i = 0 when a negative VPP is selected for the i -th sink fragment. Available: FEOL design, cell library, database of layouts generated in a similar manner. a [Wang et al. 2018] 3 / 15

Contributions ◮ Design and train a deep neural network to Vector- and Image-based Feature Extraction predict the missing BEOL connections. Training Designs A ! acking Designs ◮ The neural network makes use of both vector-based and image-based features. Network Training A ! acking ◮ Propose sofmax regression loss to select best Figure 3: Atack flow. connection among variable-size candidates. 4 / 15

Vector-based Features ◮ Distances for VPPs along both directions. ◮ Numbers of sinks connected within the fragments. ◮ Maximum capacitance of the driver and pin capacitance of the sinks. ◮ Wirelength and via contribution in each FEOL metal layer. ◮ Driver delay according to the underlying timing paths. 5 / 15

Image-based Features Feature Image 3 ’ 1 0 0 ’ Metal 3 ’ 1 0 0 ’ Metal 2 ’ Feature Image 2 1 1 1 ’ Metal 1 ’ ’ 0 1 1 0 0 1 ’ ’ Feature Image 1 ’ 0 0 0 ’ Figure 5: Layout Image Representation. Figure 4: Layout Image Scaling. 6 / 15

Sample Selection Sink A Metal 3 Source A Source B Via 3 Sink B Figure 6: All VPPs are considered as candidates except VPP (Source A, Sink B). Table 1: VPP Preferences Sink Source Sink Prefers Source Source Prefers Sink Direction Criterion A A ✓ ✗ ✓ A B ✓ ✓ ✓ B A ✗ ✗ ✗ B B ✓ ✓ ✓ 7 / 15

Model Architecture input vector features input source images input sink image ResNet Blocks CNN Blocks n x 128 n x 128 n x 256 ResNet Blocks output scores Figure 7: Neural Network Structure. 8 / 15

Model Architecture input vector features input source images input sink image 3x3 conv1-1, 16 fc1, 128 shared network 3x3 conv1-2, 16 res, 128 3x3 conv1-3, 16 res, 128 n x 128 1 x 128 3x3 conv2-1, 32, /3 res, 128 n x 256 3x3 conv2-2, 32 res, 128 fc5-1, 128 3x3 conv2-3, 32 n x 128 n x 128 3x3 conv3-1, 64, /3 n x 256 3x3 conv3-2, 64 fc5-2, 128 ResNet Block 3x3 conv3-3, 64 res, 128 3x3 conv4-1, 128, /3 res, 128 fc2, 128 3x3 conv4-2, 128 res, 128 fc2, 128 3x3 conv4-3, 128 fc6, 32 fc2, 128 fc3, 256 fc7, 1 fc4, 128 output scores Figure 8: Neural Network Architecture. 9 / 15

Sofmax Regression Loss The loss of the two-class classification is � We propose the following sofmax regression loss � � e s − e s + � � l r = − 1 j t (2) log log , t + e s t � n t + e s + j + e s + n � e s − e s − � j l c = − log j = 1 e s j , (5) j � t whose partial derivative is whose partial derivative is    e s −   � � j   e s j   � n  if j = t ,   −  j = 1 e s j − 1 if j = t ,   j + e s +   e s − n j ∂ l r = − ∂ l r ∂ l c   (3) (6) =  =  e s j   ∂ s + e s + ∂ s j � n ∂ s −   � �  j  j j otherwise.  otherwise.   j = 1 e s j  e s − j + e s +  n j The partial derivative in the last FC layer is � n The partial derivative in the last FC layer is j = 1 e s j x i , j � n ∂ l c � � − x i , t � (7) e s + − x i , t . n = j x i , j ∂ l r = − ∂ l r = 1 � � j = 1 e s j ∂ w i . (4) ∂ w + e s − j + e s + ∂ w − n � � j i i j = 1 10 / 15

Experimental Results Average Ratio M1 CCR (%) b7 Wang b11 1 Ours M1 CCR b13 1 . 21 b14 b15_1 1 b17_1 M3 CCR b18 1 . 12 c432 c880 1 c1355 M1 Time 1 · 10 − 3 c1908 c2670 c3540 1 M3 Time c5315 2 · 10 − 3 c6288 c7552 0 0 . 5 1 1 . 5 0 5 10 15 11 / 15

Experimental Results 65 Inference Time (s) 40 CCR (%) Two-class 60 Vec 20 Vec & Img 55 50 0 (a) (b) Figure 9: Comparison between different setings of techniques used. 12 / 15

Conclusion ◮ Demonstrate vector-based and image-based features. ◮ Process these heterogeneous features simultaneously in a neural network. ◮ Propose a sofmax regression loss. 13 / 15

Thanks! Qestions? 14 / 15

References I Bi, Yu, Jiann Yuan, and Yier Jin (2015). “Beyond the interconnections: Split manufacturing in RF designs”. In: Electronics 4.3, pp. 541–564. Durvaux, François and François-Xavier Standaert (2016). “From improved leakage detection to the detection of points of interests in leakage traces”. In: Annual International Conference on the Theory and Applications of Cryptographic Techniques . Springer, pp. 240–262. McCants, C (2011). “Trusted integrated chips (TIC)”. In: Intelligence Advanced Research Projects Activity (IARPA), Tech. Rep . Shamsi, Kaveh, Travis Meade, Meng Li, David Z. Pan, and Yier Jin (2019). “On the approximation resiliency of logic locking and IC camouflaging schemes”. In: IEEE Transactions on Information Forensics and Security 14.2, pp. 347–359. Wang, Yujie, Pu Chen, Jiang Hu, Guofeng Li, and Jeyavijayan Rajendran (2018). “The cat and mouse in split manufacturing”. In: IEEE Transactions on Very Large Scale Integration (VLSI) Systems 26.5, pp. 805–817. 15 / 15