Atacking Split Manufacturing from a Deep Learning Perspective - - PowerPoint PPT Presentation

Atacking Split Manufacturing from a Deep Learning Perspective

Haocheng Li1, Satwik Patnaik2, Abhrajit Sengupta2, Haoyu Yang1, Johann Knechtel3, Bei Yu1, Evangeline F. Y. Young1, Ozgur Sinanoglu3

1The Chinese University of Hong Kong 2New York University 3New York University Abu Dhabi

1 / 15

Split Manufacturing

M1 V1 M2 V2 M3 V3 M4 V4 M5 V5 M6 V6 M7 V7 M8 V8 M9 V9 M10

Front-end-of-line (FEOL) Back-end-of-line (BEOL)

Figure 1: Wire width in Nangate 45 nm open cell library.

◮ Hardware is vulnerable with un-trusted foundries ab. ◮ Split manufacturing safeguards chip designs cd.

a[Durvaux and Standaert 2016] b[Shamsi et al. 2019] c[McCants 2011] d[Bi, Yuan, and Jin 2015]

2 / 15

Threat Model

Via in FEOL layer Virtual pin in split layer M1 FEOL wiring fragment Mapping for virtual pin pairs M1 M2 M1 M3 M2 M3 M3 M3 M1 M1 M2 M2 M1

Figure 2: Two source fragments and three sink fragments.

Available: FEOL design, cell library, database of layouts generated in a similar manner. Objective: correct connection rate a CCR = m

i=1 cixi

m

i=1 ci

, (1) m is the number of sink fragments, c1, c2, . . . , cm are the numbers of sinks in every fragment, xi = 1 when a positive virtual pin pair (VPP) is selected for the i-th sink fragment, xi = 0 when a negative VPP is selected for the i-th sink fragment.

a[Wang et al. 2018]

3 / 15

Contributions

Vector- and Image-based Feature Extraction A!acking Designs Training Designs

Network Training A!acking

Figure 3: Atack flow.

◮ Design and train a deep neural network to predict the missing BEOL connections. ◮ The neural network makes use of both vector-based and image-based features. ◮ Propose sofmax regression loss to select best connection among variable-size candidates.

4 / 15

Vector-based Features

◮ Distances for VPPs along both directions. ◮ Numbers of sinks connected within the fragments. ◮ Maximum capacitance of the driver and pin capacitance of the sinks. ◮ Wirelength and via contribution in each FEOL metal layer. ◮ Driver delay according to the underlying timing paths.

5 / 15

Image-based Features

Feature Image 1 Feature Image 2 Feature Image 3

Figure 4: Layout Image Scaling.

’ 1 ’ ’ 1 1 1 ’ ’ 1 ’ ’ ’ ’ 1 1 ’ ’ 1 ’ Metal 3 Metal 2 Metal 1

Figure 5: Layout Image Representation.

6 / 15

Sample Selection

Metal 3 Via 3

Source A Source B Sink A Sink B

Figure 6: All VPPs are considered as candidates except VPP (Source A, Sink B). Table 1: VPP Preferences

Sink Source Sink Prefers Source Source Prefers Sink Direction Criterion A A ✓ ✗ ✓ A B ✓ ✓ ✓ B A ✗ ✗ ✗ B B ✓ ✓ ✓

7 / 15

Model Architecture

CNN Blocks n x 256 input vector features input source images input sink image n x 128 n x 128

• utput scores

ResNet Blocks ResNet Blocks Figure 7: Neural Network Structure.

8 / 15

Model Architecture

shared network n x 256 n x 256 input vector features input source images input sink image 3x3 conv1-1, 16 3x3 conv1-2, 16 3x3 conv1-3, 16 3x3 conv2-1, 32, /3 3x3 conv2-2, 32 3x3 conv2-3, 32 3x3 conv3-1, 64, /3 3x3 conv3-2, 64 3x3 conv3-3, 64 3x3 conv4-1, 128, /3 3x3 conv4-2, 128 3x3 conv4-3, 128 fc3, 256 fc4, 128 fc5-1, 128 fc1, 128 n x 128 n x 128 n x 128 1 x 128 fc5-2, 128 fc6, 32 fc7, 1

• utput scores

res, 128 res, 128 res, 128 res, 128 res, 128 res, 128 res, 128 fc2, 128 fc2, 128 fc2, 128

ResNet Block

Figure 8: Neural Network Architecture.

9 / 15

Sofmax Regression Loss

The loss of the two-class classification is lr = − 1 n

• log

es+

t

es−

t + es+ t +

• jt

log es−

j

es−

j + es+ j

• ,

(2) whose partial derivative is ∂lr ∂s+

j

= − ∂lr ∂s−

j

=                    − es−

j

n

• es−

j + es+ j

• if j = t,

es+

j

n

• es−

j + es+ j

• therwise.

(3) The partial derivative in the last FC layer is ∂lr ∂w+

i

= − ∂lr ∂w−

i

= 1 n

• n
• j=1

es+

j xi,j

es−

j + es+ j

− xi,t

• .

(4) We propose the following sofmax regression loss lc = − log est n

j=1 esj ,

(5) whose partial derivative is ∂lc ∂sj =              esj n

j=1 esj − 1

if j = t, esj n

j=1 esj

• therwise.

(6) The partial derivative in the last FC layer is ∂lc ∂wi = n

j=1 esjxi,j

n

j=1 esj

− xi,t. (7)

10 / 15

Experimental Results

0.5 1 1.5 M1 CCR M3 CCR M1 Time M3 Time 1.21 1.12 1 · 10−3 2 · 10−3 1 1 1 1 Average Ratio Wang Ours 5 10 15

b7 b11 b13 b14 b15_1 b17_1 b18 c432 c880 c1355 c1908 c2670 c3540 c5315 c6288 c7552

M1 CCR (%)

11 / 15

Experimental Results

50 55 60 65 CCR (%)

(a)

20 40 Inference Time (s)

(b)

Two-class Vec Vec & Img

Figure 9: Comparison between different setings of techniques used.

12 / 15

Conclusion

◮ Demonstrate vector-based and image-based features. ◮ Process these heterogeneous features simultaneously in a neural network. ◮ Propose a sofmax regression loss.

13 / 15

Thanks! Qestions?

14 / 15

References I

Bi, Yu, Jiann Yuan, and Yier Jin (2015). “Beyond the interconnections: Split manufacturing in RF designs”. In: Electronics 4.3, pp. 541–564. Durvaux, François and François-Xavier Standaert (2016). “From improved leakage detection to the detection of points of interests in leakage traces”. In: Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, pp. 240–262. McCants, C (2011). “Trusted integrated chips (TIC)”. In: Intelligence Advanced Research Projects Activity (IARPA), Tech. Rep. Shamsi, Kaveh, Travis Meade, Meng Li, David Z. Pan, and Yier Jin (2019). “On the approximation resiliency of logic locking and IC camouflaging schemes”. In: IEEE Transactions on Information Forensics and Security 14.2, pp. 347–359. Wang, Yujie, Pu Chen, Jiang Hu, Guofeng Li, and Jeyavijayan Rajendran (2018). “The cat and mouse in split manufacturing”. In: IEEE Transactions on Very Large Scale Integration (VLSI) Systems 26.5, pp. 805–817.

15 / 15