# Evasive Hardware Trojan through Adversarial Power Trace

Behnam Omidi<EMAIL_ADDRESS>Geotge Mason UniversityVirginiaUSA ,  Khaled N.
Khasawneh<EMAIL_ADDRESS>Geotge Mason UniversityVirginiaUSA and  Ihsen
Alouani<EMAIL_ADDRESS>Queen’s University Belfast Northern IrelandUK

###### Abstract.

The globalization of the Integrated Circuit (IC) supply chain, driven by time-
to-market and cost considerations, has made ICs vulnerable to hardware Trojans
(HTs). Against this threat, a promising approach is to use Machine Learning
(ML)-based side-channel analysis, which has the advatage of being a non-
intrusive method, along with efficiently detecting HTs under golden chip-free
settings.

In this paper, we question the trustworthiness of ML-based HT detection via
side-channel analysis. We introduce a HT obfuscation (HTO) approach to allow
HTs to bypass this detection method. Rather than theoretically misleading the
model by simulated adversarial traces, a key aspect of our approach is the
design and implementation of adversarial noise as part of the circuitry,
alongside the HT. We detail HTO methodologies for ASICs and FPGAs, and
evaluate our approach using TrustHub benchmark. Interestingly, we found that
HTO can be implemented with only a single transistor for ASIC designs to
generate adversarial power traces that can fool the defense with $100\%$
efficiency. We also efficiently implemented our approach on a Spartan 6 Xilinx
FPGA using 2 different variants: (i) DSP slices-based, and (ii) ring-
oscillator-based design. Additionally, we assess the efficiency of
countermeasures like spectral domain analysis, and we show that an adaptive
attacker can still design evasive HTOs by constraining the design with a
spectral noise budget. In addition, while adversarial training (AT) offers
higher protection against evasive HTs, AT models suffer from a considerable
utility loss, potentially rendering them unsuitable for such security
application.

We believe this research represents a significant step in understanding and
exploiting ML vulnerabilities in a hardware security context, and we make all
resources and designs openly available online:
https://dev.d18uu4lqwhbmka.amplifyapp.com

##  1\. Introduction

The increasing demand for shorter time-to-market and cost-effective hardware
design and manufacturing has globalized the IC supply chain, exposing ICs to
hardware-based security threats like counterfeiting, IP piracy, reverse
engineering, and HTs due to outsourcing to untrusted entities. The modern IC
production life-cycle can be divided into three main phases: design,
fabrication, testing (tehranipoor2010survey, ). HTs are malicious
modifications of a circuit to control, modify, disable, monitor, or affect the
operation of the circuit. Figure 1 illustrates the standard SoC design life
cycle, from system-level specification to fabrication. Various stages in the
IC supply chain are potential points for Hardware Trojan (HT) injection. This
could be a malicious in-house designer or team can alter the hardware design
at different abstraction levels, while relying on third party IPs or
outsourcing manufacturing facilities could create a vulnerability for
adversaries to tamper with and infect the design.

Figure 1. The credibility level of IC production life-cycle

Underestimating HT threats can lead to severe consequences. For example,
F-Secure’s 2020 report on counterfeit Cisco switches highlighted the risks of
HTs in bypassing authentication processes (fsecure2020, ). There have been
other instances, like Bloomberg’s claims in 2018 and 2021 about compromised
servers in major companies’ data centers, although these were disputed
(bloomberg, ). Additionally, the 2008 bombing of a Syrian nuclear facility
after a backdoor disabled its radar potentially due to a HT (syrianRadar, ).
These threats pose significant risks to various critical systems, making the
integrity of the semiconductor supply chain a pressing concern globally.

Researchers have explored various methods to detect HTs in chip design and
manufacturing. These include destructive and non-destructive techniques
(chakraborty2009hardware, ). Destructive techniques involve dissecting chips
to reverse engineer their layers (bao2015reverse, ). Although these methods
can be highly accurate, they are costly, time-consuming, and render the chip
unusable, limiting their practicality to a single chip analysis. In contrast,
non-destructive methods focus on the chip’s functionality or side-channel
signals, offering a more practical alternatives (zhou2015cost, ). These
include Logic Testing (saha2015improved, ), IP Trust Verification (xue2020ten,
), Optical Detection (dong2020hardware, ), Side-Channel Analysis
(nguyen2020novel, ), and ML-based Detection (yang2021side, ). Particularly,
the work in (faezi2021htnet, ) presented a ML-based approach for HT detection
using power side channel traces. This is particularly interesting post-silicon
approach because it does not require golden-chip, beyond the fact that it is
non-intrusive and highly efficient (faezi2021htnet, ).

In this paper, we question the trustworthiness of ML-based HT detection using
power side-channel data.

Research challenges. While the vulnerability of ML models to adversarial noise
is established in the literature, generating adversarial circuits, i.e.,
adversarial noise implementable in circuitry, is a novel problem. In fact, the
model’s input in (faezi2021htnet, ) is a power trace, and so is the
adversarial noise generated by existing methods. Therefore, our first
challenge is (C1): given an adversarial power trace, how to generate an
adversarial circuit that consumes this trace? Moreover, given the threat model
of HT detection, the second challenge (C2) is that adversarial circuits need
to be automatically designed with the lowest possible resource utilisation.
Finally, the third challenge (C3) is how to design defenses and to which
extent these defenses can be bypassed by adaptive attacks.

Attack. We propose HTO, a method that exploits the vulnerability of ML to
adversarial noise to generate evasive HTs that are undetectable by ML-based
approaches. We first generate a targeted adversarial patch that takes hardware
noise into account and successfully fools a state-of-the-art HT defense
approach. We then propose new approaches for designing obfuscation circuits
that consume adversarial power traces for both ASICs and FPGAs. To make the
attack even stealthier, we optimize the generated adversarial noise to
minimize the required circuitry to obfuscate the HT.

We evaluate HTO using the TrustHub benchmark with a recent ML-based HT
detection technique and show that our approach efficiently bypasses the
defense. We also demonstrate that HTO can be implemented with a single
transistor for ASIC designs, making it very stealthy.

Countermeasures and adaptive attack. For a comprehensive security evaluation,
we investigate defenses and propose an adaptive attack. We propose a spectral
defense in the frequency domain to improve the robustness of ML-based
detection and investigate an adaptive attack that generates noise in specific
frequency range to bypass this defense. Additionally, we examine AT as a
countermeasure against HTO, but find it can be circumvented with increased
attacker power budget and results in reduced baseline accuracy.

To the best of our knowledge, this is the first work to practically exploit ML
vulnerabilities to design adaptive hardware security attacks.

Contributions. The key contributions of this paper can be summarized as
follows:

Evasive HT. We propose and develop an adversarial power generation methodology
that allows HTs to bypass ML-based side channel defense. We design
configurable adversarial patch generation circuits for various platforms (ASIC
and FPGA) to consume adversarial power during the activation of HT to bypass
the power-analysis detection. (Section 3, 4)
Attack optimisation. We optimize the generated noise to achieve minimal
resource utilisation and showed that an effective HTO design can be
implemented with only $1$ Transistor in an ASIC. (Section 5)
Countermeasures and adaptive attacks. We propose a spectral domain
countermeasure for HTO (Section 7) and explore an adaptive attack by
considering the a spectral domain adversarial noise budget (Section 8). We
also explore the practicality of adversarial training taking into account the
utility constraints of the security use case.

##  2\. Threat Model

In this paper, we consider that the adversary’s objective is to _evade post-
silicon power-based ML detection of the HT_.

Attacker’s capabilities: The attacker within this threat model has the
capability to modify the design and insert HTs at any point in the victim
circuit, as commonly assumed in the state-of-the-art (clements2018hardware, ;
huang2020survey, ; faezi2021brain, ; faezi2021htnet, ). They can inject
additional circuitry, but cannot alter the defender’s ML-based HT detector,
which is trained to detect the existence of a triggered HT through power
analysis.
Defender: We assume the defender uses a ML-based HT detector which analyzes
the circuit power trace. We specifically focus on HTnet (faezi2021htnet, ) as
a golden chip-free technique, and which is trained by the power signals
gathered on TrustHub benchmarks (9fwb-8978-21, ) to detect HTs, due to its
superior detection performance.
Attacker’s knowledge: We assume that the attacker is aware of the defender’s
use of this ML model but sees it as a black-box; unable to modify its
parameters or directly interfere with its operation.
Objective: An adversary, using information learnt about the ML-based defense
mechanism, trains a proxy model and tries to craft power trace perturbations
added to the ML input to force it to output wrong labels.

##  3\. Adversarial Power Trace Generation

In this section, we introduce the process of generating an adversarial patch
which is a sneaky power trace augmented to the circuit power to force the ML-
based HT detector model to wrongly label the HT inserted ICs. We precise it is
an adversarial patch because the noise needs to be ”universal”, i.e., the
adversarial noise should fool the model regardless of the specific sample.
This is in contrary to classical adversarial noise which is crafted for a
given input sample. In the following, we use adversarial patch interchangeably
with adversarial noise.

Problem formulation: Given an original input power trace $x$ and a victim
classification model $f(.)$, the problem of generating an adversarial example
$x_{adv}$ can be formulated as a constrained optimization:

(1) $\small\begin{split}C(x+\delta)\neq C(x),~{}\forall~{}x\sim\mu_{HT},and\\\
\left\|\delta\right\|=\mathcal{D}(x,x+\delta)\leq\varepsilon\end{split}$

Where $\mu_{HT}$ is the data distribution corresponding to triggered hardware-
Trojans, which is our target for a classifier $C(.)$ to be fooled, i.e.,
evading detection. This means that we want to generate one noise ($\delta$)
$\varepsilon$ controls the magnitude of the adversarial patch.

Distance Metrics: For evading the detection, the adversarial perturbations
should be kept minimal. To measure the magnitude of adversarial noise, $L_{p}$
metrics are generally used in the literature (asplos, ; fgsm, ; CW, ). In our
case, the samples are power traces and $L_{\infty}$ is more appropriate to
measure the detectability of a potential power trace since $L_{\infty}$
measures the maximum difference for all elements at corresponding positions in
the two samples.

Adversarial Patch Generation: We generate the adversarial power noise by
solving the optimization problem and considering the detection loss function.
Given a batch of power traces $X_{i}$ and corresponding target labels $\ell$.
In each iteration, the algorithm adds the precalculated perturbation to the
Trojan inserted trace and adjusts the new noise along the direction of its
gradient w.r.t the inference loss $\partial J/\partial x$. Algorithm 1
describes the generation of adversarial power noise process.

Algorithm 1 Adversarial Power Trace Generation.

1:Input: Data set: $\mathcal{D}$, classifier: $C$, noise magnitude:
$\varepsilon$, standard deviation: $\sigma$, number of iterations: $N$.

2:Output: $\delta$ Adversarial power trace.

3:Initialize $\delta\leftarrow rand()$

4:while $iter<N$ do

5: for each Batch $X_{i}\sim\mathcal{D}$ do

6: for all $x_{j}$ s.t. $C(x_{j})=1$ do $\triangleright$ //HT distribution.

7:

8: $\delta\leftarrow\frac{1}{|X_{i}|}\sum_{j=1}^{|X_{i}|}\\{\\{\alpha
sign(\nabla_{x}J_{\theta}(C({x_{j}+\delta}),\ell))\\}\\}$

9:

10: $\delta\leftarrow Clip_{\varepsilon}\\{\delta\\}+z\sim
N\left(0,\sigma^{2}\right)$

11: end for

12: end for

13: $iter+=1$

14:end while

Where the attack strength is determined by $\alpha$ which is the perturbation
constraint, $C({x_{j}+\delta})$ computes the output of ML based classifier,
$J_{\theta}$ is the cross entropy loss function, and the sign function is
indicated as $sgn(·)$. To produce a universal patch for traces in dataset,
average of all generated noises has been forwarded to the next iteration.
Since the negative values for the patch do not have any physical meaning in
terms of power consumption and to ensure the the perturbation is restricted to
the specified power budget $\epsilon$, The attack is followed by a clipping
operation ($0\leq\delta\leq\epsilon$). A Gaussian noise $z$ with the mean
value of $0$ and standard deviation $\sigma$ has been added to the
perturbation to add robustness to the measurement and environment noise.

Based on the described algorithm, the effectiveness of different power budgets
on hardware-Trojan ML detector accuracy has been evaluated in Figure 2. The
figure shows that for fooling the ML model with $100\%$ efficiency we can
restrict the maximum power of adversarial patches to $3mW$.

Figure 2. HT detection accuracy based on changing the maximum power budget

##  4\. HTO: Proposed Adversarial Circuit Design

In the previous section, we generate an adversarial patch that is able to fool
a power side-channel based HT detection system. However, the adversarial noise
we consider in Section 3 is in the input space, i.e., it is a power trace. In
a practical scenario, we cannot act on the power trace directly, as stated
earlier in our threat model. In this section, we propose a methodology to
design a circuitry that consumes a given power trace, which is the adversarial
power trace generated in Section 3. Our objective is to answer the following
question: Given a target (adversarial) power trace, how to design a circuit
that consumes a trace that emulates the target trace?

In the following, we propose a design methodology for both FPGA and ASIC
platforms. We implement a transistor-based circuit for ASIC and (i) RO-based
as well as (ii) a DSP-based circuit design for FPGA to emulate the adversarial
patch on both platforms.

###  4.1. HTO Circuit Design for ASICs

For designing a circuit to generate adversarial power noise in ASIC, we
propose a configurable power consumption unit. Specifically, the configurable
power consumption unit is a network of intrinsic resistors hidden in
transistors which are able to configure by activating transistors. The hidden
resistors can be specified by the feature parameters of transistors during the
design phase. Based on the samples in the adversarial power noise generated by
the algorithm 1, the equivalent hidden resistors are calculated, and
corresponding vectors are activated in the power network. An example of this
conversion for $P=1.2mW$ and $V=1v$ with $18$ transistors has been shown in
Figure 3 and algorithm 2.

Figure 3. ASIC adversarial power network example Algorithm 2 Configuration
Vector Generator

1:Input: Noise samples: $\mathcal{N}$

2:Output: Configuration vectors: $\mathcal{V}$

3:Initialize $\mathcal{V}\leftarrow 0$

4:for each noise sample $P_{i}$ in $\mathcal{N}$ do

5: for each digit $d_{l}$ in $P_{i}$ do

6: for each cell $c_{j}$ in a raw of circuit do

7: if $j<d_{l}$ then

8: $\mathcal{V}_{lj}=1$

9: else

10: $\mathcal{V}_{lj}=0$

11: end if

12: end for

13: end for

14:end for

There are multiple ways to store configuration vectors:

  * •

Vectors can be stored in a Block-RAM where the order of vectors reflects the
consumed power in each cycle by the HTO.

  * •

For a System on Chip (SoC) circuit which has a processor, it is recommended to
store the vectors in the processor’s RAM to minimize resource utilization. The
vectors can feed to the configurable power network by a port connected to the
processor’s bus. The structure of stored vectors in the SoC system has been
shown in Figure 4.

Figure 4. Illustration of a configuration vector generator in a SoC case

###  4.2. HTO Circuit Design for FPGAs

Not having access to the parameters of transistors, we take a different
approach to design an HTO circuit in the FPGA platform. We propose two
different logical circuits, which are ring oscillator-based and DSP-based
networks to consume adversarial power. The implementation details of each
circuit are discussed as follows:

1- Ring Oscillators: A network of configurable ring oscillators illustrated in
Figure 5 has been proposed to consume generated adversarial power traces on
FPGA. The ring oscillator frequency of the oscillation formula is:

(2) $\small\begin{array}[]{rlc}f=\frac{1}{2n\tau}\end{array}$

Where $\tau$ is the propagation delay for a single inverter, and $n$ is the
number of inverters which should be an odd number. For generating a sneaky
adversarial power, the number of inverters should be as minimum as possible
(one inverter) leading to the maximum frequency and power consumption.
Unfortunately, our experimental setup can not capture the power consumed with
the conventional ring oscillator illustrated in Figure 5(a). Therefore, we
modified our ring oscillator design to the one shown in Figure 5(b) to
synchronize our circuit with the whole system and capture the power precisely.
In the new design, by logical-anding the enable signal with the FPGA clock, we
synchronize the capture power devices with the clock generated by the ring
oscillator. We can consume around $1mW$ by using two ROs in our experimental
setup limiting our resolution to $1mW$.

(a) Conventional Ring Oscillator

(b) Synchronized Ring Oscillator

Figure 5. Ring Oscillator

2- DSPs: We Exploit DSP components in FPGA to implement an obfuscated design
that evades hardware-Trojan detection techniques. We notice that by a DSP with
configuration in Figure 6, we can consume $1mW$ power in each clock cycle.
Based on our results, we can achieve $100\%$ efficiency to fool ML classifier
defense by using at least $3$ DSPs.

Figure 6. DSP-based network design

Configuration vectors: Similar to the ASIC design, the configuration vectors
can be stored in Block-RAMs or for an SoC circuit, vectors can be stored in
the processor’s RAM and sent to a general I/O port connected to the HTO
circuit.

###  4.3. Experimental setup

Different experimental setups have been used for the ASIC and FPGA platforms
to generate the adversarial power traces. In ASIC, the adversarial patches
generated to fool the classifier were simulated by $HSpice$ $2019$ with $32nm$
low power $PTM$. Generation of the equivalent circuit with appropriate
configuration vectors in $HSpice$ format for each patch has been automated by
a $Python$ code. For capturing the power in FPGA, we leverage ChipWhisperer
305 with Xilinx spartan 6 as a target device and ChipWhisperer-lite as a
capture device. As shown in the Figure 7 the control of Artix-7 and Spartan-6
on FPGA manage by a USB connection from the laptop. Control information of our
power measurements sends through the 20-pin connector connected to
ChipWhisperer-lite. The power measurements will be done through an SMA cable
to the ChipWhisperer-lite and sent to the laptop through a USB connection.

Figure 7. FPGA setup

###  4.4. Results

Results on ASIC illustrate the negligible difference between the generated
noises and simulated ones with the mean square error of $0.0002$. The power
consumption resolution on FPGA restricts us to only implementing the patches
with the granularity of $1mW$. Hence, The accuracy of the simulation drops in
a way that the value of $0.31$ is reported for mean square error. Tables 1 and
2 illustrate the resource utilization and model’s accuracy on ASIC and FPGA
respectively. To drop the model’s accuracy to $0\%$, it requires the maximum
of $4$ ring-oscillators to consume power in the range $0mW$ to $2mW$ with the
resolution of $1mW$ on FPGA. However, the maximum of $12$ transistors need to
generate the power in the range $0mW$ to $2mW$ with the resolution of $0.1mW$
to achieve $100\%$ efficiency in misclassification for ASIC.

Dataset |  HT detection accuracy (%) |  # of transistors |  HT detection accuracy after patching (%) |  Noise Budget (mW)
---|---|---|---|---
|  |  |  |
|  |  |  |
AES-T400 |  97.1 |  6 |  0 |  0-0.6
AES-T500 |  91.91 |  11 |  0 |  0-1.2
AES-T600 |  93.87 |  11 |  0 |  0-1
AES-T700 |  100 |  11 |  0 |  0-1.2
AES-T800 |  100 |  12 |  0 |  0-2
AES-T1800 |  94.12 |  5 |  0 |  0-0.5

Table 1. Resource utilization and HT detection accuracy on ASIC

Dataset |  HT detection accuracy (%) |  Method |  # of CLBs |  HT detection accuracy after patching (%) |  Noise Budget (mW)
---|---|---|---|---|---
|  |  |  |  |
|  |  |  |  |
AES-T400 |  97.1 |  RO |  2 |  0 |  0-1
|  |  DSP |  1 |  0 |
AES-T500 |  91.91 |  RO |  4 |  0 |  0-2
|  |  DSP |  2 |  0 |
AES-T600 |  93.87 |  RO |  2 |  0 |  0-1
|  |  DSP |  1 |  0 |
AES-T700 |  100 |  RO |  4 |  0 |  0-2
|  |  DSP |  2 |  0 |
AES-T800 |  100 |  RO |  4 |  0 |  0-2
|  |  DSP |  2 |  0 |
AES-T1800 |  94.12 |  RO |  2 |  0 |  0-1
|  |  DSP |  1 |  0 |

Table 2. Resource utilization and HT detection accuracy on FPGA

Discussion– Our results show that the generated HTO consumes power traces that
accurately emulate the adversarial patch impact on the victim system. However,
the high resource utilization required by the HTO is a clear limitation of its
threat, which can be easily exposed by state-of-the-art techniques. In the
following, we will investigate optimisation techniques to reduce the resource
utilisation for more sneaky HTO designs.

##  5\. HTO Optimization

In this section, we tackle the challenge of reducing resource utilization of
HTO circuits for a more practical attack. We start by analyzing the
adversarial patch values distribution. We observe that the noise power
distribution is biased towards a relatively limited number of values. Using
this observation, we adapted the adversarial power trace generation algorithm
to have constraints on their values within a target space, thereby producing
quantized power traces which require lower resource utilisation to emulate by
HTOs.

###  5.1. Adversarial patch values distribution

Our goal is to study the noise values distribution of the adversarial patch.
Our intuition is that if the noise power distribution is biased towards a
relatively limited number of values, we can exploit this to optimize the HTO
circuit. Figure 8 shows the noise power distribution of a full patch. We can
clearly see that in this example the noise power distribution is biased
towards $lower$ and $upper$ bound of noise budget.

(a) AES-T400

(b) AES-T500

(c) AES-T600

(d) AES-T700

(e) AES-T800

(f) AES-T1800

Figure 8. Distribution of the adversarial patch values for different target
designs.

###  5.2. Adversarial patch quantization

The previous analysis in Section 5.1 showed that the noise power distribution
is biased towards a relatively limited number of values. Hence, a projection
of the adversarial noise to a quantized space representing the most frequent
values might maintain its adversarial impact.

To verify and test this hypothesis, we generate new adversarial patches with
constraints on their values within a target space. The patch quantization
method is exposed in Algorithm 3. The algorithm updates the adversarial patch
generation process by a projection function (Line 11), which takes a vector
and rounds its values to the closes values in a subspace $\mathcal{S}$. This
subspace is defined according to the most frequent values observed beforehand.

Algorithm 3 Quantized Adversarial Power Trace Generation.

1:Input: Data set: $\mathcal{D}$, Subspace: $\mathcal{S}$, classifier: $C$,
noise magnitude: $\varepsilon$, standard deviation: $\sigma$, number of
iterations: $N$.

2:Output: $\delta$ (Quantized adversarial power trace).

3:

4:Initialize $\delta\leftarrow rand()$

5:while $iter<N$ do

6: for each Batch $X_{i}\sim\mathcal{D}$ do

7:

8: $\delta\leftarrow\frac{1}{|X_{i}|}\sum_{j=1}^{|X_{i}|}\\{\\{\alpha
sign(\nabla_{x}J_{\theta}(C({x_{j}+\delta}),\ell))\\}\\}$

9:

10: $\delta\leftarrow Clip_{\varepsilon}\\{\delta\\}+z\sim
N\left(0,\sigma^{2}\right)$

11: $\delta\leftarrow\mathcal{P}_{\mathcal{S}}(\delta)$

12: end for

13: $iter+=1$

14:end while

###  5.3. Results

Generating patches with different resolutions ($0.1mW$ to $1mW$) lead to a
significant discovery that still with the resolution of $1mW$ we reach $100\%$
efficiency in misclassifying the ML-based Trojan detector. Therefore, to
reduce the resource utilization of the adversarial power generator circuit for
a more sneaky attack, we put the equivalent transistor consuming exactly the
power in the noise patch. Figure 9 depicts an optimized circuit that can
consume power in the range $0mW$ to $2mW$ with the resolution of $1mW$ with
only $2$ transistors.

Figure 9. Optimized ASIC adversarial noise generator

Furthermore, we leverage different optimization processes on patches to reduce
the resource utilization on ASICs and FPGAs:

  * •

Calculating the mean value of adversarial power trace and project other
samples to the nearest value to the upper bound, lower bound, and mean value
(2 transistors)

  * •

Mapping above the mean value to the upper bound and below ones to zero (1
transistor)

Exploiting various quantization spaces in adversarial patches decreases the
number of transistors used in the design. Therefore, it minimizes the cost and
area of producing the HTO in the ASIC platform. Moreover, this optimization
lowers the configuration vectors causing a significant reduction in storage
units for both platforms. Our results demonstrate that we still can keep the
accuracy of the model at the acceptable value by quantizing the values of
patches to $2$ or even $1$. Table 3 and 4 represent resource utilization for
optimized patches on ASICs and FPGA respectively.

Dataset |  HT detection accuracy (%) |  # of transistors |  HT detection accuracy after patching (%) |  Noise Budget (mW)
---|---|---|---|---
|  |  |  |
|  |  |  |
AES-T400 |  97.1 |  1 |  0 |  0-0.6
AES-T500 |  91.91 |  1 |  0 |  0-1.2
AES-T600 |  93.98 |  1 |  0 |  0-1
AES-T700 |  100 |  1 |  0 |  0-1.2
AES-T800 |  100 |  1 |  0 |  0-2
AES-T1800 |  94.12 |  1 |  0 |  0-0.5

Table 3. Optimized resource utilization and HT detection accuracy on ASIC

Dataset |  HT detection accuracy (%) |  Method |  # of CLBs |  HT detection accuracy after patching (%) |  Noise Budget (mW)
---|---|---|---|---|---
|  |  |  |  |
|  |  |  |  |
AES-T400 |  97.1 |  RO |  2 |  0 |  0-1
|  |  DSP |  1 |  0 |
AES-T500 |  91.91 |  RO |  4 |  0 |  0-2
|  |  DSP |  2 |  0 |
AES-T600 |  93.84 |  RO |  2 |  0.7 |  0-1
|  |  DSP |  1 |  0 |
AES-T700 |  100 |  RO |  4 |  0.2 |  0-2
|  |  DSP |  2 |  0 |
AES-T800 |  100 |  RO |  4 |  0 |  0-2
|  |  DSP |  2 |  0 |
AES-T1800 |  94.12 |  RO |  2 |  0 |  0-1
|  |  DSP |  1 |  0 |

Table 4. Optimized resource utilization and HT detection accuracy on FPGA

##  6\. Unsynchronized Adversarial Patch

So far, we assumed that the power trace and the adversarial noise are
synchronised, which can be implemented by a simple triggering signal, e.g.,
the HTO circuit is triggered by first round of the AES. In the section, we
relax this assumption, and suppose the starting point of capturing power
traces can change and drop the synchronisation assumption. We propose to
generate a patch that is robust in this setting. Taking into account this
characteristic of the attack, we propose a patch generator that considers the
shift existing in the setup. Hence, the new problem can be formulated as
follows:

(3) $\small\begin{split}C(x+shift(\delta,k)))\neq
C(x),~{}\forall~{}x\sim\mu_{HT},and\\\
\left\|\delta\right\|_{\infty}\leq\varepsilon\\\ \end{split}$

Where $\varepsilon$ controls the magnitude of the noise vector ($\delta$),
$shift(.)$ is a function that quantifies the adversarial patch $\delta$
relatively with regard to a target power trace $y$ given a time shift
$k\in[0,d]$. Given an adversarial patch $\delta=\\{\delta_{j}\\}\forall
j\in[0,d]$ that is _consumed by a circuit in a continuous loop_ , the function
$shift(.)$ could be expressed as:

(4)
$\small\begin{split}shift(\delta,k)=\left\\{\begin{array}[]{lll}\delta(d-k+j)&\text{if}&j\in[0,k]\\\
\delta(j-k)&~{}\text{else}\end{array}\right.\\\ \end{split}$

To solve the problem formulated above, we propose Algorithm 4, which details
the noise generation mechanism of an HTO-generated power trace that is
unsynchronised with the victim circuit.

Algorithm 4 Un-synchronised Adversarial Power Trace Generation.

1:Input: Data set: $\mathcal{D}$, classifier: $C$, noise magnitude:
$\varepsilon$, standard deviation: $\sigma$, number of iterations: $N$.

2:Output: $\delta$ Adversarial power trace.

3:

4:Initialize $\delta\leftarrow rand()$

5:while $iter<N$ do

6: for each Batch $X_{i}\sim\mathcal{D}$ do

7:

8: $\delta\leftarrow\frac{1}{|X_{i}|}\sum_{j=1}^{|X_{i}|}\\{\\{\alpha
sign(\nabla_{x}J_{\theta}(C({x_{j}+sh(\delta)}),\ell))\\}\\}$

9:

10: $\delta\leftarrow Clip_{\varepsilon}\\{\delta\\}+z\sim
N\left(0,\sigma^{2}\right)$

11: end for

12: $iter+=1$

13:end while

14:

15:function $sh$($\delta$)$\triangleright$ //Time shift function.

16: $k\leftarrow Rand(d-1)$ $\triangleright$ //Select a random shift.

17: Initialize $shifted\\_\delta\leftarrow 0$

18: $shifted\\_\delta\leftarrow concat(\delta[d-k:d],\delta[0:d-k])$

19: Return:$shifted\\_\delta$

20:end function

The effectiveness of different power budgets on model accuracy for the
unsynchronized patches has been evaluated in Figure 10. The figure shows that
for fooling the ML model with $100\%$ efficiency we can restrict the maximum
power of adversarial patches to $6.9mW$.

Figure 10. HT detection accuracy based on changing the maximum power budget
for unsynchronized patches. The stochasticity comes from the random time shift
applied to the patch at inference.

For unsynchronized patches, which consume maximum power in the range $0mW$ to
$6.9mW$ ($AES-T500$), the mean square errors of $0.025$ and $0.21$ have been
calculated for ASIC and FPGA respectively. The maximum exploited resources for
the simulation of unsynchronized patches with the resolution of $1mW$ are $14$
ring-oscillators in FPGA. On the other hand, to simulate patches with the
resolution of $0.1mW$, we require the maximum of $16$ transistors.

Interestingly, similar to patches generated based on Algorithm 1, as
illustrated in Figure 11, the noise power distribution is restricted to a
relatively limited number of values. Hence, we leverage the same scenario
discussed in Section 5 to optimize the circuits for unsynchronized patches. We
use the same quantisation methodology and reduce the values of patches to a
subspace that still enables effective adversarial patches implementable with
lower resources.The resource utilization and model’s accuracy of the
unsynchronized patches are shown in Tables 5 and 6

(a) AES-T400

(b) AES-T500

(c) AES-T600

(d) AES-T700

(e) AES-T800

(f) AES-T1800

Figure 11. Full unsynchronized patch distribution

Dataset |  HT detection accuracy (%) |  # of transistors |  HT detection accuracy after patching (%) |  Noise Budget (mW)
---|---|---|---|---
|  |  |  |
|  |  |  |
AES-T400 |  97.1 |  11 |  0 |  0-1.5
|  |  1 |  0 |
AES-T500 |  91.91 |  16 |  0 |  0-6.9
|  |  1 |  0 |
AES-T600 |  93.87 |  12 |  0 |  0-2.2
|  |  1 |  0 |
AES-T700 |  100 |  12 |  0 |  0-2.4
|  |  1 |  0 |
AES-T800 |  100 |  14 |  0 |  0-4.1
|  |  1 |  0.1 |
AES-T1800 |  94.12 |  11 |  0 |  0-1.6
|  |  1 |  0 |

Table 5. Resource utilization and HT detection accuracy on ASIC for
unsynchronized patches

Dataset |  HT detection accuracy (%) |  Method |  # of CLBs |  HT detection accuracy after patching (%) |  Noise Budget (mW)
---|---|---|---|---|---
|  |  |  |  |
|  |  |  |  |
AES-T400 |  97.1 |  RO |  4 |  0 |  0-2
|  |  DSP |  2 |  0 |
AES-T500 |  91.91 |  RO |  14 |  0 |  0-7
|  |  DSP |  7 |  0 |
AES-T600 |  93.87 |  RO |  6 |  0 |  0-3
|  |  DSP |  3 |  0 |
AES-T700 |  100 |  RO |  6 |  0.1 |  0-3
|  |  DSP |  3 |  0 |
AES-T800 |  100 |  RO |  8 |  0.3 |  0-4
|  |  DSP |  4 |  0 |
AES-T1800 |  94.12 |  RO |  4 |  0 |  0-2
|  |  DSP |  2 |  0 |

Table 6. Resource utilization and HT detection accuracy on FPGA for
unsynchronized patches

##  7\. Countermeasures

Our initial threat model assumes a defender deploying an ML model for HT
detection without any further specific countermeasures. One of the possible
protections for such systems is to pre-process the input power trace to filter
out undesired signals from non-relevant frequency ranges. In the following, we
perform spectral analysis to check if the adversarially generated power trace
has a significantly different spectral signature compared to any circuit (be
it benign or an HT). Based on this spectral analysis, we propose a pre-
processing technique and discuss its limits later. Furthermore, we
adversarially trained the HT detector and show that it resulted in a loss in
accuracy, while allowing adaptive attacks to bypass the detection with a
higher amount of power budget.

Spectral Analysis: The power trace can be represented in the spectral domain
using the Fast Fourier Transform (FFT), which is defined by

(5) $\small\mathcal{S}(k)=\sum^{N-1}_{n=0}s(n)e^{-i\frac{2\pi}{N}nk}$

Where $N$ is the length of the spectral signature, $\mathcal{S}(k)$ is the
frequency domain magnitudes and $s(n)$ is the time domain power trace in our
case.

We consider a system that is comprehensively pre-processing the input signal.
The defender defines its target frequency range based on the expected power
traces. We evaluate the efficiency of the HTO under this setting. We assume
the defender has access to significant potential HTs. We first explore the
power spectral density of the benign and HT circuits to identify the frequency
range that represents the region of interest ($[f_{min},f_{max}]$). A
comprehensive band-pass filter corresponding to this frequency range is then
applied to the collected power traces before feeding it to the ML model.

Figure 12 illustrates the spectrum of the adversarial noise compared to the
average frequency response of power traces without the HTO patch. We notice
the adversarial noise contains frequency components that are beyond the
expected range of an original raw signal which makes it vulnerable to
filtering-based defenses.

(a) FFT(trace)

(b) FFT(sync patch)

(c) FFT(unsync patch)

Figure 12. AES-T700 and patch power distribution in frequency domain

Table 7 presents the attack success rate of HTO in the presence of the filter.
We couldn’t find any frequency range for the filter to retrieve the model
accuracy of $AES-T400$ and $AES-T1800$ datasets to the acceptable value. The
accuracy of the model for $AES-T500$ and $AES-T600$ datasets partially
recovered after applying the filter. We notice that for these two datasets,
the model accuracy for the baseline trace and the attacked one is the same
while measuring the results by the filter. It means that although the filter
impacts the performance of the model, it totally reduces the patching
efficiency. On the other hand, the filter significantly degrades the
performance of attack for the $AES-T700$ and $AES-T800$ and retrieves the
model accuracy to $100\%$. Moreover, We analyzed the required noise budget to
bypass the filter. The results indicate that for all datasets the attacker
needs to generate the adversarial patch with a higher amount of power which
decreases the stealthiness of the patch.

Dataset |  class |  Model’s accuracy |  Model’s accuracy after patching |  Model’s accuracy after filtering patch |  $[f_{min},f_{max}]$ (MHz) |  Noise budget (mW) |  Noise budget to bypass filter (mW)
---|---|---|---|---|---|---|---
|  |  |  |  |  |  |
|  |  |  |  |  |  |
AES-T400 |  Class-0 |  88.9 |  0 |  - |  - |  0-0.6 |  -
|  Class-1 |  97.1 |  0 |  - |  |  |
AES-T500 |  Class-0 |  96.4 |  97.7 |  100 |  [0-7.5] |  0-1.2 |  0-35
|  Class-1 |  91.91 |  0 |  47.7 |  |  |
AES-T600 |  Class-0 |  92.7 |  98.5 |  81.8 |  [0-12.5] |  0-1 |  0-35
|  Class-1 |  93.8 |  0 |  32.6 |  |  |
AES-T700 |  Class-0 |  100 |  100 |  100 |  [0-2.5] |  0-1.2 |  0-11
|  Class-1 |  100 |  0 |  100 |  |  |
AES-T800 |  Class-0 |  100 |  100 |  100 |  [0-5.5] |  0-2 |  0-12
|  Class-1 |  100 |  0 |  100 |  |  |
AES-T1800 |  Class-0 |  99.8 |  0 |  - |  - |  0-0.5 |  -
|  Class-1 |  94.12 |  0 |  - |  |  |

Table 7. Model’s accuracy for original patches and filtered ones (class-0:
benign samples, class-1: HT-inserted samples)

Adversarial Training: Adversarial training (AT) (madry2019deep, ) is a state-
of-the-art defense strategy against adversarial attacks. It can be formulated
as follows:

(6) $\small\min_{\theta}\mathbb{E}_{(x,y)\sim\mathcal{D}}\left[\max_{\delta\in
B(x,\varepsilon)}\mathcal{L}_{ce}(\theta,x+\delta,y)\right]$

Where $\theta$ indicates the parameters of the classifier, $\mathcal{L}_{ce}$
is the cross-entropy loss, $(x,y)\sim\mathcal{D}$ represents the training data
sampled from a distribution $\mathcal{D}$ and $B(x,\varepsilon)$ is the
allowed perturbation set. The interpretation of this is that the inner
maximization problem is finding the worst-case samples for the given model,
and the outer minimization problem is to train a model robust to adversarial
examples (madry2019deep, ).

We used the PGD algorithm (pgd, ) to solve the inner maximization problem. We
set the noise magnitude (epsilon) equal to $0$ with a step size of $0.1$ with
a number of iterations equal to $20$. We train the model for around $20$
epochs to reach $99\%$ classification accuracy on clean input samples.

In Figure 13, we present a comparative analysis of the effects of patches
created using our adversarial patch technique on both AT models and undefended
(regular) models . The findings show that AT reduces the efficacy of attacks
at lower levels of adversarial noise but becomes less effective against higher
noise magnitudes (larger epsilons). This indicates that while adversarial
training enhances model robustness against certain attack levels, it is less
reliable against more intense adversarial inputs. Additionally, it’s important
to note that implementing AT, particularly at higher noise levels, as
expected, incurs a decrease in baseline accuracy, resulting in a compromise on
the overall utility of the model.

(a) Synch

(b) Unsync

Figure 13. Impact of patch on baseline and adversarial trained model when the
class 1 accuracy drops to $50\%$

##  8\. Adaptive Attack

The previously adversarial patch generation method considers only a magnitude
budget in the time domain without any spectral constraints, which led to
easily filtered adversarial impact through a comprehensive filter. The
objective of an adaptive attacker is to generate adversarial noise in a
specific frequency range which corresponds to the expected spectral domain of
the designed filter. Consequently, the defender will not be able to cut-off
the impact of the injected noise unless with a considerable utility loss. For
this reason, we introduce a spectral budget in addition to the noise magnitude
budget. Specifically, we not only clip the noise magnitude in the time domain
to fit a noise budget, but also project the noise in a subset of the frequency
domain to restrain its spectral components. The problem can therefore be
formulated as follows:

(7) $\small\begin{split}C(x+shift(\delta,k))\neq
C(x),~{}\forall~{}x\sim\mu_{HT},s.t.\\\
\left\|\delta\right\|=\mathcal{D}(x,x+\delta)\leq\varepsilon\\\
~{}FFT(\delta)\in[f_{min},f_{max}]\\\ \end{split}$

Where $\varepsilon$ controls the magnitude of the noise vector $\delta$ and
$shift(.)$ is a function expressed by Equation 4 that quantifies the
adversarial patch signal $\delta$, relatively with regard to a target signal
$x$ given an incidence time $k\in[0,d]$ and $k=0$ corresponds to the
synchronised case. The new constraint on $\delta$ limits the noise frequency
components to an acceptable range defined by $f_{min}$ and $f_{max}$, which
correspond to the useful frequency range from the defender perspective. Notice
that this information is available even in the initial HT threat model.

Algorithm 5 details the noise generation mechanism of our adaptive attack; We
include the frequency clipping process within the adversarial noise generation
procedure. In each iteration, after updating the noise, we project the noise
back to the target spectral domain using the pass-band filter defined
previously. Therefore, at each iteration, we only retain noise samples with
the same frequency range as the raw signal. These noise components are then
aggregated with the current patch instance. The shift function is the same as
in Algorithm 4.

Algorithm 5 Adaptive Adversarial Power Trace Generation

1:Input: Data set: $\mathcal{D}$, classifier: $C$, noise magnitude:
$\varepsilon$, standard deviation: $\sigma$, number of iterations: $N$.

2:Output: $\delta$ Adversarial power trace.

3:

4:Initialize $\delta\leftarrow rand()$

5:while $iter<N$ do

6: for each Batch $X_{i}\sim\mathcal{D}$ do

7:

8: $\delta\leftarrow\frac{1}{|X_{i}|}\sum_{j=1}^{|X_{i}|}\\{\\{\alpha
sign(\nabla_{x}J_{\theta}(C({x_{j}+sh(\delta)}),\ell))\\}\\}$

9:

10: $\delta\leftarrow Clip_{\varepsilon}\\{\delta+z\sim
N\left(0,\sigma^{2}\right)\\}$

11: $\delta\leftarrow Clip_{[f_{min},f_{max}]}FFT(\delta+z\sim
N\left(0,\sigma^{2}\right))$

12: end for

13: $iter+=1$

14:end while

15:

##  9\. Related Work

Several works have been studied in literature to leverage machine learning to
detect HTs over the past decade (hasegawa2016hardware, ; faezi2021htnet, ). A
novel static method for HT classification at the design phase based on SVM-
based classifier and gate-level netlist features presented by Hasegawa et al.
in (hasegawa2016hardware, ). This work was also extended to a similar
framework with different ML models, including random forest (RF)
(hasegawa2017trojan, ) and neural networks (hasegawa2017hardware, ). A dataset
of side channel signals to train a neural network for Trojan detection at run-
time gathered by Faezi et al. (faezi2021htnet, ). Noor et al.
(noor2017hardware, ) propose a framework for HT identification based on ML
classification with features describing the dominant attributes of HTs.
Features such as switching activity and net structure from the gate-level net-
list have been extracted, quantified and analyzed to detect malicious activity
by Zhou et al. (zhou2016novel, ). Xiang et al. (xiang2019random, ) constructed
a random forest classifier for hardware-Trojan detection by extracting the
structural and signal characteristics at RTL. An experiment was done to
determine the required power and delay SNR for hardware-Trojan identification
by lamech et al. (lamech2011experimental, ). Inoue et al. (inoue2017designing,
) present a novel static method for HT classification using gate-level netlist
features to identify a part of designed hardware-Trojans. Iwase et al.
(iwase2015detection, ) investigated a new detection technique for HTs based on
frequency domain features by converting power consumption waveform data from
time into frequency domain. Estimating statistical correlation between the
signals in a design and exploring how this estimation can be exploited in a
clustering algorithm to identify the HT logic introduced by Cakir et al.
(cakir2015hardware, ).

Furthermore, ML network can be fooled drastically by an adversarial
perturbation which is not perceptible by human (szegedy2013intriguing, ).
Generally, the goal of the adversarial attack is to force the well-trained
network to predict wrongly with generating the adversarial examples.
Adversarial attacks can be categorized into white-box attacks
(madry2017towards, ; carlini2017towards, ) where the attacker has access to
structures and parameters of victim models and black-box attacks
(dong2019evading, ; xie2019improving, ) where the attacker does not have any
information about internal structure of target model and can get a
corresponding output only by queries. Although majority of existing attack
methods are focusing on multi classification task, it has been exploiting in
many fields such as object detection (xie2017adversarial, ), face recognition
(yin2021adv, ), visual tracking (jia2020robust, ) and etc. Therefore, in this
paper, we investigate the ML classifier vulnerabilities introduced by faezi et
al. (faezi2021htnet, ) to design a hardware generating adversarial noise to
misclassify the HT-inserted circuits.

##  10\. Discussion and Concluding Remarks

In this paper, we shed new lights on the limits of using ML techniques for
hardware security. Specifically, we propose a methodology to generate
malicious circuity that emulates the consumption of an adversarial power trace
to fool the ML-based HT detection classifier. We develop HTO to design
circuits that are meant to consume a pre-generated adversarial patch (power
trace), for both ASIC and FPGA platforms.

Our results indicate that to reach $100\%$ efficiency, only one transistor
circuit might be required for evading ML-based HT detection in the case of
ASIC platforms. We also propose two different circuit designs, i.e., ring
oscillator-based and DSP-based designs have been proposed to simulate a sneaky
adversarial power noise on FPGA platforms. Our experimental results on a
Spartan 6 FPGA board illustrate achieving a $100\%$ efficiency to evade
detection is accessible with a maximum of $4$ ROs and $2$ DSPs. Moreover, we
introduce spectral-based and adversarial training countermeasures to mitigate
the attack’s efficiency while keeping the model’s performance. We also
investigate the impact of adaptive attacks on required power budgets by
simultaneously considering the magnitude of the generated patch in the time
and frequency domains.

We believe our work shows a new practical way to exploit ML vulnerability to
adversarial noise in a realistic scenario, which is critical for hardware
security. While remaining in the classical HT threat model, our approach
points out new potential threats that need to be taken into account when using
ML techniques as defenses.

## References

  * [1] Hunting for backdoors in counterfeit cisco devices: F-secure press room, 2020.
  * [2] Sally Adee.  The hunt for the kill switch.  In IEEE Spectrum, 2008.
  * [3] Chongxi Bao, Domenic Forte, and Ankur Srivastava.  On reverse engineering-based hardware trojan detection.  IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 35(1):49–57, 2015.
  * [4] Burçin Cakır and Sharad Malik.  Hardware trojan detection for gate-level ics using signal correlation based clustering.  In 2015 Design, Automation & Test in Europe Conference & Exhibition (DATE), pages 471–476. IEEE, 2015.
  * [5] Nicholas Carlini and David Wagner.  Towards evaluating the robustness of neural networks.  In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017.
  * [6] Nicholas Carlini and David A. Wagner.  Towards evaluating the robustness of neural networks.  CoRR, abs/1608.04644, 2016.
  * [7] Rajat Subhra Chakraborty, Seetharam Narasimhan, and Swarup Bhunia.  Hardware trojan: Threats and emerging solutions.  In 2009 IEEE International high level design validation and test workshop, pages 166–171. IEEE, 2009.
  * [8] Joseph Clements and Yingjie Lao.  Hardware trojan attacks on neural networks.  arXiv preprint arXiv:1806.05768, 2018.
  * [9] Chen Dong, Yi Xu, Ximeng Liu, Fan Zhang, Guorong He, and Yuzhong Chen.  Hardware trojans in chips: A survey for detection and prevention.  Sensors, 20(18):5165, 2020.
  * [10] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu.  Evading defenses to transferable adversarial examples by translation-invariant attacks.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4312–4321, 2019.
  * [11] Sina Faezi, Rozhin Yasaei, and Mohammad Abdullah Al Faruque.  Htnet: Transfer learning for golden chip-free hardware trojan detection.  In 2021 Design, Automation & Test in Europe Conference & Exhibition (DATE), pages 1484–1489. IEEE, 2021.
  * [12] Sina Faezi, Rozhin Yasaei, Anomadarshi Barua, and Mohammad Abdullah Al Faruque.  Brain-inspired golden chip free hardware trojan detection.  IEEE Transactions on Information Forensics and Security, 16:2697–2708, 2021.
  * [13] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples, 2014.
  * [14] Amira Guesmi, Ihsen Alouani, Khaled N. Khasawneh, Mouna Baklouti, Tarek Frikha, Mohamed Abid, and Nael Abu-Ghazaleh.  Defensive approximation: Securing cnns using approximate computing.  In Proceedings of the 26th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS ’21, page 990–1003, New York, NY, USA, 2021. Association for Computing Machinery.
  * [15] Kento Hasegawa, Masaru Oya, Masao Yanagisawa, and Nozomu Togawa.  Hardware trojans classification for gate-level netlists based on machine learning.  In 2016 IEEE 22nd International Symposium on On-Line Testing and Robust System Design (IOLTS), pages 203–206. IEEE, 2016.
  * [16] Kento Hasegawa, Masao Yanagisawa, and Nozomu Togawa.  Hardware trojans classification for gate-level netlists using multi-layer neural networks.  In 2017 IEEE 23rd International Symposium on On-Line Testing and Robust System Design (IOLTS), pages 227–232. IEEE, 2017.
  * [17] Kento Hasegawa, Masao Yanagisawa, and Nozomu Togawa.  Trojan-feature extraction at gate-level netlists and its application to hardware-trojan detection using random forest classifier.  In 2017 IEEE International Symposium on Circuits and Systems (ISCAS), pages 1–4. IEEE, 2017.
  * [18] Zhao Huang, Quan Wang, Yin Chen, and Xiaohong Jiang.  A survey on machine learning against hardware trojan attacks: Recent advances and challenges.  IEEE Access, 8:10796–10826, 2020.
  * [19] Tomotaka Inoue, Kento Hasegawa, Masao Yanagisawa, and Nozomu Togawa.  Designing hardware trojans and their detection based on a svm-based approach.  In 2017 IEEE 12th International Conference on ASIC (ASICON), pages 811–814. IEEE, 2017.
  * [20] Takato Iwase, Yusuke Nozaki, Masaya Yoshikawa, and Takeshi Kumaki.  Detection technique for hardware trojans using machine learning in frequency domain.  In 2015 IEEE 4th Global Conference on Consumer Electronics (GCCE), pages 185–186. IEEE, 2015.
  * [21] Shuai Jia, Chao Ma, Yibing Song, and Xiaokang Yang.  Robust tracking against adversarial attacks.  In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XIX 16, pages 69–84. Springer, 2020.
  * [22] Robertson Jordan and Riley Michael.  The big hack: How china used a tiny chip to infiltrate u.s. companies.  Bloomberg Businessweek, 2018.
  * [23] Charles Lamech, Reza M Rad, Mohammad Tehranipoor, and Jim Plusquellic.  An experimental analysis of power and delay signal-to-noise requirements for detecting trojans and methods for achieving the required detection sensitivities.  IEEE Transactions on Information Forensics and Security, 6(3):1170–1179, 2011.
  * [24] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks, 2017.
  * [25] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  arXiv preprint arXiv:1706.06083, 2017.
  * [26] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks, 2019.
  * [27] Luong N Nguyen, Baki Berkay Yilmaz, Milos Prvulovic, and Alenka Zajic.  A novel golden-chip-free clustering technique using backscattering side channel for hardware trojan detection.  In 2020 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), pages 1–12. IEEE, 2020.
  * [28] Nur Qamarina Mohd Noor, Nilam Nur Amir Sjarif, Nurul Huda Firdaus Mohd Azmi, Salwani Mohd Daud, and Kamalia Kamardin.  Hardware trojan identification using machine learning-based classification.  Journal of Telecommunication, Electronic and Computer Engineering (JTEC), 9(3-4):23–27, 2017.
  * [29] Sayandeep Saha, Rajat Subhra Chakraborty, Srinivasa Shashank Nuthakki, Anshul, and Debdeep Mukhopadhyay.  Improved test pattern generation for hardware trojan detection using genetic algorithm and boolean satisfiability.  In Cryptographic Hardware and Embedded Systems–CHES 2015: 17th International Workshop, Saint-Malo, France, September 13-16, 2015, Proceedings 17, pages 577–596. Springer, 2015.
  * [30] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus.  Intriguing properties of neural networks.  arXiv preprint arXiv:1312.6199, 2013.
  * [31] Mohammad Tehranipoor and Farinaz Koushanfar.  A survey of hardware trojan taxonomy and detection.  IEEE design & test of computers, 27(1):10–25, 2010.
  * [32] Yiyao Xiang, Lei Li, and Wanting Zhou.  Random forest classifier for hardware trojan detection.  In 2019 12th International Symposium on Computational Intelligence and Design (ISCID), volume 1, pages 134–137. IEEE, 2019.
  * [33] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille.  Adversarial examples for semantic segmentation and object detection.  In Proceedings of the IEEE international conference on computer vision, pages 1369–1378, 2017.
  * [34] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille.  Improving transferability of adversarial examples with input diversity.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2730–2739, 2019.
  * [35] Mingfu Xue, Chongyan Gu, Weiqiang Liu, Shichao Yu, and Máire O’Neill.  Ten years of hardware trojans: a survey from the attacker’s perspective.  IET Computers & Digital Techniques, 14(6):231–246, 2020.
  * [36] Shuo Yang, Prabuddha Chakraborty, and Swarup Bhunia.  Side-channel analysis for hardware trojan detection using machine learning.  In 2021 IEEE International Test Conference India (ITC India), pages 1–6. IEEE, 2021.
  * [37] Rozhin Yasaei, Sina Faezi, and Mohammad Abdullah Al Faruque.  Hardware trojan power & em side-channel dataset, 2021.
  * [38] Bangjie Yin, Wenxuan Wang, Taiping Yao, Junfeng Guo, Zelun Kong, Shouhong Ding, Jilin Li, and Cong Liu.  Adv-makeup: A new imperceptible and transferable attack on face recognition.  arXiv preprint arXiv:2105.03162, 2021.
  * [39] Bin Zhou, Wei Zhang, Srikanthan Thambipillai, Jason Teo Kian Jin, Vivek Chaturvedi, and Tao Luo.  Cost-efficient acceleration of hardware trojan detection through fan-out cone analysis and weighted random pattern technique.  IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 35(5):792–805, 2015.
  * [40] Er-Rui Zhou, Shao-Qing Li, Ji-Hua Chen, Lin Ni, Zhi-Xun Zhao, and Jun Li.  A novel detection method for hardware trojan in third party ip cores.  In 2016 International Conference on Information System and Artificial Intelligence (ISAI), pages 528–532. IEEE, 2016.