# A Survey and Perspective on Artificial Intelligence for Security-Aware
Electronic Design Automation

David Selasi Koblah<EMAIL_ADDRESS>1234-5678-9012 ,  Rabin Yu Acharya
<EMAIL_ADDRESS>,  Daniel Capecci  ,  Olivia P. Dizon-Paradis  Florida
Institute for Cybersecurity (FICS) Research, University of
FloridaGainesvilleFloridaUSA32611 ,  Shahin Tajik  ,  Fatemeh Ganji  Worcester
Polytechnic InstituteWorcesterMassachusettsUSA01609 ,  Damon L. Woodard  and
Domenic Forte  Florida Institute for Cybersecurity (FICS) Research, University
of FloridaGainesvilleFloridaUSA32611

###### Abstract.

Artificial intelligence (AI) and machine learning (ML) techniques have been
increasingly used in several fields to improve performance and the level of
automation. In recent years, this use has exponentially increased due to the
advancement of high-performance computing and the ever increasing size of
data. One of such fields is that of hardware design; specifically the design
of digital and analog integrated circuits (ICs), where AI/ ML techniques have
been extensively used to address ever-increasing design complexity, aggressive
time-to-market, and the growing number of ubiquitous interconnected devices
(IoT). However, the security concerns and issues related to IC design have
been highly overlooked. In this paper, we summarize the state-of-the-art in
AL/ML for circuit design/optimization, security and engineering challenges,
research in security-aware CAD/EDA, and future research directions and needs
for using AI/ML for security-aware circuit design..

integrated circuit, deep learning, reinforcement learning, security primitive.

††ccs: Hardware Electronic Design Automation††ccs: Security and privacy
Security in hardware††ccs: Computing Methodologies Machine Learning

##  1\. Introduction

With the proliferation of IoT devices, and the ever-increasing design
complexity of electronic systems, artificial intelligence (AI) and machine
learning (ML) techniques have been increasingly used to optimize electronic
design automation (EDA) frameworks and accelerate the overall process. The
physical platform, or hardware, represents the first stage for any layered
security approach, and provides the initial protection mechanisms to help
ensure that preliminary security controls can be trusted. Hence, it is
considered to be the ”root-of-trust” of any electronic system. However,
research over the last two decades has revealed that the hardware establishing
these systems can no longer be considered secure and trusted. Incidents like
Meltdown (Lipp et al., 2018) and Spectre (Kocher et al., 2019), the Big Hack
of 2018 (Robertson and Riley, 2018), the 63$\%$ rate of security breaches
among organizations due to hardware vulnerabilities in 2019 (Bayern et al.,
2019), and the recent surge of fake components on the market due to the
ongoing global chip-shortage (Leprince-Ringuet, 2021) are some of the most
recent examples of hardware security-related issues. They are partly the
result of the shift in the supply chain paradigm from a vertical model to a
horizontal one. With multiple untrusted entities involved in the design
process, and the rich connectivity features of the modern day computing
systems, the critical hardware resources and intellectual property (IP) are
left exposed to attackers who in some cases can attack such resources
remotely. In addition, the modern complexity of chip designs with billions of
transistors and interactions among hundreds of IPs, coupled with the lack of
security-aware CAD/EDA tools and short time to market, can allow security
weaknesses to be introduced or go unnoticed during design.

Hardware security threats can arise during various stages of the integrated
circuit (IC) design cycle. They are generated from unintentional design flaws,
system-based side effects, and intended malicious design modifications. With
the advancement in AI and ML, hardware security threats such as physical
attacks (invasive, semi-invasive, and non-invasive), and hardware Trojans are
evolving too (Krachenfels et al., 2021; Jin et al., 2020; Timon, 2019).
However, the development of AI/ML based models to defend intellectual property
(IP) and detect known and potentially unknown attacks has yet to catch up.
Nevertheless, in the last couple of years, researchers in both academia and
industry have turned to AI to not only speed up chip design but improve upon
various figures of merit.

A recent article (Fung, 2022) from Jason Fung, CWE/CAPEC Board Member and
Intel’s current Director of Offensive Security Research and Academic Research
Engagement, highlights seven essentials for more security-aware electronic
design automation (EDA). We firmly believe that AI/ML can play a significant
role in meeting each essential:

  1. (1)

Guide users to make design tradeoffs by taking both functionality and security
into consideration. Today’s EDA tools are primarily driven by traditional
metrics, such as area, power, and delay. Security metrics are challenging
because oftentimes security cannot be modeled analytically. AI/ML, on the
other hand, can learn models from data and learn tradeoffs/policies through
trial-and-error actions with an environment.

  2. (2)

Educate users on security best practices when design decisions are being made.
Most design engineers are either untrained in security or at best experts on
one particular topic. Security-aware tools would ideally train and re-train
engineers to keep up with new attacks and threats. Although AI/ML, especially
deep learning (DL), is often considered as a black-box, interest in
explainable AI (Barredo Arrieta et al., 2020) is growing and should help
fulfill/support this directive.

  3. (3)

Detect security issues in real time when code is being written. According to
the rule-of-ten in VLSI (Bushnell and Agrawal, 2004), the cost of dealing with
a fault, bug, or security issue grows by a factor of 10 after completing each
step within a chip’s design and fabrication lifecycle. For example, finding
and fixing a bug at the register transfer level (RTL) is 10 times less
expensive than finding it after synthesis. At the extreme case, a bug found
during pre-silicon phase might be 1000 times less expensive to fix than if the
same bug were found within a chip of a fielded system, and so on. Thus, it is
essential to find security weaknesses as early as possible. AI has recently
found success in the software domain for vulnerability detection (Li et al.,
2018), fuzzing(Guan et al., 2020), etc. For digital IC design, many of these
can be directly transferred to hardware weaknesses at the source code level or
RTL. In the domain of analog ICs, there is already progress to speed up
performance evaluation of circuits (Pan et al., 2019).

  4. (4)

Beyond just finding problems, provide reliable mitigation options to address
them. It’s not enough to just point out vulnerabilities. Engineers may need
guidance on the available mitigation options and how they might impact the
rest of the design. Once again, in the software domain, there is evidence that
real-time recommendation and completion (Svyatkovskiy et al., 2019) are
possible. At a minimum, it seems that AI can already provide reasonable high
level synthesis (HLS) (Makrani et al., 2019), place-and-route (Xie et al.,
2020), physical implementation (Ding et al., 2011), predictions for digital
and analog circuits in terms of traditional metrics and, in rare cases,
security metrics (e.g. SAT attack time (Chen et al., 2020a)). It may only be a
matter of time before AI-based optimizers, especially reinforcement learning,
can automatically insert solutions and countermeasures to meet an objective
and constraints.

  5. (5)

Seamlessly integrate best-in-class protections. Aside from tradeoffs with
traditional design metrics, metrics for certain hardware attacks and
vulnerabilities may be at odds. For example, in the area of logic locking, the
community has often mentioned an unavoidable tradeoff between resistance to
SAT attacks and corruptibility (Xu et al., 2017; Liu et al., 2020b). In such
situations, a combination of methods or protections may be the best approach.
In the area of AI-based digital circuit design, “decision-making” tools have
been developed that select the right combination of algorithms and tools (Yu
et al., 2018; Neto et al., 2019) for a given IP to achieve optimal quality of
result.

  6. (6)

Recommend the most efficient test strategy for a given coverage guarantee. Not
all security properties can be verified statically. In such cases, hardware
simulation, emulation, or formal verification can be used. AI-based prediction
and classification can be used to predict performance and avoid simulations
entirely or narrow the simulation space down. Further, “decision-making” tools
can guide the development team’s choice of what tests to run and what
parameters should be used for a specific IP.

  7. (7)

Learn continuously from users. The continuous evolution of attacks and new
threats implies the need for moving target defenses. Similarly, EDA itself
needs to keep up with new challenges facing the industry such as the end of
Moore’s law, 3D integration, etc. Advancement in AI, especially DL and
federated learning (McMahan and Ramage, 2017), is coming at the perfect time
to promote continuous learning by crowdsourcing EDA problems and solutions
while still maintaining privacy of user inputs and IPs.

In this survey, we summarize both constructive and destructive use of AI/ML
techniques in the security-aware design of ICs. In other words, we review the
recent works in design/attack of security approaches at every level of the IC
design flow and the design/attack of hardware-based security primitives using
AI/ML-based approaches. As such this survey is organized as follows: Section 2
provides a brief background on ML, AI, and DL. Section 3 reviews the studies
that utilize AI/ML for general and security-aware design of digital ICs.
Section 4 reviews the AI/ML and optimization techniques involved in the design
of analog ICs, analog security primitives, and attacks on analog ICs and
security primitives. Section 5 discusses the outstanding needs and
requirements for a security-aware design of ICs. Finally, Section 6 concludes
the survey by highlighting the future trends and opportunities in the field of
security-aware IC design.

##  2\. Background

###  2.1. Machine Learning & Artificial Intelligence

(a)

(b)

Figure 1. (a) A categorization of major machine learning techniques with
relevant examples; (b) An example neural network with three hidden layers.

AI is a general term for any machine and/or program that displays some level
of intelligence. ML is a sub-field of AI concerned with algorithms that are
capable of learning patterns from data without explicitly being told those
patterns by a human. Over the years, the availability of large amounts of data
and computational resources has led to a rise in the use of ML in a variety of
fields. DL is a sub-field of ML that involves the use of artificial neural
networks (ANNs), which are organized algorithmic structures that mimic how
humans learn as shown in Fig. 1(b). In recent years, DL has been favored over
traditional ML techniques for highly complex tasks with large amounts of
complex data.

####  2.1.1. Types of Machine Learning

There are three main types of ML algorithms: supervised learning, unsupervised
learning, and reinforcement learning. An overview of these three main types is
provided in the following paragraphs, and example methods are summarized in
Fig. 1(a).

Supervised Learning is a form of task-driven ML that maps inputs to an output,
given labeled training examples. Supervised ML is often used for
classification and regression tasks. Classification tasks involve mapping
inputs to a discrete value (i.e., class label), while regression tasks involve
mapping inputs to a continuous value. Note that regression is the general form
of classification, since all classification tasks can be conceptualized as
predicting the likelihood (which is a continuous value) that an input belongs
to each class and returning the class with the highest likelihood. Popular
supervised ML methods include support vector machines (SVMs) and random forest
for classification tasks, and linear and logistic regression for regression
tasks (ALPAYDIN, 2020).

Unsupervised Learning is a form of data-driven ML that finds patterns in input
data, without the need for labeled training examples. Unsupervised ML is often
used for clustering and dimensionality reduction tasks. Clustering tasks
involve grouping data based on similar underlying structures, while
dimensionality reduction tasks involve simplifying data to its most principle
(i.e. salient) underlying structures. Common unsupervised ML methods include
k-means and k-nearest neighbor (KNN) for clustering, and principle component
analysis (PCA) and singular value decomposition (SVD) for dimensionality
reduction (ALPAYDIN, 2020).

Reinforcement Learning (RL) is a form of feedback-based ML that involves
learning from mistakes in a trial-and-error fashion. RL is often used for
prediction and control in problem domains where time and event sequences
matter, feedback may be delayed, and actions have consequences. In RL,
prediction involves predicting the performance of some policy, whereas control
involves determining the optimal policy that yields the best performance.
Though practical applications are mostly concerned with control, the problem
of prediction must oftentimes be solved first. Popular RL methods include
Monte Carlo and temporal difference (TD) Learning for prediction, and SARSA
and Q learning for control (ALPAYDIN, 2020).

Note that there are other, less mainstream types of ML such as semi-supervised
learning, self-supervised learning, multiple instance learning (MIL),
inductive learning, deductive learning, transductive learning, multi-task
learning (MTL), and active learning. In addition, there are other ML tasks
including generative modelling and association rule learning.

####  2.1.2. Machine Learning Pipeline

Regardless of which type of ML model is used, it is important to carefully
plan the ML pipeline for any task. A generalized ML pipeline is described in
the following paragraphs, and summarized in Fig. 2.

The first step of the ML pipeline, Problem Definition, involves thoroughly
understanding the problem to be solved. This involves determining what the end
goal is in terms of desired model outputs, what inputs might be needed for a
model to yield such desired outputs, and what existing techniques have already
been applied to similar problems and their assumptions, benefits, and
limitations. In other words, Problem Definition involves gaining enough domain
knowledge to make informed decisions for the remaining steps in the ML
pipeline.

During Data Collection, information relevant to the problem is gathered. Data
can be collected historically and/or in an online fashion, and includes
organized and unorganized data structures such as text, images, videos, audio
clips, etc., In supervised ML, human subject matter experts are often employed
to label the data so ML systems have training examples. Ideally, data is
sufficient in amount and properly representative of the problem space.

In the Preprocessing stage, the collected data is cleaned and converted to a
machine-readable format in preparation for feature extraction. Common
preprocessing methods concern handling missing values (e.g., removing all
datapoints with missing values from the study, replacing missing values with a
zero), handling categorical data (e.g., creating dummy variables), and
standardizing the data (e.g., normalizing values from 0 to 1).

Figure 2. General machine learning pipeline.

After Preprocessing, the data is then transformed in the Feature Extraction
stage. The goal of feature extraction is to ensure only the most salient
information relevant to the problem will be used for training the ML model. In
other words, this step helps ensure that no unnecessary features are used
during training. At best, unnecessary features do not degrade ML model
performance, at the cost of increasing the amount of data needed (as is
characteristic of the curse of dimensionality). At worst, unnecessary features
can significantly degrade ML model performance (as is characteristic of
irrelevant and/or highly correlated inputs). Common feature extraction
techniques include feature selection (e.g.,, linear discriminant analysis or
LDA), dimensionality reduction (e.g.,, PCA), and computer vision techniques
for input images (e.g., color, shape, and texture feature extraction methods).

During Training and Validation, the extracted features are used to train the
ML model. The type of ML model(s) to use will depend on a variety of factors
such as the nature and amount of input data, format of the desired output, and
the given problem’s associated ML task. Note that in DL, feature extraction
and training can occur simultaneously. Ideally, the type of ML model(s) to use
were considered at the Problem Definition stage but sometimes it is
accomplished by trial-and-error.

After the ML model is trained and its performance is validated, the Testing
and Verification stage ensures the model is ready for deployment. Testing
involves evaluating the trained model on unseen data and validation typically
involves humans ensuring the model is performing up-to-standard. Validation
data is different from testing data in that validation data is used to
evaluate the model during the training process, while testing data is
completely unseen throughout the training process (i.e. testing data is a
separate holdout set). Separate training, validation, and testing data ensures
the model is not overtraining (i.e. memorizing rather than actually learning).

After the ML model achieves desired performance on testing data and has been
verified, the model is ready for Deployment in the field. Depending on the
nature of the problem, the ML model may require updates. If so, it may be
necessary to periodically monitor performance changes over time, collect
additional data, and refine or retrain the model.

####  2.1.3. Deployment and Tools

The popularity of Python for data science applications helped drive the
development of AI, ML, and DL frameworks coded in Python. Python packages such
as Scikit-Learn (Pedregosa et al., 2011), Tensorflow (Abadi et al., 2015), and
PyTorch (Paszke et al., 2019) make AI accessible and have hence garnered the
support of a large community of developers and researchers over the years.
These tools have become widely-used for experimentation, evaluation, and
deployment with the help of application program interfaces (APIs). Advances in
hardware and software such as parallel processing, GPUs, and cloud computing
help optimize computing resources to be more suitable for training large,
complex AI models. Moreover, data is becoming more available than ever for
training and testing ML models (e.g., kaggle, Trust-hub, etc.,).

###  2.2. Deep Learning

DL models have become a hot topic again in the last decade because of the
availability of huge amount of data and deserve a short description here. They
are made up of multiple processing layers that learn representations of
training data with multiple levels of abstraction, and are used for speech
recognition, object visualization and detection task, among others. DL has
helped address complex problems that have persisted in various industries for
many years (Lecun et al., 2015). The core of DL is the use of neural networks
(NNs), as seen in Fig. 1(b), which consist of an input layer, one or more
hidden layers, and an output layer. Most deep neural networks (DNNs) flow in
one direction only from input to output. However, backpropagation is used to
change internal parameters or weights that are used to compute the
representation between a current and previous layer. And it is very efficient
for computing gradients in deep networks (Education, [n.d.]). Some examples of
DL models include convolutional neural networks (CNNs), graph neural networks
(GNNs) and graph convolutional networks (GCNs).

###  2.3. Geometric Deep Learning

Perhaps most relevant to EDA applications is _Geometric Deep Learning_ (GDL,
which provides a blueprint for generalizing DL to non-Euclidean data (e.g.,
circuits) (Bronstein et al., 2017). The success of DL approaches is owed
largely to their ability to capture local statistics of the input data. For
example, CNNs have been widely useful in computer vision tasks due to the
shift invariant properties of the convolution operator. Traditional
formulations of DL models (CNNs, RNNs etc.,) rely on Euclidean structures in
the data (_grid_ structures), e.g., image, video and speech signals. Figure 4
shows examples of Euclidean (grid) and non-Euclidean (graph) data. The
_geometric prior_ on grid data is the ordering of the nodes, which is the
structure that RNNs and CNNs implicitly take advantage of. Graph data, on the
other hand, requires no explicit ordering on the nodes and operations on the
graph are permutation invariant. Graphs, on the other hand, have permutation
invariant structure in that the nodes are not assumed to be in any specific
ordering.

Figure 3. Overview of a GNN architecture. The GNN layers provide embedded
representations of graph input data for other downstream architectures such as
RNNs, CNNs, etc. Figure 4. Traditional DL and ML primarily work on Euclidean
data or grids, while GDL generalizes to non-Euclidean data, e.g., graphs.

GNNs and GCNs are examples of GDL models which can learn directly from graph
data (this category of approaches is also referred to as _Graph Representation
Learning_ (GRL) and is a subset of GDL) (Hamilton, 2020). These models are
able to leverage graph structure as well as node and/or edge features to learn
a useful representations of data. GCNs possess the same shift invariance power
of traditional CNNs (Xu et al., 2018).

Recent work by Mirhoseini et al. demonstrates the power of combining GRL
techniques with RL training algorithms to improve placement in chip layout
(Mirhoseini et al., 2021). The Edge-GNN in (Mirhoseini et al., 2021) was first
trained to create graph embeddings that predict reward labels (in this case a
reward derived from wire-length, congestion and density metrics). Then the
Edge-GNN is used as an “encoder” for training the CNN-based policy networks in
and RL training algorithm. Figure 3 shows the general structure of GNN layers
and demonstrates how the embedded graph vectors can be passed to various down-
stream tasks. The ability to capture relationship and interaction statistics
in the circuit data using graph embeddings enabled the to policy network to
reduce placement costs.

##  3\. Security-aware Design of Digital Integrated Circuits

###  3.1. Electronic Design Automation

The electronic design automation flow for digital ICs is as follows.

####  3.1.1. Design Specification

In design specification, the designer must accurately describe the overall
design requirements. The system may be proposed by a design team to initiate
the production of a chip. The IC designers decide on functionality and plan
out verification and testing procedures for the entire process.

####  3.1.2. High-Level Synthesis

High-Level Synthesis (HLS) tools translate a design written in high-level
languages such as C/C++/SystemC into a low-level hardware description language
(HDL). Hardware components can be modeled at high levels of abstraction,
allowing the designer to map both hardware and software components (Martin et
al., 2016)

####  3.1.3. Logic Synthesis

Logic synthesis is a direct translation from the behavioral domain (register
transfer level) to the structural domain (gate level) (Jiang and Devadas,
2009). The gate-level netlist is mapped to the standard cell library. The
optimization part of logic synthesis minimizes hardware by finding equivalent
representations of larger blocks. Design constraints used as input may also be
met for circuit area, power, and performance.

####  3.1.4. Design for Testability (DFT)

DFT encompasses the techniques used to generate cost-effective tests for the
gate-level netlist obtained from logic synthesis. These techniques are geared
towards increasing observability, controllability, and predictability of the
design (Martin et al., 2016). Ad-hoc methods like partitioning and test point
insertion are relatively easier to implement, while structured ones like scan
registers, scan chains, scan architectures and algorithms ensure good
testability at the expense of additional area and delay overhead. The
resulting tests utilize test programs which drive automatic test equipment
(ATE). The ATEs also use automatic test pattern generation (ATPG) to identify
input sequences which trigger errant circuit behavior arising from
manufacturing defects (Hsiao, 2006).

####  3.1.5. Floorplanning

Flooplanning focuses on the sizes and arrangement of the physical blocks
created during logic synthesis. It affects the optimization results of the
increasing physical stages. It is the first major step in physical design.
Pins and ports are also assigned a rough location, which can further be
refined depending on the placement and routing results (Lienig and Scheible,
2020).

####  3.1.6. Placement-and-Routing

After a successfully-proposed floorplan, the place-and-route (P&R) addresses
the structural design of a circuit. The designer places and connects all of
the blocks that make up the chip such that they meet design criteria and
constraints. After the initial P&R attempts, the design’s timing constraints
are analyzed. If unsatisfactory, the P&R software in use tries different
placements and signal routing to try to meet the designated constraints
(Lienig and Scheible, 2020).

Figure 5. General digital IC design pipeline with applicable security topics
for each stage. D stands for decision making, P represents performance
prediction, while B and A stand for black box optimization or design space
exploration and AI-assisted EDA, respectively.

ML is already applied to some extent in the digital IC design process, albeit
with primary focus on general design prediction and optimization. Some needs
tackled at this stage include logic and design optimization (Haaswijk et al.,
2018), low-power approximation (Pasandi et al., 2020) and area estimation
(Froemmer et al., 2020). Careful assessment of available publications
incorporating learning into digital IC design will reveal an absolute truth;
very little work has been done to directly address hardware security
vulnerabilities. The use of intelligent models presents the opportunity to not
only optimize designs, but to secure them against the array of tools and
attacks that malicious parties have at their disposal. This is especially
important for some security properties that cannot be modelled analytically
and situations where multiple security constraints are at odds. According to
(Huang et al., 2021a), ML approaches in EDA can be broken down into four main
directions: decision making, performance prediction, black box optimization or
design space exploration and AI-assisted EDA. In the rest of this section, we
follow this same organization to discuss security-aware CAD research and
opportunities. Fig. 5 also highlights the general EDA steps and the applicable
directions for each one.

###  3.2. Decision Making

The decision-making perspective encapsulates the replacement of traditional,
brute-force design-for-security methods with more automated and efficient
techniques. In most cases, brute-force techniques involve countless trial-and-
error steps until the best-performing configuration is found and used on a
design. From a heuristic perspective, the knowledge gained may prove to be
invaluable. However, they are only feasible on simpler designs; increased
complexity transforms them into cumbersome requirements that most designers
would gladly bypass. Further, the tradeoffs between security and traditional
metrics as well as between different security metrics might be unknown or too
complex for manual tuning. Automation becomes valuable only when it is
characterized by efficiency. ML can definitively make decisions on the most
suitable settings and parameters for countermeasures with varying levels of
human input (see Fig. 6).

Figure 6. General overview of decision making process for security-aware EDA
using AI/ML/DL.

####  3.2.1. High Level Synthesis and/or Register Transfer Level

##### Encoding Optimization

Another aspect that stands to benefit from the addition of ML-powered
decision-making is finite state machine (FSM) encoding optimization. The
encoding schemes are selected based on design constraints, including power and
area. The two most common options are:

  * •

Binary Encoding \- In binary encoding scheme, states are encoded as a binary
sequence where the states are numbered starting from 0 and up. The number of
state flip-flops (FFS), $q$, required for binary encoding scheme is given by
$q=log2(n)$; where, $n$ is the number of states. The binary encoding scheme is
better suited for FSM with a fewer number of states (Lin, 2012).

  * •

One-hot Encoding \- This encoding scheme is designed with only one bit of the
state variable as “1” while all other state bits are “0”. It requires as many
state FFs as the number of states. This creates the need for more state FFs
than binary encoding (Cassel and Lima, 2006).

One-hot encoding scheme is less vulnerable to fault injection attacks while
binary is more resistant to hardware Trojans that exploit don’t care states.
This is demonstrated by Nahiyan et al. using the FSM of the SHA-256 digest
engine (Nahiyan et al., 2019). With this knowledge, a secure encoding scheme
was proposed in (Nahiyan et al., 2019) that combines binary and one-hot
schemes to achieve the best of both worlds. In future work, AI/ML may be used
to determine the best mix given a specific FSM.

##### Hardware Security Primitive Deployment at Higher Levels of Abstraction

The Automatic Implementation of Secure Silicon (AISS) program was developed by
the Defense Advanced Research Projects Agency (DARPA) to automate the process
of incorporating scalable defense mechanisms into chip designs, by allowing
designers to explore chip economics versus security trade-offs based on the
expected application and intent while maximizing designer productivity (Leef,
[n.d.]). Deployment of security methods pre-silicon are always cost-effective
and less time-consuming. With this in mind, AI/ML can be used to make
decisions as early as during HLS, or at RTL. Based on the discernible features
at these levels of abstraction, a classification-based model can use vector
embeddings to suggest suitable hardware security primitives and their
associated parameters (e.g., size). For example silicon odometers are inserted
into IC designs to measure aging and detect recycled counterfeit chips (Guin
et al., 2015). Their accuracy and yield are determined by various parameters
(Shakya et al., 2015), which can be optimized through ML/AI.

Figure 7. Arbiter PUF circuit. The circuit creates two delay paths with the
same layout length for each input X, and produces an output Y based on which
path is faster. Reprinted from (Herder et al., 2014)

Physically unclonable functions (PUFs) (Gassend et al., 2002) provide digital
fingerprints using the internal process variations (entropy) of a physical
device. An example is arbiter PUF circuit shown in Fig. 7. the The translation
of these unique and unclonable manufacturing variations into challenge-
response pairs provides unique chip identifiers or authentication mechanisms.
One of the main issues with PUFs is their reliability, i.e., ability to
provide the same output in the presence of environmental variations and aging.
To combat this, they often rely on error correcting codes (Hiller et al.,
2020), which can be designed to handle a specific number of bit flips. Another
primitive is the true random number generator (TRNG), which uses an entropy
source to generate non-deterministic data with a given throughput to seed
security algorithms like cipher keys (Gabriel et al., 2010) or masking
(Trichina, 2003). For any design that contains all three of these primitives,
their characteristics can be tuned together for a specific application or to
fit within a dedicated silicon area.

####  3.2.2. Logic Synthesis

##### Tuning EDA Parameters and Commands during Logic Synthesis

Although a constraint set may be part of the design specification, the gate
level netlist provides a better understanding of functionality to a designer.
Area constraints guide the P&R tool to locate a specified design block
partition, while timing constraints specify path delays (els, 2009). To tune
high-level directives, it is important to accurately predict their impact.
This is a tall order for most designs due to complex optimizations throughout
the design process. These complex optimizations create disparity between
desired results at the HLS stage and implemented values post-synthesis.
Conventional tools assist with optimization tasks, but machine learning is
already being used to mitigate the latter problem. For example, Yu et al. (Yu
et al., 2018) have developed Intellectual Property (IP)-specific synthesis
flows (i.e., sequence of synthesis transformations for TCL scripts) using CNNs
that improve Quality of Result (QoR). In (Neto et al., 2019), DL is used to
automatically decide which logic optimizer (And-Inverter Graph (AIG) and
Majority-Inverter Graph (MIG)) should handle different portions of the circuit
for better performance and lower area. Makrani et al. (Makrani et al., 2019)
proposed a Pyramid framework to estimate best performance and resource usage.
The input features are derived from the HLS report, and a stacked regression
model provides accurate timing, delay and resource values before reaching
post-implementation.

Optimization goals during tuning can be geared towards obtaining a more
secure, synthesised design with minimum overhead. Although this would only be
evident with the combination of other design parts, early-stage deployment
saves time and labor. For example, secure split-test (SST) is a method of
securing the manufacturing process by mandating test results to be verified by
the IP owner and by using a “key” to unlock the IPs correct functionality
after tests are passed. For the functional locking block, XOR logic is added
in series to non-critical paths. If the two inputs are different, the XOR
logic will act as an inverter (Contreras et al., 2013) causing any locked
(still untested or failed chip) to act deliberately incorrect. The optimal
number of XOR gates to insert into the circuit, insertion algorithm
(Chakraborty and Bhunia, 2009; Rajendran et al., 2015b; Lee and Touba, 2015),
or partitioning algorithm (Alaql and Bhunia, 2021) to employ for a given IP’s
function and/or structure can be determined using ML techniques.

Table 1. Security requirements under decision making with applicable AI/ML
algorithms. The cited options indicate optimization or security
implementations available for reference

Design Stage | Security Task | Applicable AI/ML Algorithms
---|---|---
| Encoding Optimization | Polynomial Regression
High Level Synthesis |  | Hardware Security Primitive Deployment
---
at Higher Levels of Abstraction
| Polynomial Regression,
---
SVM
|  | Tuning EDA Parameters and Commands
---
during Logic Synthesis
CNN (Yu et al., 2018), Stacked Regression (Makrani et al., 2019)
Logic Synthesis | Standard Cell Selection | SVM
Cross-Abstraction |  | Benchmark Selection for Security-
---
Aware EDA Tool Evaluation
GNN, GCN

##### Standard Cell Selection

A specific category of available standard cells may be used in an IC design to
address specific security vulnerabilities. As far back as 2004, sleep
transistor cells were proposed as a method for sub-threshold leakage current
reduction (Babighian et al., 2004). The sleep transistor cells are picked from
a library designed to target high layout efficiency. The results were shown to
have achieved a minimum reduction percentage of 74%. A trained support vector
machine (SVM) can be used to decide from a set of available libraries with
specific target optimizations.

####  3.2.3. Cross-Abstraction

##### Benchmark Selection for Security-Aware EDA Tool Evaluation

One additional optimization activity that may easily be overlooked is the
evaluation of EDA tools used during the IC design process. Companies and
research groups that develop EDA tools constantly update features to enhance
their output. In order to properly target specific problem areas, the testing
process must involve specific benchmarks. For example, if a designer intends
to assess the scalability of the tool, the most important requirement for the
test benchmark would be its size. If more nuanced conditions must be met, an
automated method would make this process faster and more efficient. Succinct
features of a benchmark and a tool’s problem area in a DNN can determine the
most suitable sample for testing.

In the area of hardware security, benchmarking has played a critical role in
development and comparison of hardware Trojan detection schemes (Shakya et
al., 2017) and recently in de-obfuscation (Amir et al., 2018; Tan et al.,
2020; Amir and Forte, 2020). Thus far, however, none of these benchmarking
activities have explicitly incorporated AL/ML. Table 1 provides suggested
AI/ML algorithms for future endeavors.

###  3.3. Performance Prediction

Performance prediction describes forecasting and modeling trade-offs
associated with adding countermeasures, especially at earlier design stages.
Although an ideal scenario would involve achieving optimum design goals while
guaranteeing near-perfect security awareness, a designer must be aware of the
inevitable compromises that a secure design may entail. A more achievable
target is finding the balance between optimization and security, as seen in
Fig. 8. This is where AI/ML comes into the picture. The automation of the
balance-seeking process will not only speed up the IC design pipeline, but
will ensure that the most suitable operating parameters and modifications are
available to the designer. From a business standpoint, time-to-market of ICs
in production may also decrease.

Figure 8. General overview of performance prediction process for security-
aware EDA using AI/ML/DL.

####  3.3.1. Physical Design

##### Security-aware Layouts and Tradeoff Modeling

Invasive physical attacks are expensive to execute but difficult to protect
against. Attackers resort to focused ion beam (FIB) to extract an asset’s
value by milling to its location in the IC layout, creating a metal contact to
it, and probing the contact while the chip is in operation. There are two main
sets of countermeasures proposed to combat probing attacks; the preventive
strategy utilises active or analog shields, such as meshes, while the
detection strategy checks for attacks by sensing any probing or editing and
alerting the operators (Wang et al., 2017b). To improve the effectiveness of
active shields, an automated anti-FIB probing flow called iPROBE was proposed
(Wang et al., 2019; Gao et al., [n.d.]), see Fig. 9. iPROBE uses ad hoc rules
to determine the areas and metal layers where computer-aided design (CAD)
tools should place shields to reduce “exposed area”. For a physical IC, the
exposed area (EA) metric (as described in (Shi et al., 2016)) is used to
measure the design’s vulnerability to probing attacks. A larger EA means more
flexibility with the expense that an attacker can probe without triggering
contingencies. While iPROBE did improve EA while reducing overhead as compared
to traditional shields, the security and overheads cannot yet be explicitly
controlled by the designer. In other words, trial-and-error needs to be
performed to make sure that constraints are met. To further boost efficacy of
the anti-probing method described above, it may be possible to model the
relationship between EA and power, timing and area with a multiple linear
regression model or even DL. Then, iPROBE parameters could be chosen with
security, area, power, etc., in mind.

Figure 9. iPROBE version 2 with protection for frontside and backside probing
attacks (Gao et al., [n.d.]). The light blue metal lines and darker blue metal
lines form active shields that protect against frontside attacks (through top
passivation and metal) and backside (silicon substrate), respectively. The
metal lines sandwiched between the shields carry critical information that the
attacker wants to probe. A FIB cut though an entire shield line of
frontside/backside will be detected because the signal present on it will not
match its counterpart in backside/frontside.

####  3.3.2. Cross-Abstraction

##### Modeling Area, Power, Timing, and Security Impacts of IP Protection

In general, design optimization problems have always been modeled based on
area, power and timing; timing is used here because it directly relates to
performance. Even at the HLS stage, ML implementations, like Pyramid (Makrani
et al., 2019) have been used to predict optimal timing. There has also been
work to predict area at both HLS (Zennaro et al., 2018) and logic synthesis
(Froemmer et al., 2020). Deep-PowerX is a DNN-based dynamic power consumption
minimization tool which exploits the power-area and delay-area relationships
within a netlist (Pasandi et al., 2020). Even at the placement and routing
stage, timing prediction is possible using ML (Bar, 2019).

One of the most significant threats to design integrity is IP piracy. The
availability of a design to malicious parties gives way to overuse,
modification, cloning, overproduction and/or reverse engineering. There are
various defense-centered modifications available to an engineer at various
stages of the IC design cycle, and ideas from ML-based optimization can be
applied to them.

###### IP Watermarking

A watermark is a specific modification of an IP core that allows it to be
uniquely identifiable, which is useful for piracy detection. However, IP core
watermarking in general must never alter the functionality of the design
(Chang et al., 2016). One popular method of watermarking is the the don’t-care
condition based technique. It involves adding function blocks with unspecified
input combinations to the original design. Their outputs can be forced and
used to verify the authenticity of a circuit (Dunbar and Qu, 2015). However,
additional logic may mean area, timing and power overhead. To hasten the
design cycle, these overhead metrics must be readily available to a designer.
If a trained algorithm can accurately model and predict these values, the
design house would be able to ascertain the viability of a specific
watermarking scheme, like the don’t-care condition based method.

###### Hardware Obfuscation

Hardware obfuscation is used to actively protect IP and has been applied at
all major design stages preceding fabrication and assembly. It is intended to
obscure an original design to prevent IP piracy and reverse engineering.
Hardware obfuscation also addresses IP overuse and hardware Trojan insertion.

The set of approaches that can be implemented until the DFT stage are
typically keyed approaches. These techniques attempt to prevent black box use
by key gates/inputs. One common example is logic locking, which hides the
functionality and the implementation of a design by inserting additional gates
(“key gates”) into the original netlist. The circuit will only function
correctly if the acceptable inputs or keys are provided to the key gates
(Yasin et al., 2020). The additional gates must provide low overhead and be
usable for larger designs. A significant challenge, however, has been making
logic locking scheme secure against the entire suite of oracle-based attacks
(e.g., SAT (Subramanyan et al., 2015), AppSAT (Shamsi et al., 2017), key
sensitization (Rajendran et al., 2012), etc.,.) and oracle-less attacks (e.g.,
desynthesis (Massad et al., 2017), signal probability skew (Yasin et al.,
2017), etc.,.). The former use an unlocked chip as an oracle to non-invasively
derive its key while the latter operate solely on the netlist. Preventing
oracle attacks implies that the time to recover the key should be
prohibitively high for an attacker. Recently, ML has been used to predict the
obfuscation strength in terms of the predicted time taken to de-obfuscate an
obfuscated circuit using the SAT attack. Chen et al. (Chen et al., 2020a)
demonstrate this using a GCN. They combine graph structure with gate feature
by using an enhanced graph convolutional operator named ICNet. The features
employed are divided into the graph structure, which describes connections,
and gate features, including gate mask and gate type. While this approach has
only been applied to predict SAT attack time, it can nonetheless be used to
predict resistance to other oracle attacks. Recently, oracle-less attacks such
as SAIL (Chakraborty et al., 2018) have employed ML to recover the original
(unobfuscated) netlist by reverse engineering logic synthesis rules.

Another key-based countermeasure that can be considered is FSM locking
(Chakraborty and Bhunia, 2009). FSM locking adds extra states into the FSM of
an IC design. The correct “key” is the right sequence of state transitions,
which guarantees non-erroneous functionality. The additional states are
materialised by FFs with their corresponding combinational logic. Active
hardware metering (Alkabani and Koushanfar, 2007), a version of FSM locking,
creates boosted finite state machines (BFSMs) from the new states. At this
stage, it would be imperative to be able to predict the overhead created by
the added states. This is because the design house sends the verified netlist
to the untrusted foundry to create PUFs (challenge-response pairs) from the
fabrication process variation. This may introduce additional overhead that
could affect overall functionality. Depending on the complexity of the
circuit, either a regression model or a DNN may suffice.

The keyless variety of obfuscation does not require keys, and cannot affect
functionality. The desire is to conceal design intent. Without some form of
obfuscation, a malicious party can either copy an IP or seek and exploit
design vulnerabilities using reverse engineering. The most noteworthy example
of keyless obfuscation is IC camouflaging (Chow et al., 2012), which replaces
original gates with “camo gates” which are difficult to discern by pattern
recognition. It is worth noting, however, that most camouflaging techniques
can be “mapped” into logic locked circuits (Yasin and Sinanoglu, 2015) where
the above oracle attacks are quite effective (El Massad et al., 2015). Hence,
the prediction schemes mentioned above for logic locking may also apply to
camouflaging. Further, the replacement of gates with camo gates to facilitate
camouflaging will almost always alter power consumption and area. With the
right set of features extracted from a report (HLS report), a trained
regression model could predict the parameter values with near-perfect
accuracy. There is evidence of this in other EDA applications. For example,
Zennaro et al. combine an RTL generation framework with ML algorithms to
estimate the area of the final design based on the features of an abstract
specification. They retrieve the number of configurable logic blocks (CLBs)
information from synthesised RTL design reports created from an automation
framework. They mainly use a multilayer perceptron (MLP), but also experiment
with random forests (RF) and gradient boosting (GB) (Zennaro et al., 2018).

Another popular keyless approach is split manufacturing (Imeson et al., 2013)
where a design is split, each part is fabricated at one or more untrusted
entities, and a trusted entity puts them together. Split manufacturing can
have significant overheads and security concerns (e.g., proximity attacks
(Magaña et al., 2017)) if P&R is performed poorly. Ad hoc and linear
programming approaches to perturb P&R (Wang et al., 2018a) and/or split
designs (Shi et al., 2018) have met with some success, but can likely be
improved further through the incorporation of AI-based modeling and
prediction.

##### Side Channel Attack Resistance

Side channel leakage allows an attacker to break cryptographic systems.
Signals that a cipher’s implementation inadvertently emits allow for
systematic extraction of underlying information. Examples include
instantaneous power consumption, timing/delay, and electromagnetic emissions.
Whether the attacker targets the understanding of device operation (simple) or
uses leakage information to correlate data values (differential), there are
generic countermeasures to reduce the effect of side channel leakage
(Markowitch et al., 2011). A high signal-to-noise ratio (SNR) implies the
availability of more meaningful leakage information. Hiding countermeasures
reduce the SNR by either dampening the signal with low power designing and
shielding, or flooding the leak-prone areas with noise using noise generators
(Levi et al., 2020). To measure the value of hiding on a design, a predictive,
regression-based model could provide an accurate percentage reduction in side-
channel leakage. An obvious feature would be the tuning of the technique used.

Another available countermeasure is masking which seeks to remove the
correlation between input data and side-channel leakage (Prouff and Rivain,
2013). Unlike hiding, masking is applied at the algorithmic level with logic
gates. Nonetheless, higher order side-channel analysis allows an attacker to
bypass the routine masking schemes. A higher order masking may be employed but
it may require significant overhead (Prouff et al., 2009). In order to
evaluate the effectiveness of masking, various types of AI and ML algorithms
have been employed to accomplish (a) the assessment of side-channel resiliency
against a specific attack (Picek et al., 2021), and (b) the full leakage
assessment methodology (Moos et al., 2021). However, both of these evaluation
techniques need the actual ASIC or a correctly-programmed FPGA, as well as
special equipment to be performed cf. (Arribas et al., 2018). To overcome
these obstacles, another line of research has been pursued, which is devoted
to (1) theoretical conditions for a design to be SCA-resistant (Barthe et al.,
2015; Coron, 2018; Bloem et al., 2018) or (2) model the implementation for
simulating its behavior (Bertoni et al., 2017; Reparaz, 2016) in the pre-
silicon steps. In the first category, AMASIVE framework (Zohner et al., 2012;
Huss et al., 2013) can be mentioned that identifies hypothesis functions for
leakage models cf. (Buhan et al., 2021). An example from the second class is
VerMI, which is a verification tool in the form of a logic simulator that
checks the properties of a class of masking methods (threshold implementation)
(Arribas et al., 2018) at both algorithmic and implementation levels.
Nevertheless, at this level of abstraction, i.e., pre-silicon, AI techniques
have not found direct applications yet. Perhaps, the most straightforward way
of incorporating such a technique can be imagined to examine whether the
conditions for SCA-resiliency are fulfilled (the first category).

Yet another step further, Ma et al. presented a security-driven placement and
routing tool to protect designs against EM side-channel attacks (Ma et al.,
2021) that attempts to break the balance of signal delays by register
reallocation under the condition of layout constraints. The CAD-based tool,
named CAD4EM-P, uses register reallocation and wire length adjustments to
reduce the data dependency of EM leakage with acceptable area and power
overheads (Ma et al., 2021). Opportunities to improve the effectiveness and
efficiency of this approach can rely on more advanced forms of ML-for-
prediction. For example, a graph neural network (GNN) can replace the graph-
based algorithms that are the basis of the original version.

##### Fault Injection Tolerance

In contrast to most SCA attacks, fault injection attacks involve an active
adversary. In other words, the adversary tries to observe a faulty behavior of
the target device by forcing it to function outside of its specified operating
range or feeding it undefined data. For example, an attacker can cause
erroneous operation of the target platform by tampering with the supply
voltage (a.k.a., voltage glitching), modifying the clock signal’s frequency
(a.k.a glitching), or flipping bits in the memory using a laser beam (Bar-El
et al., 2006). While most fault attacks require physical access to the victim
device, recent studies have shown that in certain cases similar fault attacks
can also be carried out remotely on a variety of systems (Alam et al., 2019).
Cryptographic devices and secure hardware have been the main targets of fault
injection attacks. For example, an adversary could inject faults into an FSM
implemented on a hardware platform to bypass authentication states and obtain
unauthorized access to security-sensitive states. On the other hand, an
adversary may be able to extract the secret key by injecting faults into a
cryptographic implementation and applying mathematical tools, like
Differential Fault Analysis (DFA), on faulty generated ciphertexts.

Several protection/detection-based countermeasures have been proposed to
mitigate the vulnerabilities of circuits against fault attacks. While device-
level countermeasures can be effective against fault injection attacks, the
cost and extra manufacturing steps make the algorithmic and circuit-based
countermeasures more attractive. EDA tools can be deployed to improve the
circuits’ resiliency for such countermeasures. However, conventional
countermeasures are generic and create high overhead in terms of area and
power. Several protection/detection-based countermeasures have been proposed
to mitigate the vulnerabilities of circuits against laser fault injection
(LFI) attacks. While physical countermeasures, such as tamper-proof packaging
and light sensors, can be effective, the cost and extra manufacturing steps
make the algorithmic and circuit-based countermeasures more attractive. For
such countermeasures, EDA tools can be deployed to improve the circuits’
resiliency. However, conventional countermeasures are generic and not tailored
to specific fault injection techniques. For instance, by using triple-modular
redundancy (Lyons and Vanderkulk, 1962), error-detection/correction codes
(Karpovsky and Taubin, 2004; Sunar et al., 2007; Tomashevich et al., 2014;
Neumeier and Keren, 2012), and MAC tags/infective computation (Reparaz et al.,
2018; De Meyer et al., 2018), the circuit becomes more resilient in general.
In these cases, however, depending on the capabilities of the adversary and
how these countermeasures are synthesized, placed, and routed, they can still
be bypassed by powerful fault attacks. AI/ML can support creating circuit
netlists and layouts during the design phase that are more resistant to fault
injection attacks by taking the physical models of fault attacks into account.
For instance, by considering fault propagation together as a new feature, the
impact of fault resilient placement and routing on security and overhead can
be predicted. As shown in Table 2, GNNs and SVMs are viable algorithms for
use.

Table 2. Security requirements under performance prediction with applicable
AI/ML algorithms. The cited options indicate optimization or security
implementations available for reference

Design Stage | Security Task | Applicable AI/ML Algorithms
---|---|---
Physical Design |  | Security-aware Layouts and
---
Tradeoff Modeling
Multiple Linear Regression
|  | Modeling Area, Power, Timing, and
---
Security Impacts of IP Protection
DNN (Pasandi et al., 2020), GCN (Chen et al., 2020a), MLP (Zennaro et al.,
2018)
| Side Channel Attack Resistance | Polynomial Regression, GNN
| Fault Injection Tolerance | GNN, SVM
| Hardware Trojan Detection Rates | SVM, Polynomial Regression
Cross-Abstraction |  | Vulnerabilities Across Design
---
Abstractions and/or PDKs
GNN, RL (Lu et al., 2021a)

##### Hardware Trojan Detection Rates

Malicious modifications, i.e., hardware Trojans, are possible during the IC
design and fabrication process. Hardware Trojan detection has been extensively
researched within the hardware security research domain (Tehranipoor and
Koushanfar, 2010). Salmani et al. proposed a method of increasing the
probability of Trojan activation using dummy scan FFs (Salmani et al., 2012).
They place a dummy scan FF with a net having low transition probability. To
test the concept, Trojan samples have to be deployed on benchmarks. The rate
of Trojan detection could be derived from the available data that these
simulations produce. Likely features that would be valuable for a prediction-
based ML model include nets with dummy scan FFs, their fanouts and their
corresponding transition probabilities.

Assertions are typically used for formal verification of specification
patterns. The behavior of circuits determines the correctness of the design.
Alsaiari et al. propose reconfigurable assertion checkers which are able to
detect hardware Trojan updates on system-on-chips (SoCs) (Alsaiari and Gebali,
2019). The design flow can be seen in Fig. 10. Even with traditional assertion
checkers where selection only occurs pre-synthesis, it is possible to
ascertain the rate of Trojan detection using the assertion checkers, the
Trojan type, as well as the point(s) of insertion.

Figure 10. Digital IC design flow with inserted assertion checkers. Reprinted
from (Alsaiari and Gebali, 2019).

Built-in self-authentication (BISA) relies on the incorporation of functional
filler cells into white spaces at the layout level to form built-in self-test
(BIST) circuitry (Xiao and Tehranipoor, 2013). The latter is designed to
verify that no BISA cell is tampered with by an untrusted foundry. The
possible failure of the BIST circuitry allows inserted Trojans to be detected.
To reduce the risk of compromising BISA design during manufacturing, split-
manufacturing can also be applied. On its own, split manufacturing cannot be
used to detect Trojans, but the technique known as “obfuscated BISA” (OBISA)
(Shi et al., 2018) combines both BISA and split-manufacturing. OBISA’s ability
to detect hardware Trojans can be predicted by training a machine learning
model.

##### Vulnerabilities Across Design Abstractions and/or PDKs

There is evidence that designs become more prone to certain security
vulnerabilities as they move across different levels of abstraction. One
example provided in (Jiang et al., 2018) presented a timing side-channel
vulnerability introduced during HLS to produce an optimized RTL
representation. Another pointed out fault-injection vulnerabilities after
logic synthesis due to FSM encoding styles and newly generated don’t-care
states (Nahiyan et al., 2019). It is important to have foreknowledge of these
potential risks as they develop during the EDA process. This is possible with
predictive algorithms. In one instance, the data flow graph representation of
the RTL could be combined with features from the HLS report to produce a GNN
capable of identifying less-secure design areas. This may also apply to
porting designs across different process design kits (PDKs). The available
gate sizes are discrete values which are usually specific to the underlying
technology. Process variations may introduce parametric alterations which
could make a device more susceptible to malicious parties. For this scenario,
PDK electrical and design rules are possible input features for the same GNN
described above. As the solution space scales exponentially with respect to
the size of the netlist, gate sizing algorithms integrated into EDA tools rely
on either heuristics or analytical methods, which leads to sub-optimal sizing
solutions. To combat this shortcoming, (Lu et al., 2021a) has demonstrated the
feasibility of applying RL algorithms equipped with GNNs that encode design
and technology features.

###  3.4. Black Box Optimization or Design Space Exploration

For design space exploration, AI/ML seeks the solution that best meets
requirements from available choices with little to no human intervention. The
expanse of the search space creates the need for automation to execute
selection, generation and evaluation of the solutions. However, the exhaustive
option may not always be the optimal one, regardless of the availability of
automation techniques. Design space exploration employs the application of
different methods: stochastic optimization methods, like random search,
evolutionary algorithms and black box optimization (Cardoso et al., 2017).
Black box optimization uses a set of configurable parameters as inputs instead
of results from the design stages, as seen in Fig. 11. The circuit may either
be too complex to model, or the engineer lacks details of the design to work
with. At the training stage, most ML/AI algorithms are being optimized to find
the best fit for input parameters, constraints, and design features. Hence,
finding the most suitable design based on specifications may be the most
intuitive application to the digital IC design.

Figure 11. General overview of black box optimization and design space
exploration process.

####  3.4.1. High Level Synthesis and/or Register Transfer Level

##### Crafting Side Channel-resilient Circuits

Referring to Section 3.3.2, masking has been introduced to stop an attacker
from mounting side channel analysis. AI has become an integral part of this,
for instance, RL has been applied to combine a set of countermeasures, which
leads to the enhancement of target resilience to, at least, some types of
attacks (Rijsdijk et al., 2021a). Seen from another perspective, machine
learning algorithms, and in particular, NNs, can defeat some countermeasures,
including masking (Kim et al., 2019; Wu et al., 2020; Picek et al., 2019). As
an example of such attacks, RL has been employed to determine proper side-
channel leakage models and training of neural networks to extract leakage
profiles (Rijsdijk et al., 2021b). Hence, robustness against such attacks has
become one of the objectives of the tests conducted to evaluate the
effectiveness of countermeasure, specifically, masking.

Given the nature of such tests, the security-aware designer may have to deal
with the higher levels of abstraction corresponding to a black box leakage
model because there is no information, including physical placement or routing
signals (Buhan et al., 2021). Therefore, masking schemes may be implemented,
but there is no guaranteed measure of effectiveness before the RTL stage. To
enhance this process, full access to the design’s layout available to the
implementing party could be useful and even be bolstered with an understanding
of the device’s functionality via RTL or gate-level implementation. This is in
line with the studies focused on modeling the implementation and simulating
its behavior as discussed before (Bertoni et al., 2017; Reparaz, 2016). In
this context, AI has not yet reached its full potential as security-critical
implementations are still designed manually. The manual design and
implementation pose a series of drawbacks stemming from (1) the lack of
integration between the various designs, (2) erroneous designs due to human
errors, and (3) high consumption of resources, including time (both execution
and design times), silicon area and/or power/energy consumption.

####  3.4.2. Physical Design

##### Porting of Cryptographic and Hardware Security Primitives to Different
Technology Nodes

Security-aware updates to designs are hardly ever direct “out-of-box”
additions to devices. For integration of an IP or hardware security primitive,
it is imperative that the design still fulfils its intended purpose. Selecting
the most appropriate parameters for a hardware security primitive is one
aspect, but another is porting it to a different technology node (Keating and
Bricaud, 2007). Although technology nodes no longer categorically correspond
to transistor gate length and half pitch, they nonetheless vary considerably
with respect to manufacturing processes, design rules, noise sensitivity,
etc., (Bagnato et al., 2014). These variations are noteworthy because they may
disrupt the transferability of primitives. For example, an optimized PUF
applied to an IC manufactured using the 28 nm process is not guaranteed to
transfer to the 22 nm process due to factors like geometric variation and
transistor type (Keating and Bricaud, 2007). The knowledge of process-specific
parameters allows for assessment of the hardware primitive porting activity
using ML. It is possible to use a classifier model as simple as an SVM to
select the most suitable match between circuit and primitive without explicit
knowledge of the design’s functionality.

##### Anti-Counterfeit and Anti-Tamper Sensor Optimization

The scourge of IC counterfeiting continues to plague the semiconductor
industry by flooding the consumer market with unauthorized, defective and
inferior versions of original chips and designs. From as far back as 2006,
electronic companies have missed out on $100 billion of revenue due to
counterfeiting (Pecht and Tiku, 2006). The recent global chip shortage has
created the avenue for these illegal devices due to demand exceeding current
supply chain capabilities (Leprince-Ringuet, 2021). Recycled and remarked
counterfeit ICs account for more than 80% of the counterfeits sold worldwide
(Guin et al., 2014). Hence, their detection has become a necessity to tackle
IC counterfeiting. Recycled counterfeits are used chips fraudulently sold as
new while remarked counterfeits are inferior chips sold as higher grades.

Different sensors have been designed as a solution to these counterfeits, as
seen in the work by Zhang et al. (Zhang and Tehranipoor, 2014) and shown in
Fig. 12. Their first of two proposed techniques uses frequency difference
retrieved from paired ring oscillators (ROs) between an original and recycled
chip to distinguish the two. RO frequency tends to degrade more with aging
because the transistors in the RO gets slower with time (Docking and Sachdev,
2003). Guin et al. also add anti-fuses and fuses for combating die and IC
recycling (CDIR). Their RO-CDIR implementation is negative temperature
instability-aware, which is valuable for flagging ICs with shorter usage (Guin
et al., 2014). To date, the design of these sensors such as number of
inverting stages, choice of threshold voltage, and overall structure are
chosen in an ad hoc manner or through empirical means. Further, foundries do
not always provide aging models to users. Both of these limits the age
estimation of such sensors and their classification accuracy. AI approaches,
such as Bayesian optimization, would be preferable, especially for its ability
to optimize black-box functions. Automating the optimization process will
ultimately make it less-exhaustive.

Figure 12. Structure of RO-based sensor reprinted from (Zhang and Tehranipoor,
2014)

Another source of hardware security issues is tampering. Once the device is
physically compromised, it may leak on-chip information to the attacker.
Hence, insertion of hardware Trojans may also be considered as tampering
(Tehranipoor and Koushanfar, 2010). One common example of tampering is FIB-
based circuit edit, which allows an attacker to remove or bypass a security
countermeasure (Livengood et al., 2011). Similar to recycling, sensors have
been proposed to combat or detect tampering. A technique proposed by Liu and
Kim uses logic-compatible embedded Flash (eFlash)-based tamper sensor built on
an exposed floating gate (FG) structure to detect physical attacks (Liu and
Kim, 2019). Any change in charge stored on the exposed FG can be detected by
this sensor. This includes humidity, high temperature, dust particles,
chemicals, and electrostatic charges. A regression-based model or a neural
network could fine-tune the configuration of such tamper sensors.

##### Hiding Countermeasure Optimization

If an attacker is aware that a sensor has been deployed to detect a certain
attack modality, the attacker may start by circumventing the sensor. For
example, the attacker may apply the minimum possible mechanical force on the
metal wires, or use a low intensity light source for a longer duration of
time. Assuming maximum throughput possible, it is crucial to supplement
successful optimization with robust defense. Hiding can dampen the signal
accessible to the attacker. With limited knowledge of the sensor-IC design and
operation, the designer could possibly rely on ensemble methods to find the
most suitable hiding framework. The same sensors used to protect against
tampering and detect counterfeits may also be vulnerable to side channel
attacks. Since they are sensitive to changing parameters like voltage and
frequency, they are prime targets for malicious parties. Sugarawa et al. show
that an attacker can reveal the internal state of a chip by observing how a
sensor reacts to laser fault injection. The leakage leads to a feasible, non-
invasive, probing attack. The sensor-type, the bit-flip detector, detects a
short-circuit current induced by a laser fault injection (Sugawara et al.,
2019). Thus, it is advisable to supersede sensor optimization with robust
hiding schemes; the ideal framework could combine both activities to boost
resistance to side channel attacks. For example, if a noise generator is used
as the default hiding mechanism, a simple regression model could predict the
amount of noise required to achieve a lower signal-to-noise ratio (SNR). A
more versatile system could have options like shielding in addition to noise
generators, with decisions and settings also based on countermeasure
optimization.

Table 3. Security requirements under black box optimization or design space
exploration with applicable AI/ML algorithms. The cited options indicate
optimization or security implementations available for reference

Design Stage | Security Task | Applicable AI/ML Algorithms
---|---|---
| High Level Synthesis and
---
Register Transfer Level
Crafting Side Channel-resilient Circuits | RL (Rijsdijk et al., 2021b), ANN
|  | Porting of Cryptographic and
---
Hardware Security Primitives to
Different Technology Nodes
SVM
|  | Anti-Counterfeit and Anti-Tamper
---
Sensor Optimization
| Bayesian Optimization, ANN,
---
Multiple Linear Regression
Physical Design | Hiding Countermeasure Optimization |  | Bayesian Optimization,
---
Ensemble Learning
Cross-Abstraction | Obfuscation for Black Box Designs | Genetic Algorithms (Chen et al., 2019), ViT

####  3.4.3. Cross-Abstraction

##### Obfuscation for Black Box Designs

Obfuscation is best implemented with complete structural and functional
understanding of a circuit, but different levels of abstraction may present
the challenge of having only one available. At the gate level, logic locking,
as described in Section 3.3.2, may be viable, but the implementing party may
also be restricted by their limited knowledge. Here again, a GNN seems capable
of modeling the complex connections within the design, the competing needs to
resist attacks, and narrowing down the most suitable implementation for
balancing security and overhead. Ideally, the complete framework should
provide locking options for each design and generate keys for a user
discretely. Genetic algorithms have been applied to logic locking attacks like
GenUnlock (Chen et al., 2019), where the evolutionary process is a black-box
procedure overseen by an objective function. Conversely, this concept may be
applicable to not only logic locking, but general obfuscation.

The physical design stage also presents opportunities for obfuscation to the
designer with black box access using ML/DL. The current state-of-the-art in
camouflaging is the covert gate approach (Shakya et al., 2019). Covert gates
are inserted randomly into the design/layout, but a CNN or vision-based
transformer (ViT) can be incorporated to quantify the impact of insertion and
ultimately identify the most viable gates to replace. Table 3 provides
possible algorithms for the security tasks provided in this subsection.

###  3.5. Assimilation of Security Rules for Electronic Design Automation

The incorporation of ML/AI into EDA describes replacing traditional heuristics
with deep learning and AI-based decision-making policies that integrate the
above steps (decision making, performance prediction, and optimization) into a
single EDA framework. This will ultimately lead to a custom-based EDA pipeline
based on the specific design and/or security application rather than relying
on generic, somewhat-archaic EDA tools. Unlike Section 3.4, the design space
may stretch beyond what a designer has at their disposal. A valuable point to
make is the possibility of utilizing a trainable decision-making policy in
contrast to exploring the available decisions. The use of AI/ML almost
guarantees more efficient results with shorter runtimes. There is budding
research within the IC design community to incorporate learning-based tools
into the EDA pipeline. The OpenROAD project is a DARPA-funded initiative which
seeks to solve EDA cost and turnaround time. The goal is to complete the
design process without performace, power or quality tradeoffs using ML, cloud-
based optimization and other techniques (Ajayi et al., 2019; Connor, 2018).
Their work so far has incorporated problem-specific tools like ioPlacer for
fast and scalable input/output pin assignment (Bandeira et al., 2020),
TritonCTS for clock tree synthesis (Han et al., 2020) and RTL-MP for macro
placement using RTL information and clustering (Kahng et al., [n.d.]). A team
of researchers at Google also presented a floorplanning tool for the physical
design stage that can successfully place macro blocks using deep RL
(Mirhoseini et al., 2021). Its results demonstrated improvement over
traditional manual efforts across performance, power consumption and area, and
allowed its application to a recent tensor processing unit (TPU) product.

With AI/ML firmly established in the pipeline, design optimization and
security could be combined. Design-specific EDA will make extraneous steps
obsolete and ultimately reduce the time-to-market for ICs. Table 4 highlights
the areas of interest for each major design stage.

Figure 13. General overview of AI-assisted EDA. The emphasis is on direct
application to EDA.

The manufacture of secure ICs must begin with embedding of security rules at
major steps of the design process. This encompasses the acts of identifying,
assessing and incorporating prerogatives and properties within specific
stages. All design steps follow defined rules during their series of actions
on the input design (Khwaja, 1997). For example, during logic synthesis,
minimization may occur by combining gate terms where applicable to reduce
circuit size (Brayton et al., 1990). Even design constraints can be described
as rules because they define the behavior of the design at each point of
usage. In the same vein, it is necessary to apply security rules as rigorous
requirements throughout the entire design sequence.

Efforts to support such assimilation are starting to grow. For example, the
Hardware Common Weakness Enumeration Special Interest Group (HW CWE SIG)
<EMAIL_ADDRESS>2022) consists of researchers and representatives from
organizations operating in hardware design, manufacturing, and security who
interact, share opinions and expertise, and leverage each other’s experiences
in defining hardware security weaknesses and identifying them with analysis
tools. However, the current initiative is manual and quite subjective. Data-
driven and AI-based approaches could make this less tedious and more objective
in nature.

####  3.5.1. High Level Synthesis and Register Transfer Level

The overall design of a circuit depends on the requirements stated in its
specifications. Traditional execution of HLS results in an RTL description of
the design, which is a better hardware-based representation of the intended
IC. During the design process, it is difficult to ascertain certain features
and how they may impact the entire circuit, but significant work has been done
to mitigate this using ML (Makrani et al., 2019; Zennaro et al., 2018; Dai et
al., 2018). One noteworthy ML-based optimization framework combines a GNN with
RL to predict design results and obtain optimal solutions under user-specified
constraints and objectives like area and latency (Wu et al., 2021). The
security-aware designer can also leverage ML to anticipate and solve security
problems that an IC is vulnerable to. Security rules at this early stage of
the design process are less-tedious and reasonably-inexpensive to enforce.

##### Obfuscated Design

Pre-synthesis obfuscation is applied to a design prior to the logic synthesis
stage. Although the most prevalent techniques are used post-synthesis, there
has been work done on this early stage method of obfuscation. Obfuscation can
be implemented at the high level stage before conversion into RTL. One group
uses MUXes driven by a locked controller units to create decoy connections
(Rajendran et al., 2015a). Exploiting the MUX’s use of inputs and a control
signal, only the correct control signals can unlock the design. The authors of
(Chakraborty and Bhunia, 2010) convert RTL code into control and data flow
graph (CDFG) form, apply locking by superimposing an authentication FSM, and
then return to RTL. Both applications may be deployed as security rules with
deep learning-based execution. The CDFG form could be implemented as a GNN for
optimum modeling of a design’s complexity.

##### Masking

Masking to mitigate the effectiveness of differential power analysis (DPA)
during a side channel attack is also possible at this level of abstraction.
Konigsmark et al. create an HLS flow which addresses side-channel leakage by
inferring security critical operations from user-specified confidential
variables in HLS input. Their modified framework rectifies imbalanced branches
that pose easy attack targets, and changes functional units based on leakage
potential (Konigsmark et al., 2017). This experiment could be the foundation
for learning-based masking solutions to prevent SCA; it stands to be improved
by feature-based rectification.

##### Information Flow Security

It is important to verify that systems adhere to information flow security
(IFS) policies, especially during the design phase. All assets flowing through
the system must be identified; this is known as information flow tracking
(IFT) (Hu et al., 2021). Achieving this at higher levels of abstraction
reduces the effort required to rectify potential problems. One publication
presents RTLIFT as a means of measuring all digital flows through RTL designs
to formally prove security properties related to integrity, confidentiality
and logic side channels (Ardeshiricham et al., 2017). Perhaps its most
impressive property is the ease of integration into the design flow.
Intelligent decisions surrounding security policies means adaptability to
different designs trade-offs such as the RL-based policy iteration to
calculate digital flows and possibly flag irregularities (Ardeshiricham et
al., 2017).

####  3.5.2. Logic Synthesis

In general, logic synthesis has been extensively-researched under AI/ML (Neto
et al., 2019; Pasandi et al., 2019; Pasandi et al., 2020). The RTL-to-gate
level process provides viable data to train models that have mostly been used
for design optimization. The conversion from behavioral level to the gate
level is the bridge between a design idea and its generation because the
specific logic functions are implemented from combinations of gates selected
in a given cell library.

##### Obfuscated Design

At the gate-level, the first form of obfuscation which may come to the
security-aware designer’s mind is logic locking. One proposed work that could
be the baseline for future AI/ML exploration is LeGO (Alaql et al., 2021). The
authors point out that it can iteratively harden a design against a set of
attacks. The framework begins by performing a simple key-based locking and
continues with an iterative feedback process which considers a set of possible
attacks to defend against (Alaql et al., 2021). The attacks are provided with
corresponding countermeasures for integration. The rule selection algorithm,
which uses prior knowledge from a database of mitigation rules, identifies the
best protection to be applied for each key-bit against a specific attack. The
”convergence point” occurs when all security issues are addressed (Alaql et
al., 2021). The learning design could be improved with an RL-based policy
iteration framework. With a suitable representation of the gate-level netlist
and its features, there are many possibilities.

##### Masking

Similarly, in the quest for side-channel resistant designs, gate-level masking
has been researched since the early 2000s. Masking is most ideal for
implementation at this stage, because of the gate design’s correlation to the
physical design’s functionality. In 2005, masked dual-rail pre-charge logic
(MDPL) was proposed as a promising DPA-resistant logic style (Popp and
Mangard, 2005). MDPL circuits are based on a standard cell libraries and have
no routing constraints concerning the balancing of complementary wires. The
dual-rail pre-charge property of MDPL specifically prevents glitches in the
circuit. A more recent implementation uses a technique that combats the
phenomena of glitches and early propagation using only cell-level “don’t
touch” constraints (Leiserson et al., 2014). Their framework, a derivative of
MDPL called LUT-Masked Dual-rail with Precharge Logic (LMDPL), can works for
both FPGA or and ASIC designs. MDPL may be used as a rule-based template for
masking gate-level designs. A GCN can be used to identify sections of the
circuit that are vulnerable and would require MDPL implementation.

##### Information Flow Security

Information flow tracking at the gate level also serves to check adherence to
security policies. The well-defined gate level information flow tracking
(GLIFT) technique has been widely used to GLIFT used to design secure hardware
architectures and detect security violations from visible timing flows.
Hardware trojan dection has even been accomplished based on harmful
information flows that point to sensitive information leakage and data
integrity violation (Nahiyan et al., 2017). From Fig. 14, the RTL synthesis
which produces the gate level representation is followed by standard cell
augmentation with shadow logic gate. Design stage verification is the most
suitable application of GLIFT to the EDA pipeline. The technique only checks
for violation of IFS policies without addition of logic to the fabricated
design. Once again, a GCN representation with sufficient features may be used
to supplement, or even replace GLIFT.

Figure 14. GLIFT workflow with standard cell and GLIFT libraries.

##### Side Channel Resistance

####  3.5.3. Device Sizing and/or Technology Mapping

Modern physical design (PD) flow includes gate sizing for PPA optimization,
used in different steps ranging from synthesis to signoff. This process is
algorithmic, assigning a proper size (gate type) to each optimizable design
instance from a set of equivalent standard cell libraries for a different
process, voltage, and temperature (PVT) corners. For each of the instances,
the available gate sizes are discrete values specific to the underlying
technology. As the solution space scales exponentially with respect to the
size of the netlist, gate sizing algorithms integrated into EDA tools rely on
either heuristics or analytical methods, which leads to sub-optimal sizing
solutions. To combat this shortcoming, (Lu et al., 2021a) has demonstrated the
feasibility of applying RL algorithms equipped with graph neural networks
(GNNs) that encode design and technology features. Specifically, the problem
of gate sizing for timing optimization at the post-route stage has been the
main focus of the study. Although the proposed sizer adopts a more global
optimization approach, it does not always outperform the commercial tool.
Nevertheless, it has the great advantage that is automatic gate sizing for
timing optimization without any human intervention.

The technology-mapping step converts internal representation and the optimized
logic based on the designated technology library (Cong and Pan, 2008). In
order to improve the effectiveness of this process in terms of energy
consumption, delay, and area overhead, approximate logic synthesis (ALS) is
discussed in the literature, where the accuracy of mapping is compromised to
meet the design requirements. However, techniques for ALS suffer from long
execution time, which has been addressed in (Pasandi et al., 2019) by adopting
RL-based strategies. Academic state-of-the-art ALS tools are considered to
evaluate the performance of the proposed RL-based ALS. The results have
demonstrated a great deal of improvement with regard to run-time and area and
delay when the RL-based ALS is applied against academic and industrial
benchmarks. Security-based optimization can also be added as a design goal for
this automatic process.

##### Fault Tolerance

Critical assets in devices may be compromised by taking advantage of errors
from fault injection. Single event upsets (SEUs) affect sequential elements,
while single event transients (SETs) arise from combinational logic (Bogaerts,
2014). An SEU may lead to a single event latchup (SEL), which results in a
high operating current, or a short circuit. Fault tolerance reduces the
sensitivity of devices to particle or laser attacks that cause these events.
Glitches can be used to progressively break cryptography schemes or disable
internal protection mechanisms (Giraud and Thillard, 2010). Redundant
computation is one way of making designs impervious to upsets. It uses double
computation (in time or space) with a final comparison; if the results from
redundant computations do not match, the output of the encryption function is
suppressed/randomized. Redundancy may cause increased area and power
consumption, but methods like the one presented in (Petrovic et al., 2012)
show high tolerance with moderate overhead is possible. The optimization
procedure can be refined using a Gaussian process to find the best trade-off
value.

####  3.5.4. Floorplanning and Physical Design

The floorplanning step formalizes the high level design established at the
beginning of the process, and is followed by P&R to connect all blocks such
that they meet design criteria and constraints. After initial P&R attempts,
the design’s timing constraints are analyzed (Martin et al., 2016). If
unsatisfactory, the P&R software in use tries different placements and signal
routing to try to meet the designated constraints. Even outside academia, work
has been done on automating floorplanning to benefit the physical layout.
Researchers at Google modeled chip floorplanning as a reinforcement learning
(RL) problem, and used a GCN representation of the design to optimize power,
area and performance (Mirhoseini et al., 2021).

In order to place Application-Specific Integrated Circuits (ASICs), designers
must deal with millions or even billions of gate-level instances to be placed
on constrained physical layouts. The placement directly impacts the quality of
the final full-chip design, supposed to be assured by employing commercial EDA
tools and spending a significant amount of time in optimization iterations cf.
(Lu et al., 2020). In a series of work, the problem of providing automated and
accurate placement guidance has been tackled through machine learning methods
(Lu et al., 2021b, 2020; Mirhoseini et al., 2020; Fogaça et al., 2019). Among
these proposals, (Mirhoseini et al., 2020) has reintroduced reinforcement
learning into the chip placement domain of study. (Goldie and Mirhoseini,
2020) provides roadmaps for placing an ASIC or FPGA netlist onto a grid,
whereas (Mirhoseini et al., 2020) gives more concrete answers to the problem
of placing a netlist graph of macros (e.g., SRAMs) and standard cells (logic
gates, such as NAND, NOR, and XOR) onto a chip canvas. The goal of these
studies is to perform chip placement such that power, performance, and area
are optimized according to the constraints on placement density and routing
congestion.

Global routing is performed on a coarse grid map to find an approximate
routing of all nets that is the basis for the detailed routing to specify the
routing of each net and satisfy all design rules. Another pressing issue with
electronic systems design is automatic routing considering wire-length,
crosstalk, via, and layer selection. Maze routers are traditionally used for
this purpose, although they have two major limitations, namely (1) being not
smart enough to perform detailed routing considering signal integrity (Hart et
al., 1968), and (2) needs for additional constraints and optimization
variables to offer global routing. RL has been proposed to resolve these by
integrating the concept of SI (Kim et al., 2020). For this, Kim et al. have
designed an RL-agent including an encoder-decoder model that is an effective
tool for solving combinatorial optimization problems (Kim et al., 2020).
Similarly, deep Q-network (DQN) agents are trained in the RL framework to
encounter the global routing problem (Liao et al., 2020), where a single DQN
conjointly routs the nets and pins in an IC. In this process, the DQN acts as
an agent and interacts with the environment. Upon receiving the state
information from the environment, the Q-values of all the potential next
states are evaluated, an action is taken, and executed. Consequently, the
environment is updated.

These optimization-based techniques provide possibilities for applications
towards more security-aware designs.

##### Crosstalk Mitigation

Design scaling from a technology process may reduce spacing between adjacent
interconnects; the resulting increased coupling capacitance between wires
causes crosstalk (Zhou and Wong, 1998). The affected signal’s value may either
change, or have delayed signal transition. False clocking, where a clock
changes states unintentionally, may also occur (Terapasirdsin and
Wattanapongsakorn, 2010). Good signal integrity is necessary for optimum
functionality of an IC (Green, 1999). Large signal-integrity problems may
cause intermittent success or complete system failure. To address crosstalk,
the design tool must be able to measure its value. The authors of (Chang et
al., 2006) find a closed form expression of crosstalk using a number of wires.
With accurate metrics, a linear regression model coupled with the RL method
applied in (Mirhoseini et al., 2021) could address crosstalk expeditiously.

##### Power Distribution Networks for Anti-Side Channel and Fault Injection

Side channel leakage is one of the results of the nature of an IC’s power
distribution network (PDN). The PDN is responsible for the supply of stable
voltage and power to each functional component of the circuit (Martin et al.,
2016), but it may also inadvertently introduce side-channel leakages
throughout the design (Zhang et al., 2020). The growing complexity of devices
introduces sophisticated PDNs with the potential to allow successful side-
channel attacks or fault injection. To improve the security of a design, it is
important to use ML to build on existing work on this topic. PowerScout is a
framework geared towards evaluating side-channel vulnerabilities by modeling
possible attacks to improve PDN designs (Zhu et al., 2020). It can effectively
predict leakage strength and also identify fault injection soft spots. The
side channel and fault injection attacks are modeled using non-learning based
design space exploration. A decision tree, or an MLP could predict these with
the same parameters being extracted. There may also be promise in modeling the
PDN using a graph-based network and optimizing leakage-prone nodes for the
physical design.

##### Anti-Tamper Layouts

Anti-tamper designs are meant to deny an adversary’s opportunity to monitor or
affect the correct operations of an IC. At the layout level, one CAD
assessment technique allows a designer to gauge a designs susceptibility to
frontside probing attacks (Wang et al., 2019). The assessment is performed by
varying attack parameters (FIB aspect ratios and angles), shield parameters
(layers and shape) and the assets under attack (keys, buses, etc.,.). Two of
the most useful aspects of the paper are the exposed area (EA), which is free
to probe without impacting transmission, and shield structure taxonomy, which
is a set of documented shield patterns (Wang et al., 2019). Based on the
attack parameters, EA and the shield taxonomy, an RL model could help
recommend the best shield design for a layout.

##### Anti-Reverse Engineering Layouts

At the layout level, IC camouflaging is a EDA engineer’s most suitable option
to prevent successful RE. The camouflaged layout is a functional replica of
the original design with camo gates (See 3.2. A novel framework for secure
layout generation could focus on generating camo gates using GANs.
Recommendations for camouflage points on an IC can be modeled using a GCN or a
CNN.

##### Custom eFPGA fabrics

The embedded FPGA (eFPGA) is an IP core integrated into an ASIC that offers
the reprogramming flexibility of FPGAs without their overhead costs. They are
added to systems which require frequent updates; by adding their fabric to an
SoC or ASIC, teams are able to modify applications seamlessly. One security
evaluation in (Bhandari et al., 2021) points out that eFPGAs can contribute to
SAT attack resilience. The eFPGAs have combinational loops that a specific
cyclic SAT solver like CycSAT (Zhou et al., 2017) cannot solve. Increasing
attack difficulty can be considered when creating eFPGA fabrics at the
physical design stage. The incorporation of a policy-based model that
incorporates this into an ASIC design could improve security considerably.

Table 4. Major IC design stages in EDA with security needs and possible
applications of AI/ML.

|  |  | AI/ML Algorithms Applicable
---|---|---|---
Design Stage | Security Task | Design Type | Suggested | Implemented
| Obfuscated Design | ASIC, FPGA | RL | GNN (Yasaei et al., 2021a)
| Masking | GNN, GCN, RF |
High Level Synthesis and Register Transfer Level | Information Flow Security | RL |
| Obfuscated Design | ASIC, FPGA | GCN |  ANN (Sisejkovic et al., 2021)
| Masking | RL, GNN |
| Information Flow Security | GCN |
Logic Synthesis | Side Channel Resistance | GNN |
| Device Sizing/
---
Technology Mapping
Fault Tolerance | ASIC | Bayesian Optimization, DNN |
| Crosstalk Mitigation | ASIC, FPGA |  |  | Logistic Regression ,
---
XGboost (Liang et al., 2020)
| Anti-tamper layouts | GCN, RL |
|  | PDNs for anti-side channel
---
and fault injection
GNN | Linear Regression (Utyamishev and Partin-Vaisband, 2020)
| Anti-RE layouts | GCN | CNN (Zargari et al., 2021)
Floorplanning and Physical Design | Custom eFPGA fabrics | RL |
|  | Test point insertion and pattern
---
generation for Trojan detection
ASIC, FPGA | RF, GB | RL(Pan and Mishra, 2021)
| Information flow security | GNN, DNN, RL |
Testing and Verification |  | Comparison of original
---
specification to final design
GNN | NLP(Yu et al., 2021)

####  3.5.5. Testing and Verification

As an IC reaches its physical state, the designers must implement design
testing and verification. It is important to point out that most major design
stages reach completion via some form of verification step (Wang et al.,
2009). For example, the logic synthesis step utilizes an RTL and gate level
netlist verification procedure to guarantee functionality retention of the
gate level design (Martin et al., 2016). Testing and verification combined
ensure that an IC has maintained original specifications and functionality
throughout the design process. For physical testing, the two most significant
options are wafer level testing and package level testing (Perry, 2007).

##### Test Point Insertion and Pattern Generation for Trojan Detection

Design for Testability (DFT) is a technique employed in designing ICs for the
purposes of reducing test costs and associated time. A very common technique
for DFT is scan-chain insertion; regular FFs in the design are replaced with
scan FFs. ATPG is a test methodology used to identify faulty behavior(s) in
circuits due to design defects. The goal of ATPG is to create a set of test
patterns that achieve a desired test coverage, TC, and fault coverage, FC,
through fault simulation (Tehranipoor and Wang, 2011). ATPG and formal methods
have been researched for Trojan detection, but most do not consider partial-
scan instances of a third-party IP (3PIP). The authors of (Cruz et al., 2018)
generate a set of constraints using the model checker to facilitate directed
test generation using ATPG tool. A constraint generation procedure uses model
checking to produce a set of signal traces. A test vector generation method
then uses ATPG with the design, rare nodes and signal traces to produce a set
of test vectors for activating each rare node (Cruz et al., 2018).

##### Information Flow Security

At the verification stage of the design flow, IFT can be executed using static
or dynamic techniques. Static techniques assess the design’s compliance with
security policies using simulation, formal verification, emulation or virtual
prototyping. They are applicable within the EDA pipeline, and are removed when
verification is completed (Hu et al., 2021). Due to the unique goals of each
specific static technique, AI/ML can be added to decrease resource usage, and
improve results. For hardware security simulation, levels of abstraction like
gate level and RTL are viable. As described in logic synthesis, graph-based
networks are ideal solutions. The simulation process links security labels to
signals. Formal verification guarantees proof of security for the desired
properties, but it is known to have scaling issues (Hu et al., 2021). The
large design state space of complex systems requires a policy-based learning
solution which RL provides. Emulation can perform hardware-software co-
verification, using FPGA emulation servers. Learning-based models could make
these servers more robust to even detect software vulnerabilities that impact
hardware. The abstract models of hardware components created by virtual
prototyping can be tested a different RL-based approach. If the policy used is
geared towards creating security problems while verifying software, the
designer becomes aware of impending problems. Dynamic techniques use dedicated
hardware to track information flow during runtime. A neural network could
validate results to predicting flow inconsistencies.

##### Comparison of Original Specification to Final Design

Furthermore, Natural language processing (NLP) can be applied to circuit
designs at different levels of abstraction. One of the most promising bridges
to this is HW2VEC, a graph learning tool to extract graph representations from
a hardware design in either RTL or gate level (Yu et al., 2021). It is divided
into two main parts: a HW2GRAPH stage which converts the design to a graph
while retaining structural information, and GRAPH2VEC which converts the graph
into Euclidean-based embeddings. GRAPH2VEC is just one of a number of graph-
to-vector-embedding algorithms that utilizes concepts from the skipgram word
embedding model (Narayanan et al., 2017). The resulting vector representation
may be applied with measures of similarity, like cosine similarity, to verify
designs. If HW2WEC can be leveraged at physical design stages, the final IC
product can be verified for structural authenticity.

Figure 15. Overview of HW2VEC from hardware design (RTL or gate level),
through extraction of graph representations to node embedding (X) and
adjacency (A) matrices. The graphrepresentations use GRAPH2VEC to acquire the
graph embeddings for hardware security applications. Reprinted from (Yu et
al., 2021)

##  4\. AI for security-aware design of Analog Integrated circuits

Analog ICs are the fundamental components that interface with the real-world
signals which are continuous and arbitrary in nature. Hence, the design of
analog circuits are considered the foundation for all IC design. In this
regards, analog IC design comprises of design of analog, radio frequency (RF),
and mixed-signal ICs such as amplifiers, oscillators, filters, power
regulators, data converters, etc., Analog IC design traditionally involves a
lot of manual work and hence relies heavily on expert knowledge and intuition.
This is the case because unlike their digital counterparts, analog design
steps typically overlap and have a higher number of complex design constraints
and specifications that need to be met simultaneously. Thus, the automation of
design of analog circuits and consequently analog security primitives has not
gathered a lot of traction compared to digital circuits. Nevertheless, it has
become paramount that the design of analog circuits be automated with the
inclusion of security-aware features because of the following reasons:

  * •

Bottleneck of the design process: Design of analog ICs involves a lot of
manual steps as explained above and are hence considered the bottleneck in any
electronic system design (Swings et al., 1990). Since analog ICs are prevalent
in almost all ICs, it is imperative that they be designed as swiftly as their
digital counterparts to meet the current demands of low power, high
performance, and quick time-to-market. Furthermore, this increasing demand
coupled with error-prone manual process demands an inclusion of security-aware
features in the design.

  * •

High susceptibility to reverse engineering: Analog ICs are generally
fabricated in higher or older technology nodes compared to digital ICs. They
also have fewer number of transistors (in order of hundreds compared to
billions) and have a lower current density, which makes it easier for the
attacker to figure out the underlying intellectual property (IP) using the
process of reverse engineering (Alam et al., 2018).

  * •

Lack of cryptomodules, error tolerance, and security primitives: There’s a
severe lack of security features and primitives applicable for analog ICs as a
large amount of research has focused on digital ICs (Alam et al., 2018).

  * •

Impact of process variation: Robust analog design has become ever so
challenging with the continuous advancement in technology node and device
scaling because the analog parameters are affected significantly more across
process, voltage, and temperature (PVT) variations. This has made the design
of reliable analog circuits very strenuous (Razavi, 2000).

  * •

Lack of comprehensive descriptiveness of design and security issues in
conventional CAD approaches: Depending on the type of analog IC, the
specifications and requirements vary quite a lot. Hence, one unified framework
or CAD approach is not applicable to the design of analog ICs. Hence, there is
a severe lack of comprehensive description of design and security issues in
traditional CAD approaches (Scheible and Lienig, 2015).

  * •

Inapplicability of most digital based security solutions: The design flow of
digital ICs is significantly different compared to analog ICs. Hence, the
design and security approaches proposed for digital ICs are not applicable for
analog and even mixed-signal ICs. Furthermore, the design of these security
features require design and cost overheads which are only expendable in the
case of large digital ICs.

Henceforth, in this section, we focus on the recent developments of the use of
automated techniques including AI based approaches and optimization techniques
in the design of analog ICs and security primitives.

###  4.1. Optimization Techniques for EDA

Machine learning models instead of pure optimization algorithms have been
extensively used to automate the design of digital circuits which has
significantly reduced the time-complexity associated with designing a robust
digital IC. Furthermore, they are able to learn from the previously explored
designs and datasets (Huang et al., 2021a). However, training machine learning
models is a challenge specifically in the analog domain compared to their
digital counterpart because of the following reasons.

  * •

The specifications of analog design are variable for different applications.
Thus, it becomes difficult to construct a uniform framework to evaluate and
optimize different analog designs (Mina et al., 2022).

  * •

It is challenging to design a well-performing model because analog parameters
are highly non-linear and susceptible to noise and process-voltage-temperature
(PVT) variations (Gielen and Rutenbar, 2000).

  * •

The models trained for design automation have worked well for digital circuits
compared to analog because analog designs suffer more in terms of area, power,
and reliability when porting from a higher node to a lower technology node.

  * •

The search space for analog design is significantly larger compared to digital
IC design. There is variety of circuit schematics and device sizes that a
designer can consider to get a reasonable performance. Plus there are more
number of specifications to meet for an analog IC compared to their digital
counterparts. This makes it computationally expensive and time-consuming to
train a decent model.

  * •

Analog design is less systematic and more heuristic and intuitive in nature
(Gielen and Rutenbar, 2000). Thus there has been a substantial amount of
automated design software tools available for digital IC design which makes it
easier to generate data and train models to optimize the design process.

Because of the reasons outlined above, there are an abundance of “automation”
frameworks which use one or more optimization algorithms in conjunction with
the simulation software to optimize the design of a specific analog circuit.
Many situations call for multi-objective optimization problems as is the case
when designing security primitives as they have additional challenges and
specifications to meet depending on the type of analog circuit at hand.
Nevertheless, depending on the search space and the problem-at-hand,
optimization techniques can be divided into three categories:

  1. (1)

Random or brute-force search which involves randomly generating a solution
until the optimization criteria is satisfied. These are time-consuming.

  2. (2)

Gradient or derivative based optimization utilizes gradient or derivatives
within the data or the objective function to guide the search for the optimal
solution (Sun et al., 2019). Gradient descent is one of the most widely used
techniques specifically in ML algorithms. They are computationally efficient
and quick, but prone to getting stuck at a local minimum rather than a global
optimum if not designed properly. Further, they require functions that are
differentiable.

  3. (3)

Heuristic derivative-free optimization methods utilize heuristic techniques
characterized by empirical rules to guide the search process to find an
optimal solution. The most popular algorithms are evolutionary algorithms (EA)
(and simulated annealing (SA) which are inspired by Charles Darwin’s theory of
evolution and the annealing techniques in metallurgy, respectively. They are
highly effective especially when derivatives or gradients do not exist and the
search space is highly non-linear or noisy. However, they are quite time-
consuming and the quality of solution is highly dependent on the initial
configuration and learning rules.

However, with the progress in high-performance computing hardware and ability
to model non-linear problems, DL and RL methods have gained a lot of
popularity in recent years. Specifically, RL have gained a lot of traction in
analog design and optimization where their counterparts, evolutionary
algorithms, have been applied for more than a decade (Zebulum et al., 2018).

Figure 16. General analog IC design flow.

###  4.2. Analog IC Design Flow and AI/ ML Techniques

Fig. 16 provides a general overview of analog IC design which is drastically
different compared to the digital circuit flow shown in Fig. 5. This is a top-
down design approach as described by Gielen et. al. (Gielen and Rutenbar,
2000). First, the analog IC designer chooses a topology and designs the
schematic such that a given set of design constraints and specifications are
fulfilled. Then, the transistors and other analog elements are sized very
carefully and simulated using a circuit simulator. Next, the layout engineer
generates the physical implementation of the IC based on the schematic,
performs physical verification (DRC and LVS), extracts the parasitics,
optimizes the location of circuit elements to fulfill the area and power
specifications, and performs the post-layout simulation. This process of
layout and simulation continues until the specified physical constraints are
met after which the IC is ready to be fabricated. The design process is
completed by testing the analog IC against the design specifications. If the
IC fails the test, then the analog designer has to repeat the whole process
and either resize the design or choose a different topology altogether. This
process usually goes for several iterations until the IC is ready to be
fabricated at a large scale.

Table 5. AI/ ML techniques used in every design stage of the analog IC design
process.

Design stage | Techniques | AI/ ML algorithms used
---|---|---
| Selection | CNN (Matsuba et al., 2018) , Polynomial regression (Kaya et al., 2018)
| Feature extraction | Supervised/ unsupervised learning (Li et al., 2016) , GNN (Kunal et al., 2020)
Topology selection | Generation | RNN (Rotman and Wolf, 2020)
| Model-based |  | SVM (Ding and Vemur, 2005), RBF/ MLP (Passos et al., 2006), Bayesian NN (Gao et al., 2019),
---
ANN with sparse regression (Tao et al., 2015), DNN (Takai and Fukuda, 2017),
ANN (Lourenço et al., 2018; Dumesnil et al., 2015),
Gaussian-based regression model (Sanabria-Borbón et al., 2020), SVM (Wang and
Franzon, 2018), BO (Huang et al., 2021b), RL (Zhao and Zhang, 2020)
Circuit sizing and biasing | Simulation-based |  | ANN (İslamoğlu et al., 2019; Li et al., 2019; Wolfe and Vemuri, 2003; Bhatia et al., 2016; Jafari et al., 2010), RL (Wang et al., 2018c; Settaluri et al., 2020), GA (Harsha and Harish, 2018; Das and Vemuri, 2007),
---
Hybrid EA (Liu et al., 2009), (RNN, DNN) (Wang et al., 2018b)
GCN (Wang et al., 2020), ANN with Polynomial regression (Lourenço et al.,
2019)
Simulation |  | Behavioral
---
modeling
| TDNN (Grabmann et al., 2019), ANN (Zhang et al., 2003), RNN (Murphy and
McCarthy, 2021),
---
Bayesian linear regression and SVM (Pan et al., 2019),
Augmented NN (Yu et al., 2017), RNN (Chen et al., 2017),
NN (Hasani et al., 2017), ANN with GA (Dumesnil et al., 2014)
| Layout | ML (Kunal et al., 2019) , Spectral graph analysis (Chen et al., 2020b)
| Placement | ANN (Guerra et al., 2019; Gusmão et al., 2020) , GNN (Li et al., 2020b) , (SVM, NN, Random forest) (Li et al., 2020a) , LP (Chen et al., 2020b)
Layout | Routing | Generative NN (Zhu et al., 2019), grid-based A* (Chen et al., 2020b)
| Performance modeling |  | DNN with ES (Hakhamaneshi et al., 2019),
---
ANN with Polynomial regression (Lourenço et al., 2019),
(SVM, NN, Random forest) (Li et al., 2020a),
CNN with transfer learning (Liu et al., 2020a)
Post-layout and test | Fault diagnosis | Decision tree (Stratigopoulos and Sunter, 2014), RideNN (Binu and Kariyappa, 2018) , GB-DBN (Liu et al., 2017), DBN (Zhao et al., 2018) , BMF (Wang et al., 2015a)

####  4.2.1. Topology selection

Topology design and selection is the first step in the design of analog ICs.
This step is one of the most critical and time-consuming step due to its
impact on the circuit performance. Traditionally, it is carried out manually
by designers with expert knowledge and intuition. With demands for high
performing analog circuits increasing, researchers as shown in Table 5 begun
to explore ML techniques that speed up the topology design process. Most of
the early work focused on small functional units such as amplifiers and
filters using simple search-based algorithms. Recently, Matsuba et al. in
(Matsuba et al., 2018) attempted to use CNN to select from only four
topologies of an amplifier with 13 different characteristics. Similarly, Kaya
et al. in (Kaya et al., 2018) have used design space exploration to generate
different Pareto-optimal fronts (POFs) in the context of balancing design
specifications across different topologies. These POF based topologies are
then fitted into a polynomial regression model for the final selection;
however, the performances of these techniques are highly dependent on the
created datasets. Researchers in (Li et al., 2016; Kunal et al., 2020) have
instead used feature extraction techniques to ensure that the complex
relationships between various topological components are well understood by
the algorithm. Li et al. (Li et al., 2016) uses both supervised and
unsupervised methods to extract features of sub-blocks and connections within
a topology while Kunal et al. (Kunal et al., 2020) uses graph neural networks
(GNN) to extract symmetry constraints among different topologies. However,
none of these techniques generate a topology automatically. One of the recent
works in (Rotman and Wolf, 2020) uses recurrent neural network (RNN) and
hypernetworks to generate a topology for a two-port circuit.

####  4.2.2. Circuit sizing and biasing

After a topology is selected for a specific design, the next step is to size
the components within the circuit and bias the design appropriately to meet
the desired specifications. This step is also referred to as analog synthesis.
Depending on the number of components, this step is one of the most tedious
ones as the design space is fairly large. As shown in Table 5, there have been
even more ML and optimization techniques to automate this step. These works
can be briefly categorized into two different techniques: model-based and
simulation-based.

##### Model-based techniques

These use regression models or surrogate models to represent the performance
of the circuit. They are thus quicker than the simulation-based approaches
which rely on circuit simulators to continuously optimize the parameters of
the circuit. Most of the model-based works have either used neural networks
(Passos et al., 2006; Gao et al., 2019; Takai and Fukuda, 2017; Lourenço et
al., 2018; Dumesnil et al., 2015) or regression models (Tao et al., 2015;
Sanabria-Borbón et al., 2020) all in the attempt to speed-up the circuit
optimization and evaluation process.

Figure 17. Overview of the circuit design framework as proposed in (Settaluri
et al., 2020).

##### Simulation-based techniques

These are considered superior since they are able to closely match real world
(or post-silicon) circuit performance. Traditionally, simulation-based
techniques have used evolutionary approaches (EA) such as genetic algorithm
(GA) as seen in (Das and Vemuri, 2007; Harsha and Harish, 2018; Liu et al.,
2009) to synthesize a wide-range of analog circuits. There have been a lot of
works using neural networks (İslamoğlu et al., 2019; Li et al., 2019; Wolfe
and Vemuri, 2003; Bhatia et al., 2016; Jafari et al., 2010) to help find
appropriate circuit parameters and biases; however, these techniques only work
for a specific circuit such as amplifier or a filter. The goal has always been
to either reduce human effort or mimic human intuition in designing these
analog circuits. In this regard, the works in (Settaluri et al., 2020; Wang et
al., 2018c; Zhao and Zhang, 2020) have used reinforcement learning (RL) to
design common analog circuits as much as 25 times faster than traditional
optimization algorithms. Zhao et al. (Zhao and Zhang, 2020) used the RL
framework along with a symbolic analysis based approach that rapidly evaluated
the circuit output without invoking a simulator.

One of the reasons that RL-based approaches are gaining more traction these
days is because of their ability to quickly learn and find the balance across
different specifications. The other reason is their ability to transfer their
knowledge, which experts expect will enable IP reuse, rapid automation, and
porting between different technology nodes. Inspired by this ability, Wang et
al. (Wang et al., 2020) used graph convolutional networks (GCN) to extract
features of components and connections within the circuit and the RL agent to
transfer these features whenever possible (e.g.,, features between a two-stage
and a three-stage amplifier) and tune the circuit parameters quickly. In both
cases of transfer learning, i.e.,, between technology nodes and circuit
topologies, the proposed RL-based sizing achieved the highest Figures of Merit
(FoM) when compared with conventional black-box optimization methods and human
expert designs. Similarly, the work in (Settaluri et al., 2020) uses NN as
their RL agent (see Fig. 17). Transfer learning is also enabled here since the
RL agent trained by running inexpensive schematic simulations can transfer its
knowledge to a different environment, i.e.,, the design including layout
parasitics. The results for post-layout simulations provided in (Settaluri et
al., 2020) demonstrate that it can converge faster than the traditional EA-
based approaches.

####  4.2.3. Simulation

The next step in the design process is simulation to check whether the
synthesized circuit satisfies the design specifications or not. Analog
designers heavily rely on circuit simulators such as HSPICE and Cadence
Spectre to assess the performance of their designs. However, behavioral
modeling based techniques as shown in Table 5 have been proposed to speed up
the simulation process and depending on the circuit application tune these
models to assess application-specific performance metrics with more accuracy.
In this regards, researchers have turned to neural network-based learning and
modeling (Grabmann et al., 2019; Zhang et al., 2003; Murphy and McCarthy,
2021; Pan et al., 2019). For instance, in (Grabmann et al., 2019), Grabmann et
al. used time-delay neural network (TDNN) to generate energy-aware AMS IP
cores. Similarly, ML algorithms along with optimization techniques have been
used to find optimal solutions across a wider search range effectively and
efficiently. In this regards, work in (Pan et al., 2019) first creates the
data by exploring different device behaviors across different technologies,
which is then fitted to a Bayesian regression model. Finally, SVM along with
GA is employed in parallel to reduce the runtime compared to a pure EA-based
optimization framework.

####  4.2.4. Layout

ML and AI techniques have also been employed to automate the layout of analog
circuits. The work in (Kunal et al., 2019) summarizes early efforts in putting
together an open-source quick layout generation flow for analog circuits that
leverages template-driven design and machine learning techniques without human
designers in the loop. In this regard, the recent work MAGICAL (Chen et al.,
2020b) takes an unannotated netlist and design rules as inputs to create a
complete GDSII using an automation framework. They use spectral graph analysis
for layout, linear programming (LP) for placement, and grid-based A* algorithm
for efficient optimized routing. Recently, graph based machine learning
networks such as GNN have been used to create models that predict the
performance for a given placement and allows knowledge transfer between
different analog circuits (Li et al., 2020b) which achieves better performance
than CNN and regression based plug-in approaches. Similarly, Geniusroute (Zhu
et al., 2019) uses variational autoencoders to extract latent layout
strategies based on human expertise and then trains a generative NN based
model to guide the automatic routing.

####  4.2.5. Post-layout and Test

Post-layout simulation involves numerous iterations of verification and re-
designs until the desired specifications are met. This is mainly due to the
domination of layout parasitics. Performance modeling techniques such as
BagNet (Hakhamaneshi et al., 2019) use DNNs along with cross-entropy and
canonical evolutionary strategies (ES) to reduce this number of iterations
significantly by leveraging past information and improving the optimizer’s
sample efficiency. Similarly, the recent work by Liu et al. (Liu et al.,
2020a) uses CNN and transfer learning to enable early design pruning for
effective design space exploration and ensure robust well-performing placement
features. Further, the difficulty in obtaining accurate performance models of
analog circuits have led to data-driven fault-diagnosis models for correctly
assessing the analog circuit design. However, because of the highly non-linear
and complex nature of analog performance faults, deep learning based
techniques (Binu and Kariyappa, 2018; Liu et al., 2017; Zhao et al., 2018)
have fared better compared to shallow networks (Stratigopoulos and Sunter,
2014; Wang et al., 2015a). Specifically, the use of deep belief networks (DBN)
have proven to be most effective as evident in (Liu et al., 2017; Zhao et al.,
2018) because of their ability to use raw time domain signals as inputs and
employ an adaptive feature extraction and fault classification techniques.

###  4.3. Security Issues in the AMS IC Design and Fabrication Flow

Figure 18. Analog IC design security vulnerabilities.

The security issues pertaining to analog ICs are summarized by the supply-
chain vulnerabilities which have increased within the last decade or so as a
result of globalization. These issues as shown in Fig. 18 can be categorized
into hardware Trojans and IC counterfeiting.

####  4.3.1. Hardware Trojans

As discussed previously for digital ICs, Trojans are intentionally created
anomalies which remain hidden and difficult to detect because they are
triggered by rare conditions. Analog Trojans can be further categorized into
charge-based Trojans (Kison et al., 2019) and hidden backdoors such as covert
channels established by exploiting process variations (Subramani et al.,
2017). Charge-based Trojans either use switched capacitors to design a trigger
circuit or exploits capacitive couplings to design Trojans with no area
overhead (Kison et al., 2019). Hidden backdoors in the case of analog ICs
mainly pertain to wireless RF networks where a Trojan circuit is designed to
establish a previously unknown channel by exploiting process variation margins
of the target circuit (Subramani et al., 2017). Although it is difficult to
design purely analog Trojans (analog payload with analog trigger), they are
more attractive than their digital counterparts because of their smaller
footprint and their incompatibility/ invisibility to digital functional
testing and verification techniques. As such there are works in AMS ICs where
the trigger is hidden in the digital portion of the IP and its payload is
transferred to the analog portion via test access mechanism (Elshamy et al.,
2020). With the advent of analog EDA tools and ML-based approaches to circuit
design, it opens up more opportunities to exploit such tools and approaches to
design analog hardware Trojans efficiently.

####  4.3.2. IC Counterfeiting

Analog ICs are one of the most widely reported counterfeited parts amongst all
types of ICs (IHS, 2012). The major reasons for analog counterfeiting are two-
fold: First, they are easy to reverse engineer because of low transistor count
and large transistor footprint. Second, analog IP design is cumbersome, manual
labor-intensive, and highly dependent on knowledge expertise; hence, their
value is significantly higher in the black market (Rutenbar, 2006). IC
counterfeiting can be briefly categorized into IP Piracy, IC recycling,
reverse engineering, overproduction, and sale of defective ICs as shown in
Fig. 18. As these are supply chain related issues, the use of automation tools
and AI/ ML techniques does not change the degree of vulnerability of the
analog IPs. However, the use of such techniques does give rise to more
opportunities in terms of security-aware design and security primitive
optimization. The next subsection describes some of the security primitives
which can be designed and exploited at different design stages.

###  4.4. Design of Analog Security Primitives Within the Design Flow

Table 6 summarizes analog security primitives that employ either ML algorithms
or an automation framework based on popular optimization techniques at various
stages of the analog IC design flow. The table also mentions the associated
security issues that are tackled by these proposed security primitives.

####  4.4.1. Physically Unclonable Functions (PUFs)

As discussed earlier, PUFs are hardware security primitives which can either
be used to create hardware authentication mechanisms or generate unique keys
for cryptographic schemes. PUFs are devised by exploiting the inherent process
variation or uncontrollable randomness present in every IC from manufacturing.
This capability makes them a low-overhead, volatile security primitive that is
more resistant to physical, side-channel, and software-based attacks. PUF
design usually involves utilizing a specific circuit structure present inside
an IC during the design step to function as a PUF. For example, the analog PUF
proposed in (Alvarez et al., 2015) leverages the threshold voltage mismatch
between transistors in a cascode current mirror. With the size of ICs
shrinking over the last few years, the limited number of input/output (I/O)
pins and the difficulty of meeting both analog and PUF based specifications
has made it challenging to devise a PUF suitable for analog ICs. In recent
years, a few researchers have leveraged circuit sizing based automation and
optimization tools to design robust PUFs that can produce unique yet random
and reliable output bit suitable for device authentication.

The work in (Chowdhury et al., 2020a) uses GA and linear programming (LP) to
size the transistors of an asynchronous null conventional logic (NCL) based
gate (such as NCL TH22 gate) to devise a PUF circuit. This PUF utilizes the
startup characteristics of cross-coupled inverters to produce a metastable
output. The circuit is sized such that this output is only affected the
inherent process variations and mismatch of the inverters inside the NCL
structure. Because of the asynchronous nature of the circuit, this PUF is
applicable for AMS circuits. Similarly, the recent work in (Shah et al., 2021)
demonstrates a way to convert any circuit to a recurrent PUF (Rec-PUF). This
is accomplished by utilizing a RNN-inspired technique involving combination of
recurrence and XOR to generate a response (PUF output) which has very little
correlation to its corresponding challenge (PUF input). They use the current
mirror array (CMA) architecture proposed in (Wang et al., 2017a) and improve