[Paper Review] Estimating the Circuit Deobfuscating Runtime based on Graph Deep Learning

Zhiqian Chen, Gaurav Kolhe+5 more|arXiv (Cornell University)|Feb 14, 2019

Physical Unclonable Functions (PUFs) and Hardware Security36 references4 citations

TL;DR

This paper proposes ICNet, a graph deep learning framework that predicts SAT-based deobfuscation runtime for obfuscated digital circuits by modeling circuit topology and gate features end-to-end. It achieves state-of-the-art accuracy and stability, reducing estimation time by 99.95% compared to brute-force solvers while outperforming multiple baselines on real-world benchmarks.

ABSTRACT

Circuit obfuscation is a recently proposed defense mechanism to protect digital integrated circuits (ICs) from reverse engineering by using camouflaged gates i.e., logic gates whose functionality cannot be precisely determined by the attacker. There have been effective schemes such as satisfiability-checking (SAT)-based attacks that can potentially decrypt obfuscated circuits, called deobfuscation. Deobfuscation runtime could have a large span ranging from few milliseconds to thousands of years or more, depending on the number and layouts of the ICs and camouflaged gates. And hence accurately pre-estimating the deobfuscation runtime is highly crucial for the defenders to maximize it and optimize their defense. However, estimating the deobfuscation runtime is a challenging task due to 1) the complexity and heterogeneity of graph-structured circuit, 2) the unknown and sophisticated mechanisms of the attackers for deobfuscation. To address the above mentioned challenges, this work proposes the first machine-learning framework that predicts the deobfuscation runtime based on graph deep learning techniques. Specifically, we design a new model, ICNet with new input and convolution layers to characterize and extract graph frequencies from ICs, which are then integrated by heterogeneous deep fully-connected layers to obtain final output. ICNet is an end-to-end framework which can automatically extract the determinant features for deobfuscation runtime. Extensive experiments demonstrate its effectiveness and efficiency.

Motivation & Objective

• To address the critical challenge of accurately and efficiently estimating SAT-based deobfuscation runtime for obfuscated ICs, which is essential for optimizing security defenses.
• To overcome the limitations of heuristic-based obfuscation selection, which is suboptimal and infeasible due to the exponential search space of possible obfuscation configurations.
• To develop a scalable, end-to-end machine learning framework capable of handling the graph-structured, heterogeneous nature of ICs and the complex, nonlinear behavior of deobfuscation attacks.
• To enable rapid evaluation of obfuscation strategies by replacing time-consuming attacker simulations with fast, accurate runtime predictions.
• To provide a stable and generalizable model that automatically extracts relevant features from circuit topology and gate attributes without manual engineering.

Proposed method

• Proposes ICNet, a novel graph neural network architecture with custom convolutional layers designed to capture the topological and structural characteristics of obfuscated ICs.
• Introduces a new graph convolution operator that avoids attribute propagation—common in GCNs but ill-suited for ICs—by focusing on local gate representations and their interactions.
• Integrates gate-level features (e.g., gate type, number) and circuit topology into a unified embedding space through a composite fully connected network for regression.
• Employs an end-to-end training paradigm that jointly learns feature representations and deobfuscation runtime prediction from raw circuit graphs and obfuscation configurations.
• Utilizes attention mechanisms to quantitatively analyze feature importance, revealing that gate count is the most influential attribute for runtime prediction.
• Trains and evaluates the model on real-world ISCAS85 and ITC99 benchmarks, comparing against multiple baselines including GCN, ChebNet, and classical regression models.

Experimental results

Research questions

• RQ1 Can a graph deep learning model accurately predict SAT-based deobfuscation runtime for obfuscated ICs, given the complexity and heterogeneity of circuit graphs?
• RQ2 How does the proposed ICNet model compare in accuracy and stability to existing machine learning and graph neural network baselines on real-world obfuscated circuit datasets?
• RQ3 Which circuit attributes (e.g., gate count, gate type) are most predictive of deobfuscation runtime, and can attention mechanisms reveal these relationships?
• RQ4 To what extent can the proposed model reduce estimation time compared to actual SAT solver runs, enabling scalable obfuscation policy exploration?
• RQ5 Is the model robust across different obfuscation strategies and feature input settings (e.g., location-only vs. full feature input)?

Key findings

• ICNet achieved the lowest mean squared error (MSE) of 0.0040 on dataset 1 and 0.0043 on dataset 2, outperforming all baselines including GCN, ChebNet, and classical regression models.
• ICNet-NN, the neural network variant of ICNet, achieved the best performance across all metrics, with an MSE of 0.0040 on dataset 1 and 0.0043 on dataset 2, and showed minimal variance across different feature settings.
• The model reduced average estimation time to 1.1336 seconds per instance, saving 99.95% of the time required by actual SAT solvers, which took up to 2411.11 seconds for the slowest case.
• Attention analysis revealed that gate count contributed 56.40% on average to the model’s attention, with a Pearson correlation of 0.8238 and Spearman rank correlation of 0.9722 with actual runtime, indicating strong predictive power.
• ICNet demonstrated superior stability compared to GCN and ChebNet, as its performance was less sensitive to input feature selection (e.g., location-only vs. full features), with smaller MSE differences across settings.
• The model successfully captured the nonlinear relationship between circuit structure and deobfuscation difficulty, outperforming linear models like LASSO, Ridge, and SVR, which exhibited high variance or constant predictions.