[Paper Review] Set-based Obfuscation for Strong PUFs against Machine Learning Attacks

Jiliang Zhang, Chaoqun Shen|arXiv (Cornell University)|Jun 6, 2018

Physical Unclonable Functions (PUFs) and Hardware Security40 references6 citations

TL;DR

This paper proposes Random Set-based Obfuscation (RSO), a lightweight defense for strong PUFs that uses a pre-stored set of stable PUF responses and a TRNG to XOR-challenge and response pairs, preventing machine learning attacks with minimal hardware cost. When attackers collect more than a threshold number of CRPs, the set is updated, maintaining prediction accuracy at ~50%—equivalent to random guessing—across multiple advanced ML models.

ABSTRACT

Strong physical unclonable function (PUF) is a promising solution for device authentication in resourceconstrained applications but vulnerable to machine learning attacks. In order to resist such attack, many defenses have been proposed in recent years. However, these defenses incur high hardware overhead, degenerate reliability and are inefficient against advanced machine learning attacks such as approximation attacks. In order to address these issues, we propose a Random Set-based Obfuscation (RSO) for Strong PUFs to resist machine learning attacks. The basic idea is that several stable responses are derived from the PUF itself and pre-stored as the set for obfuscation in the testing phase, and then a true random number generator is used to select any two keys to obfuscate challenges and responses with XOR operations. When the number of challenge-response pairs (CRPs) collected by the attacker exceeds the given threshold, the set will be updated immediately. In this way, machine learning attacks can be prevented with extremely low hardware overhead. Experimental results show that for a 64x64 Arbiter PUF, when the size of set is 32 and even if 1 million CRPs are collected by attackers, the prediction accuracies of Logistic regression, support vector machines, artificial neural network, convolutional neural network and covariance matrix adaptive evolutionary strategy are about 50% which is equivalent to the random guessing.

Motivation & Objective

• Address the vulnerability of strong PUFs to machine learning attacks, especially approximation and CMA-ES attacks.
• Overcome limitations of prior defenses that suffer from high hardware overhead, reduced reliability, or failure against advanced ML techniques.
• Design a universal, low-overhead, and reliable obfuscation mechanism compatible with all strong PUFs.
• Enable dynamic set updating to maintain security even under sustained CRP collection.
• Ensure the solution is deployable in resource-constrained IoT environments

Proposed method

• Derive a stable set of responses from the PUF itself during initialization and pre-store them as the obfuscation key set.
• Use a true random number generator (TRNG) to randomly select two keys from the set for each challenge-response pair.
• Obfuscate the challenge and response via bitwise XOR operations using the two selected keys.
• Maintain a threshold for CRP collection; when exceeded, immediately update the response set to disrupt attacker modeling.
• Apply the obfuscation during the testing phase to hide the true PUF mapping from attackers.
• Ensure the obfuscation process does not degrade PUF reliability, as XOR with random values preserves response stability

Experimental results

Research questions

• RQ1 Can a low-overhead obfuscation technique effectively resist advanced machine learning attacks on strong PUFs without degrading reliability?
• RQ2 How does the size of the response set affect the security and error rates of the obfuscated PUF system?
• RQ3 Can dynamic set updating prevent attackers from collecting sufficient CRPs to train accurate models?
• RQ4 What is the impact of RSO on the false acceptance rate (FAR) and false rejection rate (FRR) in practical authentication scenarios?
• RQ5 How does RSO compare in hardware cost to existing obfuscation techniques like Controlled-PUF, PUF-FSM, and Slender PUF?

Key findings

• For a 64×64 Arbiter PUF, with a set size of 32, prediction accuracy of all tested ML models (Logistic Regression, SVM, ANN, CNN, CMA-ES) drops to approximately 50% even after 1 million collected CRPs.
• The equal error rate (EER) for the 64×64 RSO-based Arbiter PUF is 1.7×10⁻⁶, meeting practical security standards.
• For the 128×128 RSO-based Arbiter PUF, the EER is 8.9×10⁻¹¹, indicating extremely low error rates suitable for high-security applications.
• RSO-based PUF consumes only 405 LUTs and 181 DFFs on an FPGA, significantly less than Controlled-PUF (1830 LUTs), PUF-FSM (960 LUTs), and Slender PUF (1168 LUTs).
• The TRNG and obfuscation logic can be reused from existing systems or derived from metastable PUF responses, minimizing additional hardware cost.
• The method is universally applicable to all strong PUFs and does not compromise PUF reliability due to the nature of XOR-based obfuscation