Assertion-Based Trojan Localization Using Iterative Path Sensitization

Abtract-The globalization of system-on-chip (SoC) designs in the IC supply chain has compromised security by allowing attackers to inject malicious circuitry. This introduces security violations, including critical information leakage or denial of service attacks. In this paper, we propose an automated technique to localize Trojans responsible for causing the failure of assertions that capture the design's security specifications. Our approach involves sensitizing paths for Trojan activation and assertion failure from various counterexamples, performing root cause analysis on assertion failure. These paths are expressed as temporal logic constraints, which can be negated and applied to obtain more insightful paths. We effectively localize Trojans with fewer false positives by identifying the common path activated for assertion failure. We have conducted experiments on various types of Trojans, including benchmarks from Trust-HUB, using assertions developed for test cases of different sizes and complexities to demonstrate the technique's scalability. In addition, we conducted a figure-of-merit comparative study against traditional localization methods.