Trojan Localization in Generic AMS Circuits from Combined Power and Functional Queries

Hardware Trojans can potentially be inserted into the design by untrusted manufacturers or during the design phase and can compromise system security and privacy. Extensive research has focused on detecting Trojans in digital circuits, while analog and mixed-signal (AMS) circuits have been less explored. Additionally, while Trojan detection has received a lot of attention, Trojan localization, i.e. guessing which nodes of the circuit may be compromised by the Trojan is a less studied problem. In our work we aim at this problem using an automated machine learning-based flow, based on generating synthetic data collected from the circuit's simulation model, combining both power and functional observations, and utilizing both supervised and unsupervised learning techniques. We use uncertainty sampling, and differential queries, and augment our data with process-variation modeling to improve the robustness of the framework. We observe high accuracies in both classification and localization tasks on our representative benchmark circuits. We show how without additional data generation, sensitivity analysis can be used to identify nodes on which Trojan detection and localization may be harder.