LATTE: Library Attack for Evaluating Hardware IP Protections Against Reverse Engineering

The modern semiconductor industry utilizes third-party intellectual property (IP) vendors and untrusted offshore facilities to satisfy the demand for integrated circuits (ICs) and increase profits, leading to a significant increase in IP piracy, counterfeiting, and reverse engineering (RE) throughout the IC life cycle. Various countermeasures have been proposed to protect sensitive IP against confidentiality and integrity attacks, yet they remain vulnerable to adversaries trying to bypass or disable these countermeasures. Existing countermeasures assume a threat model that classifies attack vectors depending on the adversary’s access to a functional and unprotected design (<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">oracle</i>), but it does not account for a skilled adversary with privileged access to the IC supply chain. In this paper, we introduce LATTE, a novel attack strategy that uses design features extracted from a protected IP to generate a library of candidate IPs and employs cut-point comparison to identify the closest match. Our experimental results demonstrate that LATTE can compromise various IP protection countermeasures and successfully recover the original IP from a library curated from open-source benchmarks, highlighting the need to address this vulnerability in contemporary IP protection solutions.