Familiarity, Not Detection: Rethinking Machine-Learning Hardware Trojan Detection Under Leakage-Free Side-Channel Evaluation

Abstract Machine-learning detectors for hardware Trojans (HTs) from power side-channel traces are widely reported to reach 87–100% accuracy on the standard Trust-HUB AES benchmarks. We show that these figures largely reflect Trojan familiarity rather than Trojan detection: they are obtained under random trace-level splits that place traces of the same Trojan in both training and test. We re-evaluate the problem under a protocol that is leakage-free by construction, partitioning strictly at the Trojan level, and report five findings on the Trust-HUB AES power dataset (12 Trojans, AES-T400–T2000). First, within a benchmark, Trojan activity is detectable for 11 of 12 Trojans (mean ROC-AUC 0.84), but the discriminative signal is diffuse and low-SNR, so global-average-pooling CNN/Transformer backbones common in this literature collapse to chance. Second, zero-shot detection of an unseen Trojan family falls to 0.53 ROC-AUC— below chance for several Trojans—a 0.30 drop that is robust to an independent, taxonomy-based family definition. Third, the collapse is a controlled donor effect: one Trojan’s detectability swings from 0.97 to 0.00 depending solely on whether a single related Trojan is present in training. Fourth, the failure is neither a capacity nor a representation problem—nine model families, including a hybrid CNN-attention network, self-supervised contrastive pretraining, and a selective state-space (Mamba-style) model, all remain at the wall—and it does not follow the functional taxonomy by which Trojans are categorized (payload/trigger type explain < 1% of transfer variance). Fifth, once a handful of the target chip’s own labels are available, the simplest detector—nearest-centroid on those labels— beats every cross-Trojan transfer scheme, while pooling other Trojans actively hurts. We conclude that side-channel HT detection cannot be deployed as a universal pretrained model and requires per-chip calibration, and we recommend Trojan-disjoint evaluation as standard practice.