PUFs Deep Attacks: Enhanced modeling attacks using deep learning techniques to break the security of double arbiter PUFs
Why this work is in the frame
A frame that forgets how it found something cannot be audited. These are the routes that admitted this work.
Bibliographic record
Abstract
In the past decade and a half, physical unclonable functions (PUFs) have been introduced as a promising cryptographic primitive for hardware security applications. Since then, the race between proposing new complex PUF architectures and new attack schemes to break their security has been ongoing. Although modeling attacks using conventional machine learning techniques were successful against many PUFs, there are still some delay-based PUF architectures which remain unbroken against such attacks, such as the double arbiter PUFs. These stronger complex PUFs have the potential to be a promising candidate for key generation and authentication applications. This paper presents an in-depth analysis of modeling attack using deep learning (DL) techniques against double arbiter PUFs (DA-PUFs). Unlike more conventional machine learning techniques such as logistic regression and support vector machines, DL results show enhanced prediction accuracy of the attacked PUFs, thus pushing up the boundaries of modeling attacks to break more complex architectures. The attack on 3-1 DAPUFs has improved accuracy of over 86% (compared to previous research achieving a maximum of 76%) and the 4-1 DAPUFs accuracy ranges between 71%-81.5% (compared to previous research of maximum 63%). This research is crucial for analyzing security of existing and future PUF architectures, confirming that as DL computations become more widely accessible, designers will need to hide the PUFs CRP relationship from attackers.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
Full frame distilled prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. Learned from the 10,348 direct Codex labels and 10,348 direct Gemma labels. Candidate is the union of thresholded teacher heads; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels or direct frontier model labels.
Codex and Gemma teacher scores by category
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.001 | 0.000 |
| Meta-epidemiology (narrow) | 0.000 | 0.000 |
| Meta-epidemiology (broad) | 0.000 | 0.000 |
| Bibliometrics | 0.000 | 0.001 |
| Science and technology studies | 0.000 | 0.000 |
| Scholarly communication | 0.000 | 0.001 |
| Open science | 0.001 | 0.001 |
| Research integrity | 0.000 | 0.001 |
| Insufficient payload (model declined to judge) | 0.000 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from it