
\section{AI for security-aware design of Analog Integrated circuits}\label{sec:analog}
Analog ICs are the fundamental components that interface with the real-world signals which are continuous and arbitrary in nature. Hence, the design of analog circuits are considered the foundation for all IC design. In this regards, analog IC design comprises of design of analog, radio frequency (RF), and mixed-signal ICs such as amplifiers, oscillators, filters, power regulators, data converters,~\textit{etc.,}{} Analog IC design traditionally involves a lot of manual work and hence relies heavily on expert knowledge and intuition. This is the case because unlike their digital counterparts, analog design steps typically overlap and have a higher number of complex design constraints and specifications that need to be met simultaneously. Thus, the automation of design of analog circuits and consequently analog security primitives has not gathered a lot of traction compared to digital circuits. Nevertheless, it has become paramount that the design of analog circuits be automated with the inclusion of security-aware features because of the following reasons:
\begin{itemize}
    \item \textbf{Bottleneck of the design process:} Design of analog ICs involves a lot of manual steps as explained above and are hence considered the bottleneck in any electronic system design~\cite{swings1990intelligent}. Since analog ICs are prevalent in almost all ICs, it is imperative that they be designed as swiftly as their digital counterparts to meet the current demands of low power, high performance, and quick time-to-market. Furthermore, this increasing demand coupled with error-prone manual process demands an inclusion of security-aware features in the design.
    \item \textbf{High susceptibility to reverse engineering:} Analog ICs are generally fabricated in higher or older technology nodes compared to digital ICs. They also have fewer number of transistors (in order of hundreds compared to billions) and have a lower current density, which makes it easier for the attacker to figure out the underlying intellectual property (IP) using the process of reverse engineering~\cite{alam2018challenges}. 
    \item \textbf{Lack of cryptomodules, error tolerance, and security primitives:} There's a severe lack of security features and primitives applicable for analog ICs as a large amount of research has focused on digital ICs~\cite{alam2018challenges}.
    \item \textbf{Impact of process variation:} Robust analog design has become ever so challenging with the continuous advancement in technology node and device scaling because the analog parameters are affected significantly more across process, voltage, and temperature (PVT) variations. This has made the design of reliable analog circuits very strenuous~\cite{razavi2000design}. 
    \item \textbf{Lack of comprehensive descriptiveness of design and security issues in conventional CAD approaches:} Depending on the type of analog IC, the specifications and requirements vary quite a lot. Hence, one unified framework or CAD approach is not applicable to the design of analog ICs. Hence, there is a severe lack of comprehensive description of design and security issues in traditional CAD approaches~\cite{scheible2015automation}. 
    \item \textbf{Inapplicability of most digital based security solutions:} The design flow of digital ICs is significantly different compared to analog ICs. Hence, the design and security approaches proposed for digital ICs are not applicable for analog and even mixed-signal ICs. Furthermore, the design of these security features require design and cost overheads which are only expendable in the case of large digital ICs. 
\end{itemize}
Henceforth, in this section, we focus on the recent developments of the use of automated techniques including AI based approaches and optimization techniques in the design of analog ICs and security primitives. 

\input{Sections/optimization_algorithm}

\begin{figure}[t]
\centering
\includegraphics[width=1\columnwidth]{Images/Analog/analog_design_v2.png} 
\caption{General analog IC design flow.}
\label{fig:analog_design_flow}
\end{figure}
\subsection{Analog IC Design Flow and AI/ ML Techniques}\label{sec:analog_design_flow}
Fig.~\ref{fig:analog_design_flow} provides a general overview of analog IC design which is drastically different compared to the digital circuit flow shown in Fig.~\ref{fig:icsecurity}. This is a top-down design approach as described by Gielen et. al.~\cite{gielen2000computer}. First, the analog IC designer chooses a topology and designs the schematic such that a given set of design constraints and specifications are fulfilled. Then, the transistors and other analog elements are sized very carefully and simulated using a circuit simulator. Next, the layout engineer generates the physical implementation of the IC based on the schematic, performs physical verification (DRC and LVS), extracts the parasitics, optimizes the location of circuit elements to fulfill the area and power specifications, and performs the post-layout simulation. This process of layout and simulation continues until the specified physical constraints are met after which the IC is ready to be fabricated. The design process is completed by testing the analog IC against the design specifications. If the IC fails the test, then the analog designer has to repeat the whole process and either resize the design or choose a different topology altogether. This process usually goes for several iterations until the IC is ready to be fabricated at a large scale. 

\begin{table}
\centering
\caption{AI/ ML techniques used in every design stage of the analog IC design process.}
\label{tab:design_analog}
\arrayrulecolor{black}
\resizebox{\linewidth}{!}{%
\begin{tabular}{|c|c|c|} 
\hline
\rowcolor[rgb]{0.361,0.769,0.769} \textbf{Design stage} & \textbf{Techniques} & \textbf{AI/ ML algorithms used} \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}} & Selection & CNN~\cite{matsuba2018inference} , Polynomial regression~\cite{kaya2018analog}  \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}--|}
{\cellcolor[rgb]{1,0.859,0.604}} & Feature
  extraction & Supervised/
  unsupervised learning~\cite{li2016analog} , GNN~\cite{kunal2020general}  \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}--|}
\multirow{-3}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\begin{tabular}[c]{@{}>{\cellcolor[rgb]{1,0.859,0.604}}c@{}}\textbf{ Topology}\\\textbf{~selection }\end{tabular}} & Generation & RNN~\cite{rotman2020electric} \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}} & Model-based & \begin{tabular}[c]{@{}c@{}}SVM~\cite{ding2005active}, RBF/ MLP~\cite{passos2006rbf}, Bayesian NN~\cite{gao2019efficient}, \\ANN with sparse regression~\cite{tao2015harvesting}, DNN~\cite{takai2017prediction}, ANN~\cite{lourencco2018exploration, dumesnil2015rf}, \\Gaussian-based regression model~\cite{sanabria2020gaussian}, SVM~\cite{wang2018rfic}, BO~\cite{huang2021bayesian}, RL~\cite{zhao2020deep}\end{tabular} \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}--|}
\multirow{-2}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\begin{tabular}[c]{@{}>{\cellcolor[rgb]{1,0.859,0.604}}c@{}}\textbf{ Circuit sizing }\\\textbf{and biasing }\end{tabular}} & Simulation-based & \begin{tabular}[c]{@{}c@{}}ANN~\cite{islamouglu2019artificial, li2019artificial, wolfe2003extraction, bhatia2016modelling, jafari2010design}, RL~\cite{wang2018learning, settaluri2020autockt},~ GA~\cite{harsha2018integrated, das2007automated}, \\Hybrid EA~\cite{liu2009analog}, (RNN, DNN)~\cite{wang2018application}\\~GCN~\cite{wang2020gcn}, ANN with Polynomial regression~\cite{lourencco2019using}\end{tabular} \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}\textbf{ Simulation } & \begin{tabular}[c]{@{}c@{}}Behavioral\\modeling\end{tabular} & \begin{tabular}[c]{@{}c@{}}TDNN~\cite{grabmann2019power}, ANN~\cite{zhang2003artificial}, RNN~\cite{murphy2021automated}, \\Bayesian linear regression and SVM~\cite{pan2019late}, \\ Augmented NN~\cite{yu2017method},~RNN~\cite{chen2017verilog}, \\ NN~\cite{hasani2017compositional}, ANN with GA~\cite{dumesnil2014rf}\end{tabular} \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}} & Layout & ML~\cite{kunal2019align} ,
  Spectral graph analysis~\cite{chen2020magical}  \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}--|}
{\cellcolor[rgb]{1,0.859,0.604}} & Placement & ANN
  ~\cite{ guerra2019artificial, gusmao2020semi} , GNN~\cite{li2020customized} , (SVM, NN, Random forest)~\cite{li2020exploring} , LP~\cite{chen2020magical}  \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}--|}
\multirow{-3}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\textbf{ Layout }} & Routing  & Generative NN~\cite{ zhu2019geniusroute},
  grid-based A*~\cite{chen2020magical} \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}} & Performance
  modeling & \begin{tabular}[c]{@{}c@{}}DNN with ES~\cite{hakhamaneshi2019bagnet}, \\ANN with Polynomial regression~\cite{lourencco2019using}, \\(SVM, NN, Random forest)~\cite{li2020exploring}, \\CNN with transfer learning~\cite{liu2020towards}\end{tabular} \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}--|}
\multirow{-2}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\begin{tabular}[c]{@{}>{\cellcolor[rgb]{1,0.859,0.604}}c@{}}\textbf{ Post-layout}\\\textbf{and test}\end{tabular}} & Fault
  diagnosis & Decision
  tree~\cite{stratigopoulos2014fast}, RideNN~\cite{binu2018ridenn} , GB-DBN~\cite{liu2017capturing}, DBN~\cite{zhao2018novel} , BMF~\cite{wang2015bayesian}  \\
\hline
\end{tabular}
}
\end{table}

\subsubsection{Topology selection}
Topology design and selection is the first step in the design of analog ICs. This step is one of the most critical and time-consuming step due to its impact on the circuit performance. Traditionally, it is carried out manually by designers with expert knowledge and intuition. With demands for high performing analog circuits increasing, researchers as shown in Table~\ref{tab:design_analog} begun to explore ML techniques that speed up the topology design process. Most of the early work focused on small functional units such as amplifiers and filters using simple search-based algorithms. Recently, Matsuba~\textit{et al.}{} in~\cite{matsuba2018inference} attempted to use CNN to select from only four topologies of an amplifier with 13 different characteristics. Similarly, Kaya~\textit{et al.}{} in~\cite{kaya2018analog} have used design space exploration to generate different \textbf{Pareto-optimal fronts (POFs)} in the context of balancing design specifications across different topologies. These POF based topologies are then fitted into a polynomial regression model for the final selection; however, the performances of these techniques are highly dependent on the created datasets. Researchers in ~\cite{li2016analog, kunal2020general} have instead used feature extraction techniques to ensure that the complex relationships between various topological components are well understood by the algorithm. Li~\textit{et al.}{}~\cite{li2016analog} uses both supervised and unsupervised methods to extract features of sub-blocks and connections within a topology while Kunal~\textit{et al.}{}~\cite{kunal2020general} uses graph neural networks~(GNN) to extract symmetry constraints among different topologies. However, none of these techniques generate a topology automatically. One of the recent works in~\cite{rotman2020electric} uses recurrent neural network~(RNN) and hypernetworks to generate a topology for a two-port circuit.

\subsubsection{Circuit sizing and biasing}
After a topology is selected for a specific design, the next step is to size the components within the circuit and bias the design appropriately to meet the desired specifications. This step is also referred to as \textbf{analog synthesis}. Depending on the number of components, this step is one of the most tedious ones as the design space is fairly large. As shown in Table~\ref{tab:design_analog}, there have been even more ML and optimization techniques to automate this step. These works can be briefly categorized into two different techniques: \textit{model-based} and \textit{simulation-based}.

\paragraph{Model-based techniques} These use regression models or surrogate models to represent the performance of the circuit. They are thus quicker than the simulation-based approaches which rely on circuit simulators to continuously optimize the parameters of the circuit. Most of the model-based works have either used neural networks~\cite{passos2006rbf, gao2019efficient, takai2017prediction, lourencco2018exploration, dumesnil2015rf} or regression models~\cite{tao2015harvesting, sanabria2020gaussian} all in the attempt to speed-up the circuit optimization and evaluation process. 
\begin{wrapfigure}[17]{R}{0.35\textwidth}
\centering
\includegraphics[width=0.35\textwidth]{Images/Analog/RL_AnalogCircuit.png}
\caption{Overview of the circuit design framework as proposed in~\cite{settaluri2020autockt}.}
\label{fig:RL_analogcircuit}
\end{wrapfigure}

\paragraph{Simulation-based techniques} These are considered superior since they are able to closely match real world (or post-silicon) circuit performance. Traditionally, simulation-based techniques have used evolutionary approaches~(EA) such as genetic algorithm~(GA) as seen in~\cite{das2007automated, harsha2018integrated, liu2009analog} to synthesize a wide-range of analog circuits. There have been a lot of works using neural networks~\cite{islamouglu2019artificial, li2019artificial, wolfe2003extraction, bhatia2016modelling, jafari2010design} to help find appropriate circuit parameters and biases; however, these techniques only work for a specific circuit such as amplifier or a filter. The goal has always been to either reduce human effort or mimic human intuition in designing these analog circuits. In this regard, the works in~\cite{settaluri2020autockt, wang2018learning, zhao2020deep} have used reinforcement learning~(RL) to design common analog circuits as much as 25 times faster than traditional optimization algorithms. Zhao~\textit{et al.}{}~\cite{zhao2020deep} used the RL framework along with a symbolic analysis based approach that rapidly evaluated the circuit output without invoking a simulator. 

One of the reasons that RL-based approaches are gaining more traction these days is because of their ability to quickly learn and find the balance across different specifications. The other reason is their ability to transfer their knowledge, which experts expect will enable \textbf{IP reuse}, rapid automation, and \textbf{porting} between different technology nodes. Inspired by this ability, Wang~\textit{et al.}{}~\cite{wang2020gcn} used graph convolutional networks~(GCN) to extract features of components and connections within the circuit and the RL agent to transfer these features whenever possible (\textit{e.g.,}{}, features between a two-stage and a three-stage amplifier) and tune the circuit parameters quickly. In both cases of transfer learning,~\textit{i.e.,}{}, between technology nodes and circuit topologies, the proposed RL-based sizing achieved the highest Figures of Merit (FoM) when compared with conventional black-box optimization methods and human expert designs. Similarly, the work in~\cite{settaluri2020autockt} uses NN as their RL agent (see Fig.~\ref{fig:RL_analogcircuit}). Transfer learning is also enabled here since the RL agent trained by running inexpensive schematic simulations can transfer its knowledge to a different environment,~\textit{i.e.,}{}, the design including layout parasitics. The results for post-layout simulations provided in~\cite{settaluri2020autockt} demonstrate that it can converge faster than the traditional EA-based approaches.

\subsubsection{Simulation}
The next step in the design process is simulation to check whether the synthesized circuit satisfies the design specifications or not. Analog designers heavily rely on circuit simulators such as HSPICE and Cadence Spectre to assess the performance of their designs. However, behavioral modeling based techniques as shown in Table~\ref{tab:design_analog} have been proposed to speed up the simulation process and depending on the circuit application tune these models to assess application-specific performance metrics with more accuracy. In this regards, researchers have turned to neural network-based learning and modeling~\cite{grabmann2019power, zhang2003artificial, murphy2021automated, pan2019late}. For instance, in~\cite{grabmann2019power}, Grabmann~\textit{et al.}{} used time-delay neural network~(TDNN) to generate energy-aware AMS IP cores. Similarly, ML algorithms along with optimization techniques have been used to find optimal solutions across a wider search range effectively and efficiently. In this regards, work in~\cite{pan2019late} first creates the data by exploring different device behaviors across different technologies, which is then fitted to a Bayesian regression model. Finally, SVM along with GA is employed in parallel to reduce the runtime compared to a pure EA-based optimization framework. 

\subsubsection{Layout}
ML and AI techniques have also been employed to automate the layout of analog circuits. The work in ~\cite{kunal2019align} summarizes early efforts in putting together an open-source quick layout generation flow for analog circuits that leverages template-driven design and machine learning techniques without human designers in the loop. In this regard, the recent work MAGICAL~\cite{chen2020magical} takes an unannotated netlist and design rules as inputs to create a complete GDSII using an automation framework. They use spectral graph analysis for layout, linear programming~(LP) for placement, and grid-based A* algorithm for efficient optimized routing. Recently, graph based machine learning networks such as GNN have been used to create models that predict the performance for a given placement and allows knowledge transfer between different analog circuits~\cite{li2020customized} which achieves better performance than CNN and regression based plug-in approaches. Similarly, Geniusroute~\cite{zhu2019geniusroute} uses variational autoencoders to extract latent layout strategies based on human expertise and then trains a generative NN based model to guide the automatic routing. 

\subsubsection{Post-layout and Test}
Post-layout simulation involves numerous iterations of verification and re-designs until the desired specifications are met. This is mainly due to the domination of layout parasitics. Performance modeling techniques such as BagNet~\cite{hakhamaneshi2019bagnet} use DNNs along with cross-entropy and canonical evolutionary strategies~(ES) to reduce this number of iterations significantly by leveraging past information and improving the optimizer's sample efficiency. Similarly, the recent work by Liu~\textit{et al.}{}~\cite{liu2020towards} uses CNN and transfer learning to enable early design pruning for effective design space exploration and ensure robust well-performing placement features.
Further, the difficulty in obtaining accurate performance models of analog circuits have led to data-driven fault-diagnosis models for correctly assessing the analog circuit design. However, because of the highly non-linear and complex nature of analog performance faults, deep learning based techniques~\cite{binu2018ridenn, liu2017capturing, zhao2018novel} have fared better compared to shallow networks~\cite{stratigopoulos2014fast, wang2015bayesian}. Specifically, the use of deep belief networks~(DBN) have proven to be most effective as evident in~\cite{liu2017capturing, zhao2018novel} because of their ability to use raw time domain signals as inputs and employ an adaptive feature extraction and fault classification techniques.

\subsection{Security Issues in the AMS IC Design and Fabrication Flow} \label{sec:analog_security_issues_design}

\begin{figure}[t]
\centering
\includegraphics[width=1\columnwidth]{Images/Analog/analog_security_vulnerabilities.png}
\caption{Analog IC design security vulnerabilities.}
\label{fig:analog_sec_issues}
\end{figure}

The security issues pertaining to analog ICs are summarized by the supply-chain vulnerabilities which have increased within the last decade or so as a result of globalization. These issues as shown in Fig.~\ref{fig:analog_sec_issues} can be categorized into hardware Trojans and IC counterfeiting. 
\subsubsection{Hardware Trojans}
As discussed previously for digital ICs, Trojans are intentionally created anomalies which remain hidden and difficult to detect because they are triggered by rare conditions. Analog Trojans can be further categorized into charge-based Trojans~\cite{kison2019security} and hidden backdoors such as covert channels established by exploiting process variations~\cite{subramani2017ace}. Charge-based Trojans either use switched capacitors to design a trigger circuit or exploits capacitive couplings to design Trojans with no area overhead~\cite{kison2019security}. Hidden backdoors in the case of analog ICs mainly pertain to wireless RF networks where a Trojan circuit is designed to establish a previously unknown channel by exploiting process variation margins of the target circuit~\cite{subramani2017ace}. Although it is difficult to design purely analog Trojans (analog payload with analog trigger), they are more attractive than their digital counterparts because of their smaller footprint and their incompatibility/ invisibility to digital functional testing and verification techniques. As such there are works in AMS ICs where the trigger is hidden in the digital portion of the IP and its payload is transferred to the analog portion via test access mechanism~\cite{elshamy2020hardware}. With the advent of analog EDA tools and ML-based approaches to circuit design, it opens up more opportunities to exploit such tools and approaches to design analog hardware Trojans efficiently.

\subsubsection{IC Counterfeiting}
Analog ICs are one of the most widely reported counterfeited parts amongst all types of ICs~\cite{IHS_data}. The major reasons for analog counterfeiting are two-fold: First, they are easy to reverse engineer because of low transistor count and large transistor footprint. Second, analog IP design is cumbersome, manual labor-intensive, and highly dependent on knowledge expertise; hence, their value is significantly higher in the black market~\cite{rutenbar2006design}. IC counterfeiting can be briefly categorized into IP Piracy, IC recycling, reverse engineering, overproduction, and sale of defective ICs as shown in Fig.~\ref{fig:analog_sec_issues}. 
As these are supply chain related issues, the use of automation tools and AI/ ML techniques does not change the degree of vulnerability of the analog IPs. However, the use of such techniques does give rise to more opportunities in terms of security-aware design and security primitive optimization. The next subsection describes some of the security primitives which can be designed and exploited at different design stages.

\subsection{Design of Analog Security Primitives Within the Design Flow} \label{sec:analog_security_design}




Table~\ref{tab:security_analog} summarizes analog security primitives that employ either ML algorithms or an automation framework based on popular optimization techniques at various stages of the analog IC design flow. The table also mentions the associated security issues that are tackled by these proposed security primitives. 
\subsubsection{Physically Unclonable Functions (PUFs)}
As discussed earlier, PUFs are hardware security primitives which can either be used to create hardware authentication mechanisms or generate unique keys for cryptographic schemes. PUFs are devised by exploiting the inherent \textbf{process variation} or uncontrollable randomness present in every IC from manufacturing. This capability makes them a low-overhead, volatile security primitive that is more resistant to physical, side-channel, and software-based attacks. PUF design usually involves utilizing a specific circuit structure present inside an IC during the design step to function as a PUF. For example, the analog PUF proposed in~\cite{alvarez201514} leverages the threshold voltage mismatch between transistors in a cascode current mirror. With the size of ICs shrinking over the last few years, the limited number of input/output (I/O) pins and the difficulty of meeting both analog and PUF based specifications has made it challenging to devise a PUF suitable for analog ICs. In recent years, a few researchers have leveraged circuit sizing based automation and optimization tools to design robust PUFs that can produce unique yet random and reliable output bit suitable for device authentication.

The work in~\cite{chowdhury2020weak} uses GA and linear programming (LP) to size the transistors of an asynchronous null conventional logic (NCL) based gate (such as NCL TH22 gate) to devise a PUF circuit. This PUF utilizes the startup characteristics of cross-coupled inverters to produce a metastable output. The circuit is sized such that this output is only affected the inherent process variations and mismatch of the inverters inside the NCL structure. Because of the asynchronous nature of the circuit, this PUF is applicable for AMS circuits. Similarly, the recent work in~\cite{shah2021introducing} demonstrates a way to convert any circuit to a recurrent PUF (Rec-PUF). This is accomplished by utilizing a RNN-inspired technique involving combination of recurrence and XOR to generate a response (PUF output) which has very little correlation to its corresponding challenge (PUF input). They use the current mirror array (CMA) architecture proposed in~\cite{wang2017current} and improve its output reliability and its resiliency against ML-based attacks. In CMA-PUF~\cite{wang2017current}, transistors are sized small and are operated in sub-threshold region to maximize the mismatch. Further, the PUF utilizes a current controlled oscillator~(CCO) to digitize the current values of each column in the CMA. In~\cite{shah2021introducing}, the authors propose a Rec-CMAPUF where they replace CCO with a shared comparator to eliminate each column CCO's bias. They then feed the comparator's digitized output back to the input and perform the XOR operation to get the final output. This feedback or recurrence operation introduces non-linearity in the challenge-response-pair (CRP) space and increases the resistance to ML attacks. As analog PUFs are becoming more attractive, especially in the context of cryptographic ICs, the deep learning based sizing tools like RL based tools will surely be used to explore the design space and devise more reliable PUFs. For example, the sizing tools in~\cite{settaluri2020autockt,wang2020gcn,wang2018learning} can easily be used to include the PUF specifications as the additional design requirement and size the circuit to design a  PUF robust across all possible challenge-response pairs. 



\begin{table}
\centering
\caption{AI/ ML based techniques and primitives to tackle security issues in analog ICs.}
\label{tab:security_analog}
\arrayrulecolor{black}
\resizebox{\linewidth}{!}{%
\begin{tabular}{|c|c|c|c|} 
\hline
\rowcolor[rgb]{0.361,0.765,0.773} \begin{tabular}[c]{@{}>{\cellcolor[rgb]{0.361,0.765,0.773}}c@{}}\\ \textbf{Design stage}\end{tabular} & \textbf{Techniques} & \textbf{AI/ ML algorithm} & \textbf{Security Issues tackled} \\ 
\hline
{\cellcolor[rgb]{1,0.855,0.604}} & PUF~\cite{shah2021introducing, chowdhury2020weak} & RNN~\cite{shah2021introducing},  (GA, LP)~\cite{chowdhury2020weak} & IP  Piracy and Counterfeiting \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.855,0.604}}->{\arrayrulecolor{black}}---|}
\multirow{-2}{*}{{\cellcolor[rgb]{1,0.855,0.604}}\textbf{ Circuit Design }} & Logic Locking~\cite{volanis2019analog, gummidipoondijayasankaran2020towards} & ANN~\cite{volanis2019analog},  Simulated annealing~\cite{gummidipoondijayasankaran2020towards} & IP Piracy~\cite{volanis2019analog}, Overproduction~\cite{gummidipoondijayasankaran2020towards} \\ 
\hline
{\cellcolor[rgb]{1,0.855,0.604}}\textbf{ Layout } & ObfusX~\cite{zeng2021obfusx} & Explainability with RepTree & IP  Piracy, Hardware Trojans \\ 
\hline
{\cellcolor[rgb]{1,0.855,0.604}}\textbf{Simulation} & Aging simulation & \begin{tabular}[c]{@{}c@{}} RNN~\cite{rosenbaum2020machine}, \\(K-means, NN, SVM)~\cite{santhana2021recycled}\end{tabular} & IC Recycling \\ 
\hline
{\cellcolor[rgb]{1,0.855,0.604}}\textbf{ Fabrication} & \begin{tabular}[c]{@{}c@{}}Split Chip Design~\cite{pagliarini2020split}, \\Fab-of-origin~\cite{ahmadi2016machine}\end{tabular} & \begin{tabular}[c]{@{}c@{}}Branch-and-bound algorithm~\cite{pagliarini2020split},\\(PCA, DNN,~\textit{etc.,}{})~\cite{ahmadi2016machine}~\end{tabular} & IP  Piracy \\ 
\hline
{\cellcolor[rgb]{1,0.855,0.604}}\textbf{Test} & \begin{tabular}[c]{@{}c@{}}Side-channel fingerprinting~ \\and Authentication \\mechanisms\end{tabular} & \begin{tabular}[c]{@{}c@{}}ANN~\cite{liu2015concurrent}, (MLP, CNN)]~\cite{hanna2019deep}, PCA~\cite{casto2018multi},\\ SVM~\cite{chang2014approximating, acharyaldo}, (K-means, KNN, SVM)~\cite{chowdhury2020recycled}\end{tabular} & \begin{tabular}[c]{@{}c@{}}Hardware Trojan~\cite{liu2015concurrent},\\(Counterfeiting, Cloning)~\cite{casto2018multi},\\~IC Recycling~\cite{chowdhury2020recycled, chang2014approximating,acharyaldo, huang2012parametric}\end{tabular} \\
\hline
\end{tabular}
}
\end{table}

\subsubsection{Analog Locking Techniques}
There have been several attempts to expand logic locking to protect analog ICs from piracy and counterfeiting. These techniques either try to obfuscate the circuit current or the voltage biasing to hide the correct functionality of an analog IC. However, most of these techniques are susceptible to logic removal and model approximation attacks~\cite{9000113,acharya2020attack} because of low transistor count, large transistor size, and the fact that the key is implemented in digital domain. To improve the resiliency against such attacks, logic locking techniques utilizing ML algorithms have been proposed. Volanis~\textit{et al.}{} in~\cite{volanis2019analog} proposed the use of an on-die analog neural network where the trained ANN acts as a lock and its analog input acts as a key. This is achieved by eliminating direct access to the biasing inputs of the analog IC by utilizing the ANN for biasing the IC to its operating point. The ANN is made programmable by the use of floating-gate transistors which serves as a permanent storage for the synapse weights. Furthermore, the keys are in analog domain and are continuous in nature allowing for a large number of key options making this locking technique resilient against brute-force and logic removal attacks. However, because of the very same fact, there does exist a number of possible keys that can give one similar performance as the oracle output. A possible way to ensure that does not happen is to find a global solution using methods such as the one described in~\cite{li2019artificial} that utilizes GA-based global search and ANN-based local minima search techniques. 

Similarly,~\cite{gummidipoondijayasankaran2020towards} attempts to tackle the issue of overproduction of an IC by a foundry. This technique, however, implements the lock in the digital section of an AMS circuit to minimize the effects of process variation by implementing a tuning knob to optimize the values of passive components in an analog circuit. The lock essentially controls the tuning knob based on an on-chip simulated annealing~(SA) based digital optimizer~\cite{wang2015built} to help nullify process variation-related effects. This optimizer hence acts as an post-processing tool that helps obtain a robust output. However, the area overhead of implementing the self-optimization architecture and the lock is too high for a typical AMS circuit such as band-pass filter, LNA, and a low-dropout oscillator~(LDO) as proposed in the paper. This could be overcome by designing robust analog models using learning based approaches~\cite{hasani2017compositional, pan2019late} to find optimal design parameters without the use of additional circuitry. Moreover, the RL-based techniques~\cite{wang2020gcn,settaluri2020autockt} can tune the design to be robust against process variations by using multiple design runs and leveraging its transfer learning abilities.

\subsubsection{Layout Obfuscation}
\cite{zeng2021obfusx} proposed an obfuscator for split manufacturing that relied on \textit{explainability} of ML-based attacks. As discussed earlier, split manufacturing is a technique where the untrusted foundry only receives and fabricates a partial layout to prevent the attacker from extracting the full design or IP of an IC. However, this still does not prevent ML-based attacks if the layout is either not obfuscated properly or is not obfuscated at all. The method in~\cite{zeng2021obfusx} implements different routing-based obfuscation techniques such as blockage insertion, routing perturbation, and wire-lifting based on an explanatory metric devised by leveraging ML attack models. The metric, shapely additive explanation~(SHAP) value essentially helps identify the most vulnerable connections within a layout and helps the obfuscator redo the obfuscation until the desired SHAP value is reached. This obfuscator can be easily incorporated with automated layout tools such as MAGICAL~\cite{chen2020magical} to perform highly secure layouts of analog ICs.

\subsubsection{Aging Simulation}
Incorporating aging analysis and simulation in the design step helps the designer or the IP owner characterize the performance of the circuit according to its life-cycle or usage. Such characterization can also help classify if the chip has been recycled or not. There are commercially available tools such as RelXpert by Cadence~\cite{schaldenbrand2019analog} and MOSRA by Synopsys~\cite{tudor2011mos} which calculate the damage to transistors at incremental simulation times. There are also behavioral models utilizing RNNs to model aged circuits as RNNs are compatible with transient current simulation. The trained RNN models can effectively predict the behavior of a ``fresh'' circuit if it is aged and inversely can help predict the age of an used or aged chip~\cite{rosenbaum2020machine}. In this regard, the works in~\cite{rosenbaum2020machine, santhana2021recycled, chowdhury2020recycled, chang2014approximating} utilize different ML algorithms to predict the age of an used IC. The recent work in~\cite{santhana2021recycled} can predict as low as just 1-day of aging. However, the success of this classification is highly dependent on the aging model developed during the design step which uses the model library, the aging models, and Monte Carlo simulations to help distinguish between process variation related changes and aging related effects. Incorporating circuit specific behavioral models developed using ML techniques such as the operational amplifier model in~\cite{murphy2021automated}, LNA model in~\cite{dumesnil2014rf}, and oscillator model in~\cite{yu2017method} can help design more accurate and robust aging models for various analog circuits. These aging characteristics can be further used after the chip is fabricated by comparing the output performance of fresh, unused ICs to a used one. There are several such techniques proposed which will be explained in Section~\ref{sec:authenticate}.

\subsubsection{Split Chip Design and Fab-of-origin}
Split chip design as proposed in~\cite{pagliarini2020split} differs from its previous counterpart split chip manufacturing proposed in~\cite{vaidyanathan2014building}. The split-chip design consists of dividing the entire chip design into two parts such that they can later be integrated to produce the intended functionality. By doing this, split-chip design avoids technological complexity and logistical challenges of split manufacturing. The design partitioning into multiple sections is then formulated as an optimization problem which is solved using a branch-and-bound algorithm. The objective function is devised based on the vulnerability metric which is essentially the product of exposure (effectiveness of a particular configuration) and criticality (importance of individual models)~\cite{pagliarini2020split}. Split chip design has been described as being effective in tackling the problems of IP theft and piracy within the IC supply chain. However, the chip is split into multiple parts after the design is finalized meaning the appropriate topology is selected and the circuit is already sized and biased appropriately. The circuit designer can easily incorporate this vulnerability metric based optimization with the automated circuit sizing tools such as the one shown in Table~\ref{tab:design_analog} to design even more secure analog circuits.
Similarly, Ahmadi~\textit{et al.}{}~\cite{ahmadi2016machine} proposed a fab-of-origin attestation technique that leverages wafer-level parametric measurements without any information of the design underneath the die to distinguish between chips fabricated in different facilities. The authors proposed solutions for different scenarios related to this attestation problem and relied on several ML techniques such as PCA and DNN. 

\subsubsection{Side-channel based Fingerprinting and Authentication Mechanisms}\label{sec:authenticate}
The side-channel parameters such as power, delay, EM,~\textit{etc.,}{} emitted by an electronic device can be used as a fingerprint of such device to statistically assess if the device is authentic or not. There are several works which make use of behavioral models developed during the design stage to help characterize a fabricated chip as authentic or not. In this regards, the concurrent hardware Trojan detection~(CHTD) technique proposed in~\cite{liu2015concurrent} helps detect Trojans in a wireless RFICs specifically in cryptographic ICs by continuously extracting side-channel fingerprints and evaluating them on a trained on-chip neural classifier. This classifier essentially looks for systematic variations introduced by the hardware Trojan in the transient supply current to expose the malicious operation.

Similarly, the work in~\cite{hanna2019deep} trains behavioral models~(MLP and CNN) of RF transmitters to devise an authentication mechanism. Essentially these models exploit the non-linear characteristics exhibited by the power amplifier to uniquely identify each RF transmitter deployed in the field. The authors evaluated these models under various factors concerning the effects of signal quality, packet length, channel model and modulation type to demonstrate its effectiveness. Similarly in~\cite{casto2018multi}, the author proposes to use Process Specific Function (PSFs) for authenticating AMS ICs such as data converters. The harmonic frequencies and their corresponding magnitude levels are used to develop the PSF-based device identification model. The presented results showed the detection rate of $90\%$ using PCA and the PSF-based model. These side-channel based fingerprints however may not be as effective once the circuit starts to age. Hence, integrating aging models during the design step such as~\cite{rosenbaum2020machine} can help design robust fingerprinting mechanisms. 
Similarly, there are several techniques such as~\cite{chang2014approximating, chowdhury2020recycled, huang2012parametric, chowdhury2020low} who instead exploit aging characteristics without the behavioral models to train a classifier that can successfully distinguish between an aged and an authentic IC. However, these techniques require the use of a golden IC to train an effective model. 

One of the recent works in~\cite{acharyaldo} which is basically the extension of the work in~\cite{chowdhury2020recycled} instead devises an odometer by re-purposing the existing LDO structure present inside almost every IC. This LDO-odometer basically contains two different paths, a reference path which is not aged even when its send out to the field, and a normal path which is activated when out in the field. This self-referencing approach and a trained one-class SVM is then exploited to help characterize if the chip is recycled or not~\cite{acharyaldo} without the use of a golden IC. These aging-based classifiers can be improved by developing behavioral models at the design step which can help better characterize the profiles of these analog devices. For example, the learning methodology to develop behavioral models for complex MIMO system in~\cite{hasani2017compositional} can be used to characterize the LDO in~\cite{chowdhury2020recycled} and the oscillator and LNA in~\cite{chang2014approximating} at the design stage which helps improve the robustness of these aging-based authentication mechanisms. Furthermore, the automated synthesis techniques such as~\cite{settaluri2020autockt, wang2020gcn, wang2018learning} can be used to size the odometer in~\cite{acharyaldo} without incurring extra area and performance overhead. 

\subsection{Security Issues for Analog Security Primitives} \label{sec:analog_security_issues_primitives}

\begin{table}
\centering
\caption{Security vulnerabilities faced by analog ICs.}
\label{tab:security_issue_analog}
\resizebox{\linewidth}{!}{%
\begin{tabular}{|c|c|c|} 
\hline
\rowcolor[rgb]{0.361,0.769,0.769} \textbf{Attacks on} & \textbf{Technique} & \textbf{AI/ ML alg} \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}\textbf{Analog design} & Reverse engineering~\cite{cornforth2014reverse} & EC~\cite{cornforth2014reverse} \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}\textbf{PUFs} & \begin{tabular}[c]{@{}c@{}}Poster attack~\cite{ye2016poster}, \\Ensemble meta-algorithms~\cite{vijayakumar2016machine}\end{tabular} & \begin{tabular}[c]{@{}c@{}}Simulated annealing and EA~\cite{ye2016poster}, \\Bagging and Gradient Boosting~\cite{vijayakumar2016machine}\end{tabular} \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}\textbf{Logic locking techniques} & Attack of the genes~\cite{acharya2020attack} & GA~\cite{acharya2020attack} \\
\hline
\end{tabular}
}
\end{table}

Table~\ref{tab:security_issue_analog} summarizes some of the techniques that utilizes ML and optimization algorithms to execute attacks on an analog IC. 
\subsubsection{Attacks on Analog Design}
The reverse engineering technique proposed in~\cite{cornforth2014reverse} was one of the earliest works that used evolutionary computation~(EC) to reverse engineer the netlist of a simple non-linear analog IP by treating the circuit as a ''black box''. Although the reverse engineered netlist might differ from the actual netlist, the performance of both of these circuits matched rendering the success of such an approach. The recent automated design approaches specially the ones using DL and RL-based techniques may be used to reverse engineer an analog circuit. For example, the automated CNN-based topology selection technique in~\cite{matsuba2018inference} and the RL-based circuit sizing tool in~\cite{wang2018learning} can figure out the netlist with comparable performance within a day. Furthermore, MAGICAL~\cite{chen2020magical}, the automated layout technique can perform an optimized layout that might even outperform the actual design. 
\subsubsection{Attacks on PUFs}
Although PUFs could be resilient to physical as well as ML-based attacks, there are several works which leverages ML techniques to attack a PUF. The work proposed in~\cite{ye2016poster} was one of the first works that used a compound heuristics of evolutionary strategy~(ES), SA, and ant-colony to efficiently attack current mirror PUF~\cite{kumar2014design} and the voltage transfer PUF~\cite{vijayakumar2015novel} with an accuracy of $99\%$. Similarly, the work in~\cite{vijayakumar2016machine} use bagged trees and boosting technique to attack the non-linear analog PUFs. Bagged trees basically aggregates predictions from different instances of decision trees which are fed with disjoint subsets of training set to obtain the final response. While boosting ensemble of meta-algorithms is used to reduce the inherent bias present in DTs by increasing the model complexity. Nonetheless, the authors in~\cite{vijayakumar2016machine} elaborate on some analytical techniques based on the principal of functional composition to evaluate a PUF on its ML-attack resistance. These techniques can be used as security constraints during the process of analog synthesis using automated sizing frameworks like~\cite{settaluri2020autockt, wang2018learning} to size the PUF accordingly and design a ML-attack resistant PUF.
\subsubsection{Attacks on logic locking techniques}
There are several methods proposed to attack analog logic locking techniques such as~\cite{jayasankaran2019breaking, acharya2020attack}. Both of these works assume that the attacker has access to the obfuscated netlist and knows where in the IC the key is being applied. The work in~\cite{jayasankaran2019breaking} uses SMT-solver to extract the correct key locking the analog circuit. While the work in~\cite{acharya2020attack} uses GA to find the obfuscated parameter and the secret key. For this purpose, they devise an objective function based on the difference of the oracle output and the simulated output where the simulated output represents the output obtained by applying a random key generated using GA. Then given given the oracle output and the obfuscated netlist, they demonstrate how the attacker can easily estimate the value of the obfuscated parameter to reduce the search space for finding the correct key. 



\subsection{Machine Learning \& Artificial Intelligence}\label{sec:mlai}
\begin{figure}[t]
\begin{subfigure}{.52\textwidth}
  \centering
 
  \includegraphics[width=\linewidth]{Images/Machine_Learning_Methods.png} 
  \caption{}
  \label{fig:ml_methods}
\end{subfigure}
\begin{subfigure}{.45\textwidth}
  \centering
 
  \includegraphics[width=0.9\linewidth]{Images/Deep_Learning.png}  
  \caption{}
  \label{fig:deep_learning}
\end{subfigure}
\caption{(a) A categorization of major machine learning techniques with relevant examples; (b) An example neural network with three hidden layers.}
\end{figure}

AI is a general term for any machine and/or program that displays some level of intelligence. ML is a sub-field of AI concerned with algorithms that are capable of learning patterns from data without explicitly being told those patterns by a human. Over the years, the availability of large amounts of data and computational resources has led to a rise in the use of ML in a variety of fields. DL is a sub-field of ML that involves the use of artificial neural networks (ANNs), which are organized algorithmic structures that mimic how humans learn as shown in Fig.~\ref{fig:deep_learning}. In recent years, DL has been favored over traditional ML techniques for highly complex tasks with large amounts of complex data.
 
\subsubsection{Types of Machine Learning} There are three main types of ML algorithms: supervised learning, unsupervised learning, and reinforcement learning. An overview of these three main types is provided in the following paragraphs, and example methods are summarized in Fig.~\ref{fig:ml_methods}. 
 
\textbf{Supervised Learning} is a form of task-driven ML that maps inputs to an output, given labeled training examples. Supervised ML is often used for classification and regression tasks. Classification tasks involve mapping inputs to a discrete value (i.e., class label), while regression tasks involve mapping inputs to a continuous value. Note that regression is the general form of classification, since all classification tasks can be conceptualized as predicting the likelihood (which is a continuous value) that an input belongs to each class and returning the class with the highest likelihood. Popular supervised ML methods include support vector machines (SVMs) and random forest for classification tasks, and linear and logistic regression for regression tasks~\cite{alpaydin_2020}. 





\textbf{Unsupervised Learning} is a form of data-driven ML that finds patterns in input data, without the need for labeled training examples. Unsupervised ML is often used for clustering and dimensionality reduction tasks. Clustering tasks involve grouping data based on similar underlying structures, while dimensionality reduction tasks involve simplifying data to its most principle (i.e. salient) underlying structures. Common unsupervised ML methods include k-means and k-nearest neighbor (KNN) for clustering, and principle component analysis (PCA) and singular value decomposition (SVD) for dimensionality reduction~\cite{alpaydin_2020}. 

\textbf{Reinforcement Learning (RL)} is a form of feedback-based ML that involves learning from mistakes in a trial-and-error fashion. RL is often used for prediction and control in problem domains where time and event sequences matter, feedback may be delayed, and actions have consequences. In RL, prediction involves predicting the performance of some policy, whereas control involves determining the optimal policy that yields the best performance. Though practical applications are mostly concerned with control, the problem of prediction must oftentimes be solved first. Popular RL methods include Monte Carlo and temporal difference (TD) Learning for prediction, and SARSA and Q learning for control~\cite{alpaydin_2020}.  

Note that there are other, less mainstream types of ML such as semi-supervised learning, self-supervised learning, multiple instance learning (MIL), inductive learning, deductive learning, transductive learning, multi-task learning (MTL), and active learning. In addition, there are other ML tasks including generative modelling and association rule learning.
    




    
\subsubsection{Machine Learning Pipeline}
Regardless of which type of ML model is used, it is important to carefully plan the ML pipeline for any task. A generalized ML pipeline is described in the following paragraphs, and summarized in Fig.~\ref{fig:ml_pipeline}. 

The first step of the ML pipeline, \textbf{Problem Definition}, involves thoroughly understanding the problem to be solved. This involves determining what the end goal is in terms of desired model outputs, what inputs might be needed for a model to yield such desired outputs, and what existing techniques have already been applied to similar problems and their assumptions, benefits, and limitations. In other words, Problem Definition involves gaining enough domain knowledge to make informed decisions for the remaining steps in the ML pipeline. 

During \textbf{Data Collection}, information relevant to the problem is gathered. Data can be collected historically and/or in an online fashion, and includes organized and unorganized data structures such as text, images, videos, audio clips,~\textit{etc.,}{} In supervised ML, human subject matter experts are often employed to label the data so ML systems have training examples. Ideally, data is sufficient in amount and properly representative of the problem space.

In the \textbf{Preprocessing} stage, the collected data is cleaned and converted to a machine-readable format in preparation for feature extraction. Common preprocessing methods concern handling missing values (\textit{e.g.,}{} removing all datapoints with missing values from the study, replacing missing values with a zero), handling categorical data (\textit{e.g.,}{} creating dummy variables), and standardizing the data (\textit{e.g.,}{} normalizing values from 0 to 1). 


\begin{figure*}[t]
     \includegraphics[width=\textwidth]{Images/Machine_Learning_Pipeline.png}
     \centering
     \caption{General machine learning pipeline.}
     \label{fig:ml_pipeline}
\end{figure*}

After Preprocessing, the data is then transformed in the \textbf{Feature Extraction} stage. The goal of feature extraction is to ensure only the most salient information relevant to the problem will be used for training the ML model. In other words, this step helps ensure that no unnecessary features are used during training. At best, unnecessary features do not degrade ML model performance, at the cost of increasing the amount of data needed (as is characteristic of the curse of dimensionality). At worst, unnecessary features can significantly degrade ML model performance (as is characteristic of irrelevant and/or highly correlated inputs). Common feature extraction techniques include feature selection (\textit{e.g.,}{}, linear discriminant analysis or LDA), dimensionality reduction (\textit{e.g.,}{}, PCA), and computer vision techniques for input images (\textit{e.g.,}{} color, shape, and texture feature extraction methods).

During \textbf{Training and Validation}, the extracted features are used to train the ML model. The type of ML model(s) to use will depend on a variety of factors such as the nature and amount of input data, format of the desired output, and the given problem's associated ML task. Note that in DL, feature extraction and training can occur simultaneously. Ideally, the type of ML model(s) to use were considered at the Problem Definition stage but sometimes it is accomplished by trial-and-error. 

After the ML model is trained and its performance is validated, the \textbf{Testing and Verification} stage ensures the model is ready for deployment. Testing involves evaluating the trained model on unseen data and validation typically involves humans ensuring the model is performing up-to-standard. Validation data is different from testing data in that validation data is used to evaluate the model during the training process, while testing data is completely unseen throughout the training process (i.e. testing data is a separate holdout set). Separate training, validation, and testing data ensures the model is not overtraining (i.e. memorizing rather than actually learning). 

After the ML model achieves desired performance on testing data and has been verified, the model is ready for \textbf{Deployment} in the field. Depending on the nature of the problem, the ML model may require updates. If so, it may be necessary to periodically monitor performance changes over time, collect additional data, and refine or retrain the model. 

\subsubsection{Deployment and Tools}
The popularity of Python for data science applications helped drive the development of AI, ML, and DL frameworks coded in Python. Python packages such as Scikit-Learn~\cite{scikit-learn}, Tensorflow~\cite{tensorflow2015-whitepaper}, and PyTorch~\cite{NEURIPS2019_9015} make AI accessible and have hence garnered the support of a large community of developers and researchers over the years. These tools have become widely-used for experimentation, evaluation, and deployment with the help of application program interfaces (APIs). Advances in hardware and software such as parallel processing, GPUs, and cloud computing help optimize computing resources to be more suitable for training large, complex AI models. Moreover, data is becoming more available than ever for training and testing ML models (\textit{e.g.,}{} kaggle, Trust-hub,~\textit{etc.,}{}).









\subsection{Deep Learning}\label{sec:dl}
DL models have become a hot topic again in the last decade because of the availability of huge amount of data and deserve a short description here. They are made up of multiple processing layers that learn representations of training data with multiple levels of abstraction, and are used for speech recognition, object visualization and detection task, among others. DL has helped address complex problems that have persisted in various industries for many years~\cite{lecun2021}. The core of DL is the use of neural networks (NNs), as seen in Fig.~\ref{fig:deep_learning}, which consist of an input layer, one or more hidden layers, and an output layer. 
Most deep neural networks~(DNNs) flow in one direction only from input to output. However, backpropagation is used to change internal parameters or weights that are used to compute the representation between a current and previous layer. And it is very efficient for computing gradients in deep networks~\cite{ibm}.
Some examples of DL models include convolutional neural networks (CNNs), graph neural networks (GNNs) and graph convolutional networks (GCNs).

\subsection{Geometric Deep Learning}\label{sec:gnn}
Perhaps most relevant to EDA applications is \emph{Geometric Deep Learning} (GDL, which provides a blueprint for generalizing DL to non-Euclidean data (\textit{e.g.,}{} circuits)~\cite{Bronstein2017-geometric}.
The success of DL approaches is owed largely to their ability to capture local statistics of the input data.
For example, CNNs have been widely useful in computer vision tasks due to the shift invariant properties of the convolution operator.
Traditional formulations of DL models (CNNs, RNNs \textit{etc.,}{}) rely on Euclidean structures in the data (\emph{grid} structures), \textit{e.g.,}{} image, video and speech signals.
Figure~\ref{fig:grids-graphs} shows examples of Euclidean (grid) and non-Euclidean (graph) data.  
The \emph{geometric prior} on grid data is the ordering of the nodes, which is the structure that RNNs and CNNs implicitly take advantage of.
Graph data, on the other hand, requires no explicit ordering on the nodes and operations on the graph are permutation invariant.
Graphs, on the other hand, have permutation invariant structure in that the nodes are not assumed to be in any specific ordering.
\begin{figure*}
    \centering
    \includegraphics[width=0.7\textwidth]{Images/arch.pdf}
    \caption{Overview of a GNN architecture.  The GNN layers provide embedded representations of graph input data for other downstream architectures such as RNNs, CNNs, etc.}
    \label{fig:gnn-arch}
\end{figure*}
\begin{wrapfigure}{l}{0.28\textwidth}
    \centering
    \includegraphics[width=0.25\textwidth]{Images/data.pdf}
    \caption{Traditional DL and ML primarily work on Euclidean data or grids, while GDL generalizes to non-Euclidean data, \textit{e.g.,}{} graphs.}
    \vspace{-1.5em}
    \label{fig:grids-graphs}
\end{wrapfigure}

GNNs and GCNs are examples of GDL models which can learn directly from graph data (this category of approaches is also referred to as \emph{Graph Representation Learning} (GRL) and is a subset of GDL)~\cite{Hamilton2020-grl}.
These models are able to leverage graph structure as well as node and/or edge features to learn a useful representations of data.
GCNs possess the same shift invariance power of traditional CNNs~\cite{xu2018powerful}.

Recent work by Mirhoseini~\textit{et al.}{} demonstrates the power of combining GRL techniques with RL training algorithms to improve placement in chip layout~\cite{Mirhoseini2021AGP}.
The Edge-GNN in~\cite{Mirhoseini2021AGP} was first trained to create graph embeddings that predict reward labels (in this case a reward derived from wire-length, congestion and density metrics).
Then the Edge-GNN is used as an ``encoder'' for training the CNN-based policy networks in and RL training algorithm.
Figure~\ref{fig:gnn-arch} shows the general structure of GNN layers and demonstrates how the embedded graph vectors can be passed to various down-stream tasks.
The ability to capture relationship and interaction statistics in the circuit data using graph embeddings enabled the to policy network to reduce placement costs.




    
    
    



    

    


\subsection{Electronic Design Automation}\label{sec:eda}
The electronic design automation flow for digital ICs is as follows:




 \subsubsection{Design Specification}
    In design specification, the designer must accurately describe the overall design requirements. The system may be proposed by a design team to initiate the production of a chip. The IC designers decide on functionality and plan out verification and testing procedures for the entire process.
    
\subsubsection{High-Level Synthesis}
    High-Level Synthesis (HLS) tools translate a design written in high-level languages such as C/C++/SystemC into a low-level hardware description language (HDL). Hardware components can be modeled at high levels of abstraction, allowing the designer to map both hardware and software components~\cite{martin_scheffer_lavagno_2016}
    
\subsubsection{Logic Synthesis}
     Logic synthesis is a direct translation from the behavioral domain (register transfer level) to the structural domain (gate level)~\cite{JIANG2009299}. The gate-level netlist is mapped to the standard cell library. The optimization part of logic synthesis minimizes hardware by finding equivalent representations of larger blocks. Design constraints used as input may also be met for circuit area, power, and performance.
    

\subsubsection{Design for Testability (DFT)}
   DFT encompasses the techniques used to generate cost-effective tests for the gate-level netlist obtained from logic synthesis. These techniques are geared towards increasing observability, controllability, and predictability of the design~\cite{martin_scheffer_lavagno_2016}. Ad-hoc methods like partitioning and test point insertion are relatively easier to implement, while structured ones like scan registers, scan chains, scan architectures and algorithms ensure good testability at the expense of additional area and delay overhead. The resulting tests utilize test programs which drive automatic test equipment (ATE). The ATEs also use automatic test pattern generation (ATPG) to identify input sequences which trigger errant circuit behavior arising from manufacturing defects~\cite{HSIAO2006161}. 

     
\subsubsection{Floorplanning}
    Flooplanning focuses on the sizes and arrangement of the physical blocks created during logic synthesis. It affects the optimization results of the increasing physical stages. It is the first major step in physical design. Pins and ports are also assigned a rough location, which can further be refined depending on the placement and routing results~\cite{Lienig2020}.

    
\subsubsection{Placement-and-Routing}
   After a successfully-proposed floorplan, the place-and-route~(P\&R) addresses the structural design of a circuit. The designer places and connects all of the blocks that make up the chip such that they meet design criteria and constraints. After the initial P\&R attempts, the design's timing constraints are analyzed. If unsatisfactory, the P\&R software in use tries different placements and signal routing to try to meet the designated constraints~\cite{Lienig2020}.

\vspace{1em}



\subsection{General Security Applications at Various Stages of Electronic Design Automation}

ML is already applied to some extent in the digital IC design process, albeit with primary focus on general design prediction and optimization. Some needs tackled at this stage include logic and design optimization~\cite{Haaswijk2018}, low-power approximation~\cite{Pasandi2020} and area estimation~\cite{froemmer2020}. Careful assessment of available publications incorporating learning into digital IC design will reveal an absolute truth; very little work has been done to directly address hardware security vulnerabilities. The use of intelligent models presents the opportunity to not only optimize designs, but to secure them against the array of tools and attacks that malicious parties have at their disposal. This is especially important for some security properties that cannot be modelled analytically and situations where multiple security constraints are at odds. According to~\cite{huang2021machine}, ML approaches in EDA can be broken down into four main directions: \textbf{decision making}, \textbf{performance prediction}, \textbf{black box optimization or design space exploration} and \textbf{AI-assisted EDA}. In the rest of this section, we follow this same organization to discuss security-aware CAD research and opportunities. Fig.~\ref{fig:icsecurity} also highlights the general EDA steps and the applicable directions for each one.

The decision-making perspective encapsulates the replacement of traditional, brute-force design-for-security methods with more automated and efficient techniques. In most cases, brute-force techniques involve countless trial-and-error steps until the best-performing configuration is found and used on a design. From a heuristic perspective, the knowledge gained may prove to be invaluable. However, they are only feasible on simpler designs; increased complexity transforms them into cumbersome requirements that most designers would gladly bypass. Further, the tradeoffs between security and traditional metrics as well as between different security metrics might be unknown or too complex for manual tuning. Automation becomes valuable only when it is characterized by efficiency. ML can definitively make decisions on the most suitable settings and parameters for countermeasures with varying levels of human input~(see Fig.~\ref{fig:decisionmaking}).

Performance prediction describes forecasting and modeling trade-offs associated with adding countermeasures, especially at earlier design stages. Although an ideal scenario would involve achieving optimum design goals while guaranteeing near-perfect security awareness, a designer must be aware of the inevitable compromises that a secure design may entail. A more achievable target is finding the balance between optimization and security, as seen in Fig.~\ref{fig:performanceprediction}. This is where AI/ML comes into the picture. The automation of the balance-seeking process will not only speed up the IC design pipeline, but will ensure that the most suitable operating parameters and modifications are available to the designer. From a business standpoint, time-to-market of ICs in production may also decrease.

For design space exploration, AI/ML seeks the solution that best meets requirements from available choices with little to no human intervention. The expanse of the search space creates the need for automation to execute selection, generation and evaluation of the solutions. However, the exhaustive option may not always be the optimal one, regardless of the availability of automation techniques. Design space exploration employs the application of different methods: stochastic optimization methods, like random search, evolutionary algorithms and black box optimization~\cite{CARDOSO201799}. Black box optimization uses a set of configurable parameters as inputs instead of results from the design stages, as seen in Fig.~\ref{fig:blackbox}. The circuit may either be too complex to model, or the engineer lacks details of the design to work with. At the training stage, most ML/AI algorithms are being optimized to find the best fit for input parameters, constraints, and design features. Hence, finding the most suitable design based on specifications may be the most intuitive application to the digital IC design.



\begin{figure*}[t]
   \includegraphics[width=\textwidth]{Images/IC Design with Security Topics.png}
   \centering
   \caption{General digital IC design pipeline with applicable security topics for each stage. \textbf{D} stands for decision making, \textbf{P} represents performance prediction, while \textbf{B} and \textbf{A} stand for black box optimization or design space exploration and AI-assisted EDA, respectively.}
   \label{fig:icsecurity}
\end{figure*}

\subsubsection{High Level Synthesis and/or Register Transfer Level}\label{sec: hlsrtl}

\paragraph{\textbf{Hardware Security Primitive Deployment at Higher Levels of Abstraction}}\label{subsubsec: aiss}
The Automatic Implementation of Secure Silicon (AISS) program was developed by the Defense Advanced Research Projects Agency (DARPA) to automate the process of incorporating scalable defense mechanisms into chip designs, by allowing designers to explore chip economics versus security trade-offs based on the expected application and intent while maximizing designer productivity~\cite{darpa}. Deployment of security methods pre-silicon are always cost-effective and less time-consuming. With this in mind, AI/ML can be used to make decisions as early as during HLS, or at RTL. Based on the discernible features at these levels of abstraction, a classification-based model can use vector embeddings to suggest suitable hardware security primitives and their associated parameters (e.g., size). For example silicon odometers are inserted into IC designs to measure aging and detect recycled counterfeit chips~\cite{guin2015design}. Their accuracy and yield are determined by various parameters~\cite{shakya2015performance}, which can be optimized through ML/AI. 

Physically unclonable functions (PUFs)~\cite{gassend2002silicon} provide digital fingerprints using the internal process variations (entropy) of a physical device. The translation of these unique and unclonable manufacturing variations into challenge-response pairs provides unique chip identifiers or authentication mechanisms. One of the main issues with PUFs is their reliability,~\textit{i.e.,}{} ability to provide the same output in the presence of environmental variations and aging. To combat this, they often rely on error correcting codes~\cite{hiller2020review}, which can be designed to handle a specific number of bit flips. Another primitive is the true random number generator (TRNG), which uses an entropy source to generate non-deterministic data with a given throughput to seed security algorithms like cipher keys~\cite{gabriel_wittmann_sych_dong_mauerer_andersen_marquardt_leuchs_2010} or masking~\cite{trichina2003combinational}. For any design that contains all three of these primitives, their characteristics can be tuned together for a specific application or to fit within a dedicated silicon area.



\paragraph{\textbf{Encoding Optimization}}\label{subsubsec: encoding}
Another aspect that stands to benefit from the addition of ML-powered decision-making is finite state machine (FSM) encoding optimization. The encoding schemes are selected based on design constraints, including power and area. The two most common options are:

\begin{itemize}
\item \textbf{Binary Encoding} -
In binary encoding scheme, states are encoded as a binary sequence where the states are numbered starting from 0 and up. The number of state flip-flops (FFS), $q$, required for binary encoding scheme is given by $q = log2(n)$; where, $n$ is the number of states. The binary encoding scheme is better suited for FSM with a fewer number of states~\cite{lin2012binary}.

\item \textbf{One-hot Encoding} -
This encoding scheme is designed with only one bit of the state variable as ``1'' while all other state bits are ``0''. It requires as many state FFs as the number of states. This creates the need for more state FFs than binary encoding~\cite{cassel2006onehot}.
\end{itemize}

One-hot encoding scheme is less vulnerable to fault injection attacks while binary is more resistant to hardware Trojans that exploit don't care states. This is demonstrated by Nahiyan~\textit{et al.}{} using the FSM of the SHA-256 digest engine~\cite{nahiyan2019}. With this knowledge, a secure encoding scheme was proposed in~\cite{nahiyan2019} that combines binary and one-hot schemes to achieve the best of both worlds. In future work, AI/ML may be used to determine the best mix given a specific FSM.


\paragraph{\textbf{Crafting Side Channel-resilient Circuits}}
Referring to Section~\ref{subsubsec: sidechannelresist}, masking has been introduced to stop an attacker from mounting side channel analysis. 
AI has become an integral part of this, for instance, RL has been applied to combine a set of countermeasures, which leads to the enhancement of target resilience to, at least, some types of attacks \cite{rijsdijk2021reinforcement}. 
Seen from another perspective, machine learning algorithms, and in particular, NNs, can defeat some countermeasures, including masking~\cite{kim2019make,related_works:automated_hyperparameter_tuning,related_works:SCA_metrics}. 
As an example of such attacks, RL has been employed to determine proper side-channel leakage models and training of neural networks to extract leakage profiles~\cite{DBLP:journals/iacr/RijsdijkWPP21}.
Hence, robustness against such attacks has become one of the objectives of the tests conducted to evaluate the effectiveness of countermeasure, specifically, masking. 

Given the nature of such tests, the security-aware designer may have to deal with the higher levels of abstraction corresponding to a black box leakage model because there is no information, including physical placement or routing signals \cite{buhan2021sok}.
Therefore, masking schemes may be implemented, but there is no guaranteed measure of effectiveness before the RTL stage.
To enhance this process, full access to the design's layout available to the implementing party could be useful and even be bolstered with an understanding of the device's functionality via RTL or gate-level implementation. 
This is in line with the studies focused on modeling the implementation and simulating its behavior as discussed before~\cite{bertoni2017methodology,reparaz2016detecting}. 
In this context, AI has not yet reached its full potential as security-critical implementations are still designed manually.  
The manual design and implementation pose a series of drawbacks stemming from (1) the lack of integration between the various designs, (2) erroneous designs due to human errors, and (3) high consumption of resources, including time (both execution and design times), silicon area and/or power/energy consumption. 


\paragraph{\textbf{Hardware Trojan Detection Rates at Register Transfer Level}}
Malicious modifications,~\textit{i.e.,}{} \textbf{hardware Trojans}, are possible during the IC design and fabrication process. Hardware Trojan detection has been extensively researched within the hardware security research domain~\cite{tehranipoor2010}. Salmani~\textit{et al.}{} proposed a method of increasing the probability of Trojan activation using dummy scan FFs~\cite{salmani2012}. They place a dummy scan FF with a net having low transition probability. To test the concept, Trojan samples have to be deployed on benchmarks. The rate of Trojan detection could be derived from the available data that these simulations produce. Likely features that would be valuable for a prediction-based ML model include nets with dummy scan FFs, their fanouts and their corresponding transition probabilities. 

\textbf{Assertions} are typically used for formal verification of specification patterns. The behavior of circuits determines the correctness of the design. Alsaiari~\textit{et al.}{} propose reconfigurable assertion checkers which are able to detect hardware Trojan updates on system-on-chips (SoCs)~\cite{alsaiari2019}. The design flow can be seen in Fig.~\ref{fig:assert}. Even with traditional assertion checkers where selection only occurs pre-synthesis, it is possible to ascertain the rate of Trojan detection using the assertion checkers, the Trojan type, as well as the point(s) of insertion.


\begin{figure}[t!]
\centering
\includegraphics[width=0.5\columnwidth]{Images/asserion checker paper.PNG}
\caption{Digital IC design flow with inserted assertion checkers. Reprinted from~ \cite{alsaiari2019}.}
\label{fig:assert}
\end{figure}



\subsubsection{Logic Synthesis}\label{sec:logicsynth}


\paragraph{\textbf{Tuning EDA Parameters and Commands during Logic Synthesis}}\label{subsubsec: dectuninglogic}
Although a constraint set may be part of the design specification, the gate level netlist provides a better understanding of functionality to a designer. Area constraints guide the P\&R tool to locate a specified design block partition, while timing constraints specify path delays~\cite{else2009}. To tune high-level directives, it is important to accurately predict their impact. This is a tall order for most designs due to complex optimizations throughout the design process. These complex optimizations create disparity between desired results at the HLS stage and implemented values post-synthesis. Conventional tools assist with optimization tasks, but machine learning is already being used to mitigate the latter problem. For example, Yu~\textit{et al.}{}~\cite{yu2018developing} have developed Intellectual Property (IP)-specific synthesis flows (i.e., sequence of synthesis transformations for TCL scripts) using CNNs that improve Quality of Result (QoR). In~\cite{Neto2019LSOracleAL}, DL is used to automatically decide which logic optimizer (And-Inverter Graph (AIG) and Majority-Inverter Graph (MIG)) should handle different portions of the circuit for better performance and lower area. Makrani~\textit{et al.}{}~\cite{Makrani2019} proposed a Pyramid framework to estimate best performance and resource usage. The input features are derived from the HLS report, and a stacked regression model provides accurate timing, delay and resource values before reaching post-implementation. 

Optimization goals during tuning can be geared towards obtaining a more secure, synthesised design with minimum overhead. Although this would only be evident with the combination of other design parts, early-stage deployment saves time and labor. For example, secure split-test (SST) is a method of securing the manufacturing process by mandating test results to be verified by the IP owner and by using a ``key'' to unlock the IPs correct functionality after tests are passed. For the functional locking block, XOR logic is added in series to non-critical paths. If the two inputs are different, the XOR logic will act as an inverter~\cite{contreras2013} causing any locked (still untested or failed chip) to act deliberately incorrect. The optimal number of XOR gates to insert into the circuit, insertion algorithm~\cite{chakraborty2009harpoon,6616532,lee2015improving}, or partitioning algorithm~\cite{alaql2021saro} to employ for a given IP's function and/or structure can be determined using ML techniques. 




\paragraph{\textbf{Standard Cell Selection}}\label{subsubsec: standardcell} A specific category of available standard cells may be used in an IC design to address specific security vulnerabilities. As far back as 2004, sleep transistor cells were proposed as a method for sub-threshold leakage current reduction~\cite{babighian2004}. The sleep transistor cells are picked from a library designed to target high layout efficiency. The results were shown to have achieved a minimum reduction percentage of 74\%. A trained support vector machine~(SVM) can be used to decide from a set of available libraries with specific target optimizations. 


\begin{figure*}[t]
   \includegraphics[width=\textwidth]{Images/Decision-Making Diagram (1).png}
   \centering
   \caption{General overview of decision making process for security-aware EDA using AI/ML/DL.}
   \label{fig:decisionmaking}
\end{figure*}



\paragraph{\textbf{Obfuscation for Black Box Designs during Logic Synthesis}}
Obfuscation is best implemented with complete structural and functional understanding of a circuit, but different levels of abstraction may present the challenge of having only one available. At the gate level, logic locking, as described in Section~\ref{par: dectuning, obfus}, may be viable, but the implementing party may also be restricted by their limited knowledge. Here again, a GNN seems capable of modeling the complex connections within the design, the competing needs to resist attacks, and narrowing down the most suitable implementation for balancing security and overhead. Ideally, the complete framework should provide locking options for each design and generate keys for a user discretely. Genetic algorithms have been applied to logic locking attacks like GenUnlock~\cite{chen2019genunlock}, where the evolutionary process is a black-box procedure overseen by an objective function. Conversely, this concept may be applicable to not only logic locking, but general obfuscation.




\subsubsection{Physical Design}


\paragraph{\textbf{Security-aware Layouts and Tradeoff Modeling}} \label{subsubsec: eaprediction}

Invasive physical attacks are expensive to execute but difficult to protect against. Attackers resort to focused ion beam~(FIB) to extract an asset’s value by milling to its location in the IC layout, creating a metal contact to it, and probing the contact while the chip is in operation. There are two main sets of countermeasures proposed to combat probing attacks; the preventive strategy utilises active or analog shields, such as meshes, while the detection strategy checks for attacks by sensing any probing or editing and alerting the operators~\cite{wang2017}. To improve the effectiveness of active shields, an automated anti-FIB probing flow called iPROBE was proposed~\cite{Wang2019,osti_10174121}, see Fig.~\ref{fig:iprobe}. iPROBE uses ad hoc rules to determine the areas and metal layers where computer-aided design (CAD) tools should place shields to reduce ``exposed area''. For a physical IC, the exposed area (EA) metric (as described in \cite{shi2016layout}) is used to measure the design’s vulnerability to probing attacks. A larger EA means more flexibility with the expense that an attacker can probe without triggering contingencies. While iPROBE did improve EA while reducing overhead as compared to traditional shields, the security and overheads cannot yet be explicitly controlled by the designer. In other words, trial-and-error needs to be performed to make sure that constraints are met. To further boost efficacy of the anti-probing method described above, it may be possible to model the relationship between EA and power, timing and area with a multiple linear regression model or even DL. Then, iPROBE parameters could be chosen with security, area, power,~\textit{etc.,}{} in mind.

\begin{figure}[t]
\centering
\includegraphics[width=0.5\columnwidth]{Images/iProbev2.png}
\caption{iPROBE version 2 with protection for frontside and backside probing attacks~\cite{osti_10174121}. The light blue metal lines and darker blue metal lines form active shields that protect against frontside attacks (through top passivation and metal) and backside (silicon substrate), respectively. The metal lines sandwiched between the shields carry critical information that the attacker wants to probe. A FIB cut though an entire shield line of frontside/backside will be detected because the signal present on it will not match its counterpart in backside/frontside.}
\label{fig:iprobe}
\end{figure}


\paragraph{\textbf{Porting of Cryptographic and Hardware Security Primitives to Different Technology Nodes}}
Security-aware updates to designs are hardly ever direct ``out-of-box'' additions to devices. For integration of an IP or hardware security primitive, it is imperative that the design still fulfils its intended purpose. Selecting the most appropriate parameters for a hardware security primitive is one aspect, but another is porting it to a different technology node~\cite{keating_bricaud_2007}. Although technology nodes no longer categorically correspond to transistor gate length and half pitch, they nonetheless vary considerably with respect to manufacturing processes, design rules, noise sensitivity,~\textit{etc.,}{}~\cite{bagnato_indrusiak_quadri_rossi_2014}. These variations are noteworthy because they may disrupt the transferability of primitives. For example, an optimized PUF applied to an IC manufactured using the 28~nm process is not guaranteed to transfer to the 22~nm process due to factors like geometric variation and transistor type~\cite{keating_bricaud_2007}. The knowledge of process-specific parameters allows for assessment of the hardware primitive porting activity using ML. It is possible to use a classifier model as simple as an SVM to select the most suitable match between circuit and primitive without explicit knowledge of the design's functionality.


\paragraph{\textbf{Obfuscation for Black Box Designs during Physical Design}}
The physical design stage also presents opportunities for obfuscation to the designer with black box access using ML/DL. The current state-of-the-art in camouflaging is the covert gate approach~\cite{shakya2019covert}. Covert gates are inserted randomly into the design/layout, but a CNN or vision-based transformer can be incorporated to quantify the impact of insertion and ultimately identify the most viable gates to replace. 



\paragraph{\textbf{Anti-Counterfeit and Anti-Tamper Sensor Optimization}}
The scourge of IC counterfeiting continues to plague the semiconductor industry by flooding the consumer market with unauthorized, defective and inferior versions of original chips and designs. From as far back as 2006, electronic companies have missed out on \$100 billion of revenue due to counterfeiting~\cite{pecht2006}. The recent global chip shortage has created the avenue for these illegal devices due to demand exceeding current supply chain capabilities~\cite{leprince-ringuet_2021}. Recycled and remarked counterfeit ICs account for more than 80\% of the counterfeits sold worldwide~\cite{guin2014}. Hence, their detection has become a necessity to tackle IC counterfeiting. Recycled counterfeits are used chips fraudulently sold as new while remarked counterfeits are inferior chips sold as higher grades. 

Different sensors have been designed as a solution to these counterfeits, as seen in the work by by Zhang~\textit{et al.}{}~\cite{zhang2014}. Their first of two proposed techniques uses frequency difference retrieved from paired ring oscillators (ROs) between an original and recycled chip to distinguish the two. RO frequency tends to degrade more with aging because the transistors in the RO gets slower with time~\cite{docking2003ro}. Guin~\textit{et al.}{} also add anti-fuses and fuses for combating die and IC recycling (CDIR). Their RO-CDIR implementation is negative temperature instability-aware, which is valuable for flagging ICs with shorter usage~\cite{guin2014}. To date, the design of these sensors such as number of inverting stages, choice of threshold voltage, and overall structure are chosen in an ad hoc manner or through empirical means. Further, foundries do not always provide aging models to users. Both of these limits the age estimation of such sensors and their classification accuracy.


AI approaches, such as Bayesian optimization, would be preferable, especially for its ability to optimize black-box functions. Automating the optimization process will ultimately make it less-exhaustive.

Another source of hardware security issues is tampering. Once the device is physically compromised, it may leak on-chip information to the attacker. Hence, insertion of hardware Trojans may also be considered as tampering~\cite{tehranipoor2010}. One common example of tampering is FIB-based circuit edit, which allows an attacker to remove or bypass a security countermeasure~\cite{livengood_tan_hack_kane_greenzweig_2011}. Similar to recycling, sensors have been proposed to combat or detect tampering. A technique proposed by Liu and Kim uses logic-compatible embedded Flash (eFlash)-based tamper sensor built on an exposed floating gate (FG) structure to detect physical attacks~\cite{Liu2019}. Any change in charge stored on the exposed FG can be detected by this sensor. This includes humidity, high temperature, dust particles, chemicals, and electrostatic charges. A regression-based model or a neural network could fine-tune the configuration of such tamper sensors.


\paragraph{\textbf{Hiding Countermeasure Optimization}}
If an attacker is aware that a sensor has been deployed to detect a certain attack modality, the attacker may start by circumventing the sensor. For example, the attacker may apply the minimum possible mechanical force on the metal wires, or use a low intensity light source for a longer duration of time. Assuming maximum throughput possible, it is crucial to supplement successful optimization with robust defense. Hiding can dampen the signal accessible to the attacker. With limited knowledge of the sensor-IC design and operation, the designer could possibly rely on ensemble methods to find the most suitable hiding framework. The same sensors used to protect against tampering and detect counterfeits may also be vulnerable to side channel attacks. Since they are sensitive to changing parameters like voltage and frequency, they are prime targets for malicious parties. Sugarawa~\textit{et al.}{} show that an attacker can reveal the internal state of a chip by observing how a sensor reacts to laser fault injection. The leakage leads to a feasible, non-invasive, probing attack. The sensor-type, the bit-flip detector, detects a short-circuit current induced by a laser fault injection~\cite{SUGAWARA201963}. Thus, it is advisable to supersede sensor optimization with robust hiding schemes; the ideal framework could combine both activities to boost resistance to side channel attacks. For example, if a noise generator is used as the default hiding mechanism, a simple regression model could predict the amount of noise required to achieve a lower signal-to-noise ratio (SNR). A more versatile system could have options like shielding in addition to noise generators, with decisions and settings also based on countermeasure optimization.



\paragraph{\textbf{Tuning EDA Parameters and Commands during Place-and-Route}}\label{subsubsec: dectuningpr}
At this stage of the design process, the manner of parameter tuning differs greatly from higher levels of abstraction. Improved P\&R decision-making means better chip area utilization, timing performance, and routability. A Pareto optimal solution may also be the best option, where significant parameter tradeoffs are required to achieve the best-possible design. Although most of the AI/ML applications at this stage have focused on obtaining complete design solutions, tuning parameters is still important for optimization. The authors of~\cite{karthik2018regplacement} use random forest (RF) regression techniques to tune guidelines and constraints for register placement. They are able to decide on the ideal location of each register and use that as seed placement for the entire design. One of its objectives is geared towards improved routing congestion, but a security-based implementation could address a countermeasure like obfuscation using different guidelines~\cite{karthik2018regplacement}.


 
\paragraph{\textbf{Hardware Trojan Detection Rates during Layout}}
\textbf{Built-in self-authentication (BISA)} relies on the incorporation of functional filler cells into white spaces at the layout level to form built-in self-test (BIST) circuitry~\cite{xiao2013bisa}. The latter is designed to verify that no BISA cell is tampered with by an untrusted foundry. The possible failure of the BIST circuitry allows inserted Trojans to be detected. To reduce the risk of compromising BISA design during manufacturing, \textbf{split-manufacturing} can also be applied. On its own, split manufacturing cannot be used to detect Trojans, but the technique known as ``obfuscated BISA'' (OBISA)~\cite{shi2018obfuscated} combines both BISA and split-manufacturing. OBISA's ability to detect hardware Trojans can be predicted by training a machine learning model.







\subsubsection{Cross-Abstraction Applications}\label{crossabstraction}

\paragraph{\textbf{Modeling Area, Power, Timing, and Security Impacts of IP Protection}} \label{subsubsec: ipprediction}

In general, design optimization problems have always been modeled based on area, power and timing; timing is used here because it directly relates to performance. Even at the HLS stage, ML implementations, like Pyramid~\cite{Makrani2019} have been used to predict optimal timing. There has also been work to predict area at both HLS~\cite{Zennaro2018} and logic synthesis~\cite{froemmer2020}. Deep-PowerX is a DNN-based dynamic power consumption minimization tool which exploits the power-area and delay-area relationships within a netlist~\cite{Pasandi2020}. Even at the placement and routing stage, timing prediction is possible using ML~\cite{Barboza2019}. 

One of the most significant threats to design integrity is IP piracy. The availability of a design to malicious parties gives way to overuse, modification, cloning, overproduction and/or reverse engineering. There are various defense-centered modifications available to an engineer at various stages of the IC design cycle, and ideas from ML-based optimization can be applied to them. 
\subparagraph{IP Watermarking} A watermark is a specific modification of an IP core that allows it to be uniquely identifiable, which is useful for piracy detection. However, IP core watermarking in general must never alter the functionality of the design~\cite{Chang2016watermark}. One popular method of watermarking is the the don't-care condition based technique. It involves adding function blocks with unspecified input combinations to the original design. Their outputs can be forced and used to verify the authenticity of a circuit~\cite{Dunbar2015SatisfiabilityDC}. However, additional logic may mean area, timing and power overhead. To hasten the design cycle, these overhead metrics must be readily available to a designer. If a trained algorithm can accurately model and predict these values, the design house would be able to ascertain the viability of a specific watermarking scheme, like the don't-care condition based method.

\subparagraph{Hardware Obfuscation}\label{par: dectuning, obfus} Hardware obfuscation is used to actively protect IP and has been applied at all major design stages preceding fabrication and assembly. It is intended to obscure an original design to prevent IP piracy and reverse engineering. Hardware obfuscation also addresses IP overuse and hardware Trojan insertion. 

The set of approaches that can be implemented until the DFT stage are typically \textbf{keyed} approaches. These techniques attempt to prevent black box use by key gates/inputs. One common example is \textbf{logic locking}, which hides the functionality and the implementation of a design by inserting additional gates (``key gates'') into the original netlist. The circuit will only function correctly if the acceptable inputs or keys are provided to the key gates~\cite{Yasin2020}. The additional gates must provide low overhead and be usable for larger designs. A significant challenge, however, has been making logic locking scheme secure against the entire suite of oracle-based attacks (e.g., SAT~\cite{subramanyan2015evaluating}, AppSAT~\cite{shamsi2017appsat}, key sensitization~\cite{rajendran2012security},~\textit{etc.,}{}.) and oracle-less attacks (e.g., desynthesis~\cite{massad2017logic}, signal probability skew~\cite{yasin2017security},~\textit{etc.,}{}.). The former use an unlocked chip as an oracle to non-invasively derive its key while the latter operate solely on the netlist. Preventing oracle attacks implies that the time to recover the key should be prohibitively high for an attacker. Recently, ML has been used to predict the obfuscation strength in terms of the predicted time taken to de-obfuscate an obfuscated circuit using the SAT attack. Chen~\textit{et al.}{}~\cite{chen2020} demonstrate this using a GCN. They combine graph structure with gate feature by using an enhanced graph convolutional operator named ICNet. The features employed are divided into the graph structure, which describes connections, and gate features, including gate mask and gate type. While this approach has only been applied to predict SAT attack time, it can nonetheless be used to predict resistance to other oracle attacks. Recently, oracle-less attacks such as SAIL~\cite{chakraborty2018sail} have employed ML to recover the original (unobfuscated) netlist by reverse engineering logic synthesis rules.

Another key-based countermeasure that can be considered is FSM locking~\cite{chakraborty2009harpoon}. FSM locking adds extra states into the FSM of an IC design. The correct ``key'' is the right sequence of state transitions, which guarantees non-erroneous functionality. The additional states are materialised by FFs with their corresponding combinational logic. Active hardware metering~\cite{alkabani2007active}, a version of FSM locking, creates boosted finite state machines (BFSMs) from the new states. At this stage, it would be imperative to be able to predict the overhead created by the added states. This is because the design house sends the verified netlist to the untrusted foundry to create PUFs (challenge-response pairs) from the fabrication process variation. This may introduce additional overhead that could affect overall functionality. Depending on the complexity of the circuit, either a regression model or a DNN may suffice.

The \textbf{keyless} variety of obfuscation does not require keys, and cannot affect functionality. The desire is to conceal design intent. Without some form of obfuscation, a malicious party can either copy an IP or seek and exploit design vulnerabilities using reverse engineering. The most noteworthy example of keyless obfuscation is \textbf{IC camouflaging}~\cite{chow2012camouflaging}, which replaces original gates with ``camo gates'' which are difficult to discern by pattern recognition. It is worth noting, however, that most camouflaging techniques can be ``mapped'' into logic locked circuits~\cite{yasin2015transforming} where the above oracle attacks are quite effective~\cite{el2015integrated}. Hence, the prediction schemes mentioned above for logic locking may also apply to camouflaging. Further, the replacement of gates with camo gates to facilitate camouflaging will almost always alter power consumption and area. With the right set of features extracted from a report (HLS report), a trained regression model could predict the parameter values with near-perfect accuracy. There is evidence of this in other EDA applications. For example, Zennaro~\textit{et al.}{} combine an RTL generation framework with ML algorithms to estimate the area of the final design based on the features of an abstract specification. They retrieve the number of configurable logic blocks (CLBs) information from synthesised RTL design reports created from an automation framework. They mainly use a multilayer perceptron (MLP), but also experiment with random forests (RF) and gradient boosting (GB)~\cite{Zennaro2018}.

Another popular keyless approach is \textbf{split manufacturing}~\cite{imeson2013securing} where a design is split, each part is fabricated at one or more untrusted entities, and a trusted entity puts them together. Split manufacturing can have significant overheads and security concerns (e.g., proximity attacks~\cite{magana2017proximity}) if P\&R is performed poorly. Ad hoc and linear programming approaches to perturb P\&R~\cite{wang2018cat} and/or split designs~\cite{shi2018obfuscated} have met with some success, but can likely be improved further through the incorporation of AI-based modeling and prediction.



\paragraph{\textbf{Side Channel Attack Resistance}} \label{subsubsec: sidechannelresist}
Side channel leakage allows an attacker to break cryptographic systems. Signals that a cipher's implementation inadvertently emits allow for systematic extraction of underlying information. Examples include instantaneous power consumption, timing/delay, and electromagnetic emissions. Whether the attacker targets the understanding of device operation (simple) or uses leakage information to correlate data values (differential), there are generic countermeasures to reduce the effect of side channel leakage~\cite{markowitch_2011sca}. A high signal-to-noise ratio~(SNR) implies the availability of more meaningful leakage information. \textbf{Hiding} countermeasures reduce the SNR by either dampening the signal with low power designing and shielding, or flooding the leak-prone areas with noise using noise generators~\cite{levi2020ask}. To measure the value of hiding on a design, a predictive, regression-based model could provide an accurate percentage reduction in side-channel leakage. An obvious feature would be the tuning of the technique used. 

Another available countermeasure is \textbf{masking} which seeks to remove the correlation between input data and side-channel leakage ~\cite{prouff_2013_masking}. Unlike hiding, masking is applied at the algorithmic level with logic gates. Nonetheless, higher order side-channel analysis allows an attacker to bypass the routine masking schemes. A higher order masking may be employed but it may require significant overhead~\cite{prouff2009}. 
In order to evaluate the effectiveness of masking, various types of AI and ML algorithms have been employed to accomplish (a) the assessment of side-channel resiliency against a specific attack~\cite{picek2021sok}, and (b) the full leakage assessment methodology~\cite{moos2021dl}. 
However, both of these evaluation techniques need the actual ASIC or a correctly-programmed FPGA, as well as special equipment to be performed cf.~\cite{arribas2018vermi}. 
To overcome these obstacles, another line of research has been pursued, which is devoted to (1) theoretical conditions for a design to be SCA-resistant~\cite{barthe2015verified,coron2018formal,bloem2018formal} or (2) model the implementation for simulating its behavior~\cite{bertoni2017methodology,reparaz2016detecting} in the pre-silicon steps. 
In the first category, AMASIVE framework~\cite{zohner2012,huss2013amasive} can be mentioned that identifies hypothesis functions for leakage models cf.~\cite{buhan2021sok}. An example from the second class is VerMI, which is a verification tool in the form of a logic simulator that checks the properties of a class of masking methods (threshold implementation)~\cite{arribas2018vermi} at both algorithmic and implementation levels. 
Nevertheless, at this level of abstraction,~\textit{i.e.,}{} pre-silicon, AI techniques have not found direct applications yet. Perhaps, the most straightforward way of incorporating such a technique can be imagined to examine whether the conditions for SCA-resiliency are fulfilled (the first category). 

Yet another step further, Ma~\textit{et al.}{} presented a security-driven placement and routing tool to protect designs against EM side-channel attacks~\cite{CADSec2020} that attempts to break the balance of signal delays by register reallocation under the condition of layout constraints. The CAD-based tool, named CAD4EM-P, uses register reallocation and wire length adjustments to reduce the data dependency of EM leakage with acceptable area and power overheads~\cite{CADSec2020}. Opportunities to improve the effectiveness and efficiency of this approach can rely on more advanced forms of ML-for-prediction. For example, a graph neural network (GNN) can replace the graph-based algorithms that are the basis of the original version. 


\paragraph{\textbf{Fault Injection Tolerance}}
In contrast to most SCA attacks, fault injection attacks involve an active adversary.
In other words, the adversary tries to observe a faulty behavior of the target device by forcing it to function outside of its specified operating range or feeding it undefined data. 
For example, an attacker can cause erroneous operation of the target platform by tampering with the supply voltage (\textit{a.k.a.,}{} voltage glitching), modifying the clock signal's frequency (a.k.a glitching), or flipping bits in the memory using a laser beam~\cite{bar2006sorcerer}.
While most fault attacks require physical access to the victim device, recent studies have shown that in certain cases similar fault attacks can also be carried out remotely on a variety of systems~\cite{alam2019ram}.
Cryptographic devices and secure hardware have been the main targets of fault injection attacks. 
For example, an adversary could inject faults into an FSM implemented on a hardware platform to bypass authentication states and obtain unauthorized access to security-sensitive states.
On the other hand, an adversary may be able to extract the secret key by injecting faults into a cryptographic implementation and applying mathematical tools, like Differential Fault Analysis (DFA), on faulty generated ciphertexts.

Several protection/detection-based countermeasures have been proposed to mitigate the vulnerabilities of circuits against fault attacks.
While device-level countermeasures can be effective against fault injection attacks, the cost and extra manufacturing steps make the algorithmic and circuit-based countermeasures more attractive.
EDA tools can be deployed to improve the circuits' resiliency for such countermeasures.
However, conventional countermeasures are generic and create high overhead in terms of area and power.
Several protection/detection-based countermeasures have been proposed to mitigate the vulnerabilities of circuits against laser fault injection~(LFI) attacks.
While physical countermeasures, such as tamper-proof packaging and light sensors, can be effective, the cost and extra manufacturing steps make the algorithmic and circuit-based countermeasures more attractive.
For such countermeasures, EDA tools can be deployed to improve the circuits' resiliency.
However, conventional countermeasures are generic and not tailored to specific fault injection techniques.
For instance, by using triple-modular redundancy~\cite{lyons1962use}, error-detection/correction codes~\cite{karpovsky2004new,sunar2007sequential,tomashevich2014protecting, neumeier2012punctured}, and MAC tags/infective computation~\cite{CAPA,MandM}, the circuit becomes more resilient in general.
In these cases, however, depending on the capabilities of the adversary and how these countermeasures are synthesized, placed, and routed, they can still be bypassed by powerful fault attacks.
AI/ML can support creating circuit netlists and layouts during the design phase that are more resistant to fault injection attacks by taking the physical models of fault attacks into account.
For instance, by considering fault propagation together as a new feature, the impact of fault resilient placement and routing on security and overhead can be predicted.




\paragraph{\textbf{Vulnerabilities Across Design Abstractions and/or PDKs}}
There is evidence that designs become more prone to certain security vulnerabilities as they move across different levels of abstraction. One example provided in \cite{jiang2018} presented a timing side-channel vulnerability introduced during HLS to produce an optimized RTL representation. Another pointed out fault-injection vulnerabilities after logic synthesis due to FSM encoding styles and newly generated don't-care states~\cite{nahiyan2019}. It is important to have foreknowledge of these potential risks as they develop during the EDA process. This is possible  with predictive algorithms. In one instance, the data flow graph representation of the RTL could be combined with features from the HLS report to produce a GNN capable of identifying less-secure design areas. 
This may also apply to porting designs across different process design kits~(PDKs). The available gate sizes are discrete values which are usually specific to the underlying technology. Process variations may introduce parametric alterations which could make a device more susceptible to malicious parties. For this scenario, PDK electrical and design rules are possible input features for the same GNN described above. As the solution space scales exponentially with respect to the size of the netlist, gate sizing algorithms integrated into EDA tools rely on either heuristics or analytical methods, which leads to sub-optimal sizing solutions. To combat this shortcoming,~\cite{lu2021rl} has demonstrated the feasibility of applying RL algorithms equipped with GNNs that encode design and technology features. 


\paragraph{\textbf{Benchmark Selection for Security-Aware EDA Tool Evaluation}}\label{subsubsec: benchselection}
One additional optimization activity that may easily be overlooked is the evaluation of EDA tools used during the IC design process. Companies and research groups that develop EDA tools constantly update features to enhance their output. In order to properly target specific problem areas, the testing process must involve specific benchmarks. For example, if a designer intends to assess the scalability of the tool, the most important requirement for the test benchmark would be its size. If more nuanced conditions must be met, an automated method would make this process faster and more efficient. Succinct features of a benchmark and a tool's problem area in a DNN can determine the most suitable sample for testing. 

In the area of hardware security, benchmarking has played a critical role in development and comparison of hardware Trojan detection schemes~\cite{shakya2017benchmarking} and recently in de-obfuscation~\cite{amir2018development,tan2020benchmarking,amir2020adaptable}. Thus far, however, none of these benchmarking activities have explicitly incorporated AL/ML. 
 
 

 



\begin{figure*}[t]
   \includegraphics[width=\textwidth]{Images/Performance Prediction.png}
   \centering
   \caption{General overview of performance prediction process for security-aware EDA using AI/ML/DL.}
   \label{fig:performanceprediction}
\end{figure*}





\begin{figure*}[t]
   \includegraphics[width=0.85\textwidth]{Images/Black Box DSE.png}
   \centering
   \caption{General overview of black box optimization and design space exploration process.}
   \label{fig:blackbox}
\end{figure*}








\subsection{\textbf{Assimilation of Security Rules into Electronic Design Automation}}\label{aieda}
The incorporation of ML/AI into EDA describes replacing traditional heuristics with deep learning and AI-based decision-making policies that integrate the above steps (decision making, performance prediction, and optimization) into a single EDA framework. This will ultimately lead to a custom-based EDA pipeline based on the specific design and/or security application rather than relying on generic, somewhat-archaic EDA tools. Unlike  Section~\ref{subsec: blackbox}, the design space may stretch beyond what a designer has at their disposal. A valuable point to make is the possibility of utilizing a trainable decision-making policy in contrast to exploring the available decisions. The use of AI/ML almost guarantees more efficient results with shorter runtimes. There is budding research within the IC design community to incorporate learning-based tools into the EDA pipeline. 
The OpenROAD project is a DARPA-funded initiative which seeks to solve EDA cost and turnaround time. The goal is to complete the design process without performace, power or quality tradeoffs using ML, cloud-based optimization and other techniques~\cite{ajayi2019openroad,connor_2018}. Their work so far has incorporated problem-specific tools like ioPlacer for fast and scalable input/output pin assignment~\cite{bandeira2020ioPlacer}, TritonCTS for clock tree synthesis~\cite{Han2020OptimalGH} and RTL-MP for macro placement using RTL information and clustering~\cite{kahng_varadarajan_wang_2022}. A team of researchers at Google also presented a floorplanning tool for the physical design stage that can successfully place macro blocks using deep RL~\cite{Mirhoseini2021AGP}. Its results demonstrated improvement over traditional manual efforts across performance, power consumption and area, and allowed its application to a recent tensor processing unit (TPU) product.

Unfortunately, very little work has been done to utilize learning models to make designs security-aware at every major stage. With AI/ML firmly established in the pipeline, design optimization and security could be combined. Design-specific EDA will make extraneous steps obsolete and ultimately reduce the time-to-market for ICs. Table~\ref{tab: aieda} highlights the areas of interest for each major design stage.


\begin{figure*}[t]
   \includegraphics[width=\textwidth]{Images/AIEDA (1).png}
   \centering
   \caption{General overview of AI-assisted EDA. The emphasis is on direct application to EDA.}
   \label{fig:aieda}
\end{figure*}




The manufacture of secure ICs must begin with embedding of security rules at major steps of the design process. This encompasses the acts of identifying, assessing and incorporating prerogatives and properties within specific stages. All design steps follow defined rules during their series of actions on the input design~\cite{khwaja1997edarule}. For example, during logic synthesis, minimization may occur by combining gate terms where applicable to reduce circuit size~\cite{brayton1990logicsyn}. Even design constraints can be described as rules because they define the behavior of the design at each point of usage. In the same vein, it is necessary to apply security rules as rigorous requirements throughout the entire design sequence. 

Efforts to support such assimilation are starting to grow. For example, the Hardware Common Weakness Enumeration Special Interest Group (HW CWE SIG)~\cite{CWE_MITRE} consists of researchers and representatives from organizations operating in hardware design, manufacturing, and security who interact, share opinions and expertise, and leverage each other’s experiences in defining hardware security weaknesses and identifying them with analysis tools. However, the current initiative is manual and quite subjective. Data-driven and AI-based approaches could make this less tedious and more objective in nature.



 





\subsubsection{High Level Synthesis and Register Transfer Level}
The overall design of a circuit depends on the requirements stated in its specifications. Traditional execution of HLS results in an RTL description of the design, which is a better hardware-based representation of the intended IC. During the design process, it is difficult to ascertain certain features and how they may impact the entire circuit, but significant work has been done to mitigate this using ML~\cite{Makrani2019,Zennaro2018, Dai2018}. One noteworthy ML-based optimization framework combines a GNN with RL to predict design results and obtain optimal solutions under user-specified constraints and objectives like area and latency~\cite{wu2021ironman}. The security-aware designer can also leverage ML to anticipate and solve security problems that an IC is vulnerable to. Security rules at this early stage of the design process are less-tedious and reasonably-inexpensive to enforce.

Pre-synthesis obfuscation is applied to a design prior to the logic synthesis stage. Although the most prevalent techniques are used post-synthesis, there has been work done on this early stage method of obfuscation. Obfuscation can be implemented at the high level stage before conversion into RTL. One group uses MUXes driven by a locked controller units to create decoy connections~\cite{rajendran2015}. Exploiting the MUX's use of inputs and a control signal, only the correct control signals can unlock the design. The authors of \cite{Chakraborty2010} convert RTL code into control and data flow graph (CDFG) form, apply locking by superimposing an authentication FSM, and then return to RTL. Both applications may be deployed as security rules with deep learning-based execution. The CDFG form could be implemented as a GNN for optimum modeling of a design's complexity.

Masking to prevent differential power analysis (DPA) during a side channel attack is also possible at this level of abstraction. Konigsmark~\textit{et al.}{} create an HLS flow which addresses side-channel leakage by inferring security critical operations from user-specified confidential variables in HLS input. Their modified framework rectifies imbalanced branches that pose easy attack targets, and changes functional units based on leakage potential~\cite{konigsmark2017}. This experiment could be the foundation for learning-based masking solutions to prevent SCA; it stands to be improved by feature-based rectification. 

It is important to verify that systems adhere to information flow security (IFS) policies, especially during the design phase. All assets flowing through the system must be identified; this is known as information flow tracking (IFT)~\cite{hu2021}. Achieving this at higher levels of abstraction reduces the effort required to rectify potential problems. One publication presents RTLIFT as a means of measuring all digital flows through RTL designs to formally prove security properties related to integrity, confidentiality and logic side channels~\cite{Ardeshiricham2017}. Perhaps its most impressive property is the ease of integration into the design flow. Intelligent decisions surrounding security policies means adaptability to different designs trade-offs such as the RL-based policy iteration to calculate digital flows and possibly flag irregularities~\cite{Ardeshiricham2017}. 



\begin{table}
\centering
\caption{Major IC design stages in EDA with security needs and possible applications of AI/ML.}
\arrayrulecolor{black}
\resizebox{\linewidth}{!}{
\begin{tabular}{|c|c|c|c|c|} 
\hline
\rowcolor[rgb]{0.361,0.769,0.769} {\cellcolor[rgb]{0.361,0.769,0.769}}        & {\cellcolor[rgb]{0.361,0.769,0.769}}              & {\cellcolor[rgb]{0.361,0.769,0.769}}                    & \multicolumn{2}{c|}{\textbf{AI/ML Algorithms Applicable}}            \\ 
\hhline{|>{\arrayrulecolor[rgb]{0.361,0.769,0.769}}--->{\arrayrulecolor{black}}--|}
\rowcolor[rgb]{0.361,0.769,0.769} \multirow{-2}{*}{{\cellcolor[rgb]{0.361,0.769,0.769}}\begin{tabular}[c]{@{}>{\cellcolor[rgb]{0.361,0.769,0.769}}c@{}}\\ \textbf{Design Stage}\end{tabular}}   & \multirow{-2}{*}{{\cellcolor[rgb]{0.361,0.769,0.769}}\textbf{Security Task}}            & \multirow{-2}{*}{{\cellcolor[rgb]{0.361,0.769,0.769}}\textbf{Design Type}} & \textbf{Suggested}         & \textbf{Implemented}                    \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}        & Obfuscated Design              & \multirow{3}{*}{ASIC, FPGA}          & RL      & GNN~\cite{rozhin_2021}                      \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
{\cellcolor[rgb]{1,0.859,0.604}}        & Masking     &                   & GNN, GCN, RF               &                      \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
\multirow{-3}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\begin{tabular}[c]{@{}>{\cellcolor[rgb]{1,0.859,0.604}}c@{}}\textbf{High Level Synthesis and}\\\textbf{~Register Transfer Level}\end{tabular}} & Information Flow Security      &                   & RL      &                      \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}        & Obfuscated Design              & \multirow{4}{*}{ASIC, FPGA}          & GCN     & ~ ~ANN~\cite{Sisejkovic2021-challenge-logic-locking}            \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
{\cellcolor[rgb]{1,0.859,0.604}}        & Masking     &                   & RL, GNN &                      \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
{\cellcolor[rgb]{1,0.859,0.604}}        & Information Flow Security      &                   & GCN     &                      \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
\multirow{-4}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\textbf{Logic Synthesis }}                      & Side Channel Resistance        &                   & GNN     &                      \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}\begin{tabular}[c]{@{}>{\cellcolor[rgb]{1,0.859,0.604}}c@{}}\textbf{Device Sizing/ }\\\textbf{Technology Mapping}\end{tabular}               & Fault Tolerance                & ASIC              & Bayesian Optimization, DNN &                      \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}        & Crosstalk Mitigation           & \multirow{5}{*}{ASIC, FPGA}          &         & \begin{tabular}[c]{@{}c@{}}Logistic Regression~, \\XGboost~\cite{liang2020crosstalk} ~\end{tabular}  \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
{\cellcolor[rgb]{1,0.859,0.604}}        & Anti-tamper layouts            &                   & GCN, RL &                      \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
{\cellcolor[rgb]{1,0.859,0.604}}        & \begin{tabular}[c]{@{}c@{}}PDNs for anti-side channel \\and fault injection\end{tabular}                   &                   & GNN     &      Linear Regression~\cite{utyamishev2020power}                \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
{\cellcolor[rgb]{1,0.859,0.604}}        & Anti-RE layouts                &                   & GCN                   &       CNN~\cite{zargari2021captive}               \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
\multirow{-5}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\begin{tabular}[c]{@{}>{\cellcolor[rgb]{1,0.859,0.604}}c@{}}\textbf{Floorplanning and}\\\textbf{~Physical Design }\end{tabular}}               & Custom eFPGA fabrics           &                   & RL      &                      \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}        & \begin{tabular}[c]{@{}c@{}}Test point insertion and pattern \\generation for Trojan detection\end{tabular} & \multirow{3}{*}{ASIC, FPGA}          & RF, GB  & RL\cite{pan2021atpg}     \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
{\cellcolor[rgb]{1,0.859,0.604}}        & Information flow security      &                   & GNN, DNN,  RL    &                      \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
\multirow{-3}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\textbf{Testing and Verification }}             & \begin{tabular}[c]{@{}c@{}}Comparison of original \\specification to final design\end{tabular}             &                   & GNN     & NLP\cite{yu2021hw2vec}                      \\
\hline
\end{tabular}
}
\label{tab: aieda}
\end{table}

\subsubsection{Logic Synthesis}
In general, logic synthesis has been extensively-researched under AI/ML~\cite{Neto2019LSOracleAL, pasandi2019approximate,Pasandi2020}. The RTL-to-gate level process provides viable data to train models that have mostly been used for design optimization. The conversion from behavioral level to the gate level is the bridge between a design idea and its generation because the specific logic functions are implemented from combinations of gates selected in a given cell library.




At the gate-level, the first form of obfuscation which comes to the security-aware designer's mind is logic locking. With various methods available, there is little existing work using AI/ML. One proposed work that could be the baseline for future exploration is LeGO~\cite{alaql2021}. The authors point out that it can iteratively harden a design against a set of attacks. The framework begins by performing a simple key-based locking and continues with an iterative feedback process which considers a set of possible attacks to defend against~\cite{alaql2021}. The attacks are provided with corresponding countermeasures for integration. The rule selection algorithm, which uses prior knowledge from a database of mitigation rules, identifies the best protection to be applied for each key-bit against a specific attack. The "convergence point" occurs when all security issues are addressed~\cite{alaql2021}. The learning design could be improved with an RL-based policy iteration framework. With a suitable representation of the gate-level netlist and its features, there are many possibilities.




Similarly, in the quest for side-channel resistant designs, gate-level masking has been researched since the early 2000s. Masking is most ideal for implementation at this stage, because of the gate design's correlation to the physical design's functionality. In 2005, masked dual-rail pre-charge logic (MDPL) was proposed as a promising DPA-resistant logic style~\cite{Popp2005}. MDPL circuits are based on a standard cell libraries and have no routing constraints concerning the balancing of complementary wires. The dual-rail pre-charge property of MDPL specifically prevents glitches in the circuit. A more recent implementation uses a technique that combats the phenomena of glitches and early propagation using only cell-level “don’t touch” constraints~\cite{Leierson2014}. Their framework, a derivative of MDPL called LUT-Masked Dual-rail with Precharge Logic (LMDPL), can works for both FPGA or and ASIC designs. MDPL may be used as a rule-based template for masking gate-level designs. A GCN can be used to identify sections of the circuit that are vulnerable and would require MDPL implementation.


Information flow tracking at the gate level also serves to check adherence to security policies. The well-defined gate level information flow tracking (GLIFT) technique has been widely used to GLIFT used to design secure hardware architectures and detect security violations from visible timing flows. Hardware trojan dection has even been accomplished based on harmful information flows that point to sensitive information leakage and data integrity violation~\cite{nahiyan2017trojandetection}. From Fig.~\ref{fig:glift}, the RTL synthesis which produces the gate level representation is followed by standard cell augmentation with shadow logic gate. Design stage verification is the most suitable application of GLIFT to the EDA pipeline. The technique only checks for violation of IFS policies without addition of logic to the fabricated design. Once again, a GCN representation with sufficient features may be used to supplement, or even replace GLIFT.

\begin{figure*}[t]
   \includegraphics[width=0.9\textwidth]{Images/Glift flow.png}
   \centering
   \caption{GLIFT workflow with standard cell and GLIFT libraries.}
   \label{fig:glift}
\end{figure*}






\subsubsection{Device Sizing and/or Technology Mapping}
For ASIC designs, device size is crucial to the success of a design. The targeted purpose of ASICs means even the slightest deviation from specified dimensions will result in a failed design process. The technology-mapping step converts internal representation and the optimized logic based on the designated technology library~\cite{kaufmann2008techmap}. The mapped netlist nodes are implemented with available components to optimize area, power and/or delay; the gates in a library are have pre-defined values for these parameters. RL is capable of further optimizing the entire design with regard to power, area and delay. Techniques for approximate logic synthesis (ALS) suffer from long execution time, which has been addressed in~\cite{pasandi2019approximate} by adopting RL-based strategies. 

Critical assets in devices may be compromised by taking advantage of errors from fault injection. Single event upsets (SEUs) affect sequential elements, while single event transients (SETs) arise from combinational logic~\cite{BOGAERTS2014250}. An SEU may lead to a single event latchup (SEL), which results in a high operating current, or a short circuit. Fault tolerance reduces the sensitivity of devices to particle or laser attacks that cause these events. Glitches can be used to progressively break cryptography schemes or disable internal protection mechanisms~\cite{giraud2010}. Redundant computation is one way of making designs impervious to upsets. It uses double computation (in time or space) with a final comparison; if the results from redundant computations do not match, the output of the encryption function is suppressed/randomized. Redundancy may cause increased area and power consumption, but methods like the one presented in~\cite{petrovic2012} show high tolerance with moderate overhead is possible. The optimization procedure can be refined using a Gaussian process to find the best trade-off value.




\subsubsection{Floorplanning and Physical Design}
The floorplanning step formalizes the high level design established at the beginning of the process, and is followed by P\&R to connect all blocks such that they meet design criteria and constraints. After initial P\&R attempts, the design’s timing constraints are analyzed~\cite{martin_scheffer_lavagno_2016}. If unsatisfactory, the P\&R software in use tries different placements and signal routing to try to meet the designated constraints. Even outside academia, work has been done on automating floorplanning to benefit the physical layout. Researchers at Google modeled chip floorplanning as a reinforcement learning (RL) problem, and used a GCN representation of the design to optimize power, area and performance~\cite{Mirhoseini2021AGP}. 



Design scaling from a technology process may reduce spacing between adjacent interconnects; the resulting increased coupling capacitance between wires causes crosstalk~\cite{zhou1998crosstalk}. The affected signal's value may either change, or have delayed signal transition. False clocking, where a clock changes states unintentionally, may also occur~\cite{terapasirdsin2010crosstalk}. Good signal integrity is necessary for optimum functionality of an IC~\cite{green1999}. Large signal-integrity problems may cause intermittent success or complete system failure. To address crosstalk, the design tool must be able to measure its value. The authors of \cite{chang2006} find a closed form expression of crosstalk using a number of wires. With accurate metrics, a linear regression model coupled with the RL method applied in~\cite{Mirhoseini2021AGP} could address crosstalk expeditiously.


Side channel leakage is one of the results of the nature of an IC's power distribution network (PDN). The PDN is responsible for the supply of stable voltage and power to each functional component of the circuit~\cite{martin_scheffer_lavagno_2016}, but it may also inadvertently introduce side-channel leakages throughout the design~\cite{zhang2020pdnsca}. The growing complexity of devices introduces sophisticated PDNs with the potential to allow successful side-channel attacks or fault injection. To improve the security of a design, it is important to use ML to build on existing work on this topic. PowerScout is a framework geared towards evaluating side-channel vulnerabilities by modeling possible attacks to improve PDN designs~\cite{zhu2020}. It can effectively predict leakage strength and also identify fault injection soft spots. The side channel and fault injection attacks are modeled using non-learning based design space exploration. A decision tree, or an MLP could predict these with the same parameters being extracted. There may also be promise in modeling the PDN using a graph-based network and optimizing leakage-prone nodes for the physical design.


Anti-tamper designs are meant to deny an adversary’s opportunity to monitor or affect the correct operations of an IC. At the layout level, one CAD assessment technique allows a designer to gauge a designs susceptibility to frontside probing attacks~\cite{Wang2019}. The assessment is performed by varying attack parameters (FIB aspect ratios and angles), shield parameters (layers and shape) and the assets under attack (keys, buses,~\textit{etc.,}{}.). Two of the most useful aspects of the paper are the exposed area (EA), which is free to probe without impacting transmission, and shield structure taxonomy, which is a set of documented shield patterns~\cite{Wang2019}. Based on the attack parameters, EA and the shield taxonomy, an RL model could help recommend the best shield design for a layout.


At the layout level, IC camouflaging is a EDA engineer's most suitable option to prevent successful RE. The camouflaged layout is a functional replica of the original design with camo gates (See ~\ref{subsection: decisionmaking}. A novel framework for secure layout generation could focus on generating camo gates using GANs. Recommendations for camouflage points on an IC can be modeled using a GCN or a CNN.



The embedded FPGA (eFPGA) is an IP core integrated into an ASIC that offers the reprogramming flexibility of FPGAs without their overhead costs. They are added to systems which require frequent updates; by adding their fabric to an SoC or ASIC, teams are able to modify applications seamlessly. One security evaluation in \cite{Bhandari2021} points out that eFPGAs can contribute to SAT attack resilience. The eFPGAs have combinational loops that a specific cyclic SAT solver like CycSAT~\cite{zhou2017} cannot solve. Increasing attack difficulty can be considered when creating eFPGA fabrics at the physical design stage. The incorporation of a policy-based model that incorporates this into an ASIC design could improve security considerably.



\subsubsection{Testing and Verification}

As an IC reaches its physical state, the designers must implement design testing and verification. It is important to point out that most major design stages reach completion via some form of verification step~\cite{wang2009electronic}. For example, the logic synthesis step utilizes an RTL and gate level netlist verification procedure to guarantee functionality retention of the gate level design~\cite{martin_scheffer_lavagno_2016}. Testing and verification combined ensure that an IC has maintained original specifications and functionality throughout the design process. For physical testing, the two most significant options are wafer level testing and package level testing~\cite{perry_2007}. 





Design for Testability (DFT) is a technique employed in designing ICs for the purposes of reducing test costs and associated time. A very common technique for DFT is scan-chain insertion; regular FFs in the design are replaced with scan FFs. ATPG is a test methodology used to identify faulty behavior(s) in circuits due to design defects. The goal of ATPG is to create a set of test patterns that achieve a desired test coverage, TC, and fault coverage, FC, through fault simulation~\cite{hardware2011}. ATPG and formal methods have been researched for Trojan detection, but most do not consider partial-scan instances of a third-party IP (3PIP). The authors of~\cite{cruz2018} generate a set of constraints using the model checker to facilitate directed test generation using ATPG tool. A constraint generation procedure uses model checking to produce a set of signal traces. A test vector generation method then uses ATPG with the design, rare nodes and signal traces to produce a set of test vectors for activating each rare node~\cite{cruz2018}.


At the verification stage of the design flow, IFT can be executed using static or dynamic techniques. Static techniques assess the design's compliance with security policies using simulation, formal verification, emulation or virtual prototyping. They are applicable within the EDA pipeline, and are removed when verification is completed~\cite{hu2021}. Due to the unique goals of each specific static technique, AI/ML can be added to decrease resource usage, and improve results. For hardware security simulation, levels of abstraction like gate level and RTL are viable. As described in logic synthesis, graph-based networks are ideal solutions. The simulation process links security labels to signals. Formal verification guarantees proof of security for the desired properties, but it is known to have scaling issues~\cite{hu2021}. The large design state space of complex systems requires a policy-based learning solution which RL provides. Emulation can perform hardware-software co-verification, using FPGA emulation servers. Learning-based models could make these servers more robust to even detect software vulnerabilities that impact hardware. The abstract models of hardware components created by virtual prototyping can be tested a different RL-based approach. If the policy used is geared towards creating security problems while verifying software, the designer becomes aware of impending problems. Dynamic techniques use dedicated hardware to track information flow during runtime. A neural network could validate results to predicting flow inconsistencies.


Furthermore, Natural language processing (NLP) can be applied to circuit designs at different levels of abstraction. One of the most promising bridges to this is HW2VEC, a graph learning tool to extract graph representations from a hardware design in either RTL or gate level~\cite{yu2021hw2vec}. It is divided into two main parts: a HW2GRAPH stage which converts the design to a graph while retaining structural information, and GRAPH2VEC which converts the graph into Euclidean-based embeddings. GRAPH2VEC is just one of a number of graph-to-vector-embedding algorithms that utilizes concepts from the skipgram word embedding model~\cite{narayanan2017graph2vec}. The resulting vector representation may be applied with measures of similarity, like cosine similarity, to verify designs. If HW2WEC can be leveraged at physical design stages, the final IC product can be verified for structural authenticity.
 


\subsection{Ecosystem Essentials for Accelerating Research and Development}

\subsubsection{Open-Source Benchmarks, Benchmark Generation Tools, and Data Augmentation}
The academic community is plagued by a lack of benchmarks to facilitate research and experimentation. For pre-silicon tool development, most researchers rely on common sets such as the ISCAS ('85, '89, '99) and OpenCores benchmarks~\cite{jenihhin}. Although these have varying degrees of complexity, the available designs do not accurately capture the entire space of today's IC industry. Companies are particularly hesitant to make even their most outdated designs available due to confidentiality of IPs. The result is a dissonance between academic research and industrial development, which is even more problematic for AI-based EDA. To develop effective AI/ML models, vast amounts of quality data are required. This requires a concerted effort from industry giants, irrespective of their own internal research and development investments. 

Hardware security-focused benchmarks like the ones available on Trust Hub seek to push research in the field. This online resource provides a few hundred examples of board level Trojans~\cite{HARRISON202112}, chip level Trojans~\cite{salmani2012, shakya2017benchmarking} and obfuscation~\cite{amir2018development} benchmarks.
Without benchmark generation tools, the samples become tedious to create. It is imperative that such tools are developed and made open-source, especially for AI training and validation that require large datasets. For this, Amir and Forte~\cite{amir2020adaptable} propose a technique that leverages linear optimization to generate synthetic combinational benchmarks that are adaptable to user input constraints and structurally different from input reference benchmarks. This can be viewed as a form of data augmentation to increase variation of features seen by AI/ML/DL algorithms, which should make them learn better and avoid overfitting. Similarly, behavioral models of common analog circuits can act as benchmarks for analog ICs which designers can easily evaluate and integrate security-related constraints and metrics within those models.



\subsubsection{Standardized Domain Knowledge
As the academic community needs vast amounts of data, researchers also needs standardized domain knowledge. 
Domain knowledge helps standardize data collection processes, so data collected from different labs is consistent. It also guides researchers to identify relevant features for their specific applications; such prior knowledge means more informed \textbf{feature selection} and \textbf{dimensionality reduction}. Both allow practitioners to reduce the number of features in a dataset by only focusing on important ones. The EDA pipeline produces reports and tunable parameters that may be useful to a model. Without that distinction, an ML model may not achieve its improved automation and efficiency goals. The general benefits include requiring less data for high-accuracy models, creating more robust models, and utilizing interpretable features that help advance explainable AI (XAI) in EDA.








\subsubsection{Open-source EDA Tools and PDKs}
As this survey demonstrates, designing ICs requires many stages; IP cores must be verified and tested for synthesis to different FPGA architectures and various standard cell libraries. Tools like ones available on OpenCores.org are suitable for less-complex demands, and foster collaboration among users. However, they are not industry standard, hence they differ in functionality from commercial tools provided by Synopsys, Cadence, and Xilinx. They are also less-reliable and may have trouble scaling up to modern designs.

Some tools have been provided through extensive research within the academic and industrial communities. The OpenROAD initiative seeks to reduce effort, cost and time for hardware designs by providing 24-hour layout implementation~\cite{ajayi2019openroad}. Their GitHub repository also allows designers with available PDKs to add to the ones available. Similarly, the ALIGN initiative consists of a joint academic/industry team to develop open-source software for analog/mixed-signal circuit layout to translate
a netlist into a physical layout, with 24-hour turnaround and no
human in the loop~\cite{kunal2019align}. The development of more security-aware designs needs a similar effort from interested parties. With the same emphasis on automation, AI/ML requires working EDA tools to build from.

\subsection{Advanced AI Techniques to Explore and Benefits }

\subsubsection{Transfer Learning (TL)}
Transfer learning (TL) is built on the knowledge of previously-learned tasks; the knowledge gained from solving one machine learning problem can be used to address another one (see Fig.~\ref{fig:transferlearning}). The benefits of utilizing transfer learning are faster training times, increased accuracy, and eliminating the need for large amounts of data. Pan and Yang~\cite{pan2010transfer} use domain, task, and marginal probabilities to describe transfer learning. Take a domain $D$, a two-element tuple with feature space $\chi$ and marginal probability $P(X)$. $X$ is a sample data point, and the entire domain is represented as
\begin{align}
   D = \{\chi, P(X)\}
\end{align}
Now consider a task $T$, another two-element tuple of label space $\gamma$ and predictive function $\eta$. The objective function can be denoted as P($\gamma \vert$ X). Also, $Y$ is a corresponding label point for $X$. Therefore,
\begin{align}
   {T = \{\gamma, P(Y \vert X)\} = \{\gamma, \eta\}}
\end{align}
A source domain can be represented as $D_s$, source task as $T_s$, target domain as $D_t$, and target task as $T_t$. Hence, the aim of transfer learning is to learn the target conditional probability function $\eta_t$ or P($Y_t \vert X_t$) in $D_t$ with information gained from $D_s$ and $T_s$.

TL is ideal for applications within the IC design domain because general design rules are used globally. Design libraries and technology nodes may differ, but pre-trained deep learning models can be applied to various optimization and security-aware problems. This is especially the case in analog IP design where the lack of portability and re-usability across different circuits, design stages, and technology nodes has acted as impediments to the advancement of analog EDA tools. TL has become common in the community for its ability to help train models and quickly deploy models in applications where data is not readily available, as is often the case in the hardware assurance domain. 

\begin{figure}[t]
\centering
\includegraphics[width=0.9\columnwidth]{Images/Transfer_Learning.png}
\caption{High level description of transfer learning: the applied knowledge from pre-training using Model 1 helps reduce data required for Model 2.}
\label{fig:transferlearning}
\end{figure}

\subsubsection{Federated Learning for Collaboration Without Hardware IP Compromise}\label{subsec:federated}
\input{Sections/federated}

\subsubsection{Explainable AI and Engineer Education}\label{subsec:xai}
\input{Sections/x_ai.tex}

   
   
   

\subsection{Electronic Design Automation}\label{sec:eda}
The electronic design automation flow for digital ICs is as follows.

 \subsubsection{Design Specification}
    In design specification, the designer must accurately describe the overall design requirements. The system may be proposed by a design team to initiate the production of a chip. The IC designers decide on functionality and plan out verification and testing procedures for the entire process.
    
\subsubsection{High-Level Synthesis}
    High-Level Synthesis (HLS) tools translate a design written in high-level languages such as C/C++/SystemC into a low-level hardware description language (HDL). Hardware components can be modeled at high levels of abstraction, allowing the designer to map both hardware and software components~\cite{martin_scheffer_lavagno_2016}
    
\subsubsection{Logic Synthesis}
     Logic synthesis is a direct translation from the behavioral domain (register transfer level) to the structural domain (gate level)~\cite{JIANG2009299}. The gate-level netlist is mapped to the standard cell library. The optimization part of logic synthesis minimizes hardware by finding equivalent representations of larger blocks. Design constraints used as input may also be met for circuit area, power, and performance.
    

\subsubsection{Design for Testability (DFT)}
   DFT encompasses the techniques used to generate cost-effective tests for the gate-level netlist obtained from logic synthesis. These techniques are geared towards increasing observability, controllability, and predictability of the design~\cite{martin_scheffer_lavagno_2016}. Ad-hoc methods like partitioning and test point insertion are relatively easier to implement, while structured ones like scan registers, scan chains, scan architectures and algorithms ensure good testability at the expense of additional area and delay overhead. The resulting tests utilize test programs which drive automatic test equipment (ATE). The ATEs also use automatic test pattern generation (ATPG) to identify input sequences which trigger errant circuit behavior arising from manufacturing defects~\cite{HSIAO2006161}. 

     
\subsubsection{Floorplanning}
    Flooplanning focuses on the sizes and arrangement of the physical blocks created during logic synthesis. It affects the optimization results of the increasing physical stages. It is the first major step in physical design. Pins and ports are also assigned a rough location, which can further be refined depending on the placement and routing results~\cite{Lienig2020}.

    
\subsubsection{Placement-and-Routing}
   After a successfully-proposed floorplan, the place-and-route~(P\&R) addresses the structural design of a circuit. The designer places and connects all of the blocks that make up the chip such that they meet design criteria and constraints. After the initial P\&R attempts, the design's timing constraints are analyzed. If unsatisfactory, the P\&R software in use tries different placements and signal routing to try to meet the designated constraints~\cite{Lienig2020}.

\vspace{1em}

\begin{figure*}[t]
   \includegraphics[width=\textwidth]{Images/IC_Design_with_Security_Topics.png}
   \centering
   \caption{General digital IC design pipeline with applicable security topics for each stage. \textbf{D} stands for decision making, \textbf{P} represents performance prediction, while \textbf{B} and \textbf{A} stand for black box optimization or design space exploration and AI-assisted EDA, respectively.}
   \label{fig:icsecurity}
\end{figure*}

ML is already applied to some extent in the digital IC design process, albeit with primary focus on general design prediction and optimization. Some needs tackled at this stage include logic and design optimization~\cite{Haaswijk2018}, low-power approximation~\cite{Pasandi2020} and area estimation~\cite{froemmer2020}. Careful assessment of available publications incorporating learning into digital IC design will reveal an absolute truth; very little work has been done to directly address hardware security vulnerabilities. The use of intelligent models presents the opportunity to not only optimize designs, but to secure them against the array of tools and attacks that malicious parties have at their disposal. This is especially important for some security properties that cannot be modelled analytically and situations where multiple security constraints are at odds. According to~\cite{huang2021machine}, ML approaches in EDA can be broken down into four main directions: \textbf{decision making}, \textbf{performance prediction}, \textbf{black box optimization or design space exploration} and \textbf{AI-assisted EDA}. In the rest of this section, we follow this same organization to discuss security-aware CAD research and opportunities. Fig.~\ref{fig:icsecurity} also highlights the general EDA steps and the applicable directions for each one.



\subsection{\textbf{Decision Making}}\label{subsection: decisionmaking}
The decision-making perspective encapsulates the replacement of traditional, brute-force design-for-security methods with more automated and efficient techniques. In most cases, brute-force techniques involve countless trial-and-error steps until the best-performing configuration is found and used on a design. From a heuristic perspective, the knowledge gained may prove to be invaluable. However, they are only feasible on simpler designs; increased complexity transforms them into cumbersome requirements that most designers would gladly bypass. Further, the tradeoffs between security and traditional metrics as well as between different security metrics might be unknown or too complex for manual tuning. Automation becomes valuable only when it is characterized by efficiency. ML can definitively make decisions on the most suitable settings and parameters for countermeasures with varying levels of human input~(see Fig.~\ref{fig:decisionmaking}).





\begin{figure*}[t]
   \includegraphics[width=\textwidth]{Images/Decision-Making_Diagram_1.png}
   \centering
   \caption{General overview of decision making process for security-aware EDA using AI/ML/DL.}
   \label{fig:decisionmaking}
\end{figure*}


\subsubsection{High Level Synthesis and/or Register Transfer Level}


\paragraph{Encoding Optimization}\label{para: encoding}
Another aspect that stands to benefit from the addition of ML-powered decision-making is finite state machine (FSM) encoding optimization. The encoding schemes are selected based on design constraints, including power and area. The two most common options are:

\begin{itemize}
\item \textbf{Binary Encoding} -
In binary encoding scheme, states are encoded as a binary sequence where the states are numbered starting from 0 and up. The number of state flip-flops (FFS), $q$, required for binary encoding scheme is given by $q = log2(n)$; where, $n$ is the number of states. The binary encoding scheme is better suited for FSM with a fewer number of states~\cite{lin2012binary}.

\item \textbf{One-hot Encoding} -
This encoding scheme is designed with only one bit of the state variable as ``1'' while all other state bits are ``0''. It requires as many state FFs as the number of states. This creates the need for more state FFs than binary encoding~\cite{cassel2006onehot}.
\end{itemize}

One-hot encoding scheme is less vulnerable to fault injection attacks while binary is more resistant to hardware Trojans that exploit don't care states. This is demonstrated by Nahiyan~\textit{et al.}{} using the FSM of the SHA-256 digest engine~\cite{nahiyan2019}. With this knowledge, a secure encoding scheme was proposed in~\cite{nahiyan2019} that combines binary and one-hot schemes to achieve the best of both worlds. In future work, AI/ML may be used to determine the best mix given a specific FSM.



\paragraph{Hardware Security Primitive Deployment at Higher Levels of Abstraction}\label{paragraph: aiss}
The Automatic Implementation of Secure Silicon (AISS) program was developed by the Defense Advanced Research Projects Agency (DARPA) to automate the process of incorporating scalable defense mechanisms into chip designs, by allowing designers to explore chip economics versus security trade-offs based on the expected application and intent while maximizing designer productivity~\cite{darpa}. Deployment of security methods pre-silicon are always cost-effective and less time-consuming. With this in mind, AI/ML can be used to make decisions as early as during HLS, or at RTL. Based on the discernible features at these levels of abstraction, a classification-based model can use vector embeddings to suggest suitable hardware security primitives and their associated parameters (e.g., size). For example silicon odometers are inserted into IC designs to measure aging and detect recycled counterfeit chips~\cite{guin2015design}. Their accuracy and yield are determined by various parameters~\cite{shakya2015performance}, which can be optimized through ML/AI. 

\begin{figure*}[t]
   \includegraphics[width=0.8\textwidth]{Images/arbiter_puf.PNG}
   \centering
   \caption{Arbiter PUF circuit. The circuit creates two delay paths with the same layout length for each input X, and produces an output Y based on which path is faster. Reprinted from~\cite{herder2014puf}}
   \label{fig:puf}
\end{figure*}

Physically unclonable functions (PUFs)~\cite{gassend2002silicon} provide digital fingerprints using the internal process variations (entropy) of a physical device. An example is arbiter PUF circuit shown in Fig.~\ref{fig:puf}. the The translation of these unique and unclonable manufacturing variations into challenge-response pairs provides unique chip identifiers or authentication mechanisms. One of the main issues with PUFs is their reliability,~\textit{i.e.,}{} ability to provide the same output in the presence of environmental variations and aging. To combat this, they often rely on error correcting codes~\cite{hiller2020review}, which can be designed to handle a specific number of bit flips. Another primitive is the true random number generator (TRNG), which uses an entropy source to generate non-deterministic data with a given throughput to seed security algorithms like cipher keys~\cite{gabriel_wittmann_sych_dong_mauerer_andersen_marquardt_leuchs_2010} or masking~\cite{trichina2003combinational}. For any design that contains all three of these primitives, their characteristics can be tuned together for a specific application or to fit within a dedicated silicon area.






\subsubsection{Logic Synthesis}
\paragraph{\textbf{Tuning EDA Parameters and Commands during Logic Synthesis}}\label{subsubsec: dectuninglogic}
Although a constraint set may be part of the design specification, the gate level netlist provides a better understanding of functionality to a designer. Area constraints guide the P\&R tool to locate a specified design block partition, while timing constraints specify path delays~\cite{else2009}. To tune high-level directives, it is important to accurately predict their impact. This is a tall order for most designs due to complex optimizations throughout the design process. These complex optimizations create disparity between desired results at the HLS stage and implemented values post-synthesis. Conventional tools assist with optimization tasks, but machine learning is already being used to mitigate the latter problem. For example, Yu~\textit{et al.}{}~\cite{yu2018developing} have developed Intellectual Property (IP)-specific synthesis flows (i.e., sequence of synthesis transformations for TCL scripts) using CNNs that improve Quality of Result (QoR). In~\cite{Neto2019LSOracleAL}, DL is used to automatically decide which logic optimizer (And-Inverter Graph (AIG) and Majority-Inverter Graph (MIG)) should handle different portions of the circuit for better performance and lower area. Makrani~\textit{et al.}{}~\cite{Makrani2019} proposed a Pyramid framework to estimate best performance and resource usage. The input features are derived from the HLS report, and a stacked regression model provides accurate timing, delay and resource values before reaching post-implementation. 

Optimization goals during tuning can be geared towards obtaining a more secure, synthesised design with minimum overhead. Although this would only be evident with the combination of other design parts, early-stage deployment saves time and labor. For example, secure split-test (SST) is a method of securing the manufacturing process by mandating test results to be verified by the IP owner and by using a ``key'' to unlock the IPs correct functionality after tests are passed. For the functional locking block, XOR logic is added in series to non-critical paths. If the two inputs are different, the XOR logic will act as an inverter~\cite{contreras2013} causing any locked (still untested or failed chip) to act deliberately incorrect. The optimal number of XOR gates to insert into the circuit, insertion algorithm~\cite{chakraborty2009harpoon,6616532,lee2015improving}, or partitioning algorithm~\cite{alaql2021saro} to employ for a given IP's function and/or structure can be determined using ML techniques. 



\begin{table*}[t!]
\centering
\caption{Security requirements under decision making with applicable AI/ML algorithms. The cited options indicate optimization or security implementations available for reference}
\label{table:decisionmaking}
\arrayrulecolor{black}
\resizebox{\linewidth}{!}{
\begin{tabular}{|c|c|c|} 
\hline
\rowcolor[rgb]{0.361,0.769,0.769} \textbf{Design Stage }   & \textbf{Security Task }     & \textbf{Applicable AI/ML Algorithms}            \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}      & Encoding Optimization       & Polynomial Regression      \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}--|}
\multirow{-2}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\textbf{High Level Synthesis}} & \begin{tabular}[c]{@{}c@{}}Hardware Security Primitive Deployment\\at Higher Levels of Abstraction\end{tabular} & \begin{tabular}[c]{@{}c@{}}Polynomial Regression,\\SVM\end{tabular}  \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}      & \begin{tabular}[c]{@{}c@{}}Tuning EDA Parameters and Commands\\during Logic Synthesis\end{tabular}              & CNN~\cite{yu2018developing}, Stacked Regression~\cite{Makrani2019}     \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}--|}
\multirow{-2}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\textbf{Logic Synthesis }}     & Standard Cell Selection     & SVM   \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}\textbf{Cross-Abstraction} & \begin{tabular}[c]{@{}c@{}}Benchmark Selection for Security-\\Aware EDA Tool Evaluation\end{tabular}            & GNN, GCN                   \\
\hline
\end{tabular}
}
\end{table*}

\paragraph{\textbf{Standard Cell Selection}}\label{subsubsec: standardcell} A specific category of available standard cells may be used in an IC design to address specific security vulnerabilities. As far back as 2004, sleep transistor cells were proposed as a method for sub-threshold leakage current reduction~\cite{babighian2004}. The sleep transistor cells are picked from a library designed to target high layout efficiency. The results were shown to have achieved a minimum reduction percentage of 74\%. A trained support vector machine~(SVM) can be used to decide from a set of available libraries with specific target optimizations. 



\subsubsection{Cross-Abstraction}

\paragraph{\textbf{Benchmark Selection for Security-Aware EDA Tool Evaluation}}\label{subsubsec: benchselection}
One additional optimization activity that may easily be overlooked is the evaluation of EDA tools used during the IC design process. Companies and research groups that develop EDA tools constantly update features to enhance their output. In order to properly target specific problem areas, the testing process must involve specific benchmarks. For example, if a designer intends to assess the scalability of the tool, the most important requirement for the test benchmark would be its size. If more nuanced conditions must be met, an automated method would make this process faster and more efficient. Succinct features of a benchmark and a tool's problem area in a DNN can determine the most suitable sample for testing. 

In the area of hardware security, benchmarking has played a critical role in development and comparison of hardware Trojan detection schemes~\cite{shakya2017benchmarking} and recently in de-obfuscation~\cite{amir2018development,tan2020benchmarking,amir2020adaptable}. Thus far, however, none of these benchmarking activities have explicitly incorporated AL/ML. Table~\ref{table:decisionmaking} provides suggested AI/ML algorithms for future endeavors. 







 

\subsection{\textbf{Performance Prediction}}\label{subsec: performanceprediction}
Performance prediction describes forecasting and modeling trade-offs associated with adding countermeasures, especially at earlier design stages. Although an ideal scenario would involve achieving optimum design goals while guaranteeing near-perfect security awareness, a designer must be aware of the inevitable compromises that a secure design may entail. A more achievable target is finding the balance between optimization and security, as seen in Fig.~\ref{fig:performanceprediction}. This is where AI/ML comes into the picture. The automation of the balance-seeking process will not only speed up the IC design pipeline, but will ensure that the most suitable operating parameters and modifications are available to the designer. From a business standpoint, time-to-market of ICs in production may also decrease.






\begin{figure*}[t]
   \includegraphics[width=\textwidth]{Images/Performance_Prediction.png}
   \centering
   \caption{General overview of performance prediction process for security-aware EDA using AI/ML/DL.}
   \label{fig:performanceprediction}
\end{figure*}



\subsubsection{Physical Design}

\paragraph{\textbf{Security-aware Layouts and Tradeoff Modeling}} \label{subsubsec: eaprediction}
Invasive physical attacks are expensive to execute but difficult to protect against. Attackers resort to focused ion beam~(FIB) to extract an asset’s value by milling to its location in the IC layout, creating a metal contact to it, and probing the contact while the chip is in operation. There are two main sets of countermeasures proposed to combat probing attacks; the preventive strategy utilises active or analog shields, such as meshes, while the detection strategy checks for attacks by sensing any probing or editing and alerting the operators~\cite{wang2017}. To improve the effectiveness of active shields, an automated anti-FIB probing flow called iPROBE was proposed~\cite{Wang2019,osti_10174121}, see Fig.~\ref{fig:iprobe}. iPROBE uses ad hoc rules to determine the areas and metal layers where computer-aided design (CAD) tools should place shields to reduce ``exposed area''. For a physical IC, the exposed area (EA) metric (as described in \cite{shi2016layout}) is used to measure the design’s vulnerability to probing attacks. A larger EA means more flexibility with the expense that an attacker can probe without triggering contingencies. While iPROBE did improve EA while reducing overhead as compared to traditional shields, the security and overheads cannot yet be explicitly controlled by the designer. In other words, trial-and-error needs to be performed to make sure that constraints are met. To further boost efficacy of the anti-probing method described above, it may be possible to model the relationship between EA and power, timing and area with a multiple linear regression model or even DL. Then, iPROBE parameters could be chosen with security, area, power,~\textit{etc.,}{} in mind.

\begin{figure}[t]
\centering
\includegraphics[width=0.5\columnwidth]{Images/iProbev2.png}
\caption{iPROBE version 2 with protection for frontside and backside probing attacks~\cite{osti_10174121}. The light blue metal lines and darker blue metal lines form active shields that protect against frontside attacks (through top passivation and metal) and backside (silicon substrate), respectively. The metal lines sandwiched between the shields carry critical information that the attacker wants to probe. A FIB cut though an entire shield line of frontside/backside will be detected because the signal present on it will not match its counterpart in backside/frontside.}
\label{fig:iprobe}
\end{figure}







\subsubsection{Cross-Abstraction}
\paragraph{\textbf{Modeling Area, Power, Timing, and Security Impacts of IP Protection}} \label{subsubsec: ipprediction}

In general, design optimization problems have always been modeled based on area, power and timing; timing is used here because it directly relates to performance. Even at the HLS stage, ML implementations, like Pyramid~\cite{Makrani2019} have been used to predict optimal timing. There has also been work to predict area at both HLS~\cite{Zennaro2018} and logic synthesis~\cite{froemmer2020}. Deep-PowerX is a DNN-based dynamic power consumption minimization tool which exploits the power-area and delay-area relationships within a netlist~\cite{Pasandi2020}. Even at the placement and routing stage, timing prediction is possible using ML~\cite{Barboza2019}. 

One of the most significant threats to design integrity is IP piracy. The availability of a design to malicious parties gives way to overuse, modification, cloning, overproduction and/or reverse engineering. There are various defense-centered modifications available to an engineer at various stages of the IC design cycle, and ideas from ML-based optimization can be applied to them. 
\subparagraph{IP Watermarking} A watermark is a specific modification of an IP core that allows it to be uniquely identifiable, which is useful for piracy detection. However, IP core watermarking in general must never alter the functionality of the design~\cite{Chang2016watermark}. One popular method of watermarking is the the don't-care condition based technique. It involves adding function blocks with unspecified input combinations to the original design. Their outputs can be forced and used to verify the authenticity of a circuit~\cite{Dunbar2015SatisfiabilityDC}. However, additional logic may mean area, timing and power overhead. To hasten the design cycle, these overhead metrics must be readily available to a designer. If a trained algorithm can accurately model and predict these values, the design house would be able to ascertain the viability of a specific watermarking scheme, like the don't-care condition based method.

\subparagraph{Hardware Obfuscation}\label{par: dectuning, obfus} Hardware obfuscation is used to actively protect IP and has been applied at all major design stages preceding fabrication and assembly. It is intended to obscure an original design to prevent IP piracy and reverse engineering. Hardware obfuscation also addresses IP overuse and hardware Trojan insertion. 

The set of approaches that can be implemented until the DFT stage are typically \textbf{keyed} approaches. These techniques attempt to prevent black box use by key gates/inputs. One common example is \textbf{logic locking}, which hides the functionality and the implementation of a design by inserting additional gates (``key gates'') into the original netlist. The circuit will only function correctly if the acceptable inputs or keys are provided to the key gates~\cite{Yasin2020}. The additional gates must provide low overhead and be usable for larger designs. A significant challenge, however, has been making logic locking scheme secure against the entire suite of oracle-based attacks (e.g., SAT~\cite{subramanyan2015evaluating}, AppSAT~\cite{shamsi2017appsat}, key sensitization~\cite{rajendran2012security},~\textit{etc.,}{}.) and oracle-less attacks (e.g., desynthesis~\cite{massad2017logic}, signal probability skew~\cite{yasin2017security},~\textit{etc.,}{}.). The former use an unlocked chip as an oracle to non-invasively derive its key while the latter operate solely on the netlist. Preventing oracle attacks implies that the time to recover the key should be prohibitively high for an attacker. Recently, ML has been used to predict the obfuscation strength in terms of the predicted time taken to de-obfuscate an obfuscated circuit using the SAT attack. Chen~\textit{et al.}{}~\cite{chen2020} demonstrate this using a GCN. They combine graph structure with gate feature by using an enhanced graph convolutional operator named ICNet. The features employed are divided into the graph structure, which describes connections, and gate features, including gate mask and gate type. While this approach has only been applied to predict SAT attack time, it can nonetheless be used to predict resistance to other oracle attacks. Recently, oracle-less attacks such as SAIL~\cite{chakraborty2018sail} have employed ML to recover the original (unobfuscated) netlist by reverse engineering logic synthesis rules.

Another key-based countermeasure that can be considered is FSM locking~\cite{chakraborty2009harpoon}. FSM locking adds extra states into the FSM of an IC design. The correct ``key'' is the right sequence of state transitions, which guarantees non-erroneous functionality. The additional states are materialised by FFs with their corresponding combinational logic. Active hardware metering~\cite{alkabani2007active}, a version of FSM locking, creates boosted finite state machines (BFSMs) from the new states. At this stage, it would be imperative to be able to predict the overhead created by the added states. This is because the design house sends the verified netlist to the untrusted foundry to create PUFs (challenge-response pairs) from the fabrication process variation. This may introduce additional overhead that could affect overall functionality. Depending on the complexity of the circuit, either a regression model or a DNN may suffice.

The \textbf{keyless} variety of obfuscation does not require keys, and cannot affect functionality. The desire is to conceal design intent. Without some form of obfuscation, a malicious party can either copy an IP or seek and exploit design vulnerabilities using reverse engineering. The most noteworthy example of keyless obfuscation is \textbf{IC camouflaging}~\cite{chow2012camouflaging}, which replaces original gates with ``camo gates'' which are difficult to discern by pattern recognition. It is worth noting, however, that most camouflaging techniques can be ``mapped'' into logic locked circuits~\cite{yasin2015transforming} where the above oracle attacks are quite effective~\cite{el2015integrated}. Hence, the prediction schemes mentioned above for logic locking may also apply to camouflaging. Further, the replacement of gates with camo gates to facilitate camouflaging will almost always alter power consumption and area. With the right set of features extracted from a report (HLS report), a trained regression model could predict the parameter values with near-perfect accuracy. There is evidence of this in other EDA applications. For example, Zennaro~\textit{et al.}{} combine an RTL generation framework with ML algorithms to estimate the area of the final design based on the features of an abstract specification. They retrieve the number of configurable logic blocks (CLBs) information from synthesised RTL design reports created from an automation framework. They mainly use a multilayer perceptron (MLP), but also experiment with random forests (RF) and gradient boosting (GB)~\cite{Zennaro2018}.

Another popular keyless approach is \textbf{split manufacturing}~\cite{imeson2013securing} where a design is split, each part is fabricated at one or more untrusted entities, and a trusted entity puts them together. Split manufacturing can have significant overheads and security concerns (e.g., proximity attacks~\cite{magana2017proximity}) if P\&R is performed poorly. Ad hoc and linear programming approaches to perturb P\&R~\cite{wang2018cat} and/or split designs~\cite{shi2018obfuscated} have met with some success, but can likely be improved further through the incorporation of AI-based modeling and prediction.


\paragraph{\textbf{Side Channel Attack Resistance}} \label{subsubsec: sidechannelresist}
Side channel leakage allows an attacker to break cryptographic systems. Signals that a cipher's implementation inadvertently emits allow for systematic extraction of underlying information. Examples include instantaneous power consumption, timing/delay, and electromagnetic emissions. Whether the attacker targets the understanding of device operation (simple) or uses leakage information to correlate data values (differential), there are generic countermeasures to reduce the effect of side channel leakage~\cite{markowitch_2011sca}. A high signal-to-noise ratio~(SNR) implies the availability of more meaningful leakage information. \textbf{Hiding} countermeasures reduce the SNR by either dampening the signal with low power designing and shielding, or flooding the leak-prone areas with noise using noise generators~\cite{levi2020ask}. To measure the value of hiding on a design, a predictive, regression-based model could provide an accurate percentage reduction in side-channel leakage. An obvious feature would be the tuning of the technique used. 

Another available countermeasure is \textbf{masking} which seeks to remove the correlation between input data and side-channel leakage ~\cite{prouff_2013_masking}. Unlike hiding, masking is applied at the algorithmic level with logic gates. Nonetheless, higher order side-channel analysis allows an attacker to bypass the routine masking schemes. A higher order masking may be employed but it may require significant overhead~\cite{prouff2009}. 
In order to evaluate the effectiveness of masking, various types of AI and ML algorithms have been employed to accomplish (a) the assessment of side-channel resiliency against a specific attack~\cite{picek2021sok}, and (b) the full leakage assessment methodology~\cite{moos2021dl}. 
However, both of these evaluation techniques need the actual ASIC or a correctly-programmed FPGA, as well as special equipment to be performed cf.~\cite{arribas2018vermi}. 
To overcome these obstacles, another line of research has been pursued, which is devoted to (1) theoretical conditions for a design to be SCA-resistant~\cite{barthe2015verified,coron2018formal,bloem2018formal} or (2) model the implementation for simulating its behavior~\cite{bertoni2017methodology,reparaz2016detecting} in the pre-silicon steps. 
In the first category, AMASIVE framework~\cite{zohner2012,huss2013amasive} can be mentioned that identifies hypothesis functions for leakage models cf.~\cite{buhan2021sok}. An example from the second class is VerMI, which is a verification tool in the form of a logic simulator that checks the properties of a class of masking methods (threshold implementation)~\cite{arribas2018vermi} at both algorithmic and implementation levels. 
Nevertheless, at this level of abstraction,~\textit{i.e.,}{} pre-silicon, AI techniques have not found direct applications yet. Perhaps, the most straightforward way of incorporating such a technique can be imagined to examine whether the conditions for SCA-resiliency are fulfilled (the first category). 

Yet another step further, Ma~\textit{et al.}{} presented a security-driven placement and routing tool to protect designs against EM side-channel attacks~\cite{CADSec2020} that attempts to break the balance of signal delays by register reallocation under the condition of layout constraints. The CAD-based tool, named CAD4EM-P, uses register reallocation and wire length adjustments to reduce the data dependency of EM leakage with acceptable area and power overheads~\cite{CADSec2020}. Opportunities to improve the effectiveness and efficiency of this approach can rely on more advanced forms of ML-for-prediction. For example, a graph neural network (GNN) can replace the graph-based algorithms that are the basis of the original version. 


\paragraph{\textbf{Fault Injection Tolerance}}
In contrast to most SCA attacks, fault injection attacks involve an active adversary.
In other words, the adversary tries to observe a faulty behavior of the target device by forcing it to function outside of its specified operating range or feeding it undefined data. 
For example, an attacker can cause erroneous operation of the target platform by tampering with the supply voltage (\textit{a.k.a.,}{} voltage glitching), modifying the clock signal's frequency (a.k.a glitching), or flipping bits in the memory using a laser beam~\cite{bar2006sorcerer}.
While most fault attacks require physical access to the victim device, recent studies have shown that in certain cases similar fault attacks can also be carried out remotely on a variety of systems~\cite{alam2019ram}.
Cryptographic devices and secure hardware have been the main targets of fault injection attacks. 
For example, an adversary could inject faults into an FSM implemented on a hardware platform to bypass authentication states and obtain unauthorized access to security-sensitive states.
On the other hand, an adversary may be able to extract the secret key by injecting faults into a cryptographic implementation and applying mathematical tools, like Differential Fault Analysis (DFA), on faulty generated ciphertexts.

Several protection/detection-based countermeasures have been proposed to mitigate the vulnerabilities of circuits against fault attacks.
While device-level countermeasures can be effective against fault injection attacks, the cost and extra manufacturing steps make the algorithmic and circuit-based countermeasures more attractive.
EDA tools can be deployed to improve the circuits' resiliency for such countermeasures.
However, conventional countermeasures are generic and create high overhead in terms of area and power.
Several protection/detection-based countermeasures have been proposed to mitigate the vulnerabilities of circuits against laser fault injection~(LFI) attacks.
While physical countermeasures, such as tamper-proof packaging and light sensors, can be effective, the cost and extra manufacturing steps make the algorithmic and circuit-based countermeasures more attractive.
For such countermeasures, EDA tools can be deployed to improve the circuits' resiliency.
However, conventional countermeasures are generic and not tailored to specific fault injection techniques.
For instance, by using triple-modular redundancy~\cite{lyons1962use}, error-detection/correction codes~\cite{karpovsky2004new,sunar2007sequential,tomashevich2014protecting, neumeier2012punctured}, and MAC tags/infective computation~\cite{CAPA,MandM}, the circuit becomes more resilient in general.
In these cases, however, depending on the capabilities of the adversary and how these countermeasures are synthesized, placed, and routed, they can still be bypassed by powerful fault attacks.
AI/ML can support creating circuit netlists and layouts during the design phase that are more resistant to fault injection attacks by taking the physical models of fault attacks into account.
For instance, by considering fault propagation together as a new feature, the impact of fault resilient placement and routing on security and overhead can be predicted. As shown in Table~\ref{table:performanceprediction}, GNNs and SVMs are viable algorithms for use.


\begin{table*}[t!]
\centering
\caption{Security requirements under performance prediction with applicable AI/ML algorithms. The cited options indicate optimization or security implementations available for reference}
\label{table:performanceprediction}
\arrayrulecolor{black}
\resizebox{\linewidth}{!}{
\begin{tabular}{|c|c|c|} 
\hline
\rowcolor[rgb]{0.361,0.769,0.769} \textbf{Design Stage }                     & \textbf{Security Task }   & \multicolumn{1}{c|}{\textbf{Applicable AI/ML Algorithms}}            \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}\textbf{Physical Design}                     & \begin{tabular}[c]{@{}c@{}}Security-aware Layouts and \\Tradeoff Modeling\end{tabular}   & \multicolumn{1}{c|}{Multiple Linear Regression} \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}   & \begin{tabular}[c]{@{}c@{}}Modeling Area, Power, Timing, and \\Security Impacts of IP Protection\end{tabular} & \multicolumn{1}{c|}{DNN~\cite{Pasandi2020}, GCN~\cite{chen2020}, MLP~\cite{Zennaro2018}}  \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}--|}
{\cellcolor[rgb]{1,0.859,0.604}}   & Side Channel Attack Resistance                 & Polynomial Regression, GNN \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}--|}
{\cellcolor[rgb]{1,0.859,0.604}}   & Fault Injection Tolerance & GNN, SVM                   \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}--|}
{\cellcolor[rgb]{1,0.859,0.604}}   & Hardware Trojan Detection Rates                & SVM, Polynomial Regression \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}--|}
\multirow{-5}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\textbf{Cross-Abstraction}} & \begin{tabular}[c]{@{}c@{}}Vulnerabilities Across Design\\~Abstractions~and/or PDKs\end{tabular}              & GNN, RL~\cite{lu2021rl}           \\
\hline
\end{tabular}
}
\end{table*}

\paragraph{\textbf{Hardware Trojan Detection Rates}}
Malicious modifications,~\textit{i.e.,}{} \textbf{hardware Trojans}, are possible during the IC design and fabrication process. Hardware Trojan detection has been extensively researched within the hardware security research domain~\cite{tehranipoor2010}. Salmani~\textit{et al.}{} proposed a method of increasing the probability of Trojan activation using dummy scan FFs~\cite{salmani2012}. They place a dummy scan FF with a net having low transition probability. To test the concept, Trojan samples have to be deployed on benchmarks. The rate of Trojan detection could be derived from the available data that these simulations produce. Likely features that would be valuable for a prediction-based ML model include nets with dummy scan FFs, their fanouts and their corresponding transition probabilities. 

\textbf{Assertions} are typically used for formal verification of specification patterns. The behavior of circuits determines the correctness of the design. Alsaiari~\textit{et al.}{} propose reconfigurable assertion checkers which are able to detect hardware Trojan updates on system-on-chips (SoCs)~\cite{alsaiari2019}. The design flow can be seen in Fig.~\ref{fig:assert}. Even with traditional assertion checkers where selection only occurs pre-synthesis, it is possible to ascertain the rate of Trojan detection using the assertion checkers, the Trojan type, as well as the point(s) of insertion.

\begin{figure}[t!]
\centering
\includegraphics[width=0.5\columnwidth]{Images/asserion_checker_paper.PNG}
\caption{Digital IC design flow with inserted assertion checkers. Reprinted from~ \cite{alsaiari2019}.}
\label{fig:assert}
\end{figure}

\textbf{Built-in self-authentication (BISA)} relies on the incorporation of functional filler cells into white spaces at the layout level to form built-in self-test (BIST) circuitry~\cite{xiao2013bisa}. The latter is designed to verify that no BISA cell is tampered with by an untrusted foundry. The possible failure of the BIST circuitry allows inserted Trojans to be detected. To reduce the risk of compromising BISA design during manufacturing, \textbf{split-manufacturing} can also be applied. On its own, split manufacturing cannot be used to detect Trojans, but the technique known as ``obfuscated BISA'' (OBISA)~\cite{shi2018obfuscated} combines both BISA and split-manufacturing. OBISA's ability to detect hardware Trojans can be predicted by training a machine learning model.

\paragraph{\textbf{Vulnerabilities Across Design Abstractions and/or PDKs}}
There is evidence that designs become more prone to certain security vulnerabilities as they move across different levels of abstraction. One example provided in \cite{jiang2018} presented a timing side-channel vulnerability introduced during HLS to produce an optimized RTL representation. Another pointed out fault-injection vulnerabilities after logic synthesis due to FSM encoding styles and newly generated don't-care states~\cite{nahiyan2019}. It is important to have foreknowledge of these potential risks as they develop during the EDA process. This is possible  with predictive algorithms. In one instance, the data flow graph representation of the RTL could be combined with features from the HLS report to produce a GNN capable of identifying less-secure design areas. 
This may also apply to porting designs across different process design kits~(PDKs). The available gate sizes are discrete values which are usually specific to the underlying technology. Process variations may introduce parametric alterations which could make a device more susceptible to malicious parties. For this scenario, PDK electrical and design rules are possible input features for the same GNN described above. As the solution space scales exponentially with respect to the size of the netlist, gate sizing algorithms integrated into EDA tools rely on either heuristics or analytical methods, which leads to sub-optimal sizing solutions. To combat this shortcoming,~\cite{lu2021rl} has demonstrated the feasibility of applying RL algorithms equipped with GNNs that encode design and technology features.






\subsection{\textbf{Black Box Optimization or Design Space Exploration}}\label{subsec: blackbox}
For design space exploration, AI/ML seeks the solution that best meets requirements from available choices with little to no human intervention. The expanse of the search space creates the need for automation to execute selection, generation and evaluation of the solutions. However, the exhaustive option may not always be the optimal one, regardless of the availability of automation techniques. Design space exploration employs the application of different methods: stochastic optimization methods, like random search, evolutionary algorithms and black box optimization~\cite{CARDOSO201799}. Black box optimization uses a set of configurable parameters as inputs instead of results from the design stages, as seen in Fig.~\ref{fig:blackbox}. The circuit may either be too complex to model, or the engineer lacks details of the design to work with. At the training stage, most ML/AI algorithms are being optimized to find the best fit for input parameters, constraints, and design features. Hence, finding the most suitable design based on specifications may be the most intuitive application to the digital IC design.


\begin{figure*}[t]
   \includegraphics[width=0.85\textwidth]{Images/Black_Box_DSE.png}
   \centering
   \caption{General overview of black box optimization and design space exploration process.}
   \label{fig:blackbox}
\end{figure*}







\subsubsection{High Level Synthesis and/or Register Transfer Level}

\paragraph{\textbf{Crafting Side Channel-resilient Circuits}}
Referring to Section~\ref{subsubsec: sidechannelresist}, masking has been introduced to stop an attacker from mounting side channel analysis. 
AI has become an integral part of this, for instance, RL has been applied to combine a set of countermeasures, which leads to the enhancement of target resilience to, at least, some types of attacks \cite{rijsdijk2021reinforcement}. 
Seen from another perspective, machine learning algorithms, and in particular, NNs, can defeat some countermeasures, including masking~\cite{kim2019make,related_works:automated_hyperparameter_tuning,related_works:SCA_metrics}. 
As an example of such attacks, RL has been employed to determine proper side-channel leakage models and training of neural networks to extract leakage profiles~\cite{DBLP:journals/iacr/RijsdijkWPP21}.
Hence, robustness against such attacks has become one of the objectives of the tests conducted to evaluate the effectiveness of countermeasure, specifically, masking. 

Given the nature of such tests, the security-aware designer may have to deal with the higher levels of abstraction corresponding to a black box leakage model because there is no information, including physical placement or routing signals \cite{buhan2021sok}.
Therefore, masking schemes may be implemented, but there is no guaranteed measure of effectiveness before the RTL stage.
To enhance this process, full access to the design's layout available to the implementing party could be useful and even be bolstered with an understanding of the device's functionality via RTL or gate-level implementation. 
This is in line with the studies focused on modeling the implementation and simulating its behavior as discussed before~\cite{bertoni2017methodology,reparaz2016detecting}. 
In this context, AI has not yet reached its full potential as security-critical implementations are still designed manually.  
The manual design and implementation pose a series of drawbacks stemming from (1) the lack of integration between the various designs, (2) erroneous designs due to human errors, and (3) high consumption of resources, including time (both execution and design times), silicon area and/or power/energy consumption. 


\subsubsection{Physical Design}

\paragraph{\textbf{Porting of Cryptographic and Hardware Security Primitives to Different Technology Nodes}}
Security-aware updates to designs are hardly ever direct ``out-of-box'' additions to devices. For integration of an IP or hardware security primitive, it is imperative that the design still fulfils its intended purpose. Selecting the most appropriate parameters for a hardware security primitive is one aspect, but another is porting it to a different technology node~\cite{keating_bricaud_2007}. Although technology nodes no longer categorically correspond to transistor gate length and half pitch, they nonetheless vary considerably with respect to manufacturing processes, design rules, noise sensitivity,~\textit{etc.,}{}~\cite{bagnato_indrusiak_quadri_rossi_2014}. These variations are noteworthy because they may disrupt the transferability of primitives. For example, an optimized PUF applied to an IC manufactured using the 28~nm process is not guaranteed to transfer to the 22~nm process due to factors like geometric variation and transistor type~\cite{keating_bricaud_2007}. The knowledge of process-specific parameters allows for assessment of the hardware primitive porting activity using ML. It is possible to use a classifier model as simple as an SVM to select the most suitable match between circuit and primitive without explicit knowledge of the design's functionality.


\paragraph{\textbf{Anti-Counterfeit and Anti-Tamper Sensor Optimization}}
The scourge of IC counterfeiting continues to plague the semiconductor industry by flooding the consumer market with unauthorized, defective and inferior versions of original chips and designs. From as far back as 2006, electronic companies have missed out on \$100 billion of revenue due to counterfeiting~\cite{pecht2006}. The recent global chip shortage has created the avenue for these illegal devices due to demand exceeding current supply chain capabilities~\cite{leprince-ringuet_2021}. Recycled and remarked counterfeit ICs account for more than 80\% of the counterfeits sold worldwide~\cite{guin2014}. Hence, their detection has become a necessity to tackle IC counterfeiting. Recycled counterfeits are used chips fraudulently sold as new while remarked counterfeits are inferior chips sold as higher grades. 

Different sensors have been designed as a solution to these counterfeits, as seen in the work by Zhang~\textit{et al.}{}~\cite{zhang2014} and shown in Fig.~\ref{fig:rosensor}. Their first of two proposed techniques uses frequency difference retrieved from paired ring oscillators (ROs) between an original and recycled chip to distinguish the two. RO frequency tends to degrade more with aging because the transistors in the RO gets slower with time~\cite{docking2003ro}. Guin~\textit{et al.}{} also add anti-fuses and fuses for combating die and IC recycling (CDIR). Their RO-CDIR implementation is negative temperature instability-aware, which is valuable for flagging ICs with shorter usage~\cite{guin2014}. To date, the design of these sensors such as number of inverting stages, choice of threshold voltage, and overall structure are chosen in an ad hoc manner or through empirical means. Further, foundries do not always provide aging models to users. Both of these limits the age estimation of such sensors and their classification accuracy.
AI approaches, such as Bayesian optimization, would be preferable, especially for its ability to optimize black-box functions. Automating the optimization process will ultimately make it less-exhaustive.



\begin{figure*}[t]
   \includegraphics[width=0.85\textwidth]{Images/ro_based_sensor.PNG}
   \centering
   \caption{Structure of RO-based sensor reprinted from~\cite{zhang2014}}
   \label{fig:rosensor}
\end{figure*}


Another source of hardware security issues is tampering. Once the device is physically compromised, it may leak on-chip information to the attacker. Hence, insertion of hardware Trojans may also be considered as tampering~\cite{tehranipoor2010}. One common example of tampering is FIB-based circuit edit, which allows an attacker to remove or bypass a security countermeasure~\cite{livengood_tan_hack_kane_greenzweig_2011}. Similar to recycling, sensors have been proposed to combat or detect tampering. A technique proposed by Liu and Kim uses logic-compatible embedded Flash (eFlash)-based tamper sensor built on an exposed floating gate (FG) structure to detect physical attacks~\cite{Liu2019}. Any change in charge stored on the exposed FG can be detected by this sensor. This includes humidity, high temperature, dust particles, chemicals, and electrostatic charges. A regression-based model or a neural network could fine-tune the configuration of such tamper sensors.


\paragraph{\textbf{Hiding Countermeasure Optimization}}
If an attacker is aware that a sensor has been deployed to detect a certain attack modality, the attacker may start by circumventing the sensor. For example, the attacker may apply the minimum possible mechanical force on the metal wires, or use a low intensity light source for a longer duration of time. Assuming maximum throughput possible, it is crucial to supplement successful optimization with robust defense. Hiding can dampen the signal accessible to the attacker. With limited knowledge of the sensor-IC design and operation, the designer could possibly rely on ensemble methods to find the most suitable hiding framework. The same sensors used to protect against tampering and detect counterfeits may also be vulnerable to side channel attacks. Since they are sensitive to changing parameters like voltage and frequency, they are prime targets for malicious parties. Sugarawa~\textit{et al.}{} show that an attacker can reveal the internal state of a chip by observing how a sensor reacts to laser fault injection. The leakage leads to a feasible, non-invasive, probing attack. The sensor-type, the bit-flip detector, detects a short-circuit current induced by a laser fault injection~\cite{SUGAWARA201963}. Thus, it is advisable to supersede sensor optimization with robust hiding schemes; the ideal framework could combine both activities to boost resistance to side channel attacks. For example, if a noise generator is used as the default hiding mechanism, a simple regression model could predict the amount of noise required to achieve a lower signal-to-noise ratio (SNR). A more versatile system could have options like shielding in addition to noise generators, with decisions and settings also based on countermeasure optimization.



\begin{table*}[t!]
\centering
\caption{Security requirements under black box optimization or design space exploration with applicable AI/ML algorithms. The cited options indicate optimization or security implementations available for reference}
\label{table:blackbox}
\arrayrulecolor{black}
\resizebox{\linewidth}{!}{
\begin{tabular}{|c|c|c|} 
\hline
\rowcolor[rgb]{0.361,0.769,0.769} \textbf{Design Stage }             & \textbf{Security Task }  & \textbf{Applicable AI/ML Algorithms}                     \\ 
\hline
\multicolumn{1}{|l|}{{\cellcolor[rgb]{1,0.859,0.604}}\begin{tabular}[c]{@{}>{\cellcolor[rgb]{1,0.859,0.604}}l@{}}\textbf{High Level Synthesis and}\\\textbf{Register Transfer Level}\end{tabular}} & Crafting Side Channel-resilient Circuits      & RL~\cite{DBLP:journals/iacr/RijsdijkWPP21}, ANN                 \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}                & \begin{tabular}[c]{@{}c@{}}Porting of Cryptographic and\\Hardware~Security~Primitives to\\Different Technology~Nodes\end{tabular} & SVM            \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}--|}
{\cellcolor[rgb]{1,0.859,0.604}}                & \begin{tabular}[c]{@{}c@{}}Anti-Counterfeit and Anti-Tamper \\Sensor Optimization\end{tabular}               & \begin{tabular}[c]{@{}c@{}}Bayesian Optimization,~ ANN, \\Multiple Linear Regression\end{tabular}  \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}--|}
\multirow{-3}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\textbf{Physical Design}}                & \multicolumn{1}{l|}{Hiding Countermeasure Optimization}            & \begin{tabular}[c]{@{}c@{}}Bayesian Optimization,~ \\Ensemble Learning\end{tabular}                \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}\textbf{Cross-Abstraction}           & Obfuscation for Black Box Designs             & Genetic Algorithms~\cite{chen2019genunlock}, ViT                    \\
\hline
\end{tabular}
}
\end{table*}

\subsubsection{Cross-Abstraction}


\paragraph{\textbf{Obfuscation for Black Box Designs}}
Obfuscation is best implemented with complete structural and functional understanding of a circuit, but different levels of abstraction may present the challenge of having only one available. At the gate level, logic locking, as described in Section~\ref{par: dectuning, obfus}, may be viable, but the implementing party may also be restricted by their limited knowledge. Here again, a GNN seems capable of modeling the complex connections within the design, the competing needs to resist attacks, and narrowing down the most suitable implementation for balancing security and overhead. Ideally, the complete framework should provide locking options for each design and generate keys for a user discretely. Genetic algorithms have been applied to logic locking attacks like GenUnlock~\cite{chen2019genunlock}, where the evolutionary process is a black-box procedure overseen by an objective function. Conversely, this concept may be applicable to not only logic locking, but general obfuscation.

The physical design stage also presents opportunities for obfuscation to the designer with black box access using ML/DL. The current state-of-the-art in camouflaging is the covert gate approach~\cite{shakya2019covert}. Covert gates are inserted randomly into the design/layout, but a CNN or vision-based transformer (ViT) can be incorporated to quantify the impact of insertion and ultimately identify the most viable gates to replace. Table~\ref{table:blackbox} provides possible algorithms for the security tasks provided in this subsection.





\subsection{\textbf{Assimilation of Security Rules for Electronic Design Automation}}\label{aieda}
The incorporation of ML/AI into EDA describes replacing traditional heuristics with deep learning and AI-based decision-making policies that integrate the above steps (decision making, performance prediction, and optimization) into a single EDA framework. This will ultimately lead to a custom-based EDA pipeline based on the specific design and/or security application rather than relying on generic, somewhat-archaic EDA tools. Unlike  Section~\ref{subsec: blackbox}, the design space may stretch beyond what a designer has at their disposal. A valuable point to make is the possibility of utilizing a trainable decision-making policy in contrast to exploring the available decisions. The use of AI/ML almost guarantees more efficient results with shorter runtimes. There is budding research within the IC design community to incorporate learning-based tools into the EDA pipeline. 
The OpenROAD project is a DARPA-funded initiative which seeks to solve EDA cost and turnaround time. The goal is to complete the design process without performace, power or quality tradeoffs using ML, cloud-based optimization and other techniques~\cite{ajayi2019openroad,connor_2018}. Their work so far has incorporated problem-specific tools like ioPlacer for fast and scalable input/output pin assignment~\cite{bandeira2020ioPlacer}, TritonCTS for clock tree synthesis~\cite{Han2020OptimalGH} and RTL-MP for macro placement using RTL information and clustering~\cite{kahng_varadarajan_wang_2022}. A team of researchers at Google also presented a floorplanning tool for the physical design stage that can successfully place macro blocks using deep RL~\cite{Mirhoseini2021AGP}. Its results demonstrated improvement over traditional manual efforts across performance, power consumption and area, and allowed its application to a recent tensor processing unit (TPU) product.

With AI/ML firmly established in the pipeline, design optimization and security could be combined. Design-specific EDA will make extraneous steps obsolete and ultimately reduce the time-to-market for ICs. Table~\ref{tab: aieda} highlights the areas of interest for each major design stage.


\begin{figure*}[t]
   \includegraphics[width=\textwidth]{Images/AIEDA_1.png}
   \centering
   \caption{General overview of AI-assisted EDA. The emphasis is on direct application to EDA.}
   \label{fig:aieda}
\end{figure*}




The manufacture of secure ICs must begin with embedding of security rules at major steps of the design process. This encompasses the acts of identifying, assessing and incorporating prerogatives and properties within specific stages. All design steps follow defined rules during their series of actions on the input design~\cite{khwaja1997edarule}. For example, during logic synthesis, minimization may occur by combining gate terms where applicable to reduce circuit size~\cite{brayton1990logicsyn}. Even design constraints can be described as rules because they define the behavior of the design at each point of usage. In the same vein, it is necessary to apply security rules as rigorous requirements throughout the entire design sequence. 

Efforts to support such assimilation are starting to grow. For example, the Hardware Common Weakness Enumeration Special Interest Group (HW CWE SIG)~\cite{CWE_MITRE} consists of researchers and representatives from organizations operating in hardware design, manufacturing, and security who interact, share opinions and expertise, and leverage each other’s experiences in defining hardware security weaknesses and identifying them with analysis tools. However, the current initiative is manual and quite subjective. Data-driven and AI-based approaches could make this less tedious and more objective in nature.



 





\subsubsection{High Level Synthesis and Register Transfer Level}
The overall design of a circuit depends on the requirements stated in its specifications. Traditional execution of HLS results in an RTL description of the design, which is a better hardware-based representation of the intended IC. During the design process, it is difficult to ascertain certain features and how they may impact the entire circuit, but significant work has been done to mitigate this using ML~\cite{Makrani2019,Zennaro2018, Dai2018}. One noteworthy ML-based optimization framework combines a GNN with RL to predict design results and obtain optimal solutions under user-specified constraints and objectives like area and latency~\cite{wu2021ironman}. The security-aware designer can also leverage ML to anticipate and solve security problems that an IC is vulnerable to. Security rules at this early stage of the design process are less-tedious and reasonably-inexpensive to enforce.

\paragraph{Obfuscated Design} Pre-synthesis obfuscation is applied to a design prior to the logic synthesis stage. Although the most prevalent techniques are used post-synthesis, there has been work done on this early stage method of obfuscation. Obfuscation can be implemented at the high level stage before conversion into RTL. One group uses MUXes driven by a locked controller units to create decoy connections~\cite{rajendran2015}. Exploiting the MUX's use of inputs and a control signal, only the correct control signals can unlock the design. The authors of \cite{Chakraborty2010} convert RTL code into control and data flow graph (CDFG) form, apply locking by superimposing an authentication FSM, and then return to RTL. Both applications may be deployed as security rules with deep learning-based execution. The CDFG form could be implemented as a GNN for optimum modeling of a design's complexity.

\paragraph{Masking} Masking to mitigate the effectiveness of differential power analysis (DPA) during a side channel attack is also possible at this level of abstraction. Konigsmark~\textit{et al.}{} create an HLS flow which addresses side-channel leakage by inferring security critical operations from user-specified confidential variables in HLS input. Their modified framework rectifies imbalanced branches that pose easy attack targets, and changes functional units based on leakage potential~\cite{konigsmark2017}. This experiment could be the foundation for learning-based masking solutions to prevent SCA; it stands to be improved by feature-based rectification. 

\paragraph{Information Flow Security} It is important to verify that systems adhere to information flow security (IFS) policies, especially during the design phase. All assets flowing through the system must be identified; this is known as information flow tracking (IFT)~\cite{hu2021}. Achieving this at higher levels of abstraction reduces the effort required to rectify potential problems. One publication presents RTLIFT as a means of measuring all digital flows through RTL designs to formally prove security properties related to integrity, confidentiality and logic side channels~\cite{Ardeshiricham2017}. Perhaps its most impressive property is the ease of integration into the design flow. Intelligent decisions surrounding security policies means adaptability to different designs trade-offs such as the RL-based policy iteration to calculate digital flows and possibly flag irregularities~\cite{Ardeshiricham2017}. 





\subsubsection{Logic Synthesis}
In general, logic synthesis has been extensively-researched under AI/ML~\cite{Neto2019LSOracleAL, pasandi2019approximate,Pasandi2020}. The RTL-to-gate level process provides viable data to train models that have mostly been used for design optimization. The conversion from behavioral level to the gate level is the bridge between a design idea and its generation because the specific logic functions are implemented from combinations of gates selected in a given cell library.




\paragraph{Obfuscated Design} 
At the gate-level, the first form of obfuscation which may come to the security-aware designer's mind is logic locking. One proposed work that could be the baseline for future AI/ML exploration is LeGO~\cite{alaql2021}. The authors point out that it can iteratively harden a design against a set of attacks. The framework begins by performing a simple key-based locking and continues with an iterative feedback process which considers a set of possible attacks to defend against~\cite{alaql2021}. The attacks are provided with corresponding countermeasures for integration. The rule selection algorithm, which uses prior knowledge from a database of mitigation rules, identifies the best protection to be applied for each key-bit against a specific attack. The "convergence point" occurs when all security issues are addressed~\cite{alaql2021}. The learning design could be improved with an RL-based policy iteration framework. With a suitable representation of the gate-level netlist and its features, there are many possibilities.




\paragraph{Masking} 
Similarly, in the quest for side-channel resistant designs, gate-level masking has been researched since the early 2000s. Masking is most ideal for implementation at this stage, because of the gate design's correlation to the physical design's functionality. In 2005, masked dual-rail pre-charge logic (MDPL) was proposed as a promising DPA-resistant logic style~\cite{Popp2005}. MDPL circuits are based on a standard cell libraries and have no routing constraints concerning the balancing of complementary wires. The dual-rail pre-charge property of MDPL specifically prevents glitches in the circuit. A more recent implementation uses a technique that combats the phenomena of glitches and early propagation using only cell-level “don’t touch” constraints~\cite{Leierson2014}. Their framework, a derivative of MDPL called LUT-Masked Dual-rail with Precharge Logic (LMDPL), can works for both FPGA or and ASIC designs. MDPL may be used as a rule-based template for masking gate-level designs. A GCN can be used to identify sections of the circuit that are vulnerable and would require MDPL implementation.


\paragraph{Information Flow Security} 
Information flow tracking at the gate level also serves to check adherence to security policies. The well-defined gate level information flow tracking (GLIFT) technique has been widely used to GLIFT used to design secure hardware architectures and detect security violations from visible timing flows. Hardware trojan dection has even been accomplished based on harmful information flows that point to sensitive information leakage and data integrity violation~\cite{nahiyan2017trojandetection}. From Fig.~\ref{fig:glift}, the RTL synthesis which produces the gate level representation is followed by standard cell augmentation with shadow logic gate. Design stage verification is the most suitable application of GLIFT to the EDA pipeline. The technique only checks for violation of IFS policies without addition of logic to the fabricated design. Once again, a GCN representation with sufficient features may be used to supplement, or even replace GLIFT.

\begin{figure*}[t]
   \includegraphics[width=0.9\textwidth]{Images/Glift_flow.png}
   \centering
   \caption{GLIFT workflow with standard cell and GLIFT libraries.}
   \label{fig:glift}
\end{figure*}


\paragraph{Side Channel Resistance}




\subsubsection{Device Sizing and/or Technology Mapping}

Modern physical design (PD) flow includes gate sizing for PPA optimization, used in different steps ranging from synthesis to signoff. 
This process is algorithmic, assigning a proper size (gate type) to each optimizable design instance from a set of equivalent standard cell libraries for a different process, voltage, and temperature (PVT) corners. 
For each of the instances, the available gate sizes are discrete values specific to the underlying technology. 
As the solution space scales exponentially with respect to the size of the netlist, gate sizing algorithms integrated into EDA tools rely on either heuristics or analytical methods, which leads to sub-optimal sizing solutions. 
To combat this shortcoming,~\cite{lu2021rl} has demonstrated the feasibility of applying RL algorithms equipped with graph neural networks (GNNs) that encode design and technology features. 
Specifically, the problem of gate sizing for timing optimization at the post-route stage has been the main focus of the study. 
Although the proposed sizer adopts a more global optimization approach, it does not always outperform the commercial tool. 
Nevertheless, it has the great advantage that is automatic gate sizing for timing optimization without any human intervention. 

The technology-mapping step converts internal representation and the optimized logic based on the designated technology library~\cite{kaufmann2008techmap}.
In order to improve the effectiveness of this process in terms of energy consumption, delay, and area overhead, approximate logic synthesis (ALS) is discussed in the literature, where the accuracy of mapping is compromised to meet the design requirements. 
However, techniques for ALS suffer from long execution time, which has been addressed in~\cite{pasandi2019approximate} by adopting RL-based strategies. 
Academic state-of-the-art ALS tools are considered to evaluate the performance of the proposed RL-based ALS. 
The results have demonstrated a great deal of improvement with regard to run-time and area and delay when the  RL-based ALS is applied against academic and industrial benchmarks. 
Security-based optimization can also be added as a design goal for this automatic process.





\paragraph{Fault Tolerance} Critical assets in devices may be compromised by taking advantage of errors from fault injection. Single event upsets (SEUs) affect sequential elements, while single event transients (SETs) arise from combinational logic~\cite{BOGAERTS2014250}. An SEU may lead to a single event latchup (SEL), which results in a high operating current, or a short circuit. Fault tolerance reduces the sensitivity of devices to particle or laser attacks that cause these events. Glitches can be used to progressively break cryptography schemes or disable internal protection mechanisms~\cite{giraud2010}. Redundant computation is one way of making designs impervious to upsets. It uses double computation (in time or space) with a final comparison; if the results from redundant computations do not match, the output of the encryption function is suppressed/randomized. Redundancy may cause increased area and power consumption, but methods like the one presented in~\cite{petrovic2012} show high tolerance with moderate overhead is possible. The optimization procedure can be refined using a Gaussian process to find the best trade-off value.




\subsubsection{Floorplanning and Physical Design}
The floorplanning step formalizes the high level design established at the beginning of the process, and is followed by P\&R to connect all blocks such that they meet design criteria and constraints. After initial P\&R attempts, the design’s timing constraints are analyzed~\cite{martin_scheffer_lavagno_2016}. If unsatisfactory, the P\&R software in use tries different placements and signal routing to try to meet the designated constraints. Even outside academia, work has been done on automating floorplanning to benefit the physical layout. Researchers at Google modeled chip floorplanning as a reinforcement learning (RL) problem, and used a GCN representation of the design to optimize power, area and performance~\cite{Mirhoseini2021AGP}. 

In order to place Application-Specific Integrated Circuits (ASICs), designers must deal with millions or even billions of gate-level instances to be placed on constrained physical layouts. 
The placement directly impacts the quality of the final full-chip design, supposed to be assured by employing commercial EDA tools and spending a significant amount of time in optimization iterations cf.~\cite{lu2020vlsi}. 
In a series of work, the problem of providing automated and accurate placement guidance has been tackled through machine learning methods~\cite{lu2021law,lu2020vlsi,mirhoseini2020chip,fogacca2019finding}. 
Among these proposals,~\cite{mirhoseini2020chip} has reintroduced reinforcement learning into the chip placement domain of study. 
\cite{goldie2020placement} provides roadmaps for placing an ASIC or FPGA netlist onto a grid, whereas~\cite{mirhoseini2020chip} gives more concrete answers to the problem of placing a netlist graph of macros (e.g., SRAMs) and standard cells (logic gates, such as NAND, NOR, and XOR) onto a chip canvas. 
The goal of these studies is to perform chip placement such that power, performance, and area are optimized according to the constraints on placement density and routing congestion. 

Global routing is performed on a coarse grid map to find an approximate routing of all nets that is the basis for the detailed routing to specify the routing of each net and satisfy all design rules. 
Another pressing issue with electronic systems design is automatic routing considering wire-length, crosstalk, via, and layer selection. 
Maze routers are traditionally used for this purpose, although they have two major limitations, namely (1) being not smart enough to perform detailed routing considering signal integrity~\cite{hart1968formal}, and (2) needs for additional constraints and optimization variables to offer global routing. 
RL has been proposed to resolve these by integrating the concept of SI~\cite{kim2020reinforcement}. 
For this, Kim et al. have designed an RL-agent including an encoder-decoder model that is an effective tool for solving combinatorial optimization problems~\cite{kim2020reinforcement}. 
Similarly, deep Q-network (DQN) agents are trained in the RL framework to encounter the global routing problem~\cite{liao2020deep}, where a single DQN conjointly routs the nets and pins in an IC. 
In this process, the DQN acts as an agent and interacts with the environment. 
Upon receiving the state information from the environment, the Q-values of all the potential next states are evaluated, an action is taken, and executed. Consequently, the environment is updated.

These optimization-based techniques provide possibilities for applications towards more security-aware designs.


\paragraph{Crosstalk Mitigation} Design scaling from a technology process may reduce spacing between adjacent interconnects; the resulting increased coupling capacitance between wires causes crosstalk~\cite{zhou1998crosstalk}. The affected signal's value may either change, or have delayed signal transition. False clocking, where a clock changes states unintentionally, may also occur~\cite{terapasirdsin2010crosstalk}. Good signal integrity is necessary for optimum functionality of an IC~\cite{green1999}. Large signal-integrity problems may cause intermittent success or complete system failure. To address crosstalk, the design tool must be able to measure its value. The authors of \cite{chang2006} find a closed form expression of crosstalk using a number of wires. With accurate metrics, a linear regression model coupled with the RL method applied in~\cite{Mirhoseini2021AGP} could address crosstalk expeditiously.


\paragraph{Power Distribution Networks for Anti-Side Channel and Fault Injection} Side channel leakage is one of the results of the nature of an IC's power distribution network (PDN). The PDN is responsible for the supply of stable voltage and power to each functional component of the circuit~\cite{martin_scheffer_lavagno_2016}, but it may also inadvertently introduce side-channel leakages throughout the design~\cite{zhang2020pdnsca}. The growing complexity of devices introduces sophisticated PDNs with the potential to allow successful side-channel attacks or fault injection. To improve the security of a design, it is important to use ML to build on existing work on this topic. PowerScout is a framework geared towards evaluating side-channel vulnerabilities by modeling possible attacks to improve PDN designs~\cite{zhu2020}. It can effectively predict leakage strength and also identify fault injection soft spots. The side channel and fault injection attacks are modeled using non-learning based design space exploration. A decision tree, or an MLP could predict these with the same parameters being extracted. There may also be promise in modeling the PDN using a graph-based network and optimizing leakage-prone nodes for the physical design.


\paragraph{Anti-Tamper Layouts} Anti-tamper designs are meant to deny an adversary’s opportunity to monitor or affect the correct operations of an IC. At the layout level, one CAD assessment technique allows a designer to gauge a designs susceptibility to frontside probing attacks~\cite{Wang2019}. The assessment is performed by varying attack parameters (FIB aspect ratios and angles), shield parameters (layers and shape) and the assets under attack (keys, buses,~\textit{etc.,}{}.). Two of the most useful aspects of the paper are the exposed area (EA), which is free to probe without impacting transmission, and shield structure taxonomy, which is a set of documented shield patterns~\cite{Wang2019}. Based on the attack parameters, EA and the shield taxonomy, an RL model could help recommend the best shield design for a layout.


\paragraph{Anti-Reverse Engineering Layouts} At the layout level, IC camouflaging is a EDA engineer's most suitable option to prevent successful RE. The camouflaged layout is a functional replica of the original design with camo gates (See ~\ref{subsection: decisionmaking}. A novel framework for secure layout generation could focus on generating camo gates using GANs. Recommendations for camouflage points on an IC can be modeled using a GCN or a CNN.



\paragraph{Custom eFPGA fabrics} The embedded FPGA (eFPGA) is an IP core integrated into an ASIC that offers the reprogramming flexibility of FPGAs without their overhead costs. They are added to systems which require frequent updates; by adding their fabric to an SoC or ASIC, teams are able to modify applications seamlessly. One security evaluation in \cite{Bhandari2021} points out that eFPGAs can contribute to SAT attack resilience. The eFPGAs have combinational loops that a specific cyclic SAT solver like CycSAT~\cite{zhou2017} cannot solve. Increasing attack difficulty can be considered when creating eFPGA fabrics at the physical design stage. The incorporation of a policy-based model that incorporates this into an ASIC design could improve security considerably.


\begin{table}
\centering
\caption{Major IC design stages in EDA with security needs and possible applications of AI/ML.}
\arrayrulecolor{black}
\resizebox{\linewidth}{!}{
\begin{tabular}{|c|c|c|c|c|} 
\hline
\rowcolor[rgb]{0.361,0.769,0.769} {\cellcolor[rgb]{0.361,0.769,0.769}}        & {\cellcolor[rgb]{0.361,0.769,0.769}}              & {\cellcolor[rgb]{0.361,0.769,0.769}} & \multicolumn{2}{c|}{\textbf{AI/ML Algorithms Applicable}}            \\ 
\hhline{|>{\arrayrulecolor[rgb]{0.361,0.769,0.769}}--->{\arrayrulecolor{black}}--|}
\rowcolor[rgb]{0.361,0.769,0.769} \multirow{-2}{*}{{\cellcolor[rgb]{0.361,0.769,0.769}}\begin{tabular}[c]{@{}>{\cellcolor[rgb]{0.361,0.769,0.769}}c@{}}\\ \textbf{Design Stage}\end{tabular}}   & \multirow{-2}{*}{{\cellcolor[rgb]{0.361,0.769,0.769}}\textbf{Security Task}}            & \multirow{-2}{*}{{\cellcolor[rgb]{0.361,0.769,0.769}}\textbf{Design Type}} & \textbf{Suggested}         & \textbf{Implemented} \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}        & Obfuscated Design              & \multirow{3}{*}{ASIC, FPGA}          & RL      & GNN~\cite{rozhin_2021}   \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
{\cellcolor[rgb]{1,0.859,0.604}}        & Masking     &                   & GNN, GCN, RF               &   \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
\multirow{-3}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\begin{tabular}[c]{@{}>{\cellcolor[rgb]{1,0.859,0.604}}c@{}}\textbf{High Level Synthesis and}\\\textbf{~Register Transfer Level}\end{tabular}} & Information Flow Security      &                   & RL      &   \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}        & Obfuscated Design              & \multirow{4}{*}{ASIC, FPGA}          & GCN     & ~ ~ANN~\cite{Sisejkovic2021-challenge-logic-locking}            \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
{\cellcolor[rgb]{1,0.859,0.604}}        & Masking     &                   & RL, GNN &   \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
{\cellcolor[rgb]{1,0.859,0.604}}        & Information Flow Security      &                   & GCN     &   \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
\multirow{-4}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\textbf{Logic Synthesis }}   & Side Channel Resistance        &                   & GNN     &   \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}\begin{tabular}[c]{@{}>{\cellcolor[rgb]{1,0.859,0.604}}c@{}}\textbf{Device Sizing/ }\\\textbf{Technology Mapping}\end{tabular}               & Fault Tolerance                & ASIC              & Bayesian Optimization, DNN &   \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}        & Crosstalk Mitigation           & \multirow{5}{*}{ASIC, FPGA}          &         & \begin{tabular}[c]{@{}c@{}}Logistic Regression~, \\XGboost~\cite{liang2020crosstalk} ~\end{tabular}  \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
{\cellcolor[rgb]{1,0.859,0.604}}        & Anti-tamper layouts            &                   & GCN, RL &   \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
{\cellcolor[rgb]{1,0.859,0.604}}        & \begin{tabular}[c]{@{}c@{}}PDNs for anti-side channel \\and fault injection\end{tabular}                   &                   & GNN     &      Linear Regression~\cite{utyamishev2020power}                \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
{\cellcolor[rgb]{1,0.859,0.604}}        & Anti-RE layouts                &                   & GCN                   &       CNN~\cite{zargari2021captive}               \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
\multirow{-5}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\begin{tabular}[c]{@{}>{\cellcolor[rgb]{1,0.859,0.604}}c@{}}\textbf{Floorplanning and}\\\textbf{~Physical Design }\end{tabular}}               & Custom eFPGA fabrics           &                   & RL      &   \\ 
\hline
{\cellcolor[rgb]{1,0.859,0.604}}        & \begin{tabular}[c]{@{}c@{}}Test point insertion and pattern \\generation for Trojan detection\end{tabular} & \multirow{3}{*}{ASIC, FPGA}          & RF, GB  & RL\cite{pan2021atpg}     \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
{\cellcolor[rgb]{1,0.859,0.604}}        & Information flow security      &                   & GNN, DNN,  RL    &   \\ 
\hhline{|>{\arrayrulecolor[rgb]{1,0.859,0.604}}->{\arrayrulecolor{black}}-~--|}
\multirow{-3}{*}{{\cellcolor[rgb]{1,0.859,0.604}}\textbf{Testing and Verification }}             & \begin{tabular}[c]{@{}c@{}}Comparison of original \\specification to final design\end{tabular}             &                   & GNN     & NLP\cite{yu2021hw2vec}   \\
\hline
\end{tabular}
}
\label{tab: aieda}
\end{table}

\subsubsection{Testing and Verification}

As an IC reaches its physical state, the designers must implement design testing and verification. It is important to point out that most major design stages reach completion via some form of verification step~\cite{wang2009electronic}. For example, the logic synthesis step utilizes an RTL and gate level netlist verification procedure to guarantee functionality retention of the gate level design~\cite{martin_scheffer_lavagno_2016}. Testing and verification combined ensure that an IC has maintained original specifications and functionality throughout the design process. For physical testing, the two most significant options are wafer level testing and package level testing~\cite{perry_2007}. 





\paragraph{Test Point Insertion and Pattern Generation for Trojan Detection} Design for Testability (DFT) is a technique employed in designing ICs for the purposes of reducing test costs and associated time. A very common technique for DFT is scan-chain insertion; regular FFs in the design are replaced with scan FFs. ATPG is a test methodology used to identify faulty behavior(s) in circuits due to design defects. The goal of ATPG is to create a set of test patterns that achieve a desired test coverage, TC, and fault coverage, FC, through fault simulation~\cite{hardware2011}. ATPG and formal methods have been researched for Trojan detection, but most do not consider partial-scan instances of a third-party IP (3PIP). The authors of~\cite{cruz2018} generate a set of constraints using the model checker to facilitate directed test generation using ATPG tool. A constraint generation procedure uses model checking to produce a set of signal traces. A test vector generation method then uses ATPG with the design, rare nodes and signal traces to produce a set of test vectors for activating each rare node~\cite{cruz2018}.


\paragraph{Information Flow Security} At the verification stage of the design flow, IFT can be executed using static or dynamic techniques. Static techniques assess the design's compliance with security policies using simulation, formal verification, emulation or virtual prototyping. They are applicable within the EDA pipeline, and are removed when verification is completed~\cite{hu2021}. Due to the unique goals of each specific static technique, AI/ML can be added to decrease resource usage, and improve results. For hardware security simulation, levels of abstraction like gate level and RTL are viable. As described in logic synthesis, graph-based networks are ideal solutions. The simulation process links security labels to signals. Formal verification guarantees proof of security for the desired properties, but it is known to have scaling issues~\cite{hu2021}. The large design state space of complex systems requires a policy-based learning solution which RL provides. Emulation can perform hardware-software co-verification, using FPGA emulation servers. Learning-based models could make these servers more robust to even detect software vulnerabilities that impact hardware. The abstract models of hardware components created by virtual prototyping can be tested a different RL-based approach. If the policy used is geared towards creating security problems while verifying software, the designer becomes aware of impending problems. Dynamic techniques use dedicated hardware to track information flow during runtime. A neural network could validate results to predicting flow inconsistencies.


\paragraph{Comparison of Original Specification to Final Design} Furthermore, Natural language processing (NLP) can be applied to circuit designs at different levels of abstraction. One of the most promising bridges to this is HW2VEC, a graph learning tool to extract graph representations from a hardware design in either RTL or gate level~\cite{yu2021hw2vec}. It is divided into two main parts: a HW2GRAPH stage which converts the design to a graph while retaining structural information, and GRAPH2VEC which converts the graph into Euclidean-based embeddings. GRAPH2VEC is just one of a number of graph-to-vector-embedding algorithms that utilizes concepts from the skipgram word embedding model~\cite{narayanan2017graph2vec}. The resulting vector representation may be applied with measures of similarity, like cosine similarity, to verify designs. If HW2WEC can be leveraged at physical design stages, the final IC product can be verified for structural authenticity.
 
\begin{figure*}[t]
   \includegraphics[width=0.9\textwidth]{Images/hw2vec.PNG}
   \centering
   \caption{Overview of HW2VEC from hardware design (RTL or gate level), through extraction of graph representations to node embedding (X) and adjacency (A) matrices. The graphrepresentations use GRAPH2VEC to acquire the graph embeddings for hardware security applications. Reprinted from~\cite{yu2021hw2vec}}
   \label{fig:hw2vec}
\end{figure*}







\subsubsection{Communication}





























\subsection{Optimization Techniques for EDA}
Machine learning models instead of pure optimization algorithms have been extensively used to automate the design of digital circuits which has significantly reduced the time-complexity associated with designing a robust digital IC. Furthermore, they are able to learn from the previously explored designs and datasets~\cite{huang2021machine}. However, training machine learning models is a challenge specifically in the analog domain compared to their digital counterpart because of the following reasons.
\begin{itemize}
    \item The specifications of analog design are variable for different applications. Thus, it becomes difficult to construct a uniform framework to evaluate and optimize different analog designs~\cite{mina2022review}.
    \item It is challenging to design a well-performing model because analog parameters are highly non-linear and susceptible to noise and process-voltage-temperature (PVT) variations~\cite{gielen2000computer}.
    \item The models trained for design automation have worked well for digital circuits compared to analog because analog designs suffer more in terms of area, power, and reliability when \textbf{porting} from a higher node to a lower technology node.
    \item The search space for analog design is significantly larger compared to digital IC design. There is variety of circuit schematics and device sizes that a designer can consider to get a reasonable performance. Plus there are more number of specifications to meet for an analog IC compared to their digital counterparts. This makes it computationally expensive and time-consuming to train a decent model. 
    \item Analog design is less systematic and more heuristic and intuitive in nature~\cite{gielen2000computer}. Thus there has been a substantial amount of automated design software tools available for digital IC design which makes it easier to generate data and train models to optimize the design process.
\end{itemize}

Because of the reasons outlined above, there are an abundance of ``automation'' frameworks which use one or more optimization algorithms in conjunction with the simulation software to optimize the design of a specific analog circuit. Many situations call for multi-objective optimization problems as is the case when designing security primitives as they have additional challenges and specifications to meet depending on the type of analog circuit at hand. Nevertheless, depending on the search space and the problem-at-hand, optimization techniques can be divided into three categories:
\begin{enumerate}
    \item \textbf{Random or brute-force search} which involves randomly generating a solution until the optimization criteria is satisfied. These are time-consuming. 
    \item \textbf{Gradient or derivative based optimization} utilizes gradient or derivatives within the data or the objective function to guide the search for the optimal solution~\cite{sun2019survey}. Gradient descent is one of the most widely used techniques specifically in ML algorithms. They are computationally efficient and quick, but prone to getting stuck at a local minimum rather than a global optimum if not designed properly. Further, they require functions that are differentiable.
    \item \textbf{Heuristic derivative-free optimization} methods utilize heuristic techniques characterized by empirical rules to guide the search process to find an optimal solution. The most popular algorithms are evolutionary algorithms (EA) (and simulated annealing (SA) which are inspired by Charles Darwin's theory of evolution and the annealing techniques in metallurgy, respectively. They are highly effective especially when derivatives or gradients do not exist and the search space is highly non-linear or noisy. However, they are quite time-consuming and the quality of solution is highly dependent on the initial configuration and learning rules.
\end{enumerate}
However, with the progress in high-performance computing hardware and ability to model non-linear problems, DL and RL methods have gained a lot of popularity in recent years. Specifically, RL have gained a lot of traction in analog design and optimization where their counterparts, evolutionary algorithms, have been applied for more than a decade~\cite{zebulum2018evolutionary}. 







\section{Introduction}\label{sec:introduction}
\input{Sections/introduction}


\section{Background}\label{sec:background}
\input{Sections/background}






\section{Security-aware Design of Digital Integrated Circuits}\label{sec:digital}
\input{Sections/digital_original}

\input{Sections/analog.tex}

\section{Gaps and Opportunities in AI-based Security-aware EDA}\label{sec:needs}
\input{Sections/digital_needs}


\section{Conclusion}\label{sec:conclusion}
\input{Sections/conclusion}

\bibliographystyle{ACM-Reference-Format}
