Deep Learning-Based Method Guards Against Chip Tampering

The $75 billion counterfeit chip market jeopardizes the safety and security of multiple sectors that depend on semiconductor technologies, including aviation, communication, quantum computing, artificial intelligence, and finance.

A new counterfeit detection method for semiconductor devices could help global chip makers and users evade the risks introduced by the surge in counterfeit chips coming on the market.

The optical counterfeit detection method from Purdue University uses deep learning to identify tampering in semiconductor chips. The technology, called RAPTOR, for Residual Attention-based Processing of Tampered Optical Responses, detects adversarial tampering like malicious package abrasions, compromised thermal treatment, and adversarial tearing.

Purdue University engineers led by Alexander Kildishev created RAPTOR, an optical counterfeit detection method. RAPTOR leverages deep learning to identify adversarial tampering in chips used in semiconductor devices. DALL-E 3 OpenAI image courtesy of Purdue University.

According to professor Alexander Kildishev, who led the research, several techniques have been developed to verify semiconductor authenticity and detect counterfeit chips. “These techniques largely leverage physical security tags baked into the chip functionality or packaging,” he said. “Central to many of these methods are physical unclonable functions (PUFs), which are unique physical systems that are difficult for adversaries to replicate either because of economic constraints or inherent physical properties.”

Optical PUFs, which capitalize on the distinct optical responses of random media, are especially promising for identifying counterfeit chips. However, achieving scalability and maintaining accurate discrimination between adversarial tampering and natural degradation pose significant challenges.

The deep learning-based approach from the Purdue team identifies adversarial tampering to an optical PUF based on randomly patterned arrays of gold nanoparticles, which are used to construct a distance matrix. The researchers image the arrays using dark-field microscopy and extract the positions and radii of individual particle patterns using semantic segmentation and labeled clustering.

The nanoparticles then undergo a treatment that typifies either natural degradation or adversarial tampering. After exposing the nanoparticles to the treatment, the researchers remeasure the nanoparticle positions and radii and compare the new, post-tampered distance matrix to the pre-tampered distance matrix.

“The gold nanoparticles are randomly and uniformly distributed on the chip sample substrate, but their radii are normally distributed,” researcher Yuheng Chen said. “An original database of randomly positioned dark-field images is created through dark-field microscopy characterization.”

According to Chen, gold nanoparticles can be measured easily using dark-field microscopy. “This is a readily available technique that can integrate seamlessly into any stage of the semiconductor fabrication pipeline,” he said.

To classify pre- and post-tampering detection, the researchers used classical analytical methods for discrimination. In addition to the Hausdorff metric, they applied the Procrustes matrix distance and average Hausdorff distance metrics.

The researchers showed that under more difficult assumptions of adversarial tampering, both the Hausdorff and Procrustes metrics could be tampered with. RAPTOR addressed this gap and improved speed and accuracy under diverse adversarial tampering conditions.

“RAPTOR uses an attention mechanism for prioritizing nanoparticle correlations across pre-tamper and post-tamper samples before passing them into a residual, attention-based, deep convolutional classifier,” researcher Blake Wilson said. “It takes nanoparticles in descending order of radii to construct the distance matrices and radii from the pre-tamper and post-tamper samples.”

The researchers tested RAPTOR’s counterfeit detection capability by simulating tampering behavior in nanoparticle systems. They simulated natural changes, malicious adversarial tampering, thermal fluctuations, and varying degrees of random Gaussian translations of the nanoparticles.

Using semantic segmentation and labeled clustering, the researchers extracted the positions and radii of the gold nanoparticles in the random patterns from 1000 dark-field images in just 27 ms and verified the authenticity of each pattern using RAPTOR in 80 ms with 97.6% accuracy, under difficult adversarial tampering conditions. They further showed that RAPTOR outperformed the state-of-the-art distance metrics.

Alexander Kildishev (second from right) with members of the RAPTOR team. Courtesy of Purdue University/Lyubov Sylayeva.

“We have proved that RAPTOR has the highest average accuracy, correctly detecting tampering in 97.6% of distance matrices under worst-case scenario tampering assumptions,” Wilson said. “This exceeds the performance of the previous methods — Hausdorff, Procrustes, and average Hausdorff distance — by 40.6%, 37.3%, and 6.4%, respectively.”

These results indicate that RAPTOR can authenticate PUFs built on random arrays of gold nanoparticles faster and more accurately than classical distance matrix metric methods. However, more work is required in material development to ensure that the methods used in RAPTOR can recognize unforeseen types of tampering and natural degradation.

RAPTOR is the first anticounterfeiting method to apply an attention mechanism for PUF authentication, using the nanoparticle radii as soft weights and the post-tamper distance matrix as a value matrix. It achieved high verification accuracy under difficult, real-world tampering schema using machine learning to verify the gold nanoparticle PUFs.

“RAPTOR is a novel deep-learning approach, a discriminator that identifies tampering by analyzing gold nanoparticle patterns embedded on chips,” Kildishev said. “It is robust under adversarial tampering features such as malicious package abrasions, compromised thermal treatment, and adversarial tearing.” The team is planning to collaborate with chip-packaging researchers to further develop the nanoparticle embedding process and streamline the authentication steps. Purdue has applied for patents to protect the intellectual property.

“Our scheme opens a large opportunity for the adoption of deep learning-based anticounterfeit methods in the semiconductor industry,” Kildishev said. “At the moment, RAPTOR is a proof of concept that demonstrates AI’s great potential in the semiconductor industry. Ultimately, we want to convert it into a mature industry solution.”

The research was published in Advanced Photonics (www.doi.org/10.1117/1.AP.6.5.056002).