用AI协作生成高效绕过硬件安全GNN的电路篡改方案
NetDeTox: Adversarial and Efficient Evasion of Hardware-Security GNNs via RL-LLM Orchestration
- 用强化学习定位关键电路节点，大模型制定低开销重写策略
- 相比顶尖方法减少54%以上面积开销，大电路下还能优化原设计
- 适合芯片安全攻防研究者、硬件可信设计开发者参考
图神经网络（GNN）通过学习网表图中的结构特征，在硬件安全领域展现出潜力。然而，其对结构特征的依赖使其易受对抗性网表重写攻击；微小修改即可误导GNN判断。现有方法如综合配方扰动或门级变换，均存在较高设计开销。本文提出NetDeTox，一种自动化端到端框架，通过强化学习（RL）与大语言模型（LLM）协同，实现精准局部重写。RL代理识别影响GNN推理的关键组件，LLM生成保持功能但多样化结构特征的重写方案。两者迭代反馈持续优化对抗性重写，显著降低开销。相较于SOTA方法AttackGNN，NetDeTox在所有安全方案上均有效削弱检测能力，且重写次数更少，面积开销分别降低54.50%（GNN-RE）、25.44%（GNN4IP）和41.04%（OMLA）。尤其对于GNN4IP，在较大电路中甚至可优化原基准面积，体现其实际可用性与可扩展性。
原文摘要 · Abstract (English)
Graph neural networks (GNNs) have shown promise in hardware security by learning structural motifs from netlist graphs. However, this reliance on motifs makes GNNs vulnerable to adversarial netlist rewrites; even small-scale edits can mislead GNN predictions. Existing adversarial approaches, ranging from synthesis-recipe perturbations to gate transformations, come with high design overheads. We present NetDeTox, an automated end-to-end framework that orchestrates large language models (LLMs) with reinforcement learning (RL) in a systematic manner, enabling focused local rewriting. The RL agent identifies netlist components critical for GNN-based reasoning, while the LLM devises rewriting plans to diversify motifs that preserve functionality. Iterative feedback between the RL and LLM stages refines adversarial rewritings to limit overheads. Compared to the SOTA work AttackGNN, NetDeTox successfully degrades the effectiveness of all security schemes with fewer rewrites and substantially lower area overheads (reductions of 54.50% for GNN-RE, 25.44% for GNN4IP, and 41.04% for OMLA, respectively). For GNN4IP, ours can even optimize/reduce the original benchmarks' area, in particular for larger circuits, demonstrating the practicality and scalability of NetDeTox.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。