Technical Summary: AnalogFed

Problem Statement

Generative AI (GenAI) holds transformative potential for Electronic Design Automation (EDA), particularly in the discovery of analog circuit topologies. However, the adoption of GenAI for hardware design is severely constrained by data privacy and siloing. Unlike language or vision domains, which benefit from massive open corpora, practical hardware datasets (e.g., Verilog codebases, analog circuit libraries) are proprietary and distributed across organizations, making centralized model training infeasible due to Intellectual Property (IP) concerns.

While Federated Learning (FedL) offers a mechanism for collaborative training without sharing raw data, applying it to GenAI-driven hardware design introduces unique security vulnerabilities:

1. Model Inversion Attacks: Adversaries (or a semi-honest server) can reconstruct proprietary circuit topologies from transmitted model gradients.
2. Membership Inference Attacks (MIAs): Due to the autoregressive nature of GenAI models, which encourage memorization and high-confidence next-token prediction, attackers can determine whether specific circuit designs were part of the training set by analyzing model outputs.
3. Deployment Complexity: A practical framework must protect not only the designer's circuit topology IP but also the semiconductor fabrication technology (process parameters) used to evaluate circuit performance.

Existing defenses, such as Differential Privacy (DP), pruning, or regularization, are often inadequate for large autoregressive models, causing significant utility degradation or offering insufficient protection against sophisticated attacks.

Methodology: The AnalogFed Framework

The authors propose AnalogFed, the first privacy-preserving framework for large-scale analog circuit topology discovery using FedL and GenAI. The framework integrates three core technical strategies:

1. Two-Stage Privacy-Preserving Deployment

To address the dual-layer privacy requirements (designer IP and manufacturer process technology), AnalogFed employs a two-stage strategy:

• Federated Pre-training: Clients collaboratively pre-train a shared generative model (based on the state-of-the-art AnalogGenie backbone) using distributed private topology datasets. This stage captures foundational knowledge of circuit connectivity without exposing raw data.
• Decentralized Fine-tuning: Clients perform local fine-tuning on specific tasks (e.g., designing high-performance Op-Amps) using their private datasets and specific semiconductor process constraints. This ensures that sensitive fabrication technology remains local to the client. The fine-tuning utilizes Reinforcement Learning with Human Feedback (RLHF) via Proximal Policy Optimization (PPO) to optimize for performance metrics like Figure-of-Merit (FoM).

2. Dynamic Homomorphic Encryption (DHE)

To defend against Model Inversion Attacks during the pre-training phase, AnalogFed introduces a Dynamic Homomorphic Encryption mechanism.

• Observation: Gradients in deep neural networks exhibit a convergence behavior where magnitudes are large in early training stages (highly informative) and decay significantly in later stages.
• Mechanism: DHE adaptively encrypts only the early, large-magnitude gradients. Encryption is automatically disabled once the loss reduction drops below a 20% threshold for five consecutive epochs (typically after ~600 rounds).
• Benefit: This approach significantly reduces the computational and communication overhead associated with full homomorphic encryption while effectively preventing adversaries from reconstructing model parameters from the most informative updates.

3. Dummy Token Input Perturbation

To mitigate Membership Inference Attacks (MIAs) without degrading model utility, AnalogFed proposes a novel input perturbation strategy:

• Mechanism: The framework injects "dummy tokens" (representing dummy wires connecting nodes to power/ground, e.g., VDD/VSS) into the circuit topology sequences during training. These tokens mimic industry-standard practices for layout symmetry but serve as a privacy defense.
• Training Strategy: The dummy tokens are injected at a specific ratio (e.g., 6%) into the input sequences. Crucially, the loss function is masked for these dummy tokens, meaning they act as input perturbations but do not contribute to gradient updates.
• Effect: This shifts the training data distribution, reducing the model's over-familiarity with specific training patterns and making it difficult for attackers to distinguish between member and non-member circuits based on prediction confidence.

Key Contributions

1. First FedL Framework for GenAI-Driven EDA: AnalogFed pioneers the integration of Federated Learning with Generative AI specifically for analog design automation, establishing a foundation for scalable, privacy-preserving hardware design.
2. Two-Level Privacy Collaboration: The framework uniquely addresses the protection of both proprietary topology datasets (designer IP) and semiconductor fabrication technologies (manufacturer IP) through a staged deployment strategy.
3. Domain-Specific Defense Mechanisms:
   • Dummy Token Perturbation: A novel, low-overhead strategy to mitigate MIAs in circuit generative models by perturbing inputs rather than adding noise to model updates.
   • Dynamic Homomorphic Encryption: An optimized encryption scheme that balances security and efficiency by encrypting only the most informative early-stage gradients.
4. Comprehensive Evaluation: The work provides extensive experiments demonstrating the framework's feasibility, scalability, and robustness across diverse federated settings, including balanced and unbalanced data distributions.

Experimental Results

The authors evaluated AnalogFed using the AnalogGenie dataset (3,350 unique analog topologies) and a 11.8M parameter decoder-only Transformer model.

• Federated Discovery Capability: Performance (Validity, Novelty, FoM, Scalability) consistently improved as the number of participating clients increased (from 3 to 16), demonstrating that FedL can leverage distributed data to build more powerful models than single-client training. The dummy token injection strategy did not degrade model utility compared to centralized training without dummy tokens.
• DHE Efficiency: By encrypting only the initial 600 rounds, DHE achieved a 5.1× reduction in communication cost compared to fully encrypted baselines (FEDML-HE) and reduced training time from 184 hours (static encryption) to 48.5 hours, while maintaining model accuracy comparable to plaintext training.
• MIA Defense: The dummy token defense significantly reduced the success rate of seven standard MIA strategies (e.g., Loss, Zlib, Mink). With a 6% dummy token ratio and block size of 4, the Area Under the Receiver Operating Characteristic Curve (AUC-ROC) scores dropped to near-random guessing levels (~0.5), indicating strong privacy protection. The defense remained robust even when attack inputs contained mismatched dummy configurations.

Significance and Claims

The paper claims that AnalogFed lays the foundation for scalable, multi-party collaboration in next-generation hardware design automation. By solving the critical bottlenecks of data silos and privacy risks, the framework enables the development of foundation-level design agents capable of discovering novel analog circuits that were previously inaccessible due to data scarcity.

The authors position AnalogFed not merely as a theoretical contribution but as a practical solution that addresses the specific vulnerabilities of GenAI in the hardware domain. They assert that this work paves the way for future at-scale GenAI-driven EDA, allowing organizations to collaborate on innovation without compromising the confidentiality of their proprietary designs or manufacturing processes. The framework is presented as a step toward a broader paradigm of privacy-preserving, cross-organizational GenAI for hardware design.