Hardware Trojans from Invisible Inversions: On the Trojanizability of Standard Cell Libraries

1. Problem Statement

The paper addresses the critical security vulnerability of Hardware Trojans (HTs) introduced during the semiconductor fabrication process. Specifically, it investigates the limitations of current physical inspection methods (Scanning Electron Microscope or SEM imaging) in detecting cell substitution attacks.

• Context: Modern IC design relies on outsourcing fabrication to third-party foundries. An adversary (e.g., a compromised foundry or insider) can swap a standard cell in the layout with a functionally different but visually similar cell from the same library.
• The Gap: Previous research (Puschner et al., S&P 2023) established a dataset of SEM images across four technology nodes (90nm, 65nm, 40nm, 28nm) but could not determine whether detection failures were due to imaging limitations (noise, resolution) or intrinsic properties of the cell libraries (i.e., the libraries themselves contain functionally distinct cells that look identical).
• Core Question: Is the inability to detect stealthy Trojans a solvable engineering problem (better cameras), or is it an inherent flaw in standard cell library design ("Trojanizability")?

2. Methodology

The authors developed a systematic framework to quantify "Trojanizability" independent of image noise, focusing on via placement as the primary distinguishing feature.

A. Robust Metric Development

• Via Extraction: Instead of relying on raw pixel intensity, the authors extract via locations (metal connections) from backside SEM images.
  • For 90nm, 65nm, and 40nm nodes, they used standard binary thresholding and morphological operations.
  • For the noisy 28nm node, they employed topological persistence analysis (a method treating the image as a topographical map to distinguish long-lived "islands" of brightness from noise).
• Instance Averaging: To eliminate imaging artifacts and stitching errors, they randomly sampled 50 instances of each cell type, aligned them, and performed a per-via majority vote. This created a "canonical representative" for each cell type that captures intrinsic visual characteristics rather than instance-specific noise.
• Similarity Scoring: They computed a Jaccard distance between the via sets of functionally different cell pairs. A score of 0 indicates perfect visual indistinguishability; 1 indicates total dissimilarity.

B. Trojanizability Assessment

• The authors compared all pairs of functionally distinct cells of the same width across the four technology nodes.
• They identified "Invisible Inversions": pairs of cells that implement logical inverses (e.g., XOR vs. XNOR, BUF vs. INV) but possess identical or near-identical via patterns.

C. Detection Evaluation

• They applied their Via Position (VP) metric to detect swapped cells and compared it against the baseline methods (Template Matching and Via Mask Matching) from the original S&P 2023 study.
• They evaluated False Negative (Beta) rates to determine the probability of a Trojan slipping through detection.

3. Key Contributions

1. Definition of Trojanizability: The paper defines and quantifies "Trojanizability" as the extent to which functionally different cells can be interchanged without visual distinction under SEM inspection.
2. Discovery of Invisible Inversions: The authors identified that logical inversions (e.g., XOR/XNOR, INV/BUF, TIEH/TIEL) are the primary source of indistinguishable cells.
3. Novel Detection Metric: They introduced a via-position-based similarity metric that outperforms previous template-matching approaches, achieving near-zero false negatives in most cases.
4. Real-World Case Study: They demonstrated a privilege-escalation backdoor in an Ibex RISC-V core (65nm and 28nm) by substituting indistinguishable cells. This Trojan bypasses privilege checks entirely while remaining visually undetectable.

4. Key Results

A. Technology Node Trends

• 28nm Node (Most Vulnerable): Exhibited the highest Trojanizability. Five pairs of functionally distinct cells were found to be visually indistinguishable (similarity score = 0). The distribution of similarity scores shifted significantly lower compared to larger nodes.
• 40nm Node: Contained a perfectly indistinguishable pair (TIEH vs. TIEL).
• 90nm & 65nm Nodes: While fewer pairs were perfectly indistinguishable, they still contained highly similar pairs (e.g., XOR/XNOR). The 65nm node had no score of 0 but showed high similarity in specific pairs.
• Conclusion: As feature sizes shrink, the density of visually similar but functionally distinct cells increases, making detection harder. This is an inherent property of the libraries, not just an imaging artifact.

B. Detection Performance

• Baseline Failure: The original template-matching methods failed to detect many substitutions, particularly in the 28nm and 40nm nodes.
• Proposed Method Success: The authors' Via Position (VP) method achieved zero false negatives across all nodes for the majority of cell pairs.
  • Exception: The 65nm node showed higher false negatives (approx. 0.5) for specific pairs due to bright imaging artifacts being misclassified as vias, suggesting template matching remains a useful fallback for specific noise conditions.

C. The Privilege-Escalation Backdoor

• Mechanism: By swapping 3 XNOR cells with XOR cells (65nm) or 2 INV cells with BUF cells (28nm), the authors altered the logic of the Physical Memory Protection (PMP) unit.
• Effect: The processor treated all execution contexts as having the highest privilege level, allowing untrusted code to access secure memory and bypass boot integrity checks.
• Stealth: The Trojan was visually undetectable via SEM because the substituted cells had identical via patterns. No routing changes were required.

D. Mitigation Cost

• The authors demonstrated that excluding these problematic cell pairs from the synthesis process (using dont_use constraints) incurs negligible overhead:
  • Area: +0.013%
  • Timing: +0.047%
  • Power: +0.022%

5. Significance and Recommendations

Significance

• Paradigm Shift: The paper proves that improved imaging equipment alone cannot solve the hardware Trojan problem if the underlying cell libraries contain "invisible inversions." The risk is intrinsic to the design of standard cell libraries in advanced nodes.
• Supply Chain Security: It highlights a critical gap in current verification workflows, showing that even rigorous SEM inspection can be bypassed by knowledgeable adversaries using standard library cells.

Recommendations

1. Empirical Validation of PDKs: Designers of high-assurance systems must benchmark Process Design Kits (PDKs) for Trojanizability before selection. Libraries with indistinguishable pairs should be avoided.
2. Synthesis Constraints: If a library cannot be changed, designers should identify and exclude functionally distinct but visually identical cell pairs during synthesis. This is a low-cost, high-impact mitigation.
3. Hardened PDKs: Foundries and library designers should treat visual distinguishability as a design rule. Future libraries should ensure no two cell types share the same via pattern (inherent watermarking).
4. Hybrid Verification: Combine SEM inspection with complementary techniques like dopant-sensitive imaging, electrical side-channel analysis, and functional testing to cover the blind spots of visual inspection.

Conclusion

The paper concludes that Trojanizability is a real and severe threat inherent to modern standard cell libraries, particularly at smaller technology nodes (28nm). While current detection methods struggle, practical and low-overhead defenses exist by curating cell libraries to eliminate "invisible inversions." The authors plan to open-source their analysis pipeline to facilitate industry adoption of these security measures.