TroPUF: Evaluating Hardware Trojan Insertion in Delay-Based Physical Unclonable Functions

2026-07-25

AI Summary

This work addresses the vulnerability of delay-based physically unclonable functions (PUFs) to stealthy hardware Trojan insertion, which exploits process-induced timing uncertainties—a threat inadequately mitigated by existing security verification methods. For the first time, the study integrates PUF security and hardware Trojan risks into a unified circuit-level simulation framework to systematically evaluate multiple delay-based PUF architectures in terms of functional reliability, hardware overhead, and resistance to machine learning modeling, both before and after Trojan implantation. Experimental results demonstrate that dormant Trojans can preserve normal PUF behavior and modeling resilience, revealing critical blind spots in current PUF validation approaches that fail to detect such threats prior to Trojan activation.

Abstract

Delay-based Physical Unclonable Functions (PUFs) are commonly used for device authentication and key generation due to the fact that they rely on manufacturing induced delay variations. However, these same variations make PUFs inherently non-deterministic, which can allow malicious logic to blend in with normal circuit behavior. As a result, the act of embedding hardware Trojans directly inside the PUF primitive presents a unique security risk that is not yet well understood. This work presents a unified simulation framework for evaluating stealthy hardware Trojan insertion across multiple delay-based PUF architectures and Trojan types. Functional metrics, hardware overhead, and resistance to machine learning modeling are assessed in parallel. Results show that dormant Trojans preserve expected PUF behavior, structural characteristics, and modeling resistance. Detectable degradation appears only after activation, indicating that conventional validation techniques fail to identify embedded Trojans prior to payload execution. These findings expose a gap in current PUF security assumptions, and highlight the need to evaluate PUFs and hardware Trojans as a coupled security problem.

Problem

• Hardware Trojan
• Physical Unclonable Function
• Delay-based PUF
• Security Risk
• Stealthy Insertion

Innovation

• Hardware Trojan
• Delay-based PUF
• Stealthy Insertion
• Machine Learning Resistance
• Security Evaluation Framework