Non-Invasive Attack on Ring Oscillator-Based PUFs Through Localized X-Ray Irradiation

Physical Unclonable Functions (PUFs) are emerging as a fundamental component of secure architectures that provide services such as authentication and key generation. A specific class of PUF is based on Ring Oscillators (ROs), where minimal behavioral differences due to process variations are harnessed to generate unique responses. The inherent strength of PUFs lies in the fact that it is practically impossible to control these phenomena to forge a specific response from the device. In this paper, we present a novel approach by introducing localized X-Ray attacks on PUFs for the first time. These attacks significantly alter the behavior of a selected RO within the array of oscillators on an FPGA. By biasing the properties of the target block, we demonstrate the feasibility of modifying the response of a specific PUF. In particular, these attacks can be executed when the target is powered off, bypassing several circuit monitoring countermeasures. This capability introduces a new class of attacks that exploit vulnerabilities even in systems with stringent security measures, raising concerns about the robustness of current security frameworks.