Flip-UnLock: An Anomaly Detection Attack on Flip-Flop-Based Logic Locking

Globalization of the IC supply chain has led to rising hardware-based reverse engineering attacks. Logic locking has been proposed to counter these threats. However, the emergence of machine learning (ML)-based attacks has proved that even the most complex logic locking approaches leave structural traces around the locked subparts of the circuit stemming from optimization steps utilized by security-agnostic synthesis tools. To prevent such optimizations around the locked subparts of the circuit, a flip-flop-based locking approach named Flip-Lock has been proposed that incorporates flip-flops in locking substructures. This paper demonstrates that while flip-flop-based locking substructures effectively mitigate local structural leakages and counter all conventional machine learning-based attacks, they inadvertently introduce circuit-level timing anomalies. These anomalies can be exploited by anomaly detection mechanisms, thereby undermining the security guarantees of the flip-flopbased locking technique. We introduce Flip-UnLock, an attack that transforms the circuit into a timing graph and applies anomaly detection techniques to differentiate between original and add-on locking flip-flops in circuits secured by flip-flop-based locking. Our approach successfully compromises the flip-flopbased locking mechanism in various benchmark circuits with an average accuracy of 88.3%.