Search papers, labs, and topics across Lattice.
This paper conducts a thorough evaluation of gradient leakage attacks (GLAs) on various state-of-the-art graph neural networks (GNNs) used in circuit design and hardware security, revealing significant vulnerabilities that could expose sensitive information about circuit components and hardware Trojans. The study finds that GNN architectures, particularly those utilizing attention mechanisms like GAT, are more susceptible to these attacks, while models employing injective aggregation, such as GIN, demonstrate better resilience. Additionally, the effectiveness of existing defense techniques is assessed, showing that while some can enhance resilience, they may also degrade model performance in certain contexts.
Gradient leakage attacks can reveal critical circuit information, exposing GNNs to significant security risks that current defenses struggle to mitigate effectively.
As graph neural networks (GNNs) become standard tools for critical tasks in circuit design and analysis, their security and privacy risks require careful attention. Here, we present the first comprehensive evaluation of gradient leakage attacks (GLAs) on GNNs in circuit-design and hardware-security tasks, a practical threat that has been largely overlooked. We assess state-of-the-art (SOTA) GNNs, including GraphSAGE, GCN, GIN, and GAT, trained on standard netlist benchmarks (ISCAS'85, EPFL, and TrustHub), for their fundamental vulnerability to GLAs. We find that GLAs can expose sensitive information, such as gate types and distinctive properties of hardware Trojans, which may assist adversaries in analyzing logic locking schemes or evading Trojan detection mechanisms. Our analysis shows that these risks are influenced by architectural features, with attention mechanisms (GAT) exacerbating leakage, while injective aggregation (GIN) provides comparatively stronger resilience. We further evaluate several SOTA defense techniques, including differential privacy, gradient clipping, secure aggregation, model compression with quantization, and adversarial training. We find that these techniques improve resilience only in specific settings and can also compromise model performance. Overall, our work provides key insights toward privacy-preserving GNNs and highlights the need for more robust and efficient defenses. We release our full methodology and artifacts.
