Logistic Regression Attack

The Logistic Regression Attack (LR Attack) was introduced by Rührmair et al. [RSSD10] to model XOR Arbiter PUFs. In pypuf, an modernized and optimized version of the LR attack is implemented using tensorflow. The original implementation is also available from the authors. A study of the data complexity of the LR attack using a different unpublished implementation of the LR attack was done by Tobisch and Becker [TB15].

Example Usage

To run the attack, CRP data of the PUF token under attack is required. Such data can be obtained through experiments on real hardware, or using a simulation. In this example, we use the pypuf XOR Arbiter PUF simulator:

>>> import pypuf.simulation, pypuf.io
>>> puf = pypuf.simulation.XORArbiterPUF(n=64, k=4, seed=1)
>>> crps = pypuf.io.ChallengeResponseSet.from_simulation(puf, N=50000, seed=2)

To run the attack, we configure the attack object with the challenge response data and attack parameters. The parameters need careful adjustment for each choice of security parameters in the PUF. Then the attack is run using the pypuf.attack.LRAttack2021.fit() method.

>>> import pypuf.attack
>>> attack = pypuf.attack.LRAttack2021(crps, seed=3, k=4, bs=1000, lr=.001, epochs=100)
>>> attack.fit()  
    Epoch 1/100
    ...
    50/50 [==============================] - ... - loss: 0.4... - accuracy: 0.9... - val_loss: 0.4643 - val_accuracy: 0.9620
    <pypuf.simulation.base.LTFArray object at 0x...>
>>> model = attack.model

The model accuracy can be measured using the pypuf accuracy metric pypuf.metrics.accuracy().

>>> import pypuf.metrics
>>> pypuf.metrics.similarity(puf, model, seed=4)
array([0.966])

Applicability

The Logistic Regression can be extended to other variants of the XOR Arbiter PUF [WBMS19]. This functionality is currently not yet included in pypuf, so that the user needs to perform the appropriate conversions before using pypuf.attack.LRAttack2021.

This implementation is also suitable to conduct the splitting attack on the Interpose PUF [WMPN19].

API

class pypuf.attack.LRAttack2021(crps: ChallengeResponseSet, seed: int, k: int, bs: int, lr: float, epochs: int, stop_validation_accuracy: float = 0.95)

Improved Logistic Regression modeling attack for XOR Arbiter PUFs.

Based on the attack of Rührmair et al. [RSSD10], this version uses tensorflow to model XOR Arbiter PUFs based on observed challenge-response pairs. Compared to the version used by the original authors, this version is based on tensorflow and uses some detail improvements.

Todo

A detailed description of the modifications used in pypuf is currently under consideration for publication. This section will be updated as soon as the manuscript is available to the public.

__init__(crps: ChallengeResponseSet, seed: int, k: int, bs: int, lr: float, epochs: int, stop_validation_accuracy: float = 0.95) → None

Initialize an improved Logistic Regression attack using the given parameters.

Parameters:

• crps (pypuf.io.ChallengeResponseSet) – Challenge-response data observed from the PUF under attack. 99% of CRP data will be used as training data, 1% will be used as validation set.

• seed (int) – Random seed for model initialization. Success of the attack may depend on the seed, in particular when little challenge-response data is used.

• k (int) – Number of parallel arbiter chains used in the XOR Arbiter PUF.

• bs (int) – Number of training examples that are processed together. Larger block size benefits from higher confidence of gradient direction and better computational performance, smaller block size benefits from earlier feedback of the weight adoption on following training steps.

• lr (float) – Learning rate of the Adam optimizer used for optimization.

• epochs (int) – Maximum number of epochs performed.

• stop_validation_accuracy (float) – Training is stopped when this validation accuracy is reached. Set to 1 to deactivate.

fit() → Simulation

Using tensorflow, runs the attack as configured and returns the obtained model.

Note

Tensorflow will write to stdout.

Todo

Currently, a copy of the challenges is created to compute the features for learning. This essentially doubles memory consumption. If the challenges can be overwritten, this can be performed in-situ to reduce memory footprint of the attack.

Returns:

Model of the XOR Arbiter PUF under attack.

property history: dict | None

After fit() was called, returns a dictionary that contains information about the training process. The dictionary contains lists of length corresponding to the number of executed epochs:

• loss the training loss,

• val_loss the validation loss,

• accuracy the training accuracy, and

• val_accuracy the validation accuracy.

property model: Simulation | None

The model that was obtained running the fit() method, None if fit() was not run yet.

Performance

The pypuf implementation is tested using tensorflow 2.4 on Intel Xeon E5-2630 v4 attacking \(n\)-bit \(k\)-XOR Arbiter PUFs. The results below are compared with those of Tobisch and Becker [TB15], which have been obtained in 2015 using up to 16 cores.

n	k	CRPs	success rate	duration	cores	[TB15] / 16 cores
64	4	30k	10/10	<1 min	4	<1 min
64	5	260k	10/10	4 min	4	<1 min
64	6	2M	20/20	<1 min	4	1 min
64	7	20M	10/10	3 min	4	55 min
64	8	150M	10/10	28 min	4	391 min
64	9	350M				2266 min
64	9	500M	7/10	14 min	40
64	10	1B	6/10	41 min	40