Learning from Output Transitions: A Chosen Challenge Strategy for ML Attacks on PUFs

The susceptibility of many strong Physically Unclonable Functions (PUFs) to machine learning (ML)-based modeling attacks is a significant challenge in hardware security. To evaluate the predictability of a PUF, the Hamming Distance Test (HDT) was introduced to measure the probability of output transitions. Poorer HDT values indicate that the attacker can predict some responses better than random guessing. However, existing work has not fully explored the integration of the HDT property for enhancing ML attacks. This paper proposes a chosen challenge strategy combining the HDT property with ML algorithms. The proposed strategy, the Differential Chosen Challenge Attack (DCCA), efficiently models a PUF by forcing the ML algorithm to learn from output transitions. Experimental results show at most 50% of Challenge-Response Paris (CRPs) are reduced compared with conventional ML attacks when attacking XOR Arbiter PUFs (XOR APUF) and Interpose PUFs (IPUFs). Furthermore, the proposed method efficiently learns the XOR trigger-based Adversarial APUFs (AAPUF) that conventional ML attacks are hard to model.