DAGNN-RE: Directed acyclic graph neural network for functional reverse engineering of gate-level netlist

Abstract

Functional reverse engineering of gate-level netlist is a crucial means for detecting the functionality of third-party IPs and enhancing IC security. The state-of-the-art method GNN-RE accurately identifies sub-circuits in flattened netlists but struggles to generalize effectively to unseen functionally-equivalent structurally-different netlists because it only extracts the structural features of the netlist. This work introduces an innovative GNN-based approach DAGNN-RE, that can accurately identify sub-circuits in combinational netlists and exhibits superior generalization capabilities for functionally-equivalent structurally-different netlists. The improved performance rests on learning both the structural and functional attributes of netlist instead of merely increasing the amount of training data. Specifically, for structural attributes, DAGNN-RE employs the partial order in message passing of Directed Acyclic Graph Neural Network (DAGNN) to extract the inherent DAG nature of netlist structure. For functional attributes, DAGNN-RE integrates the boolean function of logic gates and the time series update function following the propagation of the circuit signals to extract functionality at the sub-circuit level. Furthermore, the signal probability of logic gates is incorporated to boost the capture of functional attributes. We constructed four extra custom datasets based on the GNN-RE open-sourced dataset to test the accuracy, scalability, and generalization ability. The experimental results show that DAGNN-RE outperforms GNN-RE across all five datasets, suggesting that our approach offers more practical than GNNRE. We derived another five custom datasets from GNN-RE open-source RTL to validate the application in equivalent timing scenarios. The experimental results show that DAGNN-RE still outperforms GNN-RE, demonstrating that our approach maintains a significant advantage even for netlists that are timing and functionally equivalent but structurally different.