FSMformer: An efficient direction-aware graph transformer for state register detection of gate-level netlist

Abstract

Although the use of third-party netlist IP can enhance the quality of integrated circuit products and reduce development cycles, it also introduces potential security vulnerabilities. Identifying state registers in sequential netlists is a commonly adopted technique to assist engineers in understanding the control logic of unknown gate-level netlists. Traditional graph theory-based detection methods, such as RELIC and FSMX-ultra, suffer from low accuracy and high computational complexity. Recent graph neural network-based detection methods, such as ReIGNN, also exhibit limited accuracy, with many data DFFs being misclassified as state DFFs. In this article, we propose a graph transformer-based method, FSMformer, which utilizes bidirectional message passing as the local module and direction-aware linear fast attention as the global module, to enable the simultaneous extraction of structural and functional features from sequential netlists, thereby achieving efficient and accurate detection of state DFFs in large-scale netlists. According to the experimental results, our proposed FSMformer outperforms not only the state-of-the-art graph theory-based method FSMX-ultra and the state-of-the-art GNN-based method ReIGNN, but also various advanced neural network baselines that we employed for state DFFs detection.