<p>Hardware trojans are malicious circuits which compromise the functionality and security of an integrated circuit (IC). These circuits are manufactured directly into the silicon and cannot be fixed by security patches like software. The solution would require a costly product recall by replacing the IC and hence, early detection in the design process is essential. Hardware detection at best provides statistically based solutions with many false positives and false negatives. These detection methods require more thorough explainable analysis to filter out false indicators. Existing explainability methods developed for general domains like image classification do not always provide the actionable insights hardware engineers need. A question remains: how do domain-aware property analysis, model-agnostic case-based reasoning, and model-agnostic feature attribution techniques compare for hardware security applications? This work compares three categories of explainability for gate-level hardware trojan detection on the Trust-Hub benchmark dataset: (1) domain-aware property-based analysis of 31 circuit-specific features derived from gate fanin patterns, flip-flop distances, and primary Input/Output (I/O) connectivity; (2) model-agnostic case-based reasoning using k-nearest neighbors for precedent-based explanations; and (3) model-agnostic feature attribution methods (Local Interpretable Model-agnostic Explanations (LIME), SHapley Additive exPlanations (SHAP), gradient) that provide generic importance scores without circuit-level context. The findings show that different explainability approaches offer distinct advantages for hardware security practitioners. The domain-aware property-based method analyzes 31 circuit properties. Detection decisions are explained through familiar concepts like “high fanin complexity near outputs indicates potential trojan triggers.” Case-based reasoning (k-nearest neighbors) achieves 96.51% correspondence between predictions and training exemplars. In contrast, LIME and SHAP show only moderate per-gate agreement (Spearman <InlineEquation ID="IEq1"> <EquationSource Format="TEX">\(\varvec{\rho = 0.30}\)</EquationSource> </InlineEquation> mean over <InlineEquation ID="IEq2"> <EquationSource Format="TEX">\(\varvec{n = 11{,}392}\)</EquationSource> </InlineEquation> gates, 95% bootstrap CI <InlineEquation ID="IEq3"> <EquationSource Format="TEX">\(\varvec{[0.29, 0.31]}\)</EquationSource> </InlineEquation>; global concatenated <InlineEquation ID="IEq4"> <EquationSource Format="TEX">\(\varvec{\rho = 0.31}\)</EquationSource> </InlineEquation>, <InlineEquation ID="IEq5"> <EquationSource Format="TEX">\(\varvec{p \ll 10}^{\varvec{-300}}\)</EquationSource> </InlineEquation>), and yield generic feature importance scores that lack circuit-level context for validation or remediation planning. Detection performance using eXtreme Gradient Boosting (XGBoost) classification with optimized threshold achieves 48.08% precision and 69.44% recall on 11,392 held-out test gates (F1 = 0.568, Matthews Correlation Coefficient (MCC) = 0.575, area under the precision-recall curve (AUPRC) = 0.637) at the optimized threshold of 0.940. This represents a 4.25-fold precision improvement over a support vector machine (SVM) baseline reimplemented under identical experimental conditions (11.33% precision, 70.83% recall, F1 = 0.195 at threshold 0.050) with a 7.4-fold reduction in false-positive density (4.74 vs. 35.0 FP per 1,000 gates). Random Forest achieves comparable F1 (0.555, 58.46% precision, 52.78% recall) with half the false-positive density of XGBoost (2.37 vs. 4.74 FP per 1,000 gates), confirming that the explainable AI (XAI) findings generalize across classifier choices. Additionally, gradient-based feature attribution (Simonyan et al., 2013), with a speedup factor of 7 over SHAP, yields the same model-agnostic feature weights as SHAP and LIME, confirming that computational efficiency alone cannot substitute for domain-aware interpretability. This work provides empirical evidence comparing domain-aware property analysis, model-agnostic case-based reasoning, and model-agnostic feature attribution techniques for hardware security applications. The results show that property-based and case-based approaches offer complementary advantages: domain alignment and precedent-based interpretability, respectively, compared to generic feature rankings. These findings have implications for XAI deployment across domains where practitioners must validate and act on Machine Learning (ML) predictions.</p>

Explainability Methods for Hardware Trojan Detection: A Systematic Comparison

期刊论文
出版模式：

开放获取
发表日期：

2026年8月3日

查看全文

Paul Whitten,
Francis Wolff,
Chris Papachristou

摘要

Hardware trojans are malicious circuits which compromise the functionality and security of an integrated circuit (IC). These circuits are manufactured directly into the silicon and cannot be fixed by security patches like software. The solution would require a costly product recall by replacing the IC and hence, early detection in the design process is essential. Hardware detection at best provides statistically based solutions with many false positives and false negatives. These detection methods require more thorough explainable analysis to filter out false indicators. Existing explainability methods developed for general domains like image classification do not always provide the actionable insights hardware engineers need. A question remains: how do domain-aware property analysis, model-agnostic case-based reasoning, and model-agnostic feature attribution techniques compare for hardware security applications? This work compares three categories of explainability for gate-level hardware trojan detection on the Trust-Hub benchmark dataset: (1) domain-aware property-based analysis of 31 circuit-specific features derived from gate fanin patterns, flip-flop distances, and primary Input/Output (I/O) connectivity; (2) model-agnostic case-based reasoning using k-nearest neighbors for precedent-based explanations; and (3) model-agnostic feature attribution methods (Local Interpretable Model-agnostic Explanations (LIME), SHapley Additive exPlanations (SHAP), gradient) that provide generic importance scores without circuit-level context. The findings show that different explainability approaches offer distinct advantages for hardware security practitioners. The domain-aware property-based method analyzes 31 circuit properties. Detection decisions are explained through familiar concepts like “high fanin complexity near outputs indicates potential trojan triggers.” Case-based reasoning (k-nearest neighbors) achieves 96.51% correspondence between predictions and training exemplars. In contrast, LIME and SHAP show only moderate per-gate agreement (Spearman \(\varvec{\rho = 0.30}\) mean over \(\varvec{n = 11{,}392}\) gates, 95% bootstrap CI \(\varvec{[0.29, 0.31]}\) ; global concatenated \(\varvec{\rho = 0.31}\) , \(\varvec{p \ll 10}^{\varvec{-300}}\) ), and yield generic feature importance scores that lack circuit-level context for validation or remediation planning. Detection performance using eXtreme Gradient Boosting (XGBoost) classification with optimized threshold achieves 48.08% precision and 69.44% recall on 11,392 held-out test gates (F1 = 0.568, Matthews Correlation Coefficient (MCC) = 0.575, area under the precision-recall curve (AUPRC) = 0.637) at the optimized threshold of 0.940. This represents a 4.25-fold precision improvement over a support vector machine (SVM) baseline reimplemented under identical experimental conditions (11.33% precision, 70.83% recall, F1 = 0.195 at threshold 0.050) with a 7.4-fold reduction in false-positive density (4.74 vs. 35.0 FP per 1,000 gates). Random Forest achieves comparable F1 (0.555, 58.46% precision, 52.78% recall) with half the false-positive density of XGBoost (2.37 vs. 4.74 FP per 1,000 gates), confirming that the explainable AI (XAI) findings generalize across classifier choices. Additionally, gradient-based feature attribution (Simonyan et al., 2013), with a speedup factor of 7 over SHAP, yields the same model-agnostic feature weights as SHAP and LIME, confirming that computational efficiency alone cannot substitute for domain-aware interpretability. This work provides empirical evidence comparing domain-aware property analysis, model-agnostic case-based reasoning, and model-agnostic feature attribution techniques for hardware security applications. The results show that property-based and case-based approaches offer complementary advantages: domain alignment and precedent-based interpretability, respectively, compared to generic feature rankings. These findings have implications for XAI deployment across domains where practitioners must validate and act on Machine Learning (ML) predictions.