Research on the Security of SRAM-Based FPGAs in the Era of Artificial Intelligence

Abstract

SRAM-based FPGAs, with their flexible programmability and parallel execution features, have been widely used, and the security of such devices has drawn significant attention. Especially in the era of artificial intelligence, FPGA architectural optimizations and evolving application models have introduced novel security characteristics and threats. In this work, we introduce a taxonomy of FPGA threats and explore new threat features and potential countermeasures in the era of AI. We focus on evaluating the research trends of FPGA security, including both security threats and protection measures. Then, we propose a new perspective on the involvement of FPGA manufacturers in FPGA security and introduce the main security measures used in COTS FPGA products. Finally, we summarize the security challenges and offer future research directions.

1. Introduction

Since the introduction of the “Turing machine” theory in 1936, artificial intelligence (AI) has evolved through several ups and downs into a productivity driver that encompasses machine learning, neural networks, deep learning, large language models, and more. Advanced computing chips are a key driver of the rapid growth of the AI industry. As the foundational hardware powering AI computation, AI chips are designed for processing vast datasets and running sophisticated algorithms, e.g., Graphics Processing Units (GPUs), Field-Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), and Neural Processing Units (NPUs) [1].

Among the abovementioned AI chips, FPGAs [2] possess the capabilities of flexible programmability and efficient parallel computing. Specifically, FPGAs demonstrate significantly higher functional flexibility compared to ASICs while offering substantially faster computing speeds than microprocessors or microcontrollers [3,4,5]. To meet the computing power requirements of AI, modern FPGAs have integrated numerous heterogeneous resources, including dedicated DSPs, GTXs, embedded processors, radio frequency components, and tensor computing units [6,7]. Nowadays, FPGAs are widely utilized in intelligent computing applications, such as computational acceleration, datacenters, and cloud services.

The development of AI technologies, especially deep learning, has rapidly changed the architecture, configuration modes, and ecosystem of FPGAs. Subsequently, the security of FPGAs in the era of AI should also be carefully demonstrated and evaluated. Some survey articles have demonstrated the security of FPGAs and the impacts of AI technology development from various perspectives [8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29]. Here, we summarize 22 survey articles published in the past five years, dividing them into three research directions, as shown in

Table 1. Comparison of security threats in SRAM-based FPGA chips versus other computing chips.

Article	Research Area	Year	Topic
A. Duncan [8]	D1: FPGA security studies	2019	Threats and vulnerabilities associated with FPGA bitstreams.
Jiliang Zhang [9]		2019	Threats and defense mechanisms in FPGA-based systems, focusing on supply chain and design flow.
Z. Huang [10]	D2: Studies on applications of AI in FPGA security	2020	ML-based approaches against HT attacks from four perspectives: HT detection, DFS, bus security, and secure architecture.
X. Xu [11]	D3: Security studies on FPGA application	2020	The dual impact of machine learning on FPGA security, both as a tool for attack and defense.
Furkan Turan [12]		2020	Trust models and security challenges in FPGA-accelerated cloud computing platforms and reviews existing solutions.
Kaspar Matas [13]		2020	Hardware security challenges for FPGAs in datacenters.
S. Sunkavilli [14]	D1: FPGA security studies	2021	Security threats in new FPGA utilization model in the era of machine learning and cloud computing.
G. Dessouky [15]	D3: Security studies on FPGA application	2021	Security challenges and opportunities in secure FPGA multi-tenancy in the cloud.
S. Duan [16]		2021	Security vulnerabilities and defense mechanisms in FPGA-based hardware acceleration systems.
Z. Pan [17]	D2: Studies on applications of AI in FPGA security	2022	Utilization of machine learning techniques for hardware vulnerability analysis.
Lilas Alrahis [18]		2022	Application of GNNs in hardware security and attacks on logic locking.
A. Hasnain [19]	D1: FPGA security studies	2022	Power profiling-based side-channel attacks on FPGAs and associated countermeasures.
Hoda Naghibijouybari [20]	D3: Security studies on FPGA application	2022	Microarchitectural attacks in heterogeneous computing systems.
Dina G. Mahmoud [21]		2022	Electrical-level security threats on CPUs, FPGAs, and GPUs.
Troya Çağıl Köylü [22]	D2: Studies on applications of AI in FPGA security	2023	Applications of machine learning in hardware security.
David Koblah [23]		2023	Application of artificial intelligence and machine learning in electronic design automation.
Alexandre Proulx [24]	D1: FPGA security studies	2023	Security aspects of SoC FPGA devices incorporating a hard processing system.
P. D. Rosero-Montalvo [25]	D3: Security studies on FPGA application	2023	Security concerns for utilizing FPGAs in cloud computing.
Ferhat Erata [26]		2023	Methods for security verification across hardware and software layers in computer systems.
Ruyan Lin [27]	D1: FPGA security studies	2024	Methods for detecting vulnerabilities and security patches while identifying research gaps and future directions.
Zain Ul Abideen [28]	D3: Security studies on FPGA application	2024	Reconfigurable-based obfuscation techniques that combat security threats in hardware design.
Muhammed Kawser Ahmed [29]		2025	Examination of the security concerns associated with multi-tenant cloud FPGAs, providing a comprehensive overview of the related security, privacy and trust issues, and discussing forthcoming challenges in this evolving field of study.

. Direction 1 (D1) includes FPGA security studies. Direction 2 (D2) includes studies on applications of AI in FPGA security. Direction 3 (D3) includes security studies on FPGA application.

The existing studies have mostly focused on a specific theme or perspective. However, the vigorous development of artificial intelligence has broadly impacted the field of hardware security, especially FPGAs. Only by comprehensively examining the impact of AI on the security technologies of FPGAs can we better meet future challenges and provide strong support for the safe and reliable operation of intelligent computing systems.

We introduce a taxonomy of FPGA threats to survey, classify, and analyze the threats faced by FPGA chips, aiming to make the corresponding defense design more systematic. Figure 1 presents the proposed taxonomy, which consists of the following elements:

Configuration Security: This element focuses on the risks throughout the configuration lifecycle to ensure the integrity and confidentiality of configuration files.

Interface Security: This element covers the security of interfaces between FPGAs and external devices, debug tools, or other chips.

Logic Security: This element targets the security of FPGA internal logic resources and user designs to prevent tempering and malicious logic injecting.

Physical Security: This element focuses on the security of FPGA physical entities and physical characteristics.

The main contributions of this paper can be summarized as follows:

• Starting from the impacts of AI on aspects such as the architecture of FPGA chips, development methods, and application models, we comprehensively summarize the new characteristics of FPGA security in the AI era, including threat features and potential countermeasures.
• We summarize the protective measures used in COTS FPGA products, and propose a new perspective on the involvement of FPGA manufacturers in FPGA security. Finally, we outline the necessary future measures recommended for implementation by FPGA manufacturers.

The rest of this paper is organized as follows: In Section 2, we review the architecture and development process of FPGAs and their main security threats pre-AI. In Section 3, we analyze the threats to FPGA chips based on changes in FPGA architecture and market models in the AI era. In Section 4, we introduce security measures used in COTS FPGAs and outline necessary future measures. In Section 5, we present an experimental evaluation of the effectiveness of the main defense measures. We conclude our work and propose future work in Section 6.

2. SRAM-Based FPGA and Its Threat Features Pre-AI

2.1. SRAM-Based FPGA and Development Process

SRAM-based FPGAs are reconfigurable devices. Electronic Design Automation (EDA) development tools implement user functions and configure them. A bitstream generated by EDA tools is written into SRAM-based configuration memory arrays to configure user functions. To achieve this configuration characteristic, the internal circuitry of SRAM-based FPGA chips can be divided into two parts: the configuration circuit and the programmable logics [30], as shown in Figure 2.

The development process of SRAM-based FPGAs [31,32] is also shown in Figure 2. SRAM-based FPGAs support reconfiguration and readback functions, with configuration modules and interfaces remaining open after configuration.

Different application modes yield distinct design concepts. Traditional integrated circuit chips, like GPU and CPU, aim to save every transistor, whereas FPGA chips offer numerous redundant programmable logics and complex configuration circuits. As a result, attacks effective on other chips cannot be directly applied to FPGAs. FPGA chips were initially considered safe. However, in 2004, Ruhr Universität Bochum conducted a detailed analysis of FPGA chip security, publishing the first review article highlighting the need for specialized approaches to FPGA security [33]. In 2008, Drimer published research on the security of volatile FPGAs [34]. The security of FPGAs has since drawn attention.

2.2. The Taxonomy of Threats and Main Security Threats Pre-AI

When assessing the security of FPGAs, it is generally believed that for SRAM-based FPGAs, during the configuration process, there is a possibility that the bitstream carrying user designs may be intercepted, copied, modified, or damaged [35]. As shown in Figure 3, we classified FPGA threats into four types based on the hardware architecture and the implementation process. This taxonomy covers the entire FPGA lifecycle, from FPGA entity and user logic to the bitstream.

From the perspective of system application, the key points of offense and defense are centered on control over the bitstream [24]. The bitstream and the encryption key are the most important security assets. Next, we briefly describe the types of security threats.

2.2.1. Configuration Security

The typical threat in configuration security is cloning attacks. Clone attackers have the ability to physically access configuration interfaces. These attacks occur during processes such as function configuration and updates [36]. Stealing the bitstream, which is the basis of reverse engineering, leads to IP losses for system developers and may enable the implantation of hardware Trojans or other attacks through bitstream modification.

FPGAs support flexible configuration modes and diversified configuration interfaces. For example, the remote configuration function [37,38] provides more possible interfaces for cloning attacks. Ref. [39] summarizes the risks associated with remote dynamic configuration and the commonly used security measures.

2.2.2. Interface Security

The specific threat type in interface security is readback attacks through the debugging communication interface. After the bitstream is loaded, the open configuration ports, used for functions such as readback and partial reconfiguration, create opportunities for readback attacks. The earliest security measure was to determine whether the readback interface should be disabled according to the security level [40].

However, despite these initial security efforts, the readback interface may become vulnerable to readback attacks if not carefully designed by manufacturers. A prime example is the “Starbleed” vulnerability [41] targeting Xilinx 7-series FPGAs, which exploits the readback function of the WBSTAR register and can be regarded as a type of readback attack. Ref. [42] warns that the “Starbleed” vulnerability is still effective against the UltraScale+ series.

2.2.3. Logic Security

There are two typical means of threatening logical security: reverse engineering and hardware Trojan. In these cases, the attackers have the ability to access the EDA tools or modify the RTL codes.

Reverse engineering: The bitstream obtained through clone attacks or readback attacks can be reversed into structural netlists or RTL-level logical descriptions through reverse engineering. FPGA manufacturers typically claim that keeping the bitstream format confidential can defend against reverse engineering. However, in reality, research on reverse engineering has always been highly active, leading to numerous reverse engineering tools, for instance, the Debit toolchain [43] in 2008, the BIL [44] in 2012, the bit2NCD [45] in 2013, BITMAN [46] in 2017, BRET [47] in 2018, and the BitFREE [48] in 2023. New tools are continuously being introduced [49,50,51,52,53,54,55].

Hardware Trojans: Hardware Trojans are special circuit modules that are deliberately implanted or modified to steal or influence circuit information, functions, or performance. The concept was first proposed by Dakshi Agrawal [56] in 2007. Hardware Trojans are mainly implanted in two ways, via either third-party IPs or EDA tools.

Some mature benchmark sets provide examples of implanting hardware Trojans into IPs. For example, the Trust-HUB benchmarks [57] employ a trigger mechanism that activates the hardware Trojan using a single trigger signal in rare events. The De-Trust [58] project includes cases that use multiple discrete trigger signals, allowing each trigger signal to operate normally and remain difficult to detect.

Malware or scripts can be embedded in commercial EDA tools. Hardware Trojans can be implanted by modifying some intermediate files to change the original design functions. Ref. [59] provides two attack examples, which change the design logic through intermediate configuration files in Xilinx ISE and Altera Quartus. Another work, Ref. [60], shows that even with ARM TrustZone protection, the security of the FPGA-based SoC can be compromised via malware embedded in EDA tools. Refs. [61,62] succeeded in implanting the HT by modifying the bitstream. Refs. [63,64] indicate that the direct read–write access to open-source software’s intermediate results creates vulnerabilities for HT injection.

2.2.4. Physical Security

Side-channel attacks steal bitstreams or keys by analyzing the physical side information of FPGAs, making it a typical form physical security threat. Side-channel analysis is the most common non-invasive attack and an essential detection method for evaluating security systems. Side-channel analysis techniques related to FPGAs can be divided into two types. The first type analyzes the security applications and security algorithms implemented on FPGA chips, and the second type analyzes the configuration decryption circuits within FPGA chips.

Research on the first type dates [65,66,67,68] to at least 2003. However, regarding the main topic of this article, we focus more on the second type. According to our research, the first successful instance occurred in 2011. Moradi [69] successfully attacked the bitstream decryption module integrated in Xilinx’s VirtexII-Pro FPGA, showing that even with higher background noise compared to general ICs, the built-in cryptographic circuits of the FPGA were still vulnerable. In 2013, the research by Moradi [70] and Swierczynski [71] used it to crack Altera’s Stratix II and Stratix III series FPGAs. In 2016, Moradi [72] cracked the decryption modules of Xilinx 5, 6, and 7 series FPGAs through electromagnetic side-channel analysis. In 2021, Hettwer [73] conducted side-channel analysis on UltraScale+.

2.2.5. Protection Measures

For Configuration Security, Interface Security, and Logic Security, the industry widely adopts high-security cryptographic algorithms to enhance security and defend against potential attacks. Setting reasonable access permissions [74,75] is also one of the effective protective measures. Physical Unclonable Functions (PUF) [76,77] has also assumed an increasingly important role in the field of FPGA security.

For Physical Security, especially to avoid Side-channel attacks, a wide variety of protective approaches have been emerging, including constant-time execution [78], masking [79,80] and circuit balancing [81]. Given the vulnerability of cryptographic circuits to timing attacks, constant-time execution is a mandatory requirement in cryptographic circuit design. Masking has been theoretically validated as an effective countermeasure against first-order and higher-order side-channel analysis. However, the programmable nature of FPGA devices introduces two key obstacles to its engineering application: first, the random numbers employed for mask generation or the masks themselves cannot be securely transmitted through the bitstream download process; second, the hardware implementation of high-quality TRNG requires significant design costs. These factors collectively limit the engineering deployment of masking technology in FPGA chip designs. Circuit balancing is relatively practical. however, the balanced design of the chip’s underlying circuits introduces significant area and power consumption overhead, which has a certain impact on chip cost and performance. However, achieving balance through logic implementation approach is highly challenging and may compromise the timing performance of the user design.

3. New Features of FPGA Security in the Era of AI

To discuss the impact of the AI era on FPGA security, we need to first consider how AI impacts the structure and applications of FPGA chips.

3.1. Changes in Architecture and Applications of FPGAs

AI technology has undoubtedly had a profound impact on the architecture and application characteristics of FPGAs. Based on extensive research, we believe this impact is mainly manifested in the following three aspects.

3.1.1. Optimization of FPGA Architecture

Microarchitecture Enhancement: To better leverage the advantages of FPGAs in accelerated computing, modern FPGA chips have enhanced their low-precision computing capabilities, added support for floating point operations, and provided abundant storage resources [82,83,84,85,86]. With higher energy-efficiency, Coarse-Grained Reconfigurable Architectures (CGRAs) are emerging as a promising technology research direction [87,88,89].

Heterogeneous Computing Platform: The integration of multiple computing units has become an inevitable development trend to meet AI algorithms’ demands for computing power, communication speed, and energy efficiency. Heterogeneous computing platforms mostly use CPUs as the control cores and GPUs or AI computing engines as dedicated computing units [1,90,91]. The heterogeneous units can be integrated into one chip or through chiplet integration [92,93].

3.1.2. Agilization of the Design Process

Open-Source and Architectural Exploration: The rapid iteration requirements of chip design have made the agile design approach and research on architectural exploration and evaluation an inevitable trend. This has created demand for open-source frameworks to model, rapidly prototype, and evaluate FPGAs [82,83,84,85,86,87,88,89,90,91,92,93,94,95], embedded-FPGAs (eFPGA) [96,97], and CGRAs [98,99,100]. Open-source projects for the documentation of FPGA architectures are models of community collaboration [70,101]. FPGA manufacturers contribute to their own open-source projects too [102]. This trend places more security responsibilities on FPGA manufacturers. However, due to their trusted status, few research efforts consider the role of FPGA manufacturers in the security model 9.

Left Shift of the Design Process: To reduce the development cost of FPGA systems, design methods such as HLS and block design have been widely adopted [103,104,105]. Shifting FPGA system design to the left reduces the hardware development cost, enabling software designers and algorithm designers to conveniently utilize FPGAs for operations such as AI acceleration. Consequently, the security verification and evaluation stages should also be shifted to the left to adapt to this trend [106].

3.1.3. Alteration of Market Model

Expansion of Market Roles: With the development of machine learning technologies, a growing number of researchers have realized that traditional application models and security patterns cannot meet the requirements of modern FPGA security analysis [12,14,15]. The currently proposed application models only analyze the security matrix from the perspective of the application side. Therefore, we incorporate the FPGA chip design and manufacturing stage into the models and repropose the market model, as shown in Figure 4. The market participants of the FPGA application model include the following:

• Supply Side: Suppliers are the core force in the FPGA market and responsible for the research, development, production, and sales of FPGA products and development EDA tools.
• Third-Party Providers: With the growth of the open-source community, third-party IP cores and open-source EDA development software have emerged, presenting more options to application developers.
• Application Side: The application side is composed of expert teams tasked with developing customized applications based on FPGAs and EDA software. The application side includes FPGA cloud services [30,107] and board-level application modes.
• Client Side: Clients purchase FPGA-based solutions for specific requirements.

More Participation of Third-Party Providers: Third-party providers play an increasingly crucial role in the FPGA ecosystem. Third-party IP cores [102] enable quick function integration into FPGA designs. Open-source EDA development software [108,109,110], on the other hand, offers an alternative to the proprietary tools provided by FPGA manufacturers. These offerings not only benefit small-scale developers but also encourage the development of new design techniques within the FPGA community.

Summarizing the structural features, application characteristics, application models, and market participants of FPGAs facilitates a more targeted analysis of FPGA security. It allows for a more efficient organization of existing research findings, leading to more accurate conclusions. In the subsequent sections, we will conduct a comprehensive review of FPGA security research in the era of AI.

3.2. FPGA Security in the Era of AI

By reviewing the articles on FPGA security research, we summarize the recent research trends regarding the main threats that FPGAs face, as shown in Figure 5.

3.2.1. Heterogeneity Challenges

Heterogeneous architectures challenge common assumptions about isolation and security boundaries. They require security mechanisms to protect interactions between different heterogeneous components.

In addition, attacks propagate through heterogeneous devices. The AXI communication bus inside the SOC-FPGA architecture [111] could be exploited by attackers. Covert channels between independent devices have been detected [112]. Attacks may launch an attack from FPGA to CPU and vice versa. Ref. [113] demonstrates that the embedded processor core is vulnerable to voltage drops generated by the FPGA logic. Ref. [114] shows that the integrated platform is indeed vulnerable to prime-and-probe attacks from the FPGA targeting the CPU’s last-level cache. Refs. [60,115] highlight efficient attacks on the traditional Trusted Execution Environment (TEE). The existing trust execution environments should be upgraded.

Protection research:

Heterogeneous architectures bring risks to configuration security and interface security.

To address the risks in configuration security, Zero Trust Architecture (ZTA) should be investigated. Unlike traditional static authorization methods, ZTA does not inherently trust COTS FPGA products, enabling it to ensure the security of heterogeneous systems in scenarios where boundaries are breached [116,117,118].

To improve interface security, TEEs for FPGAs in remote computing have attracted wide attention [119,120,121,122,123]. Ref. [124] involved a provisioning service to establish trust. Ref. [125] presented a hardware/software security architecture for domain isolation in FPGA clouds.

3.2.2. Open-Source Risks

In recent years, the growth of the open-source environment has made it almost impossible for commercial FPGAs to rely on non-public bitstream structures to prevent reverse engineering, as demonstrated by project such as IceStorm [101] and X-Ray [100]. Numerous examples indicate that as long as the plaintext bitstream can be obtained, reverse engineering can be carried out [126,127]. Therefore, protecting the plaintext bitstream is key to prevention.

The agile chip design approach and open-source environments pose the risk of introducing hardware Trojans. The lightweight hardware Trojan proposed by [128] achieved an attack on an FPGA cloud platform at a relatively low cost. Additionally, research on implanting hardware Trojans into AI models implemented on single-chip FPGA accelerators is also highly active [129,130]. When activated, these HTs can result in significant degradation in inference accuracy or erroneous inference. Ref. [131] introduced several HT models proposed for the floating-point multiplier. Ref. [132] targeted specific IP cores used by processors implemented on FPGAs.

Protection research:

Logic security protection mainly relies on the hardware Trojan detection technique. Hardware Trojan detection through neural network algorithms can overcome difficulties such as the small size and strong concealment of HTs [133,134,135,136,137]. Several AI algorithms are employed, such as GNN or GCN. HT detection on FPGA SoC [138,139,140] or CGRA [141] is attracting growing attention. Another HT detection technique is run-time detection through electro-magnetic (EM) radiation [142,143,144] or power-supply noise monitoring [145].

3.2.3. Cloud Platform Remote Attacks

Heterogeneous computing platforms, along with cloud platform owners and tenant clients, promote remote attacks. High-speed communication interfaces, such as PCIE in distributed embedded systems [146,147] and shared power channels [112], all pose risks of information leakage. Modern shared-FPGA systems are vulnerable to side-channel attacks or fault injection attacks even without physical access [148,149,150,151,152,153,154]. ML algorithms implemented by FPGA acceleration have emerged as significant targets of remote attacks, including their structures, intermediate parameters, and computational results [155,156,157].

These remote attacks can reconstruct the layer and hyper-parameter sequence of neural networks, extract secret keys, or compromise data transfers.

Protection research:

Leakage caused by remote attacks has drawn the attention of researchers in physical security protection technologies.

Ref. [158] introduced “soft protection” against side-channel attacks at the logical level. Additionally, technologies have emerged for side-channel protection by utilizing the routing algorithms of EDA tools [159], dynamic power prediction [160], simulation methodology [161] and the unique dynamic reconfigurable characteristics [162] of FPGAs.

4. Security Measures of FPGA Manufacturers

Although the research on protection measures on the application side is of great importance, we believe that FPGA manufacturers play a fundamental role. Initially, FPGA chips did not integrate favorable protection technologies to ensure the security of user designs during the interview process. With the increasing awareness of FPGA security, FPGA chip manufacturers have integrated encryption algorithms and other security measures in the configuration module to ensure the security of user designs.

4.1. Traditional Security Measures of COTS FPGAs

4.1.1. Resist Configuration Security Threats

FPGA chip manufacturers do not adopt special methods to protect the bitstream from being accessed. Instead, they use cryptographic algorithms to ensure the security of user designs and resist the risks of reverse engineering.

The FPGA chips prior to the Xilinx Virtex series did not employ cryptographic technologies. Starting from the Virtex-II series launched in 2001, cryptographic algorithms were integrated to protect user designs. The Virtex4 and Virtex5 series [163,164] of FPGAs integrated the AES-256 algorithm. Beginning with the Xilinx 7 series of FPGAs, an authentication mechanism was added [165]. The Ultrascale+ series of FPGAs changed the HMAC authentication mechanism of the 7 series to the RSA authentication mechanism [166] and changed the mode from CBC to GCM to further enhance the security performance.

Intel Corporation (formerly Altera Corporation) also uses the AES algorithm as the main cryptographic algorithm. The AES encryption algorithm modes used in Intel’s modern FPGA products are shown in the following table [75]. For older devices prior to 40 nm, such as Cyclone III LS, only BBRAM is provided for key storage, while for devices after 40 nm, both volatile and non-volatile key storage are available.

Compared with the top two mainstream SRAM-based FPGA chip manufacturers, the cryptographic algorithms applied by Lattice and Microchip (formerly Microsemi) are more flexible.

In 2019, Lattice added an unchangeable security module to MachXO3D. This module provides a hardware root of trust and pre-verification encryption functions, such as the ECDSA algorithm, the ECIES-integrated encryption scheme, the AES-256 encryption algorithm, the HMAC authentication algorithm, etc. [167]. Since the Nexus technology platform was launched in 2019, FPGAs such as Certus-NX, CrossLink-NX, and Certus Pro-NX based on Nexus have been using the AES-256 algorithm, the HMAC authentication algorithm, and the ECDSA algorithm, etc. to ensure security.

Table 2. Security measures used in COTS FPGA products.

Threat Domain	Security Measure Summary	FPGA Manufacturers		Security Measures
Configuration Security	Cryptographic algorithms and authentication mechanisms	Manufacturers	Device	Security Method
		Xilinx	28 nm [165]	AES CBC + HMAC
			14 nm [166]	AES GCM + RSA
		Intel [75]	40 nm	AES CTR
			28 nm	AES CBC
			20 nm	AES CTR + HMAC
		Lattice [167]		e
		Microchip [168,169]		AES + SHA + HMAC + ECDSA
Interface Security	Access rights of readback ports	Intel [75]	20 nm	The control function of access rights to the JTAG port
		Microchip [74]		Verification mechanism for disabling readback debugging
Physical Security	Various measures	Xilinx	14 nm [166]	Pre-authentication, rolling keys, and internal self-authentication
			PSoC [170]	ARM TrustZone
		Intel	PSoC [171]	Software Guard Extensions (SGX)
		Lattice [172]		Hardware root of trust (HRoT) functions
		Microchip [168,169]		Key-tree derivation algorithm
Logic Security	EDA tool	Microchip [74]		DesignShield development tool

shows the security measures used in COTS FPGA products.

Microchip’s PolarFire series FPGAs support multiple encryption algorithms, including AES128/192/256, SHA2-224/256/384/512, HMAC authentication algorithm, RSA/DSA, and ECDSA digital signature algorithm [168]. SmartFusion2 and GLOO2 series FPGAs have a built-in SHA-256 engine to protect data security [169]. Microchip is the only FPGA supplier that provides an encryption mechanism for the key. In the IGLOO2 series, the keys are even mandatorily encrypted, establishing a mandatory mechanism of using keys to load keys [172]. In addition, Microchip does not store key values directly. Instead, it adopts an SRAM-PUF technology called Intrinsic-ID™. When powered, it uses the PUF to dynamically reconfigure the keys, thus eliminating the possibility of directly reading the keys.

4.1.2. Resist Interface Security Threats

The readback mechanism can directly obtain the bitstream, which undoubtedly poses a security risk. Almost all companies turn off readback port when users choose to use the encrypted configuration mode, including Xilinx, Intel, and Lattice. When applying the encrypted mode, Intel’s 20-nm FPGAs further added the control function of access rights to the JTAG port [75].

Only Microchip’s FPGAs provide a verification mechanism for disabling readback debugging. When the code stream is encrypted, Microchip’s FPGAs use the “lock-bits” configuration to control whether to disable the readback debugging function, and the “lock-bits” can only be configured when the correct key verification is successful [172].

4.1.3. Resist Physical Security Threats

After the capabilities and the substantial threats were reported [69,70,71,72], side-channel attacks began receiving attention from manufacturers. Xilinx adopted multiple means, such as pre-authentication, rolling keys, and internal self-authentication in the Ultrascale+ series, to enhance protection against DPA [166]. Lattice provided protection against side-channel attacks through Hardware Root of Trust (HRoT) functions that comply with industry standards and are encryption-agile and customizable [172]. These functions have been applied in new devices of each generation after MachXO3D. Microchip’s FPGAs use the key-tree derivation algorithm to provide DPA protection capabilities, and the key-tree derivation algorithm is available on devices with advanced security features enabled [168,169].

4.1.4. Resist Logic Security Threats

Microchip Corporation launched the DesignShield development tool [172] in 2021, thereby reducing the risks of cloning attacks, intellectual property theft, reverse engineering, or malicious Trojan intrusions. No defense measures against hardware Trojans have been found for other companies.

4.2. Securing the AI Era: Necessary Measures

FPGA manufacturers have been implementing various security measures for FPGAs and FPGA systems. However, it is not enough in the AI Era.

Table 3. The limitations of the current measures.

Manufacturers	Device	Security Measures	Defense Effect	Bypass Approach
Xilinx	28 nm [165]	AES CBC + HMAC	Mainstream anti-cloning and anti-tampering capabilities	StarBleed vulnerability [41] Side-channel analysis [72]
	14 nm [166]	AES GCM + RSA	Better anti-cloning and anti-tampering capabilities	GHASH-based checksum and authentication downgrade attacks [42]
		Pre-authentication, rolling keys, and internal self-authentication	DPA resistance	Side-channel analysis [73]
	PSoC [170]	ARM TrustZone	Heterogeneous SoC protection	Third-party IP attacks [173] Software-based side-channel attacks [174] Hardware Trojans [60]
Intel [75]	40 nm	AES CTR	Mainstream anti-cloning and anti-tampering capabilities	Side-channel analysis [175]
	28 nm	AES CBC
	20 nm	AES CTR + HMAC
		The control function of access rights to the JTAG port	Debug interface protection	\
	PSoC [171]	Software Guard Extensions (SGX)	Heterogeneous SoC protection	Fault injection attack [115] Software-based side-channel attacks [174]
Lattice [167]		AES + HMAC + ECDSA	Anti-cloning and anti-tampering capabilities	Side-channel analysis [176]
		Hardware root of trust (HRoT) functions	DPA resistance
Microchip		AES + SHA + HMAC + ECDSA [168,169]	Anti-tamper	\
		Verification mechanism for disabling readback debugging [172]	Reverse engineering protection	Backdoor for accessing FPGA configuration [177]
		Key-tree derivation algorithm [168,169]	Data security through system service	\
		DesignShield development tool [172]	Anti-HT

summarizes the limitations of the current measures and the existing bypass approaches. Among these, research on Lattice and Microchip FPGAs is relatively scarce, but this does not mean their security measures are unbreakable. From the summary in Table 3, we can identify three key deficiencies in the security strategies of COTS FPGA devices: Trusted Execution Environments need to be upgraded; hardware Trojan detection tools are absence; side-channel protection mechanisms should be strengthened. In the following sections, we will detail our reflections on these three key deficiencies.

4.2.1. Trusted Execution Environment Upgrade

Ref. [115] evaluated the security of the current TEEs and demonstrated their insufficient security.

To address the growing security issues faced by heterogeneity architectures, SoC-FPGA security frameworks, named FPGA-TrustZone [170] and SGX-FPGA [171], were published. Today, offensive and defensive technologies are in a state of constant evolution. Security frameworks to solve the security problems of heterogeneous computing platforms require continuous attention and enhancement.

4.2.2. Hardware Trojan Detection Tools

The threat posed by HTs should not be neglected. Tools can automatically insert HTs into user designs without any a priori knowledge [58,178]. Third-party IPs can also be carriers of HT. Integrating HT detection tools into EDA development flow is a viable and economical solution.

HT detection technology applicable to the EDA process includes logic testing [134,135,136,137,179] or formal verification [180,181,182,183]. However, few manufacturers provide tools [172,184] for hardware Trojan detection in their development environments.

Automating the HT detection flow by integrating detection tools into EDA toolchains remains an important task. The inclusion of such verification steps in the development workflow not only improves efficiency but also ensures that security considerations are addressed early in the FPGA design process.

4.2.3. Side-Channel Protection Mechanisms

Current protection measures used in COTS FPGA products include advanced cryptographic algorithms. Attackers always find a way to carry out successful attacks. Ref. [72] revealed the full 256-bit key with 2000–200,000 traces. Ref. [73] recovered part of the key with less than 50 encryptions.

To improve protection ability, new efficient algorithm [73] is published which is suitable for FPGA chips design scenarios with high requirements for both performance and security. This paper designs a finite field GF(2³²) multiplication algorithm, and implements an efficient and highly secure FPGA configuration Bitstream decryption authentication method based on the AES256 cryptographic algorithm in CTR mode and the finite field GF(2³²) multiplication operation.

In addition, protection or detection schemes compatible with EDA are cost-effective and practical. Refs. [185,186] describe tools that to against side-channel attacks. Side-channel leakage detection [187,188] provides automate ways to aware side-channel attacks in the early design stages. Refs. [159,189] utilize routing process of FPGA development flow. FPGA manufacturers could consider to deploy such detection or protection measures into the development environments to provide a viable approach for users to evaluate their designs.

5. Experiments

To comprehensively validate the discussions presented in Section 4, two representative experimental studies were conducted, each targeting a distinct but complementary aspect of FPGA security.

The first set of experiments (Section 5.1) focused on hardware Trojan detection, aiming to evaluate the feasibility and accuracy of integrating intelligent detection algorithms—specifically, graph-based learning approaches such as GCN + GraphSMOTE—into FPGA electronic design automation (EDA) workflows. This section emphasizes how AI-driven techniques can enhance the reliability of FPGA design verification and early-stage trust evaluation.

The second set of experiments (Section 5.2) investigated side-channel resistance in cryptographic modules, assessing the effectiveness of improved AES-based bitstream decryption architectures under correlation power analysis (CPA). These tests aimed to demonstrate that appropriate algorithmic selection and microarchitectural countermeasures can substantially raise the security threshold of configuration circuits.

Together, these experiments provide practical verification of the protection strategies discussed earlier, illustrating both design-time (Trojan detection) and run-time (side-channel protection) perspectives on strengthening FPGA trustworthiness in the AI era.

5.1. Hardware Trojan Detection Experiments

To evaluate the effectiveness and reproducibility of the proposed hardware Trojan detection approach, we conducted a series of experiments based on Trust-Hub benchmarks. The experimental workflow follows the same architecture as that integrated into the HT-FDS (HongTu FPGA Design Suite) environment described earlier, comprising netlist conversion, feature extraction, dataset balancing with GraphSMOTE, and graph-based classification with GCN [184]. The current detection module has been completely redesigned based on a graph neural network framework, replacing earlier clustering-based methods to achieve better adaptability and generalization.

5.1.1. Dataset and Partitioning

The experiments used all gate-level and RTL-level Trojan benchmarks publicly available from Trust-Hub, covering multiple circuit families, such as RS-232, PIC16F84, and MC8051. For each circuit, the corresponding clean and Trojan-infected versions were synthesized into netlists using the HT-FDS synthesis engine.

Each dataset was randomly split into 70% for training, 15% for validation, and 15% for testing, ensuring that Trojan and normal nodes were proportionally distributed across subsets. To ensure statistical robustness, the experiments were repeated five times with different random seeds, and average values were reported.

5.1.2. Feature Extraction and Graph Construction

After synthesis, the netlist was transformed into a graph, where nodes represent logic cells (LUTs, flip-flops, multiplexers, etc.), and edges represent signal connections.

For each node, a feature vector was constructed comprising fan-in/fan-out counts within k-levels, number of flip-flops within k-levels (FF_in_x, FF_out_x), minimum distance to primary inputs and outputs (DPI, DPO), loop count (LOOP_x), and number of multiplexers and inverters (MUX_x, INV_x).

These features were automatically derived from the connectivity graph using the internal parser of HT-FDS and then normalized to zero mean and unit variance before training.

5.1.3. GraphSMOTE Balancing

As Trojan nodes typically account for less than 1% of total nodes, we applied GraphSMOTE to mitigate data imbalance. GraphSMOTE operates in the embedding space extracted by a GraphSAGE encoder, synthesizing structurally consistent minority nodes and their corresponding edges. The edge generator was trained using binary cross-entropy loss with a 0.5 threshold for edge creation, effectively preserving the circuit’s topological integrity while achieving class balance.

5.1.4. GCN-Based Classification and Training Details

The balanced graphs were fed into a two-layer Graph Convolutional Network (GCN). The first layer contained 64 hidden units with ReLU activation, followed by a dropout rate of 0.3 to prevent overfitting. The output layer used softmax activation for binary classification.

The model was trained for 200 epochs using the Adam optimizer (learning rate = 1 × 10⁻³, weight decay = 5 × 10⁻⁴) and cross-entropy loss as the objective function. All experiments were implemented in PyTorch Geometric (v2.4) and executed on an NVIDIA RTX 3090 GPU.

5.1.5. Evaluation Metrics and Baselines

Detection performance was evaluated using the True Positive Rate (TPR), True Negative Rate (TNR), and F1 score. Baseline models for comparison included GraphSAGE [190], Random Forest (RF) [191], and R-HTDetector [192], as well as several approaches discussed in Section 4.2.2, such as LUT-level detection methods [134], neural networks and logistic regression models [135], and Explainable Graph Neural Networks (XGNNs) [136].

As summarized in

Table 4. Comparison of hardware Trojan detection methods on Trust-Hub benchmarks. (The GCN + GraphSMOTE approach outperforms other methods.).

Method	True Positive Rate (TPR)	True Negative Rate (TNR)	F1 Score
GCN + GraphSMOTE [184]	96.1%	94.0%	88.1%
GraphSAGE [190]	92.9%	99.8%	86.2%
Random Forest [191]	63.6%	100.0%	77.8%
R-HTDetector [192]	96.8%	94.5%	59.9%
LUT-Level Detection Methods [134]	98.4%	100.0%	99.5%
Neural Networks and Logistic Regression [135]	86%	-	-
XGNNs [136]	98.8%	98.7%	99.2%

, the evaluated methods exhibit different balances between true- and false-positive control. The GCN + GraphSMOTE method achieves relatively consistent results (TPR = 96.1%, TNR = 94.0%, F1 = 88.1%), representing a typical graph-based solution rather than an optimized one, and therefore, serves mainly as a reference for later comparative analysis.

Overall, these observations suggest that graph-based models provide a viable way to represent circuit structures and information flow in hardware Trojan detection. However, their performance remains closely tied to data balance, feature design, and training scale, which highlights the continuing need for more generalizable and interpretable detection frameworks.

5.2. Side-Channel Evaluation of AES-CTR-GCM Decryption

To validate the resistance of improved configuration bitstream decryption architectures against first-order side-channel attacks, we performed illustrative correlation power analysis (CPA) tests on representative FPGA implementations of AES-based modules.

Three variants were examined:

(1)

A conventional AES-256 implementation in CBC mode;

(2)

The AES256_CCM pipelined design proposed in [193].

5.2.1. Experimental Setup

The AES256_GCM pipelined design is shown in Figure 6. It employed the AES256_CTR algorithm for the decryption implementation and the GHASH32 algorithm for the authentication module. To enhance hardware efficiency, a four-stage pipeline design strategy is employed in the AES256_CTR circuit as is shown in Figure 7. The Authentication Circuit using GMAC_GF32 algorithm using only 253 LUTs. The 4-stage pipelined AES256_CTR design consumes more resources.

All modules were developed in Verilog and synthesized using Xilinx Vivado 2021 targeting a Sakura X FPGA, the overall resource utilization (including LUTs, flip-flops, BRAMs) is presented in Figure 8. The AES256_GCM design can operate stably at a clock frequency ranging from 10 MHz to 200 MHz. For security testing here, both AES256_GCM design and AES256_CBC design are set to run at 50 MHz. The Power traces were captured through the on-board shunt resistor using a high-bandwidth differential probe connected to a 500 MS/s digital oscilloscope, with 10,000 sample points per trace.

A single-shot trigger was generated by an I/O strobe at the beginning of each decryption cycle. To reduce noise, each measurement was averaged over multiple acquisitions, and all tests were carried out under constant supply voltage and temperature. These parameters allowed reproducibility and provided a controlled environment for comparing algorithmic resistance.

5.2.2. Attack Method

All variants were analyzed using the standard Hamming-weight CPA model targeting the InvSubBytes operation of the final round.

We conducted simulations using standard test vectors provided by NIST, and the functional correctness of the cryptographic circuit was verified through these simulations. Simulations were performed using NIST standard test vectors with an initial 256-bit key of 603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4. Figure 9 presents the simulation results of the first and second blocks, demonstrating that the cryptographic circuit can correctly decrypt multiple data blocks. Power consumption collection involves transmitting and receiving plaintext-ciphertext pairs via the serial port. Serial port data confirms that GMAC_GF32 algorithm does not affect decryption functionality. Figure 10 illustrates examples of measured power consumption curves, from which it can be clearly observed whether power leakage exists.

For the AES-CBC target, 5000 ciphertext-triggered traces produced clear correlation peaks (maximum ρ ≈ 0.42), enabling full last-round byte recovery. In contrast, the AES256_GCM pipelined design—with four pipeline stages, parallel S-Box organization, and a GF(2³²) authentication multiplier—showed strong suppression of data-dependent leakage. Even with 100,000 traces, the maximum absolute correlation remained near the noise floor (≈0.08), and no key bytes were recovered.

5.2.3. Discussion

The results, summarized in

Table 5. CPA comparison: Traces are ciphertext-triggered; correlation values represent maximum absolute Pearson correlation observed for the correct hypothesis at the tested byte.

Target Implementation	Traces Used	Max Observed Correlation	Key Recovered?
AES-256 (CBC, conventional)	5000	0.42	Yes
AES256_CTR + GMAC_GF32 (pipelined, as in [193])	100,000	0.08	No

, illustrate that the combination of counter-mode operation, pipelining, and integrated GMAC_GF32 authentication materially increased resistance to first-order CPA without compromising functional throughput. The measurements serve as an illustrative proof-of-concept, demonstrating that algorithmic and microarchitectural co-design can significantly enhance the protection of FPGA configuration decryption paths.

6. Conclusions and Future Prospects

The development of AI technology has influenced FPGAs and the entire integrated circuit industry. To keep pace with this rapid development, the FPGA industry technology is evolving in several ways. It achieves greater computing power and higher efficiency by exploring architectural optimization and expands the computing power boundary by embedding other computing chips or modules. Moreover, the design level is left-shifted, and more IP cores are introduced, which makes the development environment more convenient for algorithm engineers. During the lifecycle of FPGAs, the supply side plays a more crucial role.

Therefore, it is necessary to re-evaluate the security features of FPGA in the AI era.

In this paper, we have summarized the new application models and security patterns of FPGAs in the AI era. The optimization in FPGA architecture, changes in the application process, and the alterations in the application model led to more attack channels, diverse attack methods, and higher protection difficulty. FPGA manufacturers need to adopt relevant protection measures from the perspective of protecting the interests of end users. Additionally, FPGA manufacturers should promote FPGA product safety standards and security testing standards to standardize FPGA security. Establishing security verification and risk inspection mechanisms for chip manufacturing and improving the FPGA application development workflow can enhance the overall security of the FPGA system.

In the future, it is clear that FPGAs will play a more important role and drive potentially more significant changes. Tracking these changes, actively seeking countermeasures, and researching corresponding security technologies will be the focus of our future work.