{"id":"6ec7aa23-11c6-4132-b7c2-da798b7c7205","arxiv_id":"2504.19418","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A fully digital, FPGA-based framework that detects interposer tampering and hardware Trojans in neighboring chiplets by sensing impedance fluctuations on the shared power delivery network.","lead":"ChipletQuake uses sensors already inside an FPGA to measure tiny voltage changes on the chip's power network, letting one chiplet check whether a neighboring chiplet or the interposer has been tampered with. It could help hardware teams verify that chiplets purchased from outside suppliers have not been altered with hidden circuits.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The headline claim that dormant, passive, tiny Trojans are detectable is untested: every positive case study measures an active or large-scale change, so the SNR premise for unactivated circuits remains unsupported.","rationale":"I read the paper in good faith: the sensing concept is plausible, the implementation on a chiplet-based FPGA is concrete, and the negative controls show that identical designs stay within the reported similarity band. The internal logic of the framework does not contain an obvious mathematical error. However, the central claim that ChipletQuake detects dormant, passive, and tiny malicious circuits is precisely what the experiments do not test. The positive cases are an active power-modulating Trojan, a four-SLL routing utilization difference, and an IP placement change; each changes utilization, activity, or layout at a scale far larger than a small unactivated logic modification. The abstract, Section I, Section III-B, Section VI-A, and Section VII repeatedly assert detection of dormant static circuits, but no measurement with an unactivated circuit is provided. This is the load-bearing premise because the entire security value proposition over prior dynamic side-channel methods rests on detecting passive modifications. The reader identified the same gap in the weakest_assumption field, and the fix is straightforward: run a controlled experiment with a truly dormant circuit and report corrected false-positive behavior. Given that the evidence is internally consistent but incomplete, the CONDITIONAL verdict remains appropriate, and I recommend no change to the reader's verdict.","tokens_in":11538,"tokens_out":3069,"duration_ms":34533,"concrete_test":"Synthesize two bitstreams for SLR1 that are identical except for a small dormant circuit (e.g., 1–8 LUTs/FFs with all data and clock inputs held constant, or a Trust-Hub Trojan whose trigger is never asserted) placed at a fixed location. Run the full ChipletQuake flow with T=500–1000 traces per set, apply the same t-test/Wasserstein analysis, and correct the per-frequency thresholds for multiple testing (e.g., Bonferroni or a permutation-based family-wise error rate). If no corrected p-value or t-statistic exceeds threshold, the paper's headline claim about detecting dormant, passive, tiny Trojans is not supported; if one does, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's load-bearing premise, stated in Section I and Section III-B, is that any physical modification—'regardless of their physical size, activation, or action characteristics'—changes the shared-PDN impedance enough for an on-die TDC sensor to detect. Section III-A assumes the sensor 'accurately senses the voltage' at selected frequencies. This premise is never exercised in the evaluation. Case Study 4 uses Trust-Hub AES-T1100, whose payload modulates AES activity to create a power-consumption pattern; this is an active, power-drawing Trojan, not a dormant or passive one. Case Study 2 changes SLL utilization from 129 to 133 lines between SLR0 and SLR1; this is a routing-utilization change, not physical interposer metal insertion or probing. Case Study 3 changes placement and routing of an entire IP in SLR2, a large layout change. None of these results demonstrates that a small, unactivated, static malicious circuit in a neighboring chiplet (as claimed in the abstract and conclusion) produces a detectable impedance shift. The negative controls are also not false-positive rates: the t-statistic is reported as a maximum over many frequency bins without multiple-testing correction, so the probability of at least one cross-threshold bin under the null is not quantified. Thus the central security claim overreaches the experimental evidence.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes ChipletQuake, a fully digital framework implemented on an FPGA chiplet that estimates power-delivery-network (PDN) impedance signatures using a 2D grid of TDC sensors and inverter-chain actuators with frequency-swept excitation. The goal is post-silicon verification of adjacent chiplets and the host interposer by comparing sensed impedance traces against golden references. The evaluation uses an AMD Virtex UltraScale+ VU37P SSI FPGA with three SLRs: Case Study 1 distinguishes AES, FFT, and CNN designs on SLR1; Case Study 2 changes interposer SLL utilization from 129 to 133 lines; Case Study 3 changes placement/routing of an IP on SLR2; Case Study 4 distinguishes a Trust-Hub AES-T1100 Trojan design from a Trojan-free AES on SLR1. Distinguishability is assessed with Welch's t-test and Wasserstein distance, with reference-vs-reference negative controls.","tokens_in":11661,"tokens_out":4561,"duration_ms":48965,"significance":"If the claims hold, the paper introduces a useful, low-cost, fully digital mechanism for chiplet and interposer integrity verification, extending prior PDN-based fingerprinting and side-channel work to a security-verification setting. The strengths are the fully digital FPGA implementation, the systematic frequency-sweep design, the use of golden traces with no fitted parameters, the inclusion of negative-control experiments, and the use of a distribution-agnostic Wasserstein metric alongside the t-test. However, the central security claim about detecting dormant, passive, tiny malicious circuits is not exercised by the reported experiments, and the false-positive characterization lacks a multiple-testing correction, so the significance of the current evidence is below what the abstract and conclusion assert.","major_comments":[{"comment":"The paper's central security claim, stated in Section IV-A and repeated in VI-A and VII, is that ChipletQuake can detect dormant, passive, tiny malicious circuits without activating the target chiplet. This claim is not exercised by the experiments in Section V-F. The Trust-Hub AES-T1100 Trojan has a payload that modulates AES activity to create a power consumption pattern, so it is an active, power-drawing circuit rather than a dormant or passive one. No experiment places an unactivated, static, small malicious circuit in a neighboring chiplet, and no area, gate-count, or power-budget quantification of 'tiny' is provided. The load-bearing premise from Section I that physical modifications 'regardless of their physical size, activation, or action characteristics' alter the PDN impedance enough to be detected therefore remains unsupported by the evidence.","section":"IV-A and V-F"},{"comment":"The interposer-tampering experiment does not physically modify the interposer. Changing the number of SLL interconnections from 129 to 133 changes the utilization of programmable routing resources in the FPGA configuration, which is a logical/routing-level change rather than physical insertion of metal, removal of material, or contact-based probing. The result demonstrates sensitivity to utilization-dependent current paths, but the claim in Section IV-B that this emulates 'interposer tampering and probing' overstates what was measured. The text should either add a genuine physical-interposer tamper experiment or carefully rescope the claim to utilization changes.","section":"V-D"},{"comment":"The negative-control experiments do not quantify the false-positive rate of the decision procedure. The t-statistic is plotted over many frequency bins, and the figures appear to treat any bin exceeding |t|>4.5 as a detection, but no multiple-testing correction or family-wise error rate is reported. Under the null hypothesis, the probability of at least one bin crossing the threshold grows with the number of bins, so the observation that reference-vs-reference traces stay below the threshold at the plotted bins is not a statistically quantified reliability bound. Similarly, the Wasserstein critical values are computed per frequency point, but the overall decision rule over the frequency sweep is not defined. A precise multi-bin decision procedure and its false-positive rate are needed to support the reliability claims.","section":"V-B and Figs. 10, 13, 16"}],"minor_comments":[{"comment":"In Section IV-A, 'our treat model' should be 'our threat model'; in Section III-B, 'reply attacks' should be 'replay attacks.'","section":"IV-A"},{"comment":"Section V-D says 'Fig. 14 highlights the Wasserstein distance for interposer modification based on SLL utilization,' but Fig. 14 shows the SLR2 config1-versus-config2 result; the interposer Wasserstein result appears to be Fig. 11, so the cross-reference or figure numbering is inconsistent.","section":"V-D"},{"comment":"Reference [19] is cited for Welch's t-test, but the cited paper is about higher-order threshold implementations and does not appear to be the source of the test; please cite Welch's original paper or a standard leakage-assessment reference such as Schneider and Moradi.","section":"V-B"},{"comment":"Section III-A says the sensor records voltage fluctuations by 'accurately sensing the voltage,' but the TDC measures propagation delay, which is an indirect proxy for voltage; the wording should be adjusted to avoid overstating a direct voltage measurement.","section":"III-A"},{"comment":"Equation (1), the rectangular-cavity resonance formula, is not connected to the frequency points actually swept in the experiments; the text should state whether the frequency bands were selected using this formula or empirically, and how the cavity dimensions relate to the SSI package.","section":"III-C"},{"comment":"Several figures lack axis labels with units; for example, Fig. 8 labels the y-axis 'TDC Average Distance' without units, and the frequency-axis ranges differ across figures (e.g., 300-800 MHz in Fig. 9 versus 0-900 MHz in Fig. 12), which makes cross-figure comparison difficult.","section":"Figs. 8-17"}],"recommendation":"major_revision","confidential_remarks":"The paper presents a plausible and potentially useful sensing framework, but the headline security claims extend well beyond what the experiments demonstrate. The absence of a dormant/passive Trojan experiment and the unquantified multiple-testing issue in the negative controls are the main blockers for acceptance. If the authors rescope the claims to active or layout-level modifications and add a small passive circuit benchmark, or provide a rigorous statistical decision procedure, the contribution would be much stronger. Novelty relative to the prior PDN-impedance fingerprinting work (Silicon Echoes, PDNSig) should also be sharpened in revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: ChipletQuake is a real hardware demonstration that an FPGA SLR can detect impedance changes in neighboring SLRs and the interposer using only digital resources. The headline claim—that it detects dormant, passive, tiny Trojans—is not supported by the experiments, because every positive case measures either an active power-modulating circuit or a relatively large routing change. That gap matters, but the paper is still worth engaging with.\n\nWhat's new: prior PDN impedance sensing (Silicon Echoes, PDNSig) established the physics. The contribution here is applying it to chiplet/interposer verification with a 2D actuator/sensor grid and a challenge-response protocol using random subsets as one-time keys. That is a reasonable framing for zero-trust supply chains. The implementation is credible: 32 monitoring blocks on a Virtex UltraScale+ SSI device, fully digital, no external hardware. The negative controls are good—identical designs stay within |t| < 4.5 across the swept band, which is the right sanity check.\n\nSoft spots, in order of severity:\n\n1. The dormant/passive Trojan claim is untested. Section IV-A explicitly says no target switching activity is needed, and the abstract concludes detection of passive subtle circuits. But AES-T1100's payload modulates AES activity to create a power pattern; it is an active, power-drawing Trojan. The interposer case changes SLL utilization from 129 to 133 lines—a four-line routing difference, not a physical probe or inserted wire. Case Study 3 moves an entire IP's placement and routing. None of these approximates a small, unactivated, static malicious circuit. The SNR premise for that regime remains unsupported.\n\n2. The statistical reporting picks the maximum t-statistic over many frequency bins and reports no false-positive rate. Without multiple-testing correction, the probability of at least one bin exceeding 4.5 under the null is unknown. The Wasserstein thresholds are bootstrap-based and better, but the t-test figures should be read as maxima.\n\n3. No code or data are released, so independent reproduction is not possible. The one-time key protocol's security is asserted, not analyzed; replay resistance depends on the uniqueness of each {Act, Sen, Freq} combination, which is plausible but not formalized.\n\nThat said, the underlying sensing principle is plausible and the paper is transparent about its scenarios. The overclaim is fixable with an honest re-framing and a dormant-circuit experiment (or a clear statement that such detection is extrapolation). I would send it to review; a good referee can push for those changes.\n\nRecommendation: serious referee, conditional-accept path.","headline":"Solid digital impedance-sensing demo on chiplet FPGAs, but the dormant-Trojan headline claim outruns the active/large-change experiments.","tokens_in":12307,"tokens_out":1808,"would_cite":false,"duration_ms":18317,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Physical modifications in a chiplet package change the shared power network's impedance enough for a purely digital on-die sensor grid to detect them.","keywords":["hardware security","chiplet integrity verification","power delivery network","impedance sensing","time-to-digital converter","hardware Trojan detection","interposer tamper detection","zero-trust hardware"],"falsifier":"Insert into the target chiplet a few hundred additional gates that are never clocked and draw no switching current, then re-run the reported $|t|>4.5$ and Wasserstein comparisons against the golden reference; if the traces do not separate, the claim that passive dormant modifications are detectable collapses. The interposer claim should be tested by physically probing or cutting an interposer wire rather than changing routing utilization.","tokens_in":11228,"feed_emoji":"🛡️","tokens_out":8533,"duration_ms":82791,"temperature":0.7,"pith_summary":"The paper sets out to show that a chiplet can verify the physical integrity of its neighbors and the interposer by sensing the electrical impedance of the power delivery network they share, using nothing but digital FPGA resources. The motivating problem is a zero-trust chiplet supply chain: chiplets arrive from different vendors, and there may be no direct signal connection, so a verifier needs a physical channel that reflects what is actually present in the package. ChipletQuake answers with an on-die grid of actuators that inject current at swept frequencies and time-to-digital sensors that record the resulting voltage fluctuations; the frequency-dependent response acts as an impedance fingerprint of the neighboring hardware. The paper demonstrates that this fingerprint separates different hardware designs, a change in interposer line utilization, a placement change on a farther chiplet, and an AES core carrying a hardware Trojan from its clean version, all observed from the verifier chiplet.","feed_headline":"Digital power sensing exposes tampering in neighboring chiplets","feed_subtitle":"ChipletQuake detects dormant and passive hardware modifications using only FPGA logic already on the die.","key_machinery":"The mechanism is the shared power delivery network (PDN) used as a physical sensing channel. On the verifier chiplet, an actuator array—inverter chains driven at selected frequencies—draws current and perturbs the shared supply, while a 2D mesh of time-to-digital converters (delay lines that digitize tiny voltage-induced timing shifts) records the response. The swept frequency-dependent voltage response is treated as an impedance estimate; physical modifications change parasitic resistance, capacitance, and inductance in the PDN, shifting that estimate. The paper also selects frequencies near package/board cavity resonances, where the impedance is most sensitive to small parasitic changes.","core_discovery":"The central claim is that physical modifications to a chiplet or its interposer alter the impedance of the shared power delivery network regardless of the modification's size, activation state, or function, and that characterizing that impedance therefore reveals tampering. ChipletQuake implements the characterization with a 2D mesh of time-to-digital converters as sensors and inverter-chain actuators as current sources, all on the verifier chiplet. The verifier sweeps the actuator frequency, records the voltage response at a chosen set of sensor locations, and compares the resulting signature to a golden one; a deviation flags an integrity failure. On a three-chiplet FPGA, the paper reports that the method distinguishes AES, FFT, and CNN designs on an adjacent chiplet, detects a difference of four interposer communication lines, detects two different placement routings of the same design on a farther chiplet, and separates a Trojan-loaded AES implementation from a Trojan-free one using Welch's t-test and Wasserstein distance.","pith_inferences":["A stricter test than anything in the paper would use a physically dormant payload—extra gates that never toggle—and a physically altered interposer trace; the current experiments use a power-modulating Trojan payload and a routing-utilization change instead.","If the signatures are stable across voltage, temperature, and aging, the same impedance fingerprint could serve as an anti-counterfeit root of trust for chiplet supply chains, not just a tamper alarm.","The random selection of actuators, sensors, and frequencies suggests a possible remote-attestation primitive, but its security depends on how much per-device entropy the physical signature actually carries."],"forward_implications":["A trusted chiplet can verify adjacent chiplets and the interposer without any direct signal connection, because sensing happens through the shared power delivery network.","Dormant hardware Trojans that never switch can in principle be detected, because insertion alters the physical impedance even while the malicious circuit is inactive.","The verification can be structured as a one-time physical challenge-response: random actuator, sensor, and frequency selections yield unique impedance signatures that resist replay.","Choosing frequencies near package and board resonances concentrates sensitivity where small parasitic changes become visible to the sensors."],"supporting_citations":[{"why":"Supplies the frequency-selective impedance-analysis method and the observation that on-chip capacitance changes with tampering, which ChipletQuake extends from a single die to chiplets.","marker":"[5]"},{"why":"Introduces PDN-based impedance signatures for distinguishing chiplets, the fingerprinting idea that ChipletQuake repurposes for integrity verification.","marker":"[6]"},{"why":"Provides the time-to-digital converter design that ChipletQuake re-purposes as its on-die voltage sensor.","marker":"[12]"},{"why":"Supplies the AES hardware Trojan benchmark used in the detection case study.","marker":"[22]"},{"why":"Provides the equivalent RLC circuit model of the PDN and interposer used to frame the sensing mechanism.","marker":"[4]"},{"why":"Represents the prior system-in-package power-noise monitoring approach that requires running software anomalies, contrasted with ChipletQuake's static tamper detection.","marker":"[3]"},{"why":"Motivates the physical challenge-response authentication structure used for one-time verification keys.","marker":"[14]"},{"why":"Provides Welch's t-test metric used to decide whether impedance traces come from different populations.","marker":"[19]"},{"why":"Supplies the $|t|>4.5$ threshold used for rejecting the null hypothesis in the distinguishability tests.","marker":"[20]"}],"fun_headline_variants":["Impedance fingerprinting catches chiplet tampering","Chiplet security via power-network impedance checks","Detecting hardware Trojans with on-die impedance sensing","PDN impedance reveals interposer tampering","ChipletQuake: verifying chiplet integrity via PDN sensing"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method stands or falls on the assumption that even a small, inactive physical change in a neighboring chiplet or interposer shifts the shared power network's impedance enough for the verifier's digital delay sensors to see it above noise.","fun_headline_variants_meta":{"raw":{"variants":["Impedance fingerprinting catches chiplet tampering","Chiplet security via power-network impedance checks","Detecting hardware Trojans with on-die impedance sensing","PDN impedance reveals interposer tampering","ChipletQuake: verifying chiplet integrity via PDN sensing"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000266,"raw_usage":{"total_tokens":1622,"prompt_tokens":965,"completion_tokens":657,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":581,"completion_tokens_details":{"reasoning_tokens":579}},"tokens_in":581,"tokens_out":657,"duration_ms":6156,"temperature":1.0,"reasoning_tokens":579,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T05:52:51.422493+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Insert into the target chiplet a few hundred additional gates that are never clocked and draw no switching current, then re-run the reported $|t|>4.5$ and Wasserstein comparisons against the golden reference; if the traces do not separate, the claim that passive dormant modifications are detectable collapses. The interposer claim should be tested by physically probing or cutting an interposer wire rather than changing routing utilization.","supporting_citations":[{"cited_title":"Silicon echoes: Non-invasive trojan and tamper detection using frequency-selective impedance analysis,","cited_arxiv_id":null,"evidence_quote":"Supplies the frequency-selective impedance-analysis method and the observation that on-chip capacitance changes with tampering, which ChipletQuake extends from a single die to chiplets."},{"cited_title":"Pdnsig: Identifying multi-tenant cloud fpgas with power distribution network-based signatures,","cited_arxiv_id":null,"evidence_quote":"Introduces PDN-based impedance signatures for distinguishing chiplets, the fingerprinting idea that ChipletQuake repurposes for integrity verification."},{"cited_title":"V oltage-based covert channels using fpgas,","cited_arxiv_id":null,"evidence_quote":"Provides the time-to-digital converter design that ChipletQuake re-purposes as its on-die voltage sensor."},{"cited_title":"Hardware Trojan Benchmarks,","cited_arxiv_id":null,"evidence_quote":"Supplies the AES hardware Trojan benchmark used in the detection case study."},{"cited_title":"Analysis of power delivery network (pdn) in bridge- chips for 2.5-d heterogeneous integration,","cited_arxiv_id":null,"evidence_quote":"Provides the equivalent RLC circuit model of the PDN and interposer used to frame the sensing mechanism."},{"cited_title":"Sipguard: run-time system-in-package security monitoring via power noise variation,","cited_arxiv_id":null,"evidence_quote":"Represents the prior system-in-package power-noise monitoring approach that requires running software anomalies, contrasted with ChipletQuake's static tamper detection."},{"cited_title":"Pycra: Physical challenge-response authentication for active sensors under spoofing attacks,","cited_arxiv_id":null,"evidence_quote":"Motivates the physical challenge-response authentication structure used for one-time verification keys."},{"cited_title":"Higher-order threshold implementations,","cited_arxiv_id":null,"evidence_quote":"Provides Welch's t-test metric used to decide whether impedance traces come from different populations."},{"cited_title":"Leakage assessment methodology: A clear roadmap for side-channel evaluations,","cited_arxiv_id":null,"evidence_quote":"Supplies the $|t|>4.5$ threshold used for rejecting the null hypothesis in the distinguishability tests."}],"review_version":1}