{"id":"fe9c8298-3f9b-42c5-a319-4f8399f21e06","arxiv_id":"2606.25589","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":5.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"Gradient leakage attacks on GNNs for netlist benchmarks can expose gate types and Trojan properties; attention-based models leak more while defenses like differential privacy help only in limited cases without full performance preservation.","lead":"This paper evaluates gradient leakage attacks on graph neural networks used for circuit design and hardware security tasks. It finds that such attacks can reveal gate types and hardware Trojan properties, with architecture affecting leakage and common defenses offering only partial protection.","discovery_kind":"unclear","skeptic_critique":{"model":"grok-4.3","headline":"Standard academic netlists (ISCAS'85/EPFL/TrustHub) may not capture scale, structure, or deployment settings where gradient access enables practical Trojan/gate recovery.","rationale":"The reader's weakest assumption directly identifies the same representativeness gap that underpins whether the observed leakage translates to real hardware-security risk. No stronger internal inconsistency (e.g., in the attack math or defense evaluation) is visible from the supplied material.","tokens_in":1750,"tokens_out":326,"duration_ms":13830,"concrete_test":"Re-train the reported GNNs on a modern industrial netlist (≥100k gates, e.g., from OpenROAD or a public large-scale TrustHub extension) under the same GLA protocol; if gate-type or Trojan-property reconstruction F1 drops below 0.6 or requires gradient access not present in typical design flows, the headline claim weakens.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires that GLA-derived reconstructions of gate types and Trojan properties are both accurate and actionable for adversaries analyzing logic locking or evading detection. The evaluation is confined to small, decades-old academic benchmarks whose graph sizes, feature distributions, and connectivity differ markedly from contemporary industrial netlists. In addition, the implicit threat model (gradient sharing during GNN training) is not shown to map onto actual circuit-design workflows, where models are typically trained locally or under different access controls. If reconstruction fidelity collapses on larger or differently structured graphs, or if the assumed gradient exposure never occurs in practice, the security implications do not follow.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The manuscript presents the first comprehensive evaluation of gradient leakage attacks (GLAs) on GNNs (GraphSAGE, GCN, GIN, GAT) for circuit-design and hardware-security tasks. Trained on standard netlist benchmarks (ISCAS'85, EPFL, TrustHub), the GNNs are shown to leak sensitive information including gate types and hardware-Trojan properties via gradients, potentially aiding adversaries in logic-locking analysis or Trojan evasion. Architectural differences are reported (attention mechanisms increase leakage; injective aggregation improves resilience), and several SOTA defenses (differential privacy, gradient clipping, secure aggregation, quantization, adversarial training) are tested, with the finding that they help only in specific settings and can degrade model performance. The authors release full methodology and artifacts.","tokens_in":1860,"tokens_out":555,"duration_ms":22676,"significance":"If the empirical claims hold, the work is significant for surfacing an overlooked privacy vector in GNN-based netlist analysis, an area of growing practical use. Explicit architecture comparisons and the multi-defense evaluation supply concrete guidance. The public release of methodology and artifacts is a clear strength that supports reproducibility. The overall significance is reduced by the narrow benchmark set and threat-model assumptions, which limit direct translation to contemporary industrial settings.","major_comments":[{"comment":"§4 (Experimental Setup) and §5 (Results): the central claim that GLAs expose actionable information for logic-locking or Trojan evasion rests on reconstruction fidelity observed only on the small, decades-old ISCAS'85/EPFL/TrustHub graphs; no scaling study or comparison against contemporary industrial netlists is provided, leaving open whether the reported leakage remains exploitable at realistic sizes and connectivity distributions.","section":"§4 and §5"},{"comment":"§3 (Threat Model): the implicit assumption that gradient access occurs during GNN training on proprietary netlists is not mapped to actual circuit-design workflows or access-control practices; without this mapping the security implications do not follow from the reported experiments.","section":"§3"}],"minor_comments":[{"comment":"Notation for gate-type and Trojan-feature recovery metrics is introduced without an explicit equation or table reference in the main text; a single clarifying equation would improve readability.","section":"§5"},{"comment":"The abstract states that defenses 'can also compromise model performance,' but the corresponding tables do not report the magnitude of accuracy drop relative to the undefended baseline; adding these deltas would strengthen the comparison.","section":"§6"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive feedback. We address each major comment point-by-point below, providing the strongest honest defense of the manuscript while acknowledging its limitations. Revisions have been made where the comments identify areas for improvement.","responses":[{"response":"We agree that the evaluation is confined to the standard public benchmarks (ISCAS'85, EPFL, TrustHub) commonly used in GNN-for-circuits research, which are smaller than contemporary industrial netlists. These datasets were selected to ensure reproducibility and comparability with prior work on netlist analysis. The results demonstrate that leakage occurs on these graphs, supporting the core claim within the evaluated setting. We have added a dedicated Limitations subsection in the revised Discussion section that explicitly notes the benchmark-size constraint and the need for future studies on larger graphs with different connectivity distributions. A full scaling study could not be performed because large-scale proprietary netlists are not publicly available.","revision_made":"partial","referee_comment":"[§4 and §5] §4 (Experimental Setup) and §5 (Results): the central claim that GLAs expose actionable information for logic-locking or Trojan evasion rests on reconstruction fidelity observed only on the small, decades-old ISCAS'85/EPFL/TrustHub graphs; no scaling study or comparison against contemporary industrial netlists is provided, leaving open whether the reported leakage remains exploitable at realistic sizes and connectivity distributions."},{"response":"We have revised Section 3 to include an explicit mapping of the threat model to realistic circuit-design workflows. The updated text now describes concrete scenarios such as outsourced cloud-based GNN training for netlist classification, federated learning among design teams, and use of third-party ML services, where gradient access can occur despite typical access controls. These additions directly connect the experimental setup to practical security implications.","revision_made":"yes","referee_comment":"[§3] §3 (Threat Model): the implicit assumption that gradient access occurs during GNN training on proprietary netlists is not mapped to actual circuit-design workflows or access-control practices; without this mapping the security implications do not follow from the reported experiments."}],"tokens_in":1472,"tokens_out":487,"duration_ms":23868,"standing_objections":["Performing scaling studies or direct comparisons on contemporary industrial netlists, which are proprietary and not publicly accessible."]},"desk_editor":{"model":"grok-4.3","letter":"The core takeaway is that this is the first paper to run gradient leakage attacks on GNNs trained for hardware tasks like netlist classification and Trojan detection. They train GraphSAGE, GCN, GIN and GAT on ISCAS'85, EPFL and TrustHub circuits, recover gate types and some Trojan properties from gradients, note that GAT leaks more while GIN leaks less, and test a handful of defenses that only partially help and often hurt accuracy. They also release the code and artifacts.\n\nWhat stands out is the direct application to circuit security and the coverage of multiple architectures plus defenses in one place. The release of methodology is useful for anyone who wants to reproduce or extend the experiments.\n\nThe soft spots are the benchmarks and the threat model. ISCAS'85 and similar sets are small, decades-old academic examples whose size, structure and feature distributions differ from current industrial netlists. It is not shown whether the reported leakage remains accurate or actionable at larger scales or under the access patterns that actually occur in chip design workflows, where models are often trained locally. The abstract frames the work as identifying a practical risk, but without evidence that the attack succeeds outside these limited settings the security implications stay provisional.\n\nThis is mainly for people already working at the intersection of GNNs and hardware security who want to see an initial data point on leakage in this domain. It deserves a serious referee because it flags a concrete risk area that needs checking, even if the current results are scoped to standard academic benchmarks.","headline":"Paper claims first evaluation of gradient leakage on GNNs for circuit netlists, shows some leakage of gate types and Trojans on small benchmarks, but the practical threat model and benchmark relevance remain open questions.","tokens_in":2320,"tokens_out":393,"would_cite":false,"duration_ms":14227,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Gradient leakage attacks on graph neural networks for circuit netlists can reveal gate types and hardware Trojan properties.","keywords":["gradient leakage attacks","graph neural networks","circuit design","hardware security","netlist analysis","logic locking","hardware Trojans","privacy"],"falsifier":"An experiment showing that gradients leaked from these GNNs on realistic netlists allow no better than random reconstruction of gate types or Trojan properties would falsify the claim.","tokens_in":2649,"feed_emoji":"🔓","tokens_out":616,"duration_ms":17556,"temperature":0.7,"pith_summary":"This paper evaluates how gradient leakage attacks affect state-of-the-art graph neural networks applied to circuit design and hardware security tasks on standard netlist benchmarks. It shows that the attacks can extract sensitive details including logic gate types and distinctive features of hardware Trojans embedded in the circuits. Architectural differences matter: attention mechanisms increase leakage while injective aggregation offers more resistance. Common defenses such as differential privacy and gradient clipping provide only partial or context-specific protection and can reduce model accuracy. The work establishes that these privacy risks are real for GNNs used in hardware analysis and calls for better safeguards.","feed_headline":"Gradient leaks from GNNs reveal circuit gate types and Trojans","feed_subtitle":"Attacks recover hardware features from netlist models, with attention architectures leaking more and standard defenses offering only partial","key_machinery":"Gradient leakage attacks that reconstruct sensitive input features from model gradients on graph representations of circuit netlists.","core_discovery":"Gradient leakage attacks can expose sensitive information such as gate types and distinctive properties of hardware Trojans from GNNs trained on netlist benchmarks, which may assist adversaries in analyzing logic locking schemes or evading Trojan detection mechanisms. Risks are higher for attention-based models like GAT and lower for injective models like GIN. Standard defenses improve resilience only in specific settings and often trade off against model performance.","pith_inferences":["Circuit designers may need to select GNN architectures with privacy in mind rather than solely for accuracy.","The leakage pattern observed here could appear in other graph-based hardware analysis tasks beyond the tested benchmarks.","New defenses that preserve both privacy and accuracy for netlist graphs may be required beyond current general techniques."],"forward_implications":["Adversaries could use recovered gate types to analyze and defeat logic locking schemes.","Distinctive Trojan properties recovered via leakage could help evade existing Trojan detection methods.","Attention-based GNN architectures leak more than injective aggregation architectures.","Differential privacy, gradient clipping, and similar defenses only mitigate leakage in limited cases and can degrade task performance."],"fun_headline_variants":["GNN gradient leaks reveal circuit gate types","GNNs on nets leak Trojan features via gradients","Attention GNNs increase leakage in circuit tasks","Defenses partially reduce GNN gradient leaks"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"That the chosen state-of-the-art GNN architectures and standard netlist benchmarks adequately represent real-world circuit design and hardware-security threat models where gradient leakage would be practically exploitable.","fun_headline_variants_meta":{"raw":{"variants":["GNN gradient leaks reveal circuit gate types","GNNs on nets leak Trojan features via gradients","Attention GNNs increase leakage in circuit tasks","Defenses partially reduce GNN gradient leaks"]},"model":"grok-4.3","cost_usd":0.007645,"raw_usage":{"total_tokens":3514,"prompt_tokens":697,"num_sources_used":0,"completion_tokens":56,"cost_in_usd_ticks":76449500,"prompt_tokens_details":{"text_tokens":697,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2761,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":697,"tokens_out":56,"duration_ms":19299,"temperature":1.0,"reasoning_tokens":2761,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-25T21:07:27.167998+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"An experiment showing that gradients leaked from these GNNs on realistic netlists allow no better than random reconstruction of gate types or Trojan properties would falsify the claim.","supporting_citations":[],"review_version":1}