# AI Makes Crypto Evolve
## 3 Aiuc
### AI-Unaware PUF
#### 3.3.1 ML Attacks  
In this section, we analyzed the competition between ML attack-resistant PUFs and attacks on PUFs using traditional ML algorithms.  
Some PUFs that were stated to have resistances against ML attacks were exposed. The proposed Ring Oscillator Physical Unclonable Function(ROPUF) used configurable XOR gates in the Field Programmable Gate Array [56]. These programmable XOR gates could be used for the selection of ROs during the activation period. After that, selected ROs would create a unique set of sample frequencies. Statics shows that it can only prevent attacks from Logistic Regression-based and SVM-based ML attacks. Furthermore, it failed to prevent attacks from ANNs with almost 90% accuracy for prediction.  
Similar structures were shown in the proposed article [57]. It analyzed multiple arbiter PUFs with XOR gates by using NN-based ML attacks. A subspace pre-learner estimated the NN's weights by training on CRP data in subspaces corresponding to PUF components. It demonstrated 98% accuracy for the proposed PUF. However, it requires access to CRP in subspace which is not an easy condition to meet.  
Moreover, the approach proposed in [58] used multiple ML attacks on Arbiter PUFs (APUF) on TSMC's 65 nm CMOS process. The CRPs were used again for training as in most attacks. The result shows that it can reach an accuracy of 90% when only 1000 CRPs are used for training. However, if there are two XOR gates APUF, 9000 CRPs are required to achieve an accuracy of 90%. Both results show that APUFs are not secure from modeled ML attacks. In addition, Double Arbiter PUFs (DAPUFs) were claimed to have good resistances against ML attacks. However, a study in [59] shows that they only resist attacks such as SVM but cannot prevent attacks such as NNs.  
Some of the research works focus on lightweight PUFs. In this paper [60], two mathematical attack impulses related to the previously proposed light circuits PUF, namely the composite PUF and the Light-output rhythmic Secure PUF (LSPUF), were developed. It was shown that the different PUF components can be used to separate and capture attacks, which can determine the answers to unknown challenges. Using ML-based analysis, the attack complexity was reduced.  
Additional techniques were applied to obtain a higher accuracy for the prediction of PUFs' results. An ML technique that uses the Multi-Layer Perceptron (MLP) method was proposed in the article [61]. The method used successfully broke APUFs but not XOR Arbiter PUFs. It was modified in the report with an Adaptive Moment Estimation optimizer for large CRPs. The results revealed at least 98% accuracy when predicting the response. Feed Forward APUFs (FFPUF) possess advantageous properties such as good resistance for ML attacks. They also have low complexity compared to other PUFs. In order to break this PUF, the MLP method was used again [62]. The accuracy for the NN that using MLP was above 84%. Therefore, it increased accuracy by 16% compared to regular NNs.  
Time-Delayed PUFs were also examined by others. For instance, another paper [63] investigated the delay model of the Hardware-Embedded Layout PUF (HELP) and applied ML algorithms to determine resilience to the built-in model. The delay model for HELP includes significant differences compared to other PUFs such as the PUF Arbiter grounded delay, especially with respect to the combined ways in which the response bits are tested.  
Some of the studies also focused on examining PUFs' defence capability against ML attacks. Although metric criteria exist to evaluate the quality of PUFs, the most common empirical approaches to assess resistance to ML attacks need to be identified. [PERSON]. [64] introduced the PUFmeter, a new toolbox consisting of publicly available in-house developed algorithms to provide a reliable foundation for robust estimations of PUFs against ML attacks.