## 1 Introduction  
The Electro-Optical Frequency Mapping (EOFM) technique, an optical contactless probing, is undeniably powerful in the integrated circuit (IC) failure analysis realm, owing to the applications in distinguishing transistor toggling at a specific frequency through the backside of silicon ICs and reducing electrical failure analysis time [1; 2; 3; 4]. Recently, EOFM has also been treated as a new class of physical attack that is fast becoming a key instrument in the hardware security community [5; 6]. Without making any physical contact with ICs, an adversary can probe volatile and on-die-only secret data from the backside of a chip just with the help of an EOFM technique [7; 8; 9; 10]. However, the physical mechanisms of EOFM signals from modern ICs have not been understood completely to date. Although the intensity of electrical activities in each part of the device under test (DUT) can be characterized by the detected EOFM signal, the amplitude of the EOFM signal only represents the device activities qualitatively but not quantitatively. It is worth mentioning that we could analyze and interpret the probed area better with the accurate voltage level of the probed node. Historically, electron beam and mechanical probes were utilized to detect the voltage amplitude of the signal at the point to be probed from the front-side; however, the use of flip-chip packages and the high number of interconnect levels made these probing methods difficult. Additionally, electron beam and mechanical probers are intrusive and require extensive preparatory work [11; 12]. As a result, figuring out the connection between the accurate voltage level inside the DUT and the signal of the DUT detected by EOFM is an urgent requirement [11].  
In some previous work [13; 14; 15], researchers explored the EOFM signal generation mechanism of the DUT and proposed several theories on the EOFM signal generation mechanism of the DUT. Existing research confirms that the free carrier effect is one of the major contributors to the EOFM signal generation of the DUT, and also recognizes the critical role played by multiple reflections and absorptions on many different interfaces during the EOFM signal generation. Although some research has been carried out on the EOFM signal generation mechanism of the DUT, there has been little quantitative analysis of the detected EOFM signals. Consequently, up to now, the detailed voltage information of the DUT has still not been obtained from the detected EOFM signal [11]. Additionally, existing studies simply assume that the laser is focused on the metal layer on the front side of the DUT, and the modulated laser is reflected by the metal layer, whose reflectivity is considered to be 98%. A systematic understanding of the relationship between each elementary part covered by the laser spot and the EOFM signal of the DUT is still lacking.  
In this paper, we propose a novel physical model of the EOFM signal of the device based on the existing research. The purpose of this paper is to use the EOFM signal values obtained from experiments to extract detailed voltage information of the DUT through the proposed physical model. The formulas to calculate some of the physical parameters in the model are experimentally modified to match the actual situation better. The model also provides the methodology to calculate the total reflectivity contributed by each elementary part covered by the laser spot. The first section of this paper briefly analyzes the EOFM signal generation mechanism of the DUT and introduces the physical calculation model based on the transfer matrix. Next, an EOFM experiment is carried out on the diode to verify the effectiveness of the model. The above investigation can be a vital guide to extracting the detailed voltage information of the DUT and predicting the scaling of the EOFM signal at future process technologies.