  In this paper, we propose GNNUnlock, the first-of-its-kind oracle-less
machine learning-based attack on provably secure logic locking that can
identify any desired protection logic without focusing on a specific syntactic
topology. The key is to leverage a well-trained graph neural network (GNN) to
identify all the gates in a given locked netlist that belong to the targeted
protection logic, without requiring an oracle. This approach fits perfectly
with the targeted problem since a circuit is a graph with an inherent structure
and the protection logic is a sub-graph of nodes (gates) with specific and
common characteristics. GNNs are powerful in capturing the nodes' neighborhood
properties, facilitating the detection of the protection logic. To rectify any
misclassifications induced by the GNN, we additionally propose a connectivity
analysis-based post-processing algorithm to successfully remove the predicted
protection logic, thereby retrieving the original design. Our extensive
experimental evaluation demonstrates that GNNUnlock is 99.24%-100% successful
in breaking various benchmarks locked using stripped-functionality logic
locking, tenacious and traceless logic locking, and Anti-SAT. Our proposed
post-processing enhances the detection accuracy, reaching 100% for all of our
tested locked benchmarks. Analysis of the results corroborates that GNNUnlock
is powerful enough to break the considered schemes under different parameters,
synthesis settings, and technology nodes. The evaluation further shows that
GNNUnlock successfully breaks corner cases where even the most advanced
state-of-the-art attacks fail.
