Fig. 4: Machine learning and AI attacking.

a Attacking by XGBoost, showing repeated attacks through gradient-boosted decision trees. Heat maps of b n-HD and c CC for the predicted primitives corresponding to the experimental primitives in XGBoost attacking, and PMF of the corresponding d n-HD and e CC. n-HD ~ 0.4 and CC ~ 0.2 prove resilience of the PUFs to XGBoost attacking. See Supplementary Figs. 14–17 for the n-HD and CC metric details. f Attacking by GAN, where GAN consists of two networks—the generator after trained with the experimental primitives generates predicated primitives, and the discriminator distinguishes the predicted primitives from the experimental ones. See Supplementary Fig. 18 for detailed GAN topology. Heat maps of g n-HD and h CC in GAN attacking, and PMF of the corresponding i n-HD and j CC. n-HD ~ 0.5 and CC ~ 0 prove an ideal resilience of the PUFs to GAN attacking. See Supplementary Figs. 21–24 for the n-HD and CC metric details.