Photonic physical unclonable functions for co-integration of security and computing functionalities

Photonic physical unclonable functions for co-integration of security and computing functionalities Fabio Pavanello1, Niklas Pirnay2, Agraj Yadav1, Julien Poette1, Federico Marchesin3, Matěj Hejda4, Tzamn Melendez Carmona5, Alessandro Savino5, Stefano Di Carlo5, Thomas Van Vaerenbergh4, Peter Bienstman3, and Jean-Pierre Seifert2 1Univ. Grenoble Alpes, Univ. Savoie Mont Blanc, CNRS, Grenoble INP, CROMA, Grenoble, France 2Security in telecommunications, TU Berlin, Berlin, Germany 3Photonics Research Group, Dept. of Information Technology, Ghent University-imec, Ghent, Belgium 4Large Scale Integrated Photonics, Hewlett Packard Enterprise Labs, Diegem, Belgium 5Dept. of Control and Computer Engineering, Politecnico di Torino, Turin, Italy [email protected] Abstract: We propose a novel approach to build photonic physical unclonable functions (PPUFs) by leveraging Mach-Zehnder interferometer (MZI)-based computing mesh architectures. Statistical properties and robustness to machine-learning attacks show promising results for strong PPUFs. © 2026 The Author(s) 1. Introduction Physical unclonable functions (PUFs) are hardware primitives presenting a complex system-response behavior that cannot be predicted through input knowledge, nor cloned from a manufacturing point of view [1]. They are becoming an essential ingredient of security layers, replacing root-of-trust devices, relying on sensitive data stored in nonvolatile digital memory. PUFs enhance system security against malware attacks, which can directly target non-volatile memory sectors, thus accessing information such as cryptographic keys [2]. PUFs are generally distinguished between two categories: weak PUFs, which can provide only a limited set of input/output pairs, also called challenge/response pairs (CRPs), and strong PUFs, which provide a set of CRPs, scaling exponentially as a function of their footprint and which cannot be explored in feasible time by brute force approaches. While electronic strong PUFs such as arbiters are the most widely used kind, e.g. in FPGAs and microcontrollers, they present serious limitations in terms of reliability and side-channel/machine-learning (ML) modeling attacks [3]. Photonic PUFs (PPUFs) are explored as an alternative to overcoming some of these problems thanks to the usage of optical signals that can provide a larger number of degrees of freedom such as phase, frequency, polarization, and spatial profile, among others. These may all be affected by fabrication tolerances in well-designed, sensitive devices and architectures, thus leading to more complex behavior, especially when coupled with non-linear effects, and therefore enhanced robustness to ML attack [4]. Furthermore, analog and tightly confined beam propagation, paired with the high-speed and ultra-lowlatency operation of photonic architectures, can provide additional advantages by increasing the difficulty of sidechannel attacks. However, no ML attacks have been carried out on most photonic integrated implementations, with the exception of the one proposed by Grubel and co-workers [4], requiring a fs laser and a chaotic non-linear optical cavity with spectrum-temporally encoded CRPs. Here, an architecture that we recently demonstrated for matrix vector multiplication (MVM) is investigated as a PPUF [5]. While the approach could be applicable to other architectures, the chosen architecture presents a highly symmetrical topology, which mitigates unbalanced behavior among its channels, thus providing more uniformly distributed and harder to predict responses. 2. PUF Architecture, Operation, and Results The investigated architecture is shown schematically in Figure 1(a). It consists of N inputs (channels) in braided mesh encompassing N-1 layers of Mach-Zehnder interferometers (MZIs) [5]. The optical power values of the channels are modulated according to N digital inputs with M-bit resolution. These N∙M bits constitute the challenges of the PPUF. In the example depicted in Figure 1(a), an input challenge is initially separated into multiple M = 8bit portions. Importantly, each waveguide section in the architecture is affected by fabrication tolerances in both its width and thickness, providing uniqueness for different PPUF instances. Moreover, each phase shifter is set to a random value between 0 and 2π to emulate the complex weights of a photonic neural network (PNN) due to its coherent operation. Figure 1: (a) Schematic of the operation of the architecture as a PUF and relevant PUF metrics for 8-bit channel resolution. Adapted with permission from [5] © Optical Society of America. (b) Successful prediction ratio for the ML attacks with 16-, 12-, and 8-bit channel resolutions. At the mesh output, each signal is collected through a photodetector (PD) and then converted by means of an analogto-digital converter (ADC) into a M-bit resolution value. Each binary value is then concatenated together, resulting in a N∙M-bit PUF response. In this architecture, the main non-linearity is present at the read-out layer because of its multi-channel operation and coherent nature, where the optical complex amplitudes are converted through a squared modulus operation into photocurrents, scaled by the PD responsivity. Increasing N increases quadratically the footprint while the CRPs space increases exponentially as 2N∙M, thus classifying it as a strong PUF architecture. In Figure 1(a), statistical results using simulation data are presented for 8-bit-resolution ADCs/DACs, and 8 channels (where no noise was considered). Fabrication tolerances were applied solely to the straight single-mode strip waveguide sections (dominating overall footprint) to assess the architecture’s properties with ideal components at 1550 nm in a worstcase scenario. It is assumed that the signal-to-noise ratio (SNR) matches the ADC/DAC resolution. It can be observed that all the 3 key metrics of a PUF, namely uniqueness, uniformity, and bit-aliasing, show values close to an ideal 50%. Similar results are obtained for 12 and 16-bit resolutions. This behavior is expected from the accumulated optical path differences and the strong phase sensitivity of the output values. The results are obtained by considering 64-, 96and 128-bit-long CRPs and a set of 100 CRPs for each of the 100 instances of PUF generated starting from an uncorrelated sample each time, and applying fabrication tolerances for an SOI platform to a discrete grid to obtain an effective refractive index distribution [6]. To assess the robustness against ML attacks, we employed experiments where the PPUFs behavior shall be learned with an artificial NN. The goal was to predict, in an architecture-agnostic way, a single response bit using a training set of 300k CRPs for each of the 64/96/128 response bits. The ML attack uses a fully connected NN with layer sizes of 128/96/64-64-64-64-64-64-128/96/64-1 neurons and ReLu activation function. Between each deep layer, a dropout of 0.3 and batch normalization were applied. The final neuron predicts the response bit using a sigmoid activation. The standard binary cross-entropy loss function was used for NN training with the ADAM optimizer. Surprisingly, it was observed (see Figure 1(b)) that a full prediction of the responses was not possible, and moreover, the prediction pattern was similar across all the channels where the leastsignificant bits (LSBs) were the hardest to predict. This is expected to be due to the analog nature of the propagation, where the LSBs are more affected by fabrication tolerances. While these experiments do not rule out ML attacks against the PPUF, they demonstrate remarkable robustness against such attacks. By increasing N and using only hardto-learn bits, it might be possible to build a strong PUF that is robust against hardware-agnostic ML attacks and integrates a fingerprint of the accelerator with its training parameters. 3. References 1. R. Pappu et al., "Physical One-Way Functions," Science 297, 2026–2030 (2002). 2. P. Kocher et al., "Spectre Attacks: Exploiting Speculative Execution," in IEEE Symp. on Security and Privacy, pp. 1–19 (2019). 3. F. Pavanello et al., "Recent Advances in Photonic Physical Unclonable Functions," in IEEE European Test Symp., pp. 1–10 (2021). 4. B. T. Bosworth et al., "Unclonable photonic keys hardened against machine learning attacks," APL Photonics 5, 010803 (2020). 5. F. Marchesin et al., "Braided interferometer mesh for robust photonic matrix-vector multiplications with non-ideal components," Opt. Express 33, 2227 (2025). 6. Z. Lu et al., "Performance prediction for silicon photonics integrated circuits with layout-dependent correlated manufacturing variability," Opt. Express 25, 9712–9733 (2017).