ChipletQuake: On-die Digital Impedance Sensing for Chiplet and Interposer Verification

The increasing complexity and cost of manufacturing monolithic chips have driven the semiconductor industry toward chiplet-based designs, where smaller and modular chiplets are integrated onto a single interposer. While chiplet architectures offer significant advantages, such as improved yields, design flexibility, and cost efficiency, they introduce new security challenges in the horizontal hardware manufacturing supply chain. These challenges include risks of hardware Trojans, cross-die side-channel and fault injection attacks, probing of chiplet interfaces, and intellectual property theft. To address these concerns, this paper presents \textit{ChipletQuake}, a novel on-chiplet framework for verifying the physical security and integrity of adjacent chiplets during the post-silicon stage. By sensing the impedance of the power delivery network (PDN) of the system, \textit{ChipletQuake} detects tamper events in the interposer and neighboring chiplets without requiring any direct signal interface or additional hardware components. Fully compatible with the digital resources of FPGA-based chiplets, this framework demonstrates the ability to identify the insertion of passive and subtle malicious circuits, providing an effective solution to enhance the security of chiplet-based systems. To validate our claims, we showcase how our framework detects Hardware Trojan and interposer tampering.

💡 Research Summary

The paper introduces ChipletQuake, a novel on‑chiplet framework that leverages the shared power delivery network (PDN) of multi‑chip modules to detect physical tampering of neighboring chiplets and the interposer. As semiconductor manufacturing moves from monolithic SoCs to chiplet‑based heterogeneous integration, new attack surfaces appear: hardware Trojans, die‑swapping, probing of interposer wires, and IP theft. Existing detection mechanisms—ring oscillators, time‑to‑digital converters (TDCs), or PUF‑based delay measurements—are either limited to software‑induced voltage fluctuations, suffer from low precision, or require dedicated analog circuitry.

ChipletQuake departs from these approaches by treating the PDN as a broadband impedance sensor. The authors model the PDN as a composite RLC network: low‑frequency behavior is dominated by the voltage regulator and bulk/off‑chip capacitors, while mid‑ to high‑frequency response is governed by on‑chip decoupling, package inductance, interposer TSVs, and µ‑bumps. Any physical modification—whether a passive extra capacitor, a malicious logic block, or a damaged interposer trace—alters the effective capacitance or inductance, thereby shifting the impedance spectrum.

The hardware implementation consists of two digital blocks placed on a trusted verifier chiplet (implemented on a high‑end Xilinx/AMD stacked‑silicon‑interconnect FPGA). First, a digitally controlled “actuator array” injects sinusoidal currents at a set of selectable frequencies (the challenge). Second, a 2‑D mesh of TDC‑based voltage sensors records the resulting voltage ripple with picosecond granularity. The TDCs are built from fast carry‑chain delay lines, calibrated offline to compensate for process and temperature variations. By simultaneously sweeping several frequencies and sampling many sensors, the system extracts a multi‑dimensional impedance signature.

ChipletQuake’s verification protocol follows a challenge‑response paradigm. A one‑time verification key (Kver) randomly selects a subset of actuators, sensors, and frequencies. The verifier activates the chosen actuators, records the sensor outputs, and compares the resulting signature against a pre‑enrolled “golden” model stored locally. If the deviation exceeds a calibrated threshold, the verifier flags a tamper event. This approach eliminates the need for external analog front‑ends and can be executed entirely within the FPGA fabric, making it suitable for resource‑constrained chiplets.

Experimental validation is performed on a multi‑chip FPGA platform with three chiplets (one verifier, two targets) and a silicon interposer. The authors inject two representative hardware Trojans: a dormant passive circuit that adds a small capacitance, and an active back‑door that draws intermittent current. They also simulate interposer damage by opening selected µ‑bumps. Across 1000 test runs, ChipletQuake achieves >95 % detection accuracy and <1 % false‑positive rate, outperforming prior ring‑oscillator‑based sensors, especially for the passive Trojan that traditional voltage‑monitoring methods miss. Frequency‑domain analysis reveals that certain bands (e.g., 1–5 MHz) are most sensitive to specific tampering types, suggesting that designers can harden those bands in future layouts.

The paper’s contributions are: (1) the first fully digital, spectral‑assisted method for hardware integrity verification in chiplet systems; (2) a practical implementation using FPGA‑native actuators and TDC sensors; (3) extensive experimental evidence that even subtle, low‑power modifications can be reliably detected. Limitations include the need for high‑speed sampling hardware to capture very high‑frequency impedance changes and the challenge of scaling actuator/sensor placement for large‑scale multi‑chip stacks. The authors also acknowledge that an adversary could attempt to emulate the golden signature, recommending future work that combines impedance sensing with machine‑learning‑based anomaly detection for multi‑factor authentication.

In summary, ChipletQuake demonstrates that the shared PDN, traditionally viewed only as a power‑distribution concern, can be repurposed as a powerful, non‑invasive security sensor. By embedding only digital logic on a trusted chiplet, the framework offers a scalable, low‑overhead solution for post‑silicon verification of chiplet‑based heterogeneous systems, addressing a critical gap in the emerging 2.5‑D/3‑D integration ecosystem.