When Input-Only Pins Become Output-Only Secrets

Analog pins on mixed-signal chips are supposed to be one-way streets. Sensor data flows in, gets digitized, and the chip processes it. Nobody expects information to flow back out through the same pin. This paper from Rochester Institute of Technology's RAMLab demonstrates that this assumption is wrong, and they prove it on real silicon.

The core idea is deceptively simple. A hardware Trojan inserted into a closed-loop amplifier can modulate the circuit's internal offset in a data-dependent way. That offset perturbation appears as a voltage change at the input pin. To anyone monitoring the pin with the right filter, it looks like an outbound data channel. To anyone running standard production tests, it looks like normal process variation.

Why This Attack Class Has Been Overlooked

Hardware security research has spent years examining digital covert channels, power-supply side channels, electromagnetic emissions, and thermal leakage. Analog input pins barely register in this landscape because the assumption has always been that directionality is a functional property. An input-only pin receives signals. It does not transmit them.

That assumption breaks down when you consider how analog front-ends actually work. A transimpedance amplifier (TIA) or operational amplifier in a closed-loop configuration creates a feedback path between its output and input. The input node is not isolated from the amplifier's internal state. If someone can modulate the amplifier's offset voltage by toggling transistor fingers on and off, that modulation reflects back at the input pin as a voltage perturbation. The pin is nominally input-only, but the circuit topology allows bidirectional information flow.

This gap persists because industry-standard AMS testing focuses on specification compliance. Does the amplifier meet its gain, bandwidth, noise, and offset targets? If yes, the part passes. Tests do not ask whether the input pin is carrying data-bearing modulation during normal operation. The authors identify this as a fundamental test-observability gap: the tools and procedures used to validate mixed-signal ICs were not designed to detect this class of attack.

Three Conditions That Open the Door

The paper analytically identifies three properties that make a chip vulnerable to this attack:

  • A closed-loop amplifier: The feedback topology is what allows internal offset changes to propagate back to the input node. An open-loop configuration would not create this pathway.
  • An exposed amplifier input: One of the amplifier's inputs must be connected to an external pin. This is the case for virtually every sensor interface that connects to an off-chip transducer.
  • Sufficiently high impedance at that pin: If the pin has low impedance (like a voltage reference input), the offset modulation produces negligible voltage change. High-impedance sensor inputs, such as those connected to photodiodes or bioelectrodes, produce measurable perturbations.

These conditions are not rare or exotic. They describe the front-end architecture of ECG monitors, PPG sensors, EEG systems, radar receivers, optical communication interfaces, and MEMS devices. Any system that acquires signals from off-chip sensors through a closed-loop amplifier is a potential host.

The Hardware Trojan Payload

The attack payload is a small collection of extra transistors inserted into the host amplifier's differential pair. The designers add fingers (additional transistor width segments) to the existing PMOS and NMOS differential pair, each controlled by a switch implemented as a single NMOS transistor. When the stolen bitstream drives these switches on or off, the amplifier's input-referred offset shifts in proportion to the data.

The math is straightforward. The output offset of the modified amplifier becomes a function of which switch combinations are active, effectively creating a rudimentary DAC (digital-to-analog converter) and ASK (amplitude-shift keying) modulator. The complete signal at the input pin is the sum of the legitimate sensor signal, the input-referred noise, and the Trojan-induced offset. The authors express this as:

v_sns = v_sensor[m_sns] + v_of,in[m_trj] + v_Ni

The critical design constraint is an amplitude ordering: the Trojan-induced offset must exceed the input-referred noise floor to support recovery, but must remain well below the sensor signal to avoid disrupting the host function.

Silicon Validation in 55-nm CMOS

The authors fabricated a test chip in a commercial 55-nm CMOS process containing a photoplethysmography (PPG) analog front-end with the embedded Trojan payload. The PPG AFE includes a transimpedance amplifier with three gain configurations (12.25, 79.8, and 140 mV/µA), an adjustable photodiode bias current source, and the anti-aliasing low-pass filter. The Trojan payload occupies 39.284 µm², which is less than 0.001% of the area of a typical biosensing AFE.

The test board mounted the fabricated chip alongside a ROHM RHMD-0132 photodiode, a red LED as the PPG source, and an ATmega2560 microcontroller for chip-PC communication. All measurements used the maximum 140 mV/µA gain setting with the PPG frequency fixed at 1 Hz.

The Stealth Numbers That Matter

The key results center on how the Trojan hides within normal variation. Across five process corners (ff, sf, fs, tt, ss) and three temperatures (0°C, 40°C, 80°C), the Trojan-free response of the photodiode input voltage varies by 34.3% of the PPG amplitude. The maximum Trojan-induced perturbation is 5.9% of the PPG amplitude. The Trojan signature sits entirely within the envelope of natural process and temperature variation. A specification-based test would never flag it.

At the host output, after the anti-aliasing filter, the PPG signal-to-noise ratio drops by only 0.03 dB when the Trojan is active. The baseline filtered PPG SNR is 16.3 dB, typical for a single measurement frame. The 0.03 dB change is negligible.

At the input pin, the raw exfiltration signal-to-interference-plus-noise ratio (SINR) stays below -20 dB. The data-bearing component is buried beneath the noise and interference floor. Without targeted processing, the exfiltration is invisible.

Recovery Through Targeted Filtering

An attacker who knows the signaling band can apply a high-pass filter to the input pin waveform and recover the exfiltrated signal. In the silicon measurements, a high-pass filter with a 150 Hz corner frequency increased the exfiltration SINR from below -20 dB to above 14 dB, a 34 dB improvement. This is sufficient for error-free data recovery.

The authors demonstrated this with a 256-bit pseudorandom binary sequence (PRBS-7) transmitted at 6 bps using a 500 Hz carrier clock mixed via a standard CMOS NAND gate. A digital high-pass filter with a 250 Hz corner extracted and demodulated the message with zero bit errors. Alternating-pattern measurements across payload frequencies from 100 mHz to 10 kHz supported bit rates from 0.1 bps to 10 kbps, with estimated BERs between 1.66×10⁻² and 2.51×10⁻² in the 100 Hz to 1 kHz band.

The channel capacity, computed using Shannon's theorem across the measured SINR curve, reaches 30.19 kbps up to 10 kHz.

The Detectability Tradeoff

The paper introduces a relative detectability index that captures the tension between exfiltration performance and stealth. Moving the payload frequency further from the PPG signal frequency improves SINR and lowers BER, but makes the spectral signature more conspicuous to a defender who knows what to look for. The index ranges from 1.40×10⁻³ at 500 mHz to 27.81 at 10 kHz.

Monte Carlo mismatch simulations across 1000 samples show that most fabricated parts produce BERs below 30×10⁻⁶, but the upper tail indicates that mismatch can substantially degrade the channel for a subset of samples. Process variation is a double-edged sword: it helps hide the Trojan signature but can also weaken the covert channel.

What Standard Tests Miss

The authors systematically evaluate four common analog test categories against their attack:

  • Connectivity and impedance tests: The Trojan adds only the state-dependent loading of a single differential-pair finger. Conventional continuity and impedance screening targets opens, shorts, and gross faults, not incremental admittance changes.
  • SNR and noise measurements: The 0.03 dB change at the host output is too small to detect in a standard noise measurement. The test measures the output, not the input pin.
  • Static parameter tests: The 5.9% Trojan perturbation falls within the 34.3% benign variation envelope. No out-of-spec condition is generated.
  • Functional tests: The host continues to satisfy its evaluated specifications with the Trojan active. Internal nodes are typically not exposed due to parasitic loading effects.

None of these tests monitor the input pin for data-bearing spectral activity. The attack succeeds precisely because the test methodology was designed to verify functional compliance, not to detect covert channels on nominally unidirectional interfaces.

Defensive Implications

The paper's most actionable conclusion is that analog pin directionality must be treated as a security property rather than a functional assumption. This means adding explicit verification steps that monitor nominally input-only pins for data-dependent modulation during normal operation, with sufficient bandwidth and resolution to detect low-SINR exfiltration signals.

Practical defenses could include spectral monitoring of input pins during production testing, runtime anomaly detection on analog interfaces, and design-for-security rules that flag amplifier topologies combining closed-loop feedback with exposed high-impedance inputs. The authors also suggest that the relative detectability index could guide test planning by identifying which operating conditions make the channel most conspicuous.

Limitations and Open Questions

The demonstration is limited to a PPG front-end at room temperature with a single data rate and carrier frequency. Real deployment would require evaluating the attack across diverse sensor types, operating temperatures, and data rates. The 6 bps PRBS demonstration is slow; reaching 10 kbps requires operating at frequencies where the channel becomes more detectable. The tradeoff between speed and stealth needs more exploration across realistic threat scenarios.

The paper also assumes the attacker has already compromised a separate extraction mechanism to supply the secret-bearing bitstream to the analog payload. The Trojan activation and data sourcing are treated as solved problems from prior work. The contribution here is the transport mechanism, not the full attack chain.

Finally, the defensive recommendations remain conceptual. No concrete detector architecture or countermeasure circuit is proposed and validated. The gap between identifying the vulnerability and deploying practical defenses is substantial.

What This Means for Chip Designers

Any mixed-signal SoC that interfaces with off-chip sensors through closed-loop amplifiers should be evaluated against this attack class during security review. The authors identify candidate host domains including biomedical sensing, radar, wearable monitoring, optical communication, and MEMS systems. Design teams working on these applications should add analog input-pin directionality to their threat models and verify that production test plans include spectral monitoring of input pins for outbound data-bearing activity.

For security teams, the paper demonstrates that the analog domain is not immune to covert channels just because it lacks the discrete states of digital logic. Continuous-valued signals can carry attacker-controlled information in ways that are difficult to distinguish from process variation and measurement noise. The solution is not to abandon analog testing but to extend it with security-oriented coverage that explicitly addresses directionality violations.

Read the paper on arXiv