{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,13]],"date-time":"2026-04-13T23:16:18Z","timestamp":1776122178473,"version":"3.50.1"},"reference-count":60,"publisher":"Association for Computing Machinery (ACM)","issue":"5","license":[{"start":{"date-parts":[[2020,8,21]],"date-time":"2020-08-21T00:00:00Z","timestamp":1597968000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100015089","name":"Office of Naval Research","doi-asserted-by":"publisher","award":["N00014-18-1-2058"],"award-info":[{"award-number":["N00014-18-1-2058"]}],"id":[{"id":"10.13039\/100015089","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["1553419, 1801495"],"award-info":[{"award-number":["1553419, 1801495"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Des. Autom. Electron. Syst."],"published-print":{"date-parts":[[2020,9,30]]},"abstract":"<jats:p>\n            There is substantial interest in the use of machine learning (ML)-based techniques throughout the electronic computer-aided design (CAD) flow, particularly those based on deep learning. However, while deep learning methods have surpassed state-of-the-art performance in several applications, they have exhibited intrinsic susceptibility to adversarial perturbations\u2014small but deliberate alterations to the input of a neural network, precipitating incorrect predictions. In this article, we seek to investigate whether adversarial perturbations pose risks to ML-based CAD tools, and if so, how these risks can be mitigated. To this end, we use a motivating case study of lithographic hotspot detection, for which convolutional neural networks (CNN) have shown great promise. In this context, we show the\n            <jats:italic>first<\/jats:italic>\n            adversarial perturbation attacks on state-of-the-art CNN-based hotspot detectors; specifically, we show that small (on average 0.5% modified area), functionality preserving, and design-constraint-satisfying changes to a layout can nonetheless trick a CNN-based hotspot detector into predicting the modified layout as hotspot free (with up to 99.7% success in finding perturbations that flip a detector\u2019s output prediction, based on a given set of attack constraints). We propose an adversarial retraining strategy to improve the robustness of CNN-based hotspot detection and show that this strategy significantly improves robustness (by a factor of ~3) against adversarial attacks without compromising classification accuracy.\n          <\/jats:p>","DOI":"10.1145\/3408288","type":"journal-article","created":{"date-parts":[[2020,8,21]],"date-time":"2020-08-21T23:00:38Z","timestamp":1598050838000},"page":"1-31","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":26,"title":["Adversarial Perturbation Attacks on ML-based CAD"],"prefix":"10.1145","volume":"25","author":[{"given":"Kang","family":"Liu","sequence":"first","affiliation":[{"name":"New York University, Brooklyn, NY, USA"}]},{"given":"Haoyu","family":"Yang","sequence":"additional","affiliation":[{"name":"Chinese University of Hong Kong, Shatin, Hong Kong"}]},{"given":"Yuzhe","family":"Ma","sequence":"additional","affiliation":[{"name":"Chinese University of Hong Kong, Shatin, Hong Kong"}]},{"given":"Benjamin","family":"Tan","sequence":"additional","affiliation":[{"name":"New York University, Brooklyn, NY, USA"}]},{"given":"Bei","family":"Yu","sequence":"additional","affiliation":[{"name":"Chinese University of Hong Kong, Shatin, Hong Kong"}]},{"given":"Evangeline F. Y.","family":"Young","sequence":"additional","affiliation":[{"name":"Chinese University of Hong Kong, Shatin, Hong Kong"}]},{"given":"Ramesh","family":"Karri","sequence":"additional","affiliation":[{"name":"New York University, Brooklyn, NY, USA"}]},{"given":"Siddharth","family":"Garg","sequence":"additional","affiliation":[{"name":"New York University, Brooklyn, NY, USA"}]}],"member":"320","published-online":{"date-parts":[[2020,8,21]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Proceedings of the Design Automation Conference (DAC\u201919)","author":"Alawieh Mohamed Baker"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/3315574"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3264418"},{"key":"e_1_2_1_4_1","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy (SP\u201919)","volume":"1","author":"Wang Bolun","year":"2019"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/3287624.3287689"},{"key":"e_1_2_1_6_1","volume-title":"Proceedings of the AAAI Workshop on Artificial Intelligence Safety (SafeAI\u201919)","author":"Chen Bryant","year":"2019"},{"key":"e_1_2_1_7_1","volume-title":"Proceedings of the Asia and South Pacific Design Automation Conference (ASP-DAC\u201919)","author":"Chen Ying"},{"key":"e_1_2_1_8_1","unstructured":"Fran\u00e7ois Chollet et\u00a0al. 2015. Keras. Retrieved from https:\/\/keras.io.  Fran\u00e7ois Chollet et\u00a0al. 2015. Keras. Retrieved from https:\/\/keras.io."},{"key":"e_1_2_1_9_1","unstructured":"Calma Company. 1987. GDSII Stream Format Manual Release 6.0. Retrieved from http:\/\/bitsavers.informatik.uni-stuttgart.de\/pdf\/calma\/GDS_II_Stream_Format_Manual_6.0_Feb87.pdf.  Calma Company. 1987. GDSII Stream Format Manual Release 6.0. Retrieved from http:\/\/bitsavers.informatik.uni-stuttgart.de\/pdf\/calma\/GDS_II_Stream_Format_Manual_6.0_Feb87.pdf."},{"key":"e_1_2_1_10_1","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR\u201918)","author":"Dhillon Guneet S.","year":"2018"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSD.2018.00076"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3287624.3287684"},{"key":"e_1_2_1_14_1","volume-title":"Proceedings of the International Conference on Learning Representations.","author":"Goodfellow Ian J.","year":"2015"},{"key":"e_1_2_1_15_1","unstructured":"Mentor Graphics. 2019. Calibre LFD. Retrieved from https:\/\/www.mentor.com\/products\/ic_nanometer_design\/design-for-manufacturing\/calibre-lfd\/.  Mentor Graphics. 2019. Calibre LFD. Retrieved from https:\/\/www.mentor.com\/products\/ic_nanometer_design\/design-for-manufacturing\/calibre-lfd\/."},{"key":"e_1_2_1_16_1","volume-title":"Proceedings of the International Conference on Computer-Aided Design (ICCAD\u201918)","author":"Joseph"},{"key":"e_1_2_1_17_1","volume-title":"Proceedings of the 6th International Conference on Learning Representations (ICLR\u201918)","author":"Guo Chuan"},{"key":"e_1_2_1_18_1","first-page":"1263","article-title":"Learning from imbalanced data","volume":"9","author":"He Haibo","year":"2008","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3316781.3317811"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3177540.3177554"},{"key":"e_1_2_1_21_1","volume-title":"Kingma and Jimmy Ba","author":"Diederik","year":"2014"},{"key":"e_1_2_1_22_1","volume-title":"EMEA","author":"Knudsen Jesper","year":"2008"},{"key":"e_1_2_1_24_1","volume-title":"5th International Conference on Learning Representations (ICLR'17)","author":"Kurakin Alexey","year":"2017"},{"key":"e_1_2_1_25_1","volume-title":"Proceedings of the International Symposium on Physical Design (ISPD\u201918)","author":"Lin Yibo"},{"key":"e_1_2_1_26_1","volume-title":"Research in Attacks, Intrusions, and Defenses (Lecture Notes in Computer Science)","author":"Liu Kang"},{"key":"e_1_2_1_27_1","volume-title":"Proceedings of the 5th International Conference on Learning Representations (ICLR\u201917)","author":"Liu Yanpei","year":"2017"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"e_1_2_1_29_1","unstructured":"Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. Retrieved from http:\/\/arxiv.org\/abs\/1706.06083.  Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. Retrieved from http:\/\/arxiv.org\/abs\/1706.06083."},{"key":"e_1_2_1_30_1","volume-title":"Design-Process-Technology Co-optimization for Manufacturability IX","volume":"9427","author":"Matsunawa Tetsuaki","year":"2015"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"e_1_2_1_32_1","volume-title":"Proceedings of the 5th International Conference on Learning Representations (ICLR\u201917)","author":"Metzen Jan Hendrik","year":"2017"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.dsp.2017.10.011"},{"key":"e_1_2_1_34_1","unstructured":"Samuel K. Moore. 2018. DARPA Picks Its First Set of Winners in Electronics Resurgence Initiative. Retrieved from https:\/\/spectrum.ieee.org\/tech-talk\/semiconductors\/design\/darpa-picks-its-first-set-of-winners-in-electronics-resurgence-initiative.  Samuel K. Moore. 2018. DARPA Picks Its First Set of Winners in Electronics Resurgence Initiative. Retrieved from https:\/\/spectrum.ieee.org\/tech-talk\/semiconductors\/design\/darpa-picks-its-first-set-of-winners-in-electronics-resurgence-initiative."},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"e_1_2_1_36_1","volume-title":"Proceedings of the International Conference on International Conference on Machine Learning (ICML\u201910)","author":"Nair Vinod"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/VTS.2018.8368646"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2014.2335155"},{"key":"e_1_2_1_41_1","volume-title":"Proceedings of the 6th International Conference on Learning Representations (ICLR\u201918)","author":"Samangouei Pouya","year":"2018"},{"key":"e_1_2_1_42_1","volume-title":"Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. ACM, 1528--1540","author":"Sharif Mahmood"},{"key":"e_1_2_1_43_1","volume-title":"Proceedings of the 2nd International Conference on Learning Representations (ICLR\u201914)","author":"Szegedy Christian","year":"2014"},{"key":"e_1_2_1_44_1","volume-title":"Proceedings of the Design Automation Conference (DAC\u201918)","author":"Tabrizi Aysa Fakheri","year":"2018"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/2429384.2429457"},{"key":"e_1_2_1_47_1","volume-title":"Proceedings of the 6th International Conference on Learning Representations (ICLR\u201918)","author":"Tram\u00e8r Florian"},{"key":"e_1_2_1_48_1","unstructured":"Dimitris Tsipras Shibani Santurkar Logan Engstrom Alexander Turner and Aleksander Madry. 2019. Robustness may be at odds with accuracy. Retrieved from http:\/\/arxiv.org\/abs\/1805.12152.  Dimitris Tsipras Shibani Santurkar Logan Engstrom Alexander Turner and Aleksander Madry. 2019. Robustness may be at odds with accuracy. Retrieved from http:\/\/arxiv.org\/abs\/1805.12152."},{"key":"e_1_2_1_49_1","first-page":"11","article-title":"A fuzzy-matching model with grid reduction for lithography hotspot detection","volume":"33","author":"Wen Wan-Yu","year":"2014","journal-title":"IEEE Trans. Comput.-Aided Design Integr. Circ. Syst."},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISCAS.2018.8351885"},{"key":"e_1_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1145\/3240765.3240843"},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"e_1_2_1_53_1","volume-title":"Proceedings of the International Symposium on Physical Design. ACM, 161--168","author":"Xu Xiaoqing"},{"key":"e_1_2_1_54_1","volume-title":"Proceedings of the Design Automation Conference (DAC\u201918)","author":"Yang Haoyu","year":"2018"},{"key":"e_1_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1117\/12.2515172"},{"key":"e_1_2_1_56_1","volume-title":"Young","author":"Yang Haoyu","year":"2018"},{"key":"e_1_2_1_57_1","volume-title":"Proceedings of the Design Automation Conference (DAC\u201917)","author":"Yang Haoyu"},{"key":"e_1_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/3287624.3288749"},{"key":"e_1_2_1_59_1","volume-title":"Proceedings of the Design Automation Conference (DAC\u201918)","author":"Yu Cunxi","year":"2018"},{"key":"e_1_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1145\/2228360.2228576"},{"key":"e_1_2_1_61_1","volume-title":"Proceedings of the 36th International Conference on Machine Learning. 11","author":"Zhang Hongyang"}],"container-title":["ACM Transactions on Design Automation of Electronic Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3408288","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3408288","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3408288","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:39:01Z","timestamp":1750199941000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3408288"}},"subtitle":["A Case Study on CNN-based Lithographic Hotspot Detection"],"short-title":[],"issued":{"date-parts":[[2020,8,21]]},"references-count":60,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2020,9,30]]}},"alternative-id":["10.1145\/3408288"],"URL":"https:\/\/doi.org\/10.1145\/3408288","relation":{},"ISSN":["1084-4309","1557-7309"],"issn-type":[{"value":"1084-4309","type":"print"},{"value":"1557-7309","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,8,21]]},"assertion":[{"value":"2019-06-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-06-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-08-21","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}