Controlling Learnability in PUF-Based Authentication: Attacks, Protocol Co-Design, and Authorized Modeling
Gaoxiang Li · ThinkTech (Texas Tech University) · 2026
Physical Unclonable Functions (PUFs) are widely used as lightweight hardware primitives for authentication in resource-constrained IoT systems, but they face strong modeling attacks that aim to learn and replicate the PUF’s challenge–response behavior. This dissertation frames PUF security as a capability-dependent learnability problem: given an adversary’s interaction model and accessible side information, a PUF is secure only if the resulting observations are insufficient to learn the response function with meaningful accuracy. Guided by this formulation, the dissertation makes two primary contributions. First, it develops and evaluates stronger modeling methods that characterize the practical learnability boundary under different attacker capabilities (e.g., access patterns and available side information). Second, it proposes protocol/interface/PUF co-design strategies that control what information is exposed during deployment, thereby limiting adversarial learnability, while still enabling authorized modeling during secure enrollment for scalable real-world authentication. The resulting perspective provides a unified way to reason about when PUF-based authentication fails, and how to design systems that remain lightweight yet resilient under realistic attacker models. In conclusion, this work provides a new perspective for designing scalable and secure PUF-based authentication systems under realistic adversarial models.