  Logic locking aims to prevent intellectual property (IP) piracy and
unauthorized overproduction of integrated circuits (ICs). However, initial
logic locking techniques were vulnerable to the Boolean satisfiability
(SAT)-based attacks. In response, researchers proposed various SAT-resistant
locking techniques such as point function-based locking and symmetric
interconnection (SAT-hard) obfuscation. We focus on the latter since point
function-based locking suffers from various structural vulnerabilities. The
SAT-hard logic locking technique, InterLock [1], achieves a unified logic and
routing obfuscation that thwarts state-of-the-art attacks on logic locking. In
this work, we propose a novel link prediction-based attack, UNTANGLE, that
successfully breaks InterLock in an oracle-less setting without having access
to an activated IC (oracle). Since InterLock hides selected timing paths in
key-controlled routing blocks, UNTANGLE reveals the gates and interconnections
hidden in the routing blocks upon formulating this task as a link prediction
problem. The intuition behind our approach is that ICs contain a large amount
of repetition and reuse cores. Hence, UNTANGLE can infer the hidden timing
paths by learning the composition of gates in the observed locked netlist or a
circuit library leveraging graph neural networks. We show that circuits
withstanding SAT-based and other attacks can be unlocked in seconds with 100%
precision using UNTANGLE in an oracle-less setting. UNTANGLE is a generic
attack platform (which we also open source [2]) that applies to multiplexer
(MUX)-based obfuscation, as demonstrated through our experiments on ISCAS-85
and ITC-99 benchmarks locked using InterLock and random MUX-based locking.
