On the Learnability of Challenge-Response Mappings in Physical Unclonable Functions

We present empiricalevidence that software-emulated Physical Unclonable Function (PUF)protocols employing linear, signed-linear, or polynomial secret projections are learnable viastandard regression techniques. Using a purpose-built attack harness, we demonstrate thatridge regression achieves R² > 0.99 on linear projections within 100 queries, and R² > 0.93on degree-2 polynomial projections within 500 queries. Only genuinely nonlinearprojections—specifically, two-layer neural networks with ReLUactivations—resist alltested attacks up to 2,000 queries. These findings contradict claims that hash indirection,challenge consumption, or query throttling provide meaningfulanti-modeling security whenthe underlying projection retains learnable structure. We release our attack harness toenable falsification of future anti-modeling claims.