DTR27TZ02-NV002: AI Detection of Hardware Trojans

Part of the DoW SBIR/STTR FY27 Release 2 topic list. Browse all 83 topics by industry or service.

Topic DTR27TZ02-NV002 from the DoW STTR 2027 BAA, Release 2. Pre-release now; proposals due January 6, 2027, 12:00 PM ET.

Quick answer

The Defense Threat Reduction Agency (DTRA) wants an AI/ML method and prototype that non-destructively verifies integrated circuits after fabrication and finds hardware Trojans that pass conventional functional testing. This is an STTR topic that starts with a Phase I feasibility study. Proposals are due January 6, 2027, 12:00 PM ET.

Book a Free Fit Call

Solicitation at a glance

• Topic number: DTR27TZ02-NV002
• Official title: AI/ML Verification of Microelectronic Integrity for High-Assurance Systems
• Agency: Defense Threat Reduction Agency
• Program: STTR (DoW STTR 2027 BAA, Release 2)
• Award type: Phase I (see topic text for Phase II)
• Award amount: Up to $250,000 (7 months, plus up to $6,500 TABA). Source: DTRA Release 2 instructions in DSIP.
• CMMC level: Level 1
• ITAR: No
• Technology areas: Information Systems, Sensors
• Pre-release (direct TPOC contact allowed): November 4 to December 2, 2026, 8:00 AM ET
• Opens in DSIP: December 2, 2026, 8:00 AM ET
• Proposals due: January 6, 2027, 12:00 PM ET
• Official source: DSIP Topics app (search DTR27TZ02-NV002)

BW&CO's take

What the Defense Threat Reduction Agency wants

DTRA wants a post-silicon, zero-trust inspection engine. It ingests a Level 3 Technical Data Package or MBSE digital twin as the baseline of intended logic, then uses AI/ML on non-destructive evaluation data to find deviations in delivered chips, including Trojans that subvert the data layer or trigger unauthorized RF emissions. Phase I models detection without golden reference chips and identifies how the attestation can be cryptographically bound to the chip's PUF for a distributed-ledger chain of custody. Phase I is a feasibility study with a threshold of modeled detection above 85% of known functional Trojans on synthetic data. Phase II benchmarks a prototype on a performer-procured set of real ICs, with thresholds of above 90% true positives and under 5% false positives on clean chips.

Who is a good fit

• Hardware security research on Trojan detection, with IC imaging or other non-destructive evaluation data
• Machine learning on physical scan data, including GAN-based synthetic data generation
• Access to ICs with verified, inserted Trojans and their design data, or a credible way to obtain them
• Familiarity with PUFs, cryptographic attestation, and supply chain risk management frameworks

Watch-outs

• STTR program rules require the small business to team with a research institution; the topic text does not name one, so line up that partner early.
• The performer must source and physically acquire the validation ICs and digital twins, including Trojan-bearing parts, without assuming Government Furnished Information.
• Phase I must show how the approach meets the stated threshold and objective metrics, such as theoretical detection above 85% of known functional Trojans on synthetic data.
• The topic lists CMMC Level 1. Direct contact with the topic authors is allowed only during pre-release, which ends when the topic opens December 2, 2026, 8:00 AM ET.

Think your company fits DTR27TZ02-NV002? Talk with BW&CO before the January 6 deadline.

Plan Your DTR27TZ02-NV002 Submission

Official topic text (verbatim from DSIP)

The text in this section is copied word for word from the official DSIP topic as published on November 4, 2026. DSIP is the official source and topics can be amended. Always confirm the current version at dodsbirsttr.mil before you submit. Our commentary above is BW&CO's interpretation, not Government guidance.

Title

AI/ML Verification of Microelectronic Integrity for High-Assurance Systems

Objective

Develop an innovative, Artificial Intelligence / Machine Learning (AI/ML) driven methodology and prototype architecture capable of non-destructively verifying the physical and logical integrity of Integrated Circuits (ICs). The solution must reliably detect sub-nanometer, adversarial Hardware Trojans that evade conventional functional testing. This ensures absolute trust in microelectronics utilized in high-assurance communications, critical infrastructure, and secure data collection systems, explicitly including protections against data-layer subversion and unauthorized RF activation. [1]

This effort bridges a critical gap between commercial supply chain illumination and physics-based national security hardware assurance. While current commercial offerings focus on firmware vulnerabilities and counterfeiting, they are blind to perfectly manufactured, sub-nanometer malicious logic such as Hardware Trojans. Furthermore, unlike existing programs such as DARPA AISS which operate in the pre-silicon design phase, this effort operates in the post-silicon verification phase assuming a "Zero Trust" posture.

Description

The Department of War relies heavily on advanced microelectronics sourced from a globally distributed commercial supply chain. Securing this supply chain against malicious insertion is a critical national security imperative, repeatedly highlighted by the Government Accountability Office (GAO) as a high-risk area. [2]

For defense systems operating in contested environments, compromised hardware represents a catastrophic vulnerability. Advanced adversaries are capable of introducing microscopic logic alterations (e.g., dopant-level Trojans, malicious dormant circuitry) during fabrication or transit. [3] A primary use case of concern involves hardware-level Trojans engineered to bypass software encryption, forcing ultra-secure communications gear or deployable sensor packages to execute unauthorized radio frequency (RF) transmissions, thereby exposing sensitive mission telemetry to hostile forces.

Furthermore, there is a critical emerging requirement to address sophisticated vulnerabilities residing between the hardware and firmware boundaries. The DoW seeks capabilities to identify malicious logic that facilitates unauthorized data inspection within the data layer, allowing an adversary to silently monitor, filter, or alter encrypted traffic streams at the silicon level. Additionally, the solution must investigate vectors where the data layer is manipulated to trigger unintended electromagnetic emanations from legitimate components, or the covert activation of dormant RF elements, for out-of-band exfiltration. [4]

The DoW seeks proposals for an automated, AI-driven inspection capability to mitigate these threats. The desired solution should ingest a Level 3 Technical Data Package (TDP) or Model-Based Systems Engineering (MBSE) Digital Twin to establish a definitive baseline of intended logic gate behavior. It must then utilize advanced algorithms to process data from Non-Destructive Evaluation (NDE) techniques to physically and logically interrogate the delivered hardware against that baseline, identifying deviations that could enable data-layer subversion, unauthorized emissions, or system failure. [5]

Digital Provenance Integration: This effort seeks to establish an algorithmic layer of assurance compatible with modern secure supply chain initiatives. Proposals should consider the architectural requirements necessary for the proposed engine to interface with emergent DoW digital provenance frameworks, generating unique, verifiable identifiers for individual components before they are integrated into sensitive operational packages.

Data Sourcing Strategy

• Training Dataset (Performer Sourced): Performers must leverage synthetic data (MBSE/GAN generated) and existing open-source physical benchmarks to train models.
• Validation Dataset (Performer Sourced): The performer is responsible for the independent identification, procurement, and physical acquisition of the ICs and Digital Twins required for validation. This must be accomplished without assumption of reliance on Government Furnished Information (GFI); performers may propose use of appropriate GFI if such a database is known and available. This dataset must include a significant subset of components with specific, verified Hardware Trojans to ensure objective benchmarking.

FREQUENTLY ASKED QUESTIONS (FAQs)

FAQ 1.0: Commercial Market Overlap and Capability Gaps

• Q1.1: Several commercial companies utilize AI for quality assurance, and emerging platforms offer Deep Supply Chain Illumination and Firmware Assurance. How does this SBIR/STTR effort differ from these commercial offerings, and what specific gap does it close?
• A1.1: This SBIR/STTR bridges the gap between commercial supply chain illumination/firmware analysis and physics-based national security hardware assurance.
• Market Research Summary: The current commercial market includes advanced providers specializing in Deep Supply Chain Illumination, Hardware/Firmware Assurance, and Anti-Tamper & Forensics. Separately, major Failure Analysis (FA) labs utilize tools like Focused Ion Beam (FIB) and Scanning Electron Microscopy (SEM) for physical defect localization. [8]
• The Commercial Blind Spot: While firmware assurance platforms excel at identifying counterfeit parts and firmware-level vulnerabilities, they are generally blind to sub-nanometer, perfectly manufactured malicious logic etched directly into the silicon (Hardware Trojans). Furthermore, commercial AI inspection models are optimized for Yield and Reliability. A Hardware Trojan is not an error; it is a Deterministic Malicious Addition. Commercial models will pass a Trojaned chip because it meets all structural tolerances, blinding the supply chain to intentional sabotage. [9][10]
• Bridging the Gap: This proposal funds the development of Generative Adversarial Networks (GANs) that fuse these disciplines. It seeks to train detection algorithms to find intentionally hidden, malicious logic that commercial defect scanners miss, anchoring that physical assurance to the secure supply chain.

FAQ 2.0: Programmatic Differentiation and Non-Duplication of Effort

• Q2.1: How does this proposed SBIR/STTR effort differ from the DARPA Automatic Implementation of Secure Silicon (AISS) program?
• A2.1: This proposal does not duplicate DARPA AISS. [7] AISS operates in the Pre-Silicon (Design) Phase, automating the insertion of security features into the IC blueprint. This SBIR/STTR operates in the Post-Silicon (Verification) Phase. It assumes a "Zero Trust" posture, acknowledging that adversaries may bypass AISS obfuscation during physical fabrication.

FAQ 3.0: Transition Strategy and the "Valley of Death"

• Q3.1: How does this Phase I/II proposal ensure a viable Phase III transition plan?
• A3.1: By structuring the output as a verification service capable of certifying COTS hardware, the technology becomes an enabling requirement for other acquisition programs. Primary transition targets include defense certification processes and rapid acquisition authorities.

FAQ 4.0: Data Rights and Intellectual Property (IP) Friction

• Q4.1: How will this initiative overcome the reluctance of commercial vendors to share proprietary Level 3 TDPs?
• A4.1: Performers are encouraged to design their AI/ML ingestion models using secure enclave or "zero-knowledge proof" principles to mathematically compare the physical scan against the Digital Twin without exposing human-readable schematics.

Phase I

Conduct a feasibility study defining the proposed AI/ML architecture and the specific NDE data inputs required for high-fidelity anomaly detection. Validation Dataset Strategy: Develop a comprehensive identification and procurement strategy for a high-fidelity validation dataset. This must detail how the performer will source, verify, and curate a diverse set of IC models and physical samples—including known "clean" and strategically "poisoned" variants—without assumption of reliance on Government Furnished Information (GFI); performer may propose use of appropriate GFI if such a database is known and available. Develop a conceptual framework demonstrating the correlation of physical NDE scan data against a complex Digital Twin to identify logic-level alterations. Data-Layer & RF Activation Vectors: Define preliminary investigation routes and algorithmic models specifically tailored to detect logic anomalies within the data layer, as well as vectors allowing data-layer manipulation for unintended EM emanations or discrete RF activation. Model the system’s theoretical ability to detect distinct classes of Hardware Trojans (e.g., parametric, functional, dormant) without relying on "golden" physical reference chips. Interoperability Hook: Identify and describe the architectural requirements for the proposed engine to interface with emergent DoW digital provenance and Supply Chain Risk Management (SCRM) frameworks. Specifically, identify how the AI/ML verification attestation can be cryptographically bound to the hardware's inherent Physical Unclonable Function (PUF), creating a unique identifier suitable for integration into a Distributed Ledger-based Chain of Custody. [6] Metrics Alignment: Performers must explicitly demonstrate how their proposed research and conceptual architecture will meet or exceed the Threshold and Objective Measures of Performance (MOP) and Measures of Effectiveness (MOE) detailed in Enclosure 1: Programmatic Metrics and Data Sourcing. Deliver a comprehensive Final Report detailing the algorithmic approach, computational requirements, and a preliminary design for a Phase II software/hardware prototype. Phase I Exit Metrics

• MOP 1 (Architecture): Threshold: Deliver system architecture mapping NDE/TDP ingestion. Objective: Architecture includes a cryptographically secure "Zero-Knowledge" enclave design capable of identifying data-layer manipulation pathways.
• MOE 1 (Detection Capability): Threshold: Modeled AI demonstrates theoretical >85% detection of known functional Trojans in synthetic data. Objective: Theoretical >95% detection across multiple HT classes with simulated False Positive Rate (FPR)
• MOP 2 (Interoperability): Threshold: Define software API for cryptographic attestation output. Objective: Define methodology for securely binding the AI verification result to the hardware's PUF for DLT integration.
• MOP 4 (Data Strategy): Threshold: Complete a validated roadmap for acquiring physical and digital components for Phase II testing. Objective: Secured pre-commitments or established procurement channels for a diverse set of "poisoned" VLSI structures.

Phase II

Develop, demonstrate, and validate a working prototype of the AI/ML verification engine. Procure and utilize the validation dataset identified in Phase I to benchmark the prototype’s detection accuracy, false-positive rate, and processing speed against the metrics outlined in Enclosure 1. Demonstrate the algorithmic capability to adapt to novel insertion methods (e.g., adaptive learning) designed to subvert secure communications or trigger unauthorized emanations. Adversarial Synthesis (GAN): Integrate a Generative Adversarial Network (GAN) architecture to autonomously synthesize "Compound Trigger" Hardware Trojans. The engine must demonstrate the ability to identify theoretical insertions that rely on the correlation of a legitimate operational state (e.g., high-readiness mode) with an anomalous external input vector. Provide a clear transition plan detailing integration into existing DoW quality assurance pipelines, specifically interfacing with relevant DoW acquisition pathways and quality assurance centers. Phase II Exit Metrics (Prototype Demonstration)

• MOE 2 (Physical Detection - "Performer-Procured Validation Set"): Threshold: Prototype processes the procured validation dataset with True Positive Rate (TPR) >90%. Objective: TPR >99%, successfully identifying localized Hardware Trojans consisting of 10 or fewer manipulated logic gates within a VLSI structure.
• MOP 3 (Algorithmic Efficiency): Threshold: Prototype maintains FPR <5% on "clean" chips. Objective: Maintains FPR <1% while processing NDE data of a standard microcontroller in <60 minutes.
• MOE 3 (Adversarial Adaptability & State-Space Exploration): Threshold: Algorithmic model successfully flags a novel, previously unseen HT insertion method (provided by independent evaluation team) as an anomaly requiring human review within 72 hours of dataset ingestion. Objective: Performer's internal GAN autonomously generates and trains against a "Compound Trigger" Hardware Trojan reliant on the correlation of a defined operational state with an anomalous external input vector, unforeseen by the evaluation team.

Phase III Dual Use Applications

DoW Application: Integration into the acquisition lifecycle for systems requiring high assurance, specifically supporting deployable infrastructure, secure defense communications, and critical command and control network nodes. Commercial Application: Transition to the Quality Assurance (QA) markets for secure financial clearinghouses, medical life-support devices, and commercial autonomous systems, where hardware-level subversion presents catastrophic safety and liability risks.

References

1. Department of Defense Instruction (DoDI) 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN), (Washington, D.C.: Department of Defense, 2012, Incorporating Change 3, October 1, 2020).

2. U.S. Government Accountability Office (GAO), Microelectronics: DoD Has Enhanced Pandemic Coordination, but Challenges Remain in Supply Chain Risk Management, GAO-23-105658 (Washington, D.C.: January 2023).

3. Mohammad Tehranipoor and Farinaz Koushanfar, "A Survey of Hardware Trojan Taxonomy and Detection," IEEE Design & Test of Computers 27, no. 1 (2010): 10-25.

4. National Institute of Standards and Technology (NIST), Platform Firmware Resiliency Guidelines, NIST Special Publication 800-193 (Gaithersburg, MD: May 2018).

5. Department of Defense, DoD Microelectronics: Vision, (Washington, D.C.: Office of the Under Secretary of Defense for Research and Engineering, 2022).

6. Department of Defense, DoD Zero Trust Strategy, (Washington, D.C.: Chief Information Officer, November 2022).

7. Defense Advanced Research Projects Agency (DARPA), Automatic Implementation of Secure Silicon (AISS) Program (Ongoing).

8. U.S. Department of Commerce, Bureau of Industry and Security (BIS), The Semiconductor Supply Chain: Assessing National Competitiveness, (Washington, D.C.: January 2022).

9. Rostami, M., Koushanfar, F., and Karri, R., "A Primer on Hardware Security: Models, Methods, and Metrics," Proceedings of the IEEE 102, no. 8 (August 2014): 1283-1295.

10. The MITRE Corporation, Hardware Common Weakness Enumeration (CWE), (McLean, VA: 2021).

Keywords

Microelectronics, Hardware Trojans, AI/ML, Supply Chain Risk Management (SCRM), Zero Trust, Integrity Verification, Non-Destructive Evaluation (NDE), Generative Adversarial Networks (GAN)

Frequently asked questions

What is DTR27TZ02-NV002?

It is a DTRA STTR topic in the DoW STTR 2027 BAA for an AI/ML-driven method and prototype that non-destructively verifies the physical and logical integrity of integrated circuits and detects adversarial hardware Trojans.

When is DTR27TZ02-NV002 due?

Proposals are due January 6, 2027, 12:00 PM ET. Pre-release began November 4, 2026, and direct contact with the topic authors is allowed only until the topic opens on December 2, 2026, 8:00 AM ET.

Is this a Phase I or Direct-to-Phase II topic?

It is an STTR topic with a Phase I feasibility study followed by a Phase II working prototype. It does not describe a Direct-to-Phase II option.

How does this differ from DARPA AISS?

The topic states that AISS works in the pre-silicon design phase, adding security features to the IC blueprint, while this effort works in the post-silicon verification phase and assumes adversaries may bypass design-time protections during fabrication.

Book a Free Fit Call