Paper 2025/2299 Original: eprint.iacr.org/2025/2299 ↗

Far-Field $Singing$ FPGAs: Repurposing Routing Fabrics into 100 m Covert Radiators

Abstract

FPGAs rely on highly dense and symmetric internal routing networks to interconnect their configurable logic ele- ments. In standard applications, these interconnects are used solely for digital signal transfer within the device, leaving many routing paths idle. We study the surprising ability of configurable FPGA routing fabrics to act as intentional radiators when struc- tured and driven coherently. Building on prior near-field demon- strations (few centimeters), we (i) present a practical toolchain and methodology for synthesizing “fabric-only” antennas using constrained placement/routing; (ii) demonstrate reliable far-field reception for extremely long ranges (≤ 100 m) and quantified bit-error performance at meter-scale ranges using ASK/FSK modulation and simple ECC; and (iii) analyze the security implications by formalizing adversary capabilities, enumerating novel multi-tenant attack vectors, and outlining detection and mitigation strategies. Our work bridges implementation engineer- ing, complex physical-layer measurement (with a set of complex Far-Field measurement apparatus), and security analysis, and highlights the urgent need for screening and runtime monitoring in shared FPGA environments. We have systematically shaped and combined unused paths into a contiguous structure, such as {Fractal, loop, Dipole, Snake, Spiral, Array}-Antennas, which required building an automation tool-chain. When energized, this embedded structure emits measurable electromagnetic energy that can serve as a stealth communication channel. We’ve extended this concept far beyond previous near-field demonstra- tions, achieving reliable reception in the Far-Field, demonstrated rigorously with various measurements setups - a first for this class of long-range FPGA-based antennas without any external radiating RF hardware from a tiny ∼ 1x1 cm2 device. We further show a Trojan example while triggering it with rare events attacking a Decryption Oracle model