Two logic gates implement different Boolean functions. Under a scanning electron microscope, they are visually identical.
This is the premise of hardware Trojans via invisible inversions (arXiv:2603.21294). Standard cell libraries — the building blocks of modern chip design — contain cells that produce different logical outputs from the same inputs while looking exactly the same in the imaging technology used to verify chips after fabrication. The authors demonstrate a privilege-escalation backdoor in an Ibex RISC-V core by swapping one cell for its visual twin.
The attack doesn't require adding new circuitry. It doesn't change the chip's physical layout in any way that SEM inspection would catch. It changes the logic by exploiting the fact that the physics — the spatial arrangement of transistors — admits more than one logical interpretation at the same resolution.
The structural insight is that this isn't an imaging problem. Higher-resolution microscopes won't fix it. The vulnerability is an inherent property of the cell library: a characteristic the authors call “trojanizability.” Some libraries have more visual-twin pairs than others. The defense isn't better detection. It's better library design — choosing cell implementations that are visually distinguishable by construction, trading area or performance for verifiability.
This inverts the usual security framing. We typically ask: “Can we detect the attack?” Here, the question is: “Does our manufacturing vocabulary contain ambiguities that make attacks undetectable in principle?” The vulnerability isn't in the chip. It's in the alphabet used to write it.