Abstract
Published attacks on Physically Unclonable Functions (PUFs) usually test one or two attacker architectures against a single circuit family, leaving open a basic question: given the same PUF and CRP budget, which learning paradigm wins first, and why? This article benchmarks six attackers — logistic regression, least-squares regression, a multilayer perceptron, an LMN feature-lifting model, a denoising autoencoder, and a compact Transformer — against Arbiter OR-AND-XOR PUFs (AOX-PUFs) across three circuit families (aox-5, aox-6, aox-7; n=64) and twelve (x,y,z) mixes, with CRP budgets from 2,500 to ≈1.9 million on the University of Sheffield's Stanage HPC cluster. The hypothesis is that no single attacker dominates independent of circuit composition: linear attackers should suffice only while the decision boundary stays close to linear in the engineered challenge features, while non-linear attackers should become necessary once OR-AND-XOR composition pushes it away from linearity. The data confirm this. The MLP and autoencoder reach 98–99.5% accuracy fastest, by 25,000–75,000 CRPs on favourable mixes; logistic regression settles near 0.95±0.02; LMN bifurcates sharply between near-chance (0.52–0.60) and near-ceiling (≈0.98) accuracy depending on mix; least-squares regression is the weakest linear baseline. A further finding is methodological: an under-trained Transformer can make an unrelated protocol-level defence look misleadingly effective, because its classical baseline never reaches its own ceiling. These results are benchmarked against the reliability-based, hybrid-PUF, and bias-exploiting attack literature, with a labelled illustrative calculation setting this study's own data against an independently reported deep-neural-network accuracy collapse at high XOR counts.