Semi-Private Function Evaluation (SPFE) enables joint computation while protecting both input data and the function itself. A practical instantiation is gate-hiding garbled circuits, which conceal gate functionalities while revealing circuit topology. Existing security definitions intentionally exclude leakage through topology, leaving its concrete impact on function privacy largely unexplored. We present a SAT-based function-recovery attack that reconstructs hidden gate operations from a circuit's public topology under two attacker knowledge models. Our approach combines topology-preserving simplification theorems with a decomposition of the recovery task into smaller SAT queries, thereby reducing the candidate gate-type assignment space and improving recovery performance. We evaluate the attack on ISCAS benchmarks, representative secure computation circuits, and fault-tolerant sensor fusion circuits under a 24-hour recovery budget. Compared to a baseline attack, the optimized version substantially reduces recovery time and, in some cases, completes recovery within the evaluation budget where the baseline does not. Our results show that revealing circuit topology can materially assist recovery of hidden gate functionality, identifying topology as a security-relevant leakage channel in gate-hiding garbled circuits.

翻译：半私有函数评估（SPFE）支持联合计算，同时保护输入数据和函数本身。其实际实例是门隐藏混淆电路，该电路隐藏门功能但暴露电路拓扑。现有安全定义明确排除通过拓扑的信息泄露，但拓扑对函数隐私的具体影响尚未得到充分探索。我们提出一种基于SAT的函数恢复攻击，在两种攻击者知识模型下，从电路的公开拓扑中重建隐藏的门操作。该方法结合拓扑保持简化定理与将恢复任务分解为更小SAT查询的策略，从而减少候选门类型赋值空间并提升恢复性能。我们在ISCAS基准电路、代表性安全计算电路及容错传感器融合电路上评估该攻击，设置24小时恢复预算。与基线攻击相比，优化版本显著缩短恢复时间，且在部分场景中能在评估预算内完成恢复而基线方法无法实现。实验结果表明，暴露电路拓扑会实质性地辅助恢复隐藏门功能，从而将拓扑确定为门隐藏混淆电路中与安全相关的泄露信道。