Protecting Intellectual Property (IP) of electronic designs from untrusted parties involved in the semiconductor manufacturing supply chain has become a topic of intense interest. Among different proposed solutions design obfuscation has shown to be the most viable solution. Design obfuscation can be described as the process that transforms a circuit into another functional equivalent version that is significantly difficult, ideally impossible, to reverse engineer. One very promising new approach for design obfuscation is through hardware redaction, by mapping a portion of the hardware design to an embedded Field-Programmable Gate Array (eFPGA). This approach has been shown to be more secure than traditional approaches as the search space is much larger considering that the bitstream not only determines the functional logic mapped onto the eFPGA but also the interconnect [1-4]. One of the main problems with this approach though is the added design complexity, and area, power and delay overheads. Moreover, we have recently presented the first attack by mapping approximate synthesizable predictive models onto the eFPGA [5]. Although this attack only works for designs that tolerate certain degrees of errors at their output, it opens the window to more sophisticated attacks. Based on this, the main goal of this project is to fully expose the weaknesses of eFPGA-based HW redaction.