Aha, I was under the impression that it was simply and literally a question of passing too much current through a conducting trace internally, causing the internal resistance to overheat it, thus melting it. Perhaps that would be a method too unreliable or something. Perhaps I should read the wikipedia entry before speculating :).
You're not wrong, this was how fuses were originally implemented in their earliest forms in the early days of integrated circuits.
A common technique was using diodes. Zener diodes are normally used to suppress overvoltage, but they're only useful for transients, and easily destroyed by a sustained, constant overvoltage due to excessive power dissipation. This is a serious problem in surge protector designs. "If life gives you lemons, make lemonade". Since they fail as a short circuit, early chip designers exploited this property as a one-time programmable fuse for factory calibration.
Quote Troubleshooting Analog Circuits by Robert A. Pease.
> As mentioned earlier, a diode tends to fail by becoming a short circuit when overpowered, and zeners cannot absorb as much power as you would expect from short pulses. How dreadful; but, can IC designers serendipitously take advantage of this situation? Yes!
> The Vos of an op amp usually depends on the ratio of its first-stage load resistors. IC designers can connect several zeners across various small fractions of the load resistor. When they measure the Vos, they can decide which zener to short out - or zap - with a 5-ms, 0.3- to 1.8-A pulse. The zener quickly turns into a low-impedance (= 1 Ω short), so that part of the resistive network shorts out, and the Vos is improved.
> In its LM108, National Semiconductor first used zener zapping, although Precision Monolithics (Santa Clara, CA) wrote about zener zapping first and used it extensively later on. Although zener zapping is a useful technique, you have to be sure that nobody discharges a large electrostatic charge into any of the pins that are connected to the zener zaps. If you like to zap zeners for fun and profit, you probably know that they really do make a cute lightning flash in the dark when you zap them. Otherwise, be careful not to hit zeners hard, if you don’t want them to zap and short out.
> These zener zaps are also becoming popular in digital ICs under the name of “vertical fuses” or, more correctly, “anti-fuses.” If an IC designer uses platinum silicide instead of aluminum metallization for internal connections, the diode resists zapping.
Nowadays they are implemented as a write-only EEPROM or Flash memory (and can even be overwritten in some designs using a special programmer), but the name "fuse" is still used for historical reasons, and to reflect their software-irreversible nature.
Also, fun fact: since fuses are EEPROMs, they're vulnerable to potential data corruption just like any other EEPROMs. If a fuse bit ever "gets loose", it can brick many chips since their boot configurations are no longer correct. It's especially problematic for space applications. This is also used for chip cracking - you can remove the "program read-protection" bit in some microcontrollers by exposing the fuse portion of the decapped silicon die under UV light. BTW, if you ever see a computer that reports an "Intel Core i6" processor model, it's likely a corrupted fuse bit (yes, this was a real incident).
That seems odd, can't high heat cause enough of an "annealing" effect to allow the charge to leak out and reset the cell? I don't know how much heating you could safely manage on a single point on the die but this would seem to be within the realm of feasible if you could uncover the portion of the die without completely destroying the packaging. If it's a plastic encapsulated IC and something like QFP where you can get at the die surface from the top then a laser could probably be used to etch through the plastic and locally heat the memory cell without trashing the chip.
This is commonly used for microcontroller reverse-engineering and cracking - you can remove the "program read-protection" bit in some microcontrollers by exposing the fuse portion of the decapped die under UV light. That being said, in all instances of fuse manipulations I'm aware of, the chips are always decapped. I never heard of a non-destructive technique (asides from fault injection), so I'm not sure how practical is your proposal - though I won't be surprised if it exists. But make sure the chip doesn't depend on a critical bit to boot (e.g. external clock enable) before you try - indiscriminately erasing all the fuse bits can brick chips - you don't want that to happen.
Also, as a matter of fact, corrupted fuse bits are certainly responsible for some hardware failures in the field. If a fuse bit ever "gets loose", it can brick many chips since their boot configurations are no longer correct. Fuses are usually designed with a negligible failure rate in normal use, still, defective chips are occasionally made. Also, if you're going to use it in a high-temperature industry application or a radiative space environment, you definitely need to be careful.
I'd imagine you wouldn't necessarily need to decap the entire chip, just the small part of the die with the fuses. The Xbox 360 Kamikaze hack involved drilling into the package to hit one of the bond wires so coming up with a way to use a laser engraver or just a UV light source sounds plausible. As for erasing all fuse bits bricking the chip, aside from the headache of reverse engineering it surely those fuse bits are all wiped clean when the chip is manufactured. Wouldn't there be some method over a JTAG interface to set the relevant bits if you knew which ones were for some key and which were there for platform configuration values? It might not work in circuit but I'd kind of expect that to be programmed after packaging so surely it's brought out on some pin.
> aside from the headache of reverse engineering it surely those fuse bits are all wiped clean when the chip is manufactured. Wouldn't there be some method over a JTAG interface to set the relevant bits [...]
