how many low observable signals in iscas benchmarks do we have?
Do you know any tools for finding low observables signals in a VHDL code?


Assuming you are talking about HW Trojans and other malicious circuits and how to detect them, as discussed in this (and other papers I found based on your references):  http://www.kirj.ee/public/va_te/t-7-4-2.pdf

Mostly, Formal tools are used to (try to) detect HW trojans.  There are companies like One-Spin, Real-Intent and Mentor (probably Cadence and Synopsys too) that have tools dedicated to flagging "suspicious circuits" within their formal tool sets.  There are also more-focused-on-HW-CyberSecurity tools that exist, as well as others in development by certain 3-letter US Gov't agencies (you can guess the players, I'm sure).

Having said this, Constrained Random Functional verification, using Functional Coverage and Code Coverage, is also used.  While surely overlapping with Formal results, each is considered a complement of the other.  And, before you get your hopes up, There is no tool that autonomously extracts HW trojans, or other malicious circuits directly.  The role of the engineer is more crucial in this infinte problem space than it is in terms of design to requirements, or verify to those requirements, as now you are trying to verify it doesn't do anything it shouldn't... at best you will have a vacuous success when "done".  Techniques are constantly being developed as doctoral dissertations, etc., as this is, what I would consider a "wide open" field of study in which the problem is outpacing the solution, and for which one, especially new to engineering, could make a lucrative career.

Tortuga Logic comes to mind as a company that is developing a tool dedicated to HW Cybersecurity.

Take a look at Florida Institute of CyberSecurity (FICS) https://fics.institute.ufl.edu/ and maybe use it as a jumping off point for finding more information.