In what sense are silicon PUFs unclonable? I see quite a few publications on Physically Unclonable Functions implemented using regular silicon IC techniques; for example A 0.19pJ/b PVT-variation-tolerant hybrid physically unclonable function circuit for 100% stable secure key generation in 22nm CMOS (10 authors at Intel), at 2014 IEEE International Solid-State Circuits Conference, with free preview there. The device is summarized as


  ..creating a golden key at first array power-up during tester-time operation and thereafter recreating this golden value from the inherently noisy raw PUF value during regular field operation. The golden key is used to compute an Error Correction Code signature, which is stored on-die as fuses. During regular operation, error correction circuits mix raw PUF bits with ECC fuse values to regenerate the golden key with 100% accuracy.


A reference for that principle is given as: FPGA Intrinsic PUFs and Their Use for IP Protection (4 authors at Philips), in proceedings of CHES 2007.



I wonder in what sense these things are unclonable.

In particular, I fail to understand why it would not be possible to replace the noisy PUF array and its sensors by ROM with content the (probed) raw PUF value, replace the ECC data/signature by ROM too, letting the error-correction circuitry do its thing; or replace the whole thing by a small ROM or wires defining the golden key.
The answer lies in "complexity", but I do not believe they are unclonable in the explicit sense, but I can think of ways to get data out depending on how they are made.  It is easy for me to see "ROM" type gates under a SEM, and what PUFs buy you is that the structure is uniform but then you do not know the electrical characteristics.  

In a PUF array, you give it some electrical input and you get a seemingly random, but repeatable output due to [PVT] (Process Voltage Temperature) of the devices 1. You could actually consider this just a huge lookup table of complexity of bit-width and clock depth.  A 32-bit number gives you a 32-bit number out at some clock of X.  The input is generally easily to get to, but the output is buried in the layout.  The output could completely be probed, but you would get an answer for a single input.  (on the reverse engineering side, I could make things current mode so I could not probe them because probing them would cause errors).  Now assume that you have a PUF array that takes a single clock and has a 32-bit output due to a single 32-bit input, that means you'd need a single 32-bit value in your ROM to emulate the PUF.  Otherwise, you need an entry for each clock and input vector.  If you have 32-bits of possible input, for one clock, you'll need $2^{32}$ entries in your rom, and it gets huge from there.

So, (1) If you a voltage mode circuit on the output, (2) have a single entry to map, and (3) have a semiconductor lab, there's no reason you could not get a single output and replace it with the ROM.