Hidden Voice Command

Commands are modulated onto ultrasonic carrier frequencies (typically >20 kHz) that are inaudible to humans but captured by microphone hardware. Nonlinearity in microphone amplifiers causes the signal to demodulate back into the audible range, where the speech recognition engine processes it. This exploits the fact that microelectromechanical systems (MEMS) microphones—ubiquitous in smartphones and smart speakers—have a wider frequency response than human hearing.

• DolphinAttack demonstrated this vector against Siri, Google Assistant, and Alexa
• Effective range: up to 2 meters with off-the-shelf equipment
• Countermeasure: low-pass filtering at the hardware level

The attacker embeds a voice command within a louder, distracting audio track—such as music or white noise—using auditory masking principles. The human auditory system fails to consciously perceive the hidden command because it falls below the frequency-domain or temporal masking threshold of the dominant sound. The automatic speech recognition (ASR) system, however, processes the full spectrogram and transcribes the hidden instruction.

• Cocaine Noodles attack used this technique to hide commands in music
• Exploits the spectro-temporal resolution mismatch between human hearing and ASR front-ends
• Countermeasure: source separation and multi-stream attention analysis

Using gradient-based optimization against a white-box or surrogate ASR model, the attacker adds a minimal perturbation to an arbitrary audio clip. The resulting waveform sounds identical to the original to a human listener but is transcribed as an attacker-chosen command. This is a direct application of adversarial example generation to the audio domain.

• Carlini & Wagner demonstrated this with a 0.1% distortion rate against Mozilla DeepSpeech
• Perturbations are crafted using Connectionist Temporal Classification (CTC) loss
• Transfers across models with different architectures (black-box transferability)
• Countermeasure: adversarial training and randomized smoothing of audio inputs

A modulated laser beam is aimed at the microphone aperture of a smart device. The laser's intensity variations induce photoacoustic vibrations in the microphone diaphragm, effectively injecting an electrical signal that mimics an audio waveform without producing any acoustic sound. This is a physical-layer attack that bypasses all acoustic defenses.

• Light Commands attack achieved injection from 110 meters away
• Works through glass windows, making it viable for remote attacks
• Exploits the photoelectric effect in MEMS microphone components
• Countermeasure: physical microphone covers and sensor fusion with accelerometer data

Commands are synthesized using vocoder-based manipulation that preserves the phonetic content necessary for ASR transcription while destroying the perceptual cues humans use for speech comprehension. Techniques include time-scale modification, spectral inversion, and whispered-to-voiced conversion. The output sounds like unintelligible noise or garbled speech to a human but contains a clean command in the feature space used by the ASR model.

• Exploits the invariance gap between human auditory cortex processing and mel-frequency cepstral coefficient (MFCC) feature extraction
• No specialized hardware required—attack can be delivered via compromised audio files
• Countermeasure: liveness detection and multi-modal verification

An attacker generates intentional electromagnetic interference (IEMI) that couples directly onto the microphone's signal traces or the audio codec's analog front-end. The induced voltage fluctuations are interpreted as an audio signal by the device's analog-to-digital converter, completely bypassing the acoustic domain. This is a conducted or radiated EMI attack that requires proximity but leaves no acoustic signature.

• Effective against devices with unshielded audio input circuitry
• Can inject commands even when the device is in a soundproof enclosure
• Exploits common-mode to differential-mode conversion in poorly designed input stages
• Countermeasure: electromagnetic shielding and differential signaling on microphone traces

Analyze raw audio signals for artifacts invisible to standard feature extraction pipelines. This defense operates before the speech recognition stage.

• Ultrasonic Filtering: Apply a low-pass filter to strip frequencies above 20 kHz, neutralizing commands modulated onto ultrasonic carriers.
• Non-Linear Distortion Analysis: Detect intermodulation products caused by the non-linear response of microelectromechanical systems (MEMS) microphones to inaudible frequencies.
• Phase Continuity Checks: Identify synthetic or spliced audio by analyzing phase coherence, which is often disrupted in hidden command generation.

Distinguish between live human speech and replayed, synthesized, or vocoded audio to prevent acoustic injection attacks. This validates the source, not just the content.

• Pop Noise Detection: Analyze plosive bursts ('p', 'b' sounds) and breath patterns characteristic of human vocal tracts, which are absent in synthetic speech.
• Temporal Correlation Analysis: Compare the audio stream with onboard motion sensor data (accelerometer/gyroscope) to verify the device's physical vibration matches the acoustic signal.
• Room Impulse Response Verification: Measure the acoustic reflection pattern of the environment to detect if the audio was injected directly via a close-coupled transducer rather than propagating through the air.

Harden the Automatic Speech Recognition (ASR) model itself against psychoacoustic hiding and minimal perturbations by exposing it to attack vectors during training.

• Projected Gradient Descent (PGD) on Spectrograms: Generate adversarial audio examples directly on Mel-frequency cepstral coefficient (MFCC) features and include them in the training set to force robust decision boundaries.
• Imperceptible Noise Augmentation: Train the model on a dataset augmented with white noise, shaped noise, and filtered music that contains hidden commands, teaching the model to ignore obfuscation carriers.
• Multi-Condition Training: Combine clean, noisy, reverberant, and adversarially perturbed audio during training to prevent the model from relying on brittle, narrow acoustic features.

Implement a semantic firewall that evaluates the intent and risk of a parsed command against the current physical and digital context before execution.

• Risk-Rated Command Taxonomy: Classify commands into tiers (e.g., 'Query' vs. 'Transaction'). High-risk actions like unlocking doors or wiring funds require secondary confirmation.
• Multimodal Consistency Checks: Correlate the voice command with other sensor inputs. A command to 'open the garage' is rejected if the vehicle's GPS indicates it is not at home.
• User-Specific Voice Biometrics: Continuously authenticate the speaker using a lightweight embedding vector, ensuring the command originates from an authorized user, not an obfuscated universal attack.

Assume the ASR has been compromised and focus defenses on the execution layer. This is the final safety net before a command manifests in the physical world.

• Intent Confirmation Challenges: For sensitive operations, the agent must verbalize a summary of the action and wait for an explicit 'yes' confirmation, breaking the automation chain that hidden attacks rely on.
• Execution Time Delays: Introduce a mandatory, non-bypassable delay (e.g., 2 seconds) between command parsing and execution, allowing for a last-moment abort via a physical button or a secondary wake-word.
• Anomaly Scoring on Action Sequences: Monitor the sequence of requested actions. A sudden request to disable security cameras followed by an unlock command triggers a high anomaly score and automatic rejection.