SUAD: Solid-Channel Ultrasound Injection Attack and Defense to Voice Assistants

2025-08-04

AI Summary

This work addresses the emerging threat of silent, long-range, obstacle-penetrating ultrasonic attacks against voice assistants. We present the first systematic analysis of solid-channel dispersion effects on ultrasonic propagation and propose a novel paradigm for long-distance command injection via solid media (e.g., walls, tabletops). Methodologically: (1) we design a modular ultrasonic command generation model adaptable to diverse solid media and variable distances; (2) we introduce a time-frequency randomization training scheme to synthesize inaudible, robust adversarial perturbations. Furthermore, we develop a lightweight, transparent embedded defense mechanism deployable on end devices. Extensive evaluation across six mainstream smartphones demonstrates an attack activation success rate exceeding 89.8% and a defense interception rate above 98%. This is the first work to both rigorously characterize and effectively mitigate ultrasonic attacks exploiting solid-channel propagation—establishing new theoretical foundations and practical safeguards for secure voice interaction systems.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Responsible Web: Human-perceived consequences of algorithmic deployment on the web

Abstract

As a versatile AI application, voice assistants (VAs) have become increasingly popular, but are vulnerable to security threats. Attackers have proposed various inaudible attacks, but are limited by cost, distance, or LoS. Therefore, we propose ame~Attack, a long-range, cross-barrier, and interference-free inaudible voice attack via solid channels. We begin by thoroughly analyzing the dispersion effect in solid channels, revealing its unique impact on signal propagation. To avoid distortions in voice commands, we design a modular command generation model that parameterizes attack distance, victim audio, and medium dispersion features to adapt to variations in the solid-channel state. Additionally, we propose SUAD Defense, a universal defense that uses ultrasonic perturbation signals to block inaudible voice attacks (IVAs) without impacting normal speech. Since the attack can occur at arbitrary frequencies and times, we propose a training method that randomizes both time and frequency to generate perturbation signals that break ultrasonic commands. Notably, the perturbation signal is modulated to an inaudible frequency without affecting the functionality of voice commands for VAs. Experiments on six smartphones have shown that SUAD Attack achieves activation success rates above 89.8% and SUAD Defense blocks IVAs with success rates exceeding 98%.

Problem

• Long-range cross-barrier inaudible voice attack via solid channels
• Modular command generation adapting to solid-channel variations
• Ultrasonic perturbation defense blocking attacks without affecting speech

Innovation

• Long-range solid-channel ultrasound attack
• Modular command generation model
• Ultrasonic perturbation defense method