PaperlayerView exact revision on arXiv

Source-linked AI summary

DolphinAtack: Inaudible Voice Commands

Guoming Zhang, Chen Yan, Xiaoyu Ji, Taimin Zhang, Tianchen Zhang, Wenyuan Xu

arXiv:1708.09537v1cs.CR

TL;DR

Existing hidden voice commands remained audible, motivating the question of whether commands could be inaudible to people but intelligible to speech-recognition systems. DolphinAttack modulates voice commands onto ultrasonic carriers and exploits microphone-circuit nonlinearity for recovery. The attack was validated across major speech-recognition systems and many devices, while the paper also proposes defenses and identifies practical deployment constraints.

  • Problem

    Prior hidden voice commands could control speech-recognition systems but remained audible, leaving open whether commands could be inaudible to humans yet intelligible to devices.

  • Method

    DolphinAttack uses amplitude modulation to place audible voice commands on ultrasonic carriers and relies on audio-circuit nonlinearity to demodulate them.

  • Results

    DolphinAttack was validated across seven speech-recognition systems and 16 voice-controllable system platforms, succeeding on nearly all examined systems and devices.

  • Takeaways & Limitations

    The results motivate hardware and software defenses and reconsideration of voice-controllable functionality and human-interaction assumptions.

  • Takeaways & Limitations

    Experiments were time-consuming and labor-intensive because devices lacked audio-measurement feedback interfaces, requiring platform-specific measurement procedures.

Abstract

from arXiv · show

Speech recognition (SR) systems such as Siri or Google Now have become an increasingly popular human-computer interaction method, and have turned various systems into voice controllable systems(VCS). Prior work on attacking VCS shows that the hidden voice commands that are incomprehensible to people can control the systems. Hidden voice commands, though hidden, are nonetheless audible. In this work, we design a completely inaudible attack, DolphinAttack, that modulates voice commands on ultrasonic carriers (e.g., f > 20 kHz) to achieve inaudibility. By leveraging the nonlinearity of the microphone circuits, the modulated low frequency audio commands can be successfully demodulated, recovered, and more importantly interpreted by the speech recognition systems. We validate DolphinAttack on popular speech recognition systems, including Siri, Google Now, Samsung S Voice, Huawei HiVoice, Cortana and Alexa. By injecting a sequence of inaudible voice commands, we show a few proof-of-concept attacks, which include activating Siri to initiate a FaceTime call on iPhone, activating Google Now to switch the phone to the airplane mode, and even manipulating the navigation system in an Audi automobile. We propose hardware and software defense solutions. We validate that it is feasible to detect DolphinAttack by classifying the audios using supported vector machine (SVM), and suggest to re-design voice controllable systems to be resilient to inaudible voice command attacks.

1 INTRODUCTION

DolphinAttack asks whether voice commands can be inaudible to humans yet intelligible to speech-recognition systems, and demonstrates that such commands can produce security breaches across voice-controllable systems.

  • Prior obfuscated commands could control speech-recognition systems despite being incomprehensible, but remained audible and conspicuous.
  • DolphinAttack modulates voice commands onto ultrasonic carriers to make them inaudible while preserving device recognition.
  • Sequences of inaudible commands enabled attacks including opening malicious websites, initiating calls, injecting fake information, and enabling airplane mode.
  • Tests succeeded on at least one speech-recognition system for each attack across 16 VCS models, including phones, smart speakers, and automobiles.
  • The attack was validated on seven popular speech-recognition systems across 16 voice-controllable system platforms.
  • The paper proposes hardware- and software-based defenses and calls for reconsidering supported functionality and human-interaction levels in voice-controllable systems.

2 BACKGROUND AND THREAT MODEL

Voice-controllable systems capture, recognize, and execute spoken commands through microphone-centered pipelines. The threat model assumes remote ultrasonic injection against unattended devices, exploiting capture hardware that is intended to suppress inaudible frequencies.

  • Voice Controllable System: A voice-controllable system comprises voice capture, speech recognition, and command execution subsystems.Captured audio is amplified, filtered, digitized, pre-processed, recognized, and mapped to system-dependent actions.
  • Voice Controllable System: Speech recognition typically separates activation from command recognition, using wake words or a physical key before accepting arbitrary voice inputs.Examples include “Alexa” for Amazon Echo and “Hey Siri” or a button for Siri.
  • Microphone: Microphones convert airborne acoustic waves into electrical signals; MEMS microphones dominate many voice-controllable devices because of their small size and low power consumption.The paper focuses mainly on MEMS microphones while briefly reporting results for ECMs.
  • Microphone: Microphones, low-pass filters, and analog-to-digital converters are designed to suppress frequencies outside the audible range, nominally 20 Hz to 20 kHz.Typical 44.1 kHz sampling limits digitized frequencies below 22 kHz according to the Nyquist theorem.
  • Threat Model: The threat model gives the adversary no direct device access or owner interaction, but assumes device knowledge and nearby equipment capable of transmitting ultrasound.Ultrasound is defined here as f > 20 kHz because higher audible frequencies may remain perceptible to children.
  • Threat Model: DolphinAttack exploits microphone and amplifier nonlinearity to demodulate a low-frequency voice signal modulated onto an ultrasonic carrier.Figure 4 reports baseband signals at 2 kHz after microphone processing, demonstrating demodulation by nonlinearity.

3 FEASIBILITY ANALYSIS

DolphinAttack exploits microphone nonlinearity to demodulate ultrasonic amplitude-modulated voice commands into recoverable baseband signals. Experiments with ECM and MEMS microphones show feasibility for tones and voices, supporting attacks on voice controllable systems.

  • 3.1 Nonlinearity Effect Modeling: Microphone nonlinearity can generate new frequencies and downconvert a crafted ultrasonic input to recover its baseband voice signal.The model treats the microphone as having a square-law nonlinear transfer characteristic.
  • 3.1 Nonlinearity Effect Modeling: Amplitude modulation places the voice signal on an ultrasonic carrier, allowing low-frequency components to remain after nonlinear demodulation and low-pass filtering.The modulated signal contains carrier-related components; filtering removes high-frequency terms while retaining the intended voice frequency.
  • 3.2 Experimental Validation: The benchtop experiment uses a 2 kHz baseband, carriers from 9 to 20 kHz, an ultrasonic speaker, and both ECM and ADMP401 MEMS microphones.The setup measures microphone outputs to investigate whether real microphone modules receive and demodulate the modulated signals.
  • 3.2.1 Single Tone: A 20 kHz carrier produces the carrier, sidebands, and a demodulated output in the MEMS microphone experiment.The result confirms that microphone nonlinearity demodulates the baseband signal.
  • 3.2.2 Voices: MFCC comparisons evaluate whether a demodulated voice remains similar to the original TTS voice, and MCD values below 8 support further DolphinAttack study.The comparison uses three “Hey” clips: original TTS speech, audible playback recording, and 25 kHz-modulated playback recording.

4 ATTACK DESIGN

DolphinAttack must generate activation and control voice commands, modulate them for efficient demodulation, and transmit them with a portable device. Its design therefore combines command generation, modulation, and portable transmission.

  • 4 ATTACK DESIGN: DolphinAttack generates baseband commands for activation and recognition, modulates them for efficient demodulation, and uses a portable transmitter for attacks.The transmitter design is organized around command generation modules and a modulation module.

4.1 Voice Command Generation

The attack generates activation commands separately from general control commands because VCSs commonly require wake-word activation before accepting commands. It uses TTS, concatenative synthesis, and direct TTS generation for these phases.

  • 4.1 Voice Command Generation: DolphinAttack generates activation commands before general control commands because Siri operates in activation and recognition phases.Activation requires wake words and, for Siri, the trained user voice.
  • 4.1.1 Activation Commands Generation: When the owner’s voice is unavailable, TTS-based brute force creates multiple wake-word candidates and relies on one voice being sufficiently similar to activate Siri.The evaluation generates candidate “Hey Siri” voices with TTS systems.
  • 4.1.1 Activation Commands Generation: When a few owner recordings are available, concatenative synthesis searches for matching phonemes in other words and assembles them into “Hey Siri.”The method extracts and reorders matched voice segments; examples include combining “he” with “cake” and “city” with “carry.”
  • 4.1.1 Activation Commands Generation: Both synthesized “Hey Siri” commands activated Siri successfully on an iPhone 4S, while 35 of 89 TTS activation-command types succeeded, a 39% success rate.Control commands from every tested TTS system were recognized by the speech-recognition system.
  • 4.1.2 General Control Commands Generation: General control commands do not authenticate speaker identity, so an attacker can choose command text and generate it with TTS.Examples include launching applications or configuring devices.

4.2 Voice Commands Modulation

DolphinAttack uses amplitude modulation to place voice commands on ultrasonic carriers, selecting modulation parameters according to hardware response and inaudibility constraints. The design also accounts for modulation depth and voice bandwidth.

  • 4.2 Voice Commands Modulation: Amplitude modulation is required to exploit microphone nonlinearity while shifting voice commands onto ultrasonic carriers.The carrier’s amplitude varies in proportion to the baseband signal, producing a carrier and adjacent sidebands.
  • 4.2.1 AM Modulation Parameters: Modulation depth m = M/A controls carrier-amplitude variation and is hardware dependent because it affects use of microphone nonlinearity.M is the modulation amplitude and A is the carrier amplitude.
  • 4.2.1 AM Modulation Parameters: The carrier must satisfy fc − w > 20 kHz so the lowest modulated frequency remains above the audible range.Carrier selection also depends on baseband bandwidth, filters, microphone response, and speaker response.
  • 4.2.1 AM Modulation Parameters: The carrier frequency should maximize the product of speaker and VCS-microphone gains, determined from their measured frequency responses.Figure 10 reports the frequency responses of the ADMP401 microphone and Samsung Galaxy S6 Edge speaker.
  • 4.2.1 AM Modulation Parameters: A narrow-band voice is preferred because wider voice bandwidth increases the probability that modulation leaks into the audible range.The paper notes that female voices typically have wider frequency bands than male voices.

4.3 Voice Commands Transmitter

DolphinAttack uses two transmitter designs to generate modulated ultrasonic commands: a powerful setup for validation and a smartphone-based portable setup for walk-by attacks.

  • Two transmitters comprise a powerful signal-generator-driven design and a smartphone-driven portable design.Both designs include a signal source, modulator, and speaker.
  • The powerful transmitter uses a smartphone signal source, vector signal generator modulator, and wide-band dynamic ultrasonic speaker.The signal generator supports a 300 MHz sampling range and predefined modulation parameters.
  • The portable transmitter addresses smartphone sampling limits by using a Samsung Galaxy S6 Edge with an ultrasonic transducer and amplifier.Most smartphones support at most 48 kHz sampling and carrier frequencies of at most 24 kHz, while many devices work best above 24 kHz.
  • The portable implementation costs less than $3 for the amplifier, ultrasonic transducer, and battery.

5 FEASIBILITY EXPERIMENTS ACROSS VCS

Experiments across 16 voice controllable systems and 7 speech recognition systems found DolphinAttack effective on nearly all examined systems, while performance varied with hardware, SR software, commands, and modulation parameters.

  • Experiment setup: The evaluation covered popular SR systems and VCSs across personal devices, smart-home devices, and vehicles.The selected systems were intended as a representative, non-exhaustive set spanning software and hardware platforms.
  • Feasibility results: DolphinAttack succeeded on nearly all tested devices and SR systems, with inaudible commands correctly interpreted on all tested hardware and activation succeeding on every VCS requiring activation.The experiments included 16 VCSs and 7 SR systems.
  • Feasibility results: Hardware strongly influenced attack performance, producing variation in success rate, maximum distance, and modulation parameters even among devices using the same SR system.Different microphones, amplifiers, and filters produced different digitized audio, while two identical iPhone SE devices showed similar results.
  • Feasibility results: SR systems also handled identical audio differently, affecting carrier frequency, AM depth, and recognition distance beyond the shared hardware effects.The Google Chrome and Siri experiments on an iPhone SE had overlapping carrier-frequency ranges but differed in other attack parameters.
  • Feasibility results: Attack performance depended on command content and length: short, common commands were easier to recognize than commands requiring exact recognition of execution words and payloads.Commands such as “Turn on airplane mode” were easier than “Call/FaceTime 1234567890” or “Open dolphinattack.com.”
  • Feasibility results: Carrier frequency, modulation depth, and distance varied substantially across devices, with successful carrier-frequency ranges spanning 20–42 kHz and attack distances reaching 175 cm.On Nexus 7, the carrier-frequency range was 24–39 kHz; increasing modulation depth generally strengthened the demodulated signal and improved SNR and success rate, with exceptions from harmonic distortion.
  • Experiment constraints: The experiments were time-consuming and labor-intensive because devices lacked audio-measurement feedback interfaces.Researchers measured demodulation results using spectrum software or, for devices that could not install it, calling and command-log playback on another device.

6 IMPACT QUANTIFICATION

DolphinAttack remained effective across languages, noise conditions, sound pressure levels, distances, and portable-device attack settings. Recognition favored shorter activation commands, while stronger signals and device-specific demodulation improved performance.

  • Language influence: Across English, Chinese, German, French, and Spanish, the three commands achieved average recognition rates of 100%, 96%, and 98%, respectively.English and Spanish reached 100% for all commands; activation was recognized more reliably than longer control commands.
  • Background noise: Activation commands exceeded 90% recognition in office, cafe, and street noise scenarios, while longer control commands degraded as ambient noise increased.A single missed word makes the complete command unsuccessful.
  • Sound pressure level: Both sentence and word recognition reached 100% on the Apple watch above 106.2 dB SPL, whereas the Galaxy S6 Edge required 113.96 dB.Word recognition was consistently higher than sentence recognition until both reached 100%.
  • Attack distance: The Apple watch activated at 100% from 100 cm, while the Galaxy S6 Edge achieved 100% activation only from 25 cm.The authors attribute the difference to the Apple watch’s wrist-worn design and longer voice-command reception range.
  • Portable-device attack: A 3-Watt amplifier extended the maximum effective portable-device attack distance to 27 cm.The paper notes that professional equipment and more powerful amplifiers could extend the distance further.
  • Remote attacks: Remote attacks can embed inaudible commands in website audio or video, potentially triggering nearby Google Home, Alexa, and mobile voice systems.The attack can use a victim’s device to play the embedded media.

7 DEFENSES

The paper proposes hardware defenses that suppress or cancel ultrasonic command signals and a software defense that detects their distinctive recovered-signal features. An SVM experiment evaluates the feasibility of the software approach.

  • Hardware-based defense: The proposed hardware defenses are microphone enhancement and baseband cancellation.They address ultrasonic sensing directly or remove the demodulated command before speech recognition.
  • Hardware-based defense: Microphone enhancement suppresses acoustic signals above 20 kHz, where mobile MEMS microphones may otherwise detect inaudible commands.The paper identifies ultrasonic sensitivity in microphones as the root cause of the attack.
  • Hardware-based defense: Baseband cancellation detects amplitude-modulated ultrasound, demodulates it, and subtracts the resulting baseband command before low-pass filtering.The procedure is intended not to affect normal microphone operation because audible voices and ultrasound-range noise are uncorrelated.
  • Software-based defense: Recovered attack signals differ from original and recorded signals between 500 and 1000 Hz, providing a feature range for detection.The paper proposes analyzing this range with a machine-learning classifier.
  • Software-based defense: An SVM classifier used 15 time- and frequency-domain features from 24 recorded and recovered samples to test DolphinAttack detection.The samples came from 12 voice commands generated with NeoSpeech and Selvy TTS voices.

8 RELATED WORK

The related work spans voice-command injection, sensor spoofing, privacy leakage through sensors, and ultrasonic communication. DolphinAttack differs from prior ultrasonic BackDoor work by injecting rich voice commands with one speaker.

  • Security of voice controllable systems: Prior voice-command attacks include electromagnetic interference on headphone cables and voice impersonation techniques.DolphinAttack instead injects voice commands through microphone nonlinearity over ultrasound.
  • Security of sensor-equipped devices: Sensor-security research has examined malicious signal injection into smartphones, wearables, tablets, and other sensor-equipped devices.The paper places DolphinAttack within the broader sensor-spoofing literature.
  • Privacy leakage through sensors: Prior privacy-leakage studies recover speaker information, audio data, keystrokes, or printed text through gyroscopes, audio sensors, accelerometers, video, and acoustic noise.DolphinAttack similarly exploits microphone vulnerabilities for security and privacy breaches.
  • Ultrasonic communication: BackDoor creates an inaudible ultrasonic channel whose nonlinear mixing produces a single-tone audible shadow carrying data.DolphinAttack uses one speaker to inject voice commands composed of a richer set of tones into speech-recognition systems.

9 CONCLUSION

DolphinAttack modulates voice commands onto ultrasonic carriers so humans cannot perceive them, while microphone nonlinearity enables recovery and speech-recognition interpretation. The paper also proposes hardware and software defenses.

  • Conclusion: DolphinAttack uses amplitude modulation to place audible voice commands on ultrasonic carriers and attack major speech-recognition systems inaudibly.The proposed defenses address the attack from both hardware and software perspectives.
Loading 1708.09537v1…