Inaudible Voice Commands Ultrasound Modulation Liwei Song, Prateek Mittal Department of Electrical Engineering, Princeton University Motivation Attack Algorithm Given any normal voice command, we obtain the attack ultrasound with following steps. We adopt amplitude modulation in step 3 and add the same carrier wave in the final step. Voice assistants are becoming increasingly popular in IoT devices. Previous attacks on voice assistants leverage the gap between speech recognition system and human voice perception [1]. The limitation is that attack sounds are audible and conspicuous to device owners. Can we inaudibly control voice assistants? Apple Siri Low-Pass Filtering Google Assistant Upsampling Amazon Alexa Attack Overview Ultrasound Modulation Challenge: How to design inaudible attacks? Solution: We transmit ultrasounds (frequencies above 20kHz) to attack victim devices. Challenge: How to control voice assistants? Solution: We exploit the non-linearity of microphone to convert ultrasounds into normal voice commands. Carrier Wave Addition Attack Experiments Attack demonstration of the command “OK Google, take a picture”. Attack Scenario for Inaudible Voice Commands Non-Linearity Insight Typical Diagram of a Microphone A typical microphone consists of a transducer, an amplifier, a low-pass filer and an analog to digital converter. The transducer and the amplifier are not perfectly linear modules, resulting in the following non-linear function [2]. 𝑆 𝑜𝑢𝑡 = 𝑖=1 ∞ 𝐺 𝑖 𝑆 𝑖𝑛 𝑖 = 𝐺 1 𝑆 𝑖𝑛 + 𝐺 2 𝑆 𝑖𝑛 2 +… We can leverage the microphone’s inherent non-linearity to obtain normal voice frequencies from the processing of ultrasound frequencies. Attack ranges for two devices with different input powers. Input Power (𝑊) 9.2 11.8 14.8 18.7 23.7 Range (Phone, 𝑐𝑚) 222 255 277 313 354 Range (Echo, 𝑐𝑚) 145 168 187 213 239 You can scan the QR code in the title to see our attack demo. References [1] N. Carlini et al., “Hidden voice commands”, USENIX Security, 2016. [2] N. Roy et al., “Backdoor: making microphones hear inaudible sounds”, Mobisys, 2017. [3] G. Zhang et al., “DolphinAttack: inaudible voice commands”, CCS, 2017 (concurrent work). Non-linear function Non-Linearity of the Microphone