Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice...
Transcript of Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice...
![Page 1: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/1.jpg)
Inaudible Voice Commands:
The Long-Range Attack and Defense
University of Illinois at Urbana-Champaign
Nirupam Roy Haitham Hassanieh Romit Roy ChoudhurySheng Shen
![Page 2: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/2.jpg)
50 million voice assistants are sold in US
![Page 3: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/3.jpg)
Inaudible Acoustics
Normal Sound(< 24 kHz)
Ultrasound
(> 25 kHz)
“Inaudible Acoustics”
(> 25 kHz)
“Alexa, open the garage door!”Ok
![Page 4: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/4.jpg)
Inaudible Acoustics
![Page 5: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/5.jpg)
Talk Outline
0. [BackDoor], [DolphinAttack], [Princeton Video]
MobiSys’17(Best Paper)
CCS’17 arXiv
![Page 6: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/6.jpg)
Talk Outline
Today’s Talk:
0. [BackDoor], [DolphinAttack], [Princeton Video]
2. How to defend against these attacks?
1. How to launch long-range (realistic) attacks?
![Page 7: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/7.jpg)
Talk Outline
Today’s Talk:
0. [BackDoor], [DolphinAttack], [Princeton Video]
1. How to launch long-range (realistic) attacks?
2. How to defend against these attacks?
![Page 8: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/8.jpg)
10k 20k 30k 40k 50k 60k 70k 80k 90k 100k
Microphone frequency spectrum
Diaphragm Amplifier Filter ADC
Am
plit
ud
e
![Page 9: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/9.jpg)
Microphonefilter
10k 20k 30k 40k 50k 60k 70k 80k 90k 100k
Microphone frequency spectrum
Diaphragm Amplifier Filter ADC
Am
plit
ud
e
![Page 10: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/10.jpg)
Amplifier Filter ADC
Microphonefilter
Am
plit
ud
e
10k 20k 30k 40k 50k 60k 70k 80k 90k 100k
Microphone frequency spectrum
Diaphragm
Air Vibration Electric Voltage
![Page 11: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/11.jpg)
Input
Output
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
AmplifierDiaphragm
Vout = a1Vin
![Page 12: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/12.jpg)
Vout = a1Vin
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Vout = a1Vin+ a2Vin2 +...
AmplifierDiaphragm
Input
Output
Nonlinear
Input
Output
![Page 13: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/13.jpg)
Vout = a1Vin
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Vout = a1Vin+ a2Vin2 +...
AmplifierDiaphragm
Input
Output
Nonlinear
Input
Output
a2Vin2
![Page 14: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/14.jpg)
![Page 15: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/15.jpg)
10k
Frequency20k 30k 40k 50k 60k 70k 80k 90k 100k
Am
plit
ud
e
InaudibleAudible
Microphonefilter
![Page 16: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/16.jpg)
F1F2
10k
Frequency20k 30k 40k 50k 60k 70k 80k 90k 100k
Am
plit
ud
e
InaudibleAudible
Microphonefilter
![Page 17: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/17.jpg)
Vout = a1Vin+ a2Vin2
( sin F1 + sin F2 )2
F1F2
10k
Frequency20k 30k 40k 50k 60k 70k 80k 90k 100k
= cos 2F1
cos 2F2
cos (F1+F2)
cos (F1- F2)
-
-
-
+
Am
plit
ud
e
InaudibleAudible
Microphonefilter
![Page 18: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/18.jpg)
Vout = a1Vin+ a2Vin2
F1F2
( sin F1 + sin F2 )2 = cos 2F1
cos 2F2
cos (F1+F2)
cos (F1- F2)
2F2 (F1+F2)2F1
10k
Frequency20k 30k 40k 50k 60k 70k 80k 90k 100k
-
-
-
+
Am
plit
ud
e
InaudibleAudible
Microphonefilter
![Page 19: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/19.jpg)
2F2 (F1+F2)2F1
Vout = a1Vin+ a2Vin2
F1F2
( sin F1 + sin F2 )2 = cos 2F1
cos 2F2
cos (F1+F2)
cos (F1- F2)
10k
Frequency20k 30k 40k 50k 60k 70k 80k 90k 100k
-
-
-
+
Am
plit
ud
e
InaudibleAudible
Microphonefilter
![Page 20: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/20.jpg)
2F2 (F1+F2)2F1
Vout = a1Vin+ a2Vin2
F1F2
( sin F1 + sin F2 )2 = cos 2F1
cos 2F2
cos (F1+F2)
cos (F1- F2)
(F1-F2)
10k
Frequency20k 30k 40k 50k 60k 70k 80k 90k 100k
-
-
-
+
Am
plit
ud
e
InaudibleAudible
Microphonefilter
![Page 21: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/21.jpg)
F1F2
10k
Frequency20k 30k 40k 50k 60k 70k 80k 100k90k
(F1-F2)
Am
plit
ud
e
InaudibleAudible
Microphonefilter
![Page 22: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/22.jpg)
F2
10k
Frequency20k 30k 40k 50k 60k 70k 80k 90k 100k
Am
plit
ud
e
InaudibleAudible
Microphonefilter
V(t) = “Alexa, open the garage door!”
![Page 23: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/23.jpg)
F2
10k
Frequency20k 30k 40k 50k 60k 70k 80k 90k 100k
V(t) = “Alexa, open the garage door!”
Ok
Am
plit
ud
e
InaudibleAudible
Microphonefilter
![Page 24: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/24.jpg)
3-5 ft
![Page 25: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/25.jpg)
Can someone attack from a longer range?
![Page 26: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/26.jpg)
Can someone attack from a longer range?
![Page 27: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/27.jpg)
Can someone attack from a longer range?
High power makes ultrasonic speakers audible
![Page 28: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/28.jpg)
Speakers have nonlinearity too!
![Page 29: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/29.jpg)
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k
Voice Command:
![Page 30: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/30.jpg)
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k
Speaker Nonlinearity
=
![Page 31: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/31.jpg)
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k
Speaker Nonlinearity
Am
plit
ud
e
10k 20k 30k 40k 50k 60k 70k 80k 90k
=
![Page 32: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/32.jpg)
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k
Speaker Nonlinearity
Am
plit
ud
e
10k 20k 30k 40k 50k 60k 70k 80k 90k
+
=
![Page 33: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/33.jpg)
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k
Speaker Nonlinearity
Am
plit
ud
e
10k 20k 30k 40k 50k 60k 70k 80k 90k
Audible Inaudible
=
General to all speakers!
Our Solution: “Leakage Optimization”
![Page 34: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/34.jpg)
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Speaker Nonlinearity Audible Leakage
Speaker input
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Speaker output
Bandwidth: B
Bandwidth: B
𝑉 −𝑓 ∗ 𝑉(𝑓)
![Page 35: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/35.jpg)
Am
plit
ud
eA
mp
litu
de
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Speaker input
Speaker output
Speaker Nonlinearity Audible Leakage
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
![Page 36: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/36.jpg)
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Speaker input
Speaker output
Speaker Nonlinearity Audible Leakage
![Page 37: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/37.jpg)
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Speaker input
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Speaker output
Speaker Nonlinearity Audible Leakage
![Page 38: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/38.jpg)
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Speaker input
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Speaker output
Speaker Nonlinearity Audible Leakage
Chopping compresses the leakage band
![Page 39: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/39.jpg)
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Speaker input
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Speaker output
Leakage from Speaker
Sound P
ressure
Level in
dB
Frequency in Hz
15.6 31.2 62.5 125 250 500 1000 2000 4000 8000 16000
80
60
40
20
0
-20
Threshold of Hearing Curve
𝐿 𝑓
𝑇 𝑓
Human Hearing Threshold
min𝑓[𝑇 𝑓 − 𝐿(𝑓)]𝑀𝑎𝑥𝑖𝑚𝑖𝑧𝑒
𝑠𝑢𝑏𝑗𝑒𝑐𝑡 𝑡𝑜 𝑓0 ≤ 𝑓1 ≤ 𝑓2 ≤ … ≤ 𝑓𝑁
Minimum Gap
![Page 40: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/40.jpg)
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Speaker inputA
mp
litu
de
Speaker output
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
![Page 41: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/41.jpg)
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Speaker inputA
mp
litu
de
Speaker output
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Inaudible
![Page 42: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/42.jpg)
F2
F2
F2
Am
plit
ud
e
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Speaker inputA
mp
litu
de
Speaker output
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Microphonefilter
Microphone output
10k
Frequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Am
plit
ud
e
Inaudible
![Page 43: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/43.jpg)
Evaluation
![Page 44: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/44.jpg)
Inaudible voice command: Long rangeInaudible voice commands: Long range
25 feet
Speaker array running leakage optimization
![Page 45: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/45.jpg)
Evaluation
Wake-word hit rate
![Page 46: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/46.jpg)
Evaluation
Wake-word hit rate Command detection accuracy
![Page 47: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/47.jpg)
Evaluation
Maximum activation distance for different input power
![Page 48: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/48.jpg)
Talk Outline
Today’s Talk:
0. [BackDoor], [DolphinAttack], [Princeton Video]
1. How to launch long-range (realistic) attacks?
2. How to defend against these attacks?
![Page 49: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/49.jpg)
Talk Outline
Today’s Talk:
0. [BackDoor], [DolphinAttack], [Princeton Video]
2. How to defend against these attacks?
1. How to launch long-range (realistic) attacks?
![Page 50: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/50.jpg)
Am
plit
ud
e
10kFrequency
20k 30k 40k 50k 60k 70k
Core Question:
Is this a “non-linear signal” or normally recorded signal
?Voice signal
Inaudible Voice Attack
𝑣(𝑡) ∙ sin 𝜔1𝑡 + 𝑐 ∙ sin 𝜔1𝑡2
= 𝑣 𝑡 + 𝑐′𝑣2 𝑡 + ⋯
𝑣 𝑡
![Page 51: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/51.jpg)
Am
plit
ud
e
10kFrequency
20k 30k 40k 50k 60k 70k
Core Question:
Is this a “non-linear signal” or normally recorded signal
Nonlineardistortion
Voice signal
𝑣(𝑡) ∙ sin 𝜔1𝑡 + 𝑐 ∙ sin 𝜔1𝑡2 = 𝑣 𝑡 + 𝑐′𝑣2 𝑡 + ⋯
![Page 52: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/52.jpg)
Difficult to decouple “voice signal” and “non-linear signal”
Am
plit
ud
e
10kFrequency
20k 30k 40k 50k 60k 70k
Human voice signals present opportunities …
Signal Forensics
![Page 53: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/53.jpg)
Am
plit
ud
eFrequency
f
2f3f
4f
Opportunity #1: Voice > 50 Hz
Human Voice
![Page 54: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/54.jpg)
Am
plit
ud
eFrequency
f
2f3f
4f
Energy atsub-50Hz band
Opportunity #1: Voice > 50 Hz
Human Voice
![Page 55: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/55.jpg)
Am
pl.
Time
Energy variation in v(t)
Am
pl.
Time
Energy variation in v2(t)
Correlation
Opportunity #2: Correlation
![Page 56: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/56.jpg)
Am
plit
ud
e
10kFrequency
20k 30k 40k 50k 60k 70k
Opportunity #3: Amplitude Skewness
=Amplitude skew
+
![Page 57: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/57.jpg)
1000-10010
-1
8
0
2
4
6
Attack voiceLegitimate voice
Sub-50Hz power Correlation
Am
plit
ude
ske
w
Real voice
Attack voice
5000 Test Cases
![Page 58: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/58.jpg)
Overall Detection Accuracy
![Page 59: Inaudible Voice Commands: The Long-Range Attack and Defense · 2019. 5. 13. · Inaudible Voice Commands: The Long-Range Attack and Defense University of Illinois at Urbana-Champaign](https://reader033.fdocuments.us/reader033/viewer/2022052814/609e1c5fcabc4c52b66c1dbb/html5/thumbnails/59.jpg)
To summarize…
Inaudible Acoustics (> 25 kHz): “Alexa, open the garage door!”Ok
Ok
Ok