Hidden Voice Commands: Attacks and Defenses on the VCS of Autonomous Driving Cars

Zhou, Man; Qin, Zhan; Lin, Xiu; Hu, Shengshan; Wang, Qian; Ren, Kui

doi:10.1109/mwc.2019.1800477

Cited by 53 publications

(20 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…"#!$"%"&' ): This attack compromises the environment states x e t to achieve similar consequences as AP3. For example, an adversary can spoof the microphone to assign a wrong navigation mission to a vehicle and force it to reach a designated destination [73].…”

Section: B Attack Pathsmentioning

confidence: 99%

SoK: Rethinking Sensor Spoofing Attacks against Robotic Vehicles from a Systematic View

Xu¹,

Han²,

Deng³

et al. 2022

Preprint

View full text Add to dashboard Cite

Robotic Vehicles (RVs) have gained great popularity over the past few years. Meanwhile, they are also demonstrated to be vulnerable to sensor spoofing attacks. Although a wealth of research works have presented various attacks, some key questions remain unanswered: are these existing works complete enough to cover all the sensor spoofing threats? If not, how many attacks are not explored, and how difficult is it to realize them?This paper answers the above questions by comprehensively systematizing the knowledge of sensor spoofing attacks against RVs. Our contributions are threefold. (1) We identify seven common attack paths in an RV system pipeline. We categorize and assess existing spoofing attacks from the perspectives of spoofer property, operation, victim characteristic and attack goal. Based on this systematization, we identify 4 interesting insights about spoofing attack designs. (2) We propose a novel action flow model to systematically describe robotic function executions and sensor spoofing vulnerabilities. With this model, we successfully discover 104 spoofing attack vectors, 25 of which have been verified by prior works, while 55 attacks are practical but never considered. (3) We design two novel attack methodologies to verify the feasibility of newly discovered spoofing attack vectors.

show abstract

Section: B Attack Pathsmentioning

confidence: 99%

SoK: Rethinking Sensor Spoofing Attacks against Robotic Vehicles from a Systematic View

Xu¹,

Han²,

Deng³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…In speech recognition, special uses for driving scenarios are explored. Some examples include: natural language analysis based on a RNN architecture for commands like "set/change destination or driving speed" in [75], or the the vehicle control system's defense strategy using an SVM classifier that can resist attacks from hidden voice commands in [76].…”

Section: B Human-machine-interfacementioning

confidence: 99%

Artificial Intelligence Methods in In-Cabin Use Cases: A Survey

Han

Hellert

et al. 2021

Preprint

View full text Add to dashboard Cite

As interest in autonomous driving increases, efforts are being made to meet requirements for the high-level automation of vehicles. In this context, the functionality inside the vehicle cabin plays a key role in ensuring a safe and pleasant journey for driver and passenger alike. At the same time, recent advances in the field of artificial intelligence (AI) have enabled a whole range of new applications and assistance systems to solve automated problems in the vehicle cabin. This paper presents a thorough survey on existing work that utilizes AI methods for use-cases inside the driving cabin, focusing, in particular, on application scenarios related to (1) driving safety and (2) driving comfort. Results from the surveyed works show that AI technology has a promising future in tackling in-cabin tasks within the autonomous driving aspect.

show abstract

“…Also, the malicious audio can be perturbed into an unintelligible form in either time domain or frequency domain [1]. To attack the machine learning module in ASRs, recent research shows attackers can produce noise-like [11,32,58,76] or song-like [70] voice commands that cannot be interpreted by human. Psychoacoustic model can also be applied to generate the adversarial audio below the human perception threshold [49].…”

Section: Related Workmentioning

confidence: 99%

When the Differences in Frequency Domain are Compensated: Understanding and Defeating Modulated Replay Attacks on Automatic Speech Recognition

Wang

Cao

et al. 2020

Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

Automatic speech recognition (ASR) systems have been widely deployed in modern smart devices to provide convenient and diverse voice-controlled services. Since ASR systems are vulnerable to audio replay attacks that can spoof and mislead ASR systems, a number of defense systems have been proposed to identify replayed audio signals based on the speakers' unique acoustic features in the frequency domain. In this paper, we uncover a new type of replay attack called modulated replay attack, which can bypass the existing frequency domain based defense systems. The basic idea is to compensate for the frequency distortion of a given electronic speaker using an inverse filter that is customized to the speaker's transform characteristics. Our experiments on real smart devices confirm the modulated replay attacks can successfully escape the existing detection mechanisms that rely on identifying suspicious features in the frequency domain. To defeat modulated replay attacks, we design and implement a countermeasure named DualGuard. We discover and formally prove that no matter how the replay audio signals could be modulated, the replay attacks will either leave ringing artifacts in the time domain or cause spectrum distortion in the frequency domain. Therefore, by jointly checking suspicious features in both frequency and time domains, DualGuard can successfully detect various replay attacks including the modulated replay attacks. We implement a prototype of DualGuard on a popular voice interactive platform, ReSpeaker Core v2. The experimental results show DualGuard can achieve 98% accuracy on detecting modulated replay attacks. CCS CONCEPTS• Security and privacy → Security in hardware; • Humancentered computing → Human computer interaction (HCI).

show abstract

Hidden Voice Commands: Attacks and Defenses on the VCS of Autonomous Driving Cars

Cited by 53 publications

References 6 publications

SoK: Rethinking Sensor Spoofing Attacks against Robotic Vehicles from a Systematic View

SoK: Rethinking Sensor Spoofing Attacks against Robotic Vehicles from a Systematic View

Artificial Intelligence Methods in In-Cabin Use Cases: A Survey

When the Differences in Frequency Domain are Compensated: Understanding and Defeating Modulated Replay Attacks on Automatic Speech Recognition

Contact Info

Product

Resources

About