DolphinAttack delivered inaudible commands through ultrasonic carriers

Reconstruction

DolphinAttack is an input-injection result, not an exfiltration channel. The attacker begins with an ordinary voice command, modulates it onto an ultrasonic carrier and plays the resulting signal toward a target device. A nearby person does not normally hear the carrier as speech, but the target microphone and its analog front end do not behave as perfectly linear components.

That hardware nonlinearity is the key. Nonlinear microphones or amplifiers create new frequency components from the ultrasonic input. After the normal low-pass stages remove the high-frequency carrier, a baseband component corresponding to the original voice command can remain. The speech-recognition stack then receives something that resembles ordinary audio even though the human operator did not perceive the spoken command. The researchers validated the effect across several contemporary voice-control platforms and demonstrated actions including calls, airplane-mode changes and navigation manipulation.

The result predates current speech-driven LLM agents and should not be rewritten as an LLM attack. Its continuing relevance is narrower: human inaudibility is not an authentication property. Any modern system that accepts consequential microphone input may inherit the general sensor-boundary problem only if its hardware and authorization path remain susceptible.

Mechanism & boundary

1. 01

   Prepare an ordinary voice command

   The attacker starts with speech that the target voice-control system would normally understand.

   Boundary: attacker intent / speech command

2. 02

   Move the command onto an ultrasonic carrier

   Amplitude modulation shifts the command into a frequency range intended to be inaudible to nearby people.

   Boundary: audible baseband / ultrasonic signal

3. 03

   Deliver the signal to the microphone

   The crafted carrier reaches the target microphone through the acoustic environment.

   Boundary: physical environment / microphone front end

4. 04

   Hardware nonlinearity down-converts the signal

   Nonlinear behavior in the microphone or analog circuitry generates a low-frequency component corresponding to the original command before filtering.

   Boundary: ultrasonic input / baseband electrical signal

5. 05

   Speech recognition accepts the recovered command

   The voice-control stack interprets the demodulated baseband as a legitimate instruction and may perform any action its authorization policy permits.

   Boundary: sensor signal / machine-authorized action

Claims & evidence

Implications

DolphinAttack invalidates the assumption that a voice command is trustworthy because a nearby human would have heard it. The demonstrated impact is hardware-dependent command injection against tested voice-control systems. A more serious operational consequence requires an action surface that accepts voice input without sufficient confirmation or authentication. The finding does not establish that every modern microphone, assistant or LLM interface remains vulnerable.

Controls & mitigations

• Filter or attenuate ultrasonic energy at the microphone front end before nonlinear components can down-convert it.
• Detect spectral or waveform features associated with inaudible-command injection rather than relying on human perception.
• Require explicit authentication or confirmation for consequential voice actions so successful audio injection does not directly imply authority.

What remains unknown

• Susceptibility depends on microphone construction, analog circuitry, carrier frequency, playback hardware, distance and acoustic conditions.
• The original demonstrations predate current speech-driven LLM agents and do not establish vulnerability of present-day products.
• The research demonstrates command injection, not compromise of the model provider or autonomous behavior by the assistant.

Connected research