DolphinAttack is an input-injection result, not an exfiltration channel. The attacker begins with an ordinary voice command, modulates it onto an ultrasonic carrier and plays the resulting signal toward a target device. A nearby person does not normally hear the carrier as speech, but the target microphone and its analog front end do not behave as perfectly…
Inspect the ClaimsCase · DiggingBeagle record
DolphinAttack delivered inaudible commands through ultrasonic carriers
DolphinAttack used near-ultrasonic modulation and microphone nonlinearity to inject commands that were inaudible to people but interpreted by speech-recognition systems.
Scope
Input-injection research against voice-controlled systems, not an exfiltration channel and not an LLM-specific result.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
Basis and provenance
Recorded microphone nonlinearity and tested voice-assistant claims establish a command-injection demonstration; the claims do not establish current-product exploitation. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.
Assessed Sep 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DOLPHIN-TESTED · CLM-DOLPHIN-MECHANISM · DolphinAttack: Inaudible Voice Commands
At a glance
DolphinAttack invalidates the assumption that a voice command is trustworthy because a nearby human would have heard it. The demonstrated impact is hardware-dependent command injection against tested voice-control systems. A more serious operational consequence requires an action surface that accepts voice input without sufficient confirmation or…
Read the implicationsSusceptibility depends on microphone construction, analog circuitry, carrier frequency, playback hardware, distance and acoustic conditions. The original demonstrations predate current speech-driven LLM agents and do not establish vulnerability of present-day products. The research demonstrates command injection, not compromise of the model provider or…
Limits and uncertaintyFull account
DolphinAttack is an input-injection result, not an exfiltration channel. The attacker begins with an ordinary voice command, modulates it onto an ultrasonic carrier and plays the resulting signal toward a target device. A nearby person does not normally hear the carrier as speech, but the target microphone and its analog front end do not behave as perfectly linear components.
That hardware nonlinearity is the key. Nonlinear microphones or amplifiers create new frequency components from the ultrasonic input. After the normal low-pass stages remove the high-frequency carrier, a baseband component corresponding to the original voice command can remain. The speech-recognition stack then receives something that resembles ordinary audio even though the human operator did not perceive the spoken command. The researchers validated the effect across several contemporary voice-control platforms and demonstrated actions including calls, airplane-mode changes and navigation manipulation.
The result predates current speech-driven LLM agents and should not be rewritten as an LLM attack. Its continuing relevance is narrower: human inaudibility is not an authentication property. Any modern system that accepts consequential microphone input may inherit the general sensor-boundary problem only if its hardware and authorization path remain susceptible.
Mechanism and trust boundary
- 01
Prepare an ordinary voice command
The attacker starts with speech that the target voice-control system would normally understand.
Boundary: attacker intent / speech command
- 02
Move the command onto an ultrasonic carrier
Amplitude modulation shifts the command into a frequency range intended to be inaudible to nearby people.
Boundary: audible baseband / ultrasonic signal
- 03
Deliver the signal to the microphone
The crafted carrier reaches the target microphone through the acoustic environment.
Boundary: physical environment / microphone front end
- 04
Hardware nonlinearity down-converts the signal
Nonlinear behavior in the microphone or analog circuitry generates a low-frequency component corresponding to the original command before filtering.
Boundary: ultrasonic input / baseband electrical signal
- 05
Speech recognition accepts the recovered command
The voice-control stack interprets the demodulated baseband as a legitimate instruction and may perform any action its authorization policy permits.
Boundary: sensor signal / machine-authorized action
Claims & evidence
CLM-DOLPHIN-TESTEDThe researchers reported successful command recognition across multiple contemporary voice-assistant platforms and devices.supported
Basis: reported finding
- supportsDolphinAttack: Inaudible Voice Commandsrole not specified
Tested devices and proof-of-concept attacks
CLM-DOLPHIN-MECHANISMDolphinAttack modulated voice commands onto ultrasonic carriers and exploited microphone-circuit nonlinearity so speech-recognition systems recovered the commands while humans did not hear them.supported
Basis: reported finding
- supportsDolphinAttack: Inaudible Voice Commandsrole not specified
Introduction and attack overview
Implications
DolphinAttack invalidates the assumption that a voice command is trustworthy because a nearby human would have heard it. The demonstrated impact is hardware-dependent command injection against tested voice-control systems. A more serious operational consequence requires an action surface that accepts voice input without sufficient confirmation or authentication. The finding does not establish that every modern microphone, assistant or LLM interface remains vulnerable.
Controls and mitigations
- Filter or attenuate ultrasonic energy at the microphone front end before nonlinear components can down-convert it.
- Detect spectral or waveform features associated with inaudible-command injection rather than relying on human perception.
- Require explicit authentication or confirmation for consequential voice actions so successful audio injection does not directly imply authority.
Unknowns and contradictions
- Susceptibility depends on microphone construction, analog circuitry, carrier frequency, playback hardware, distance and acoustic conditions.
- The original demonstrations predate current speech-driven LLM agents and do not establish vulnerability of present-day products.
- The research demonstrates command injection, not compromise of the model provider or autonomous behavior by the assistant.
Sources and citation
Material revision history
- Sep 19, 2026 · Published version · first publication · revision 15
- Sep 19, 2026 · Published version · material revision · revision 20Public fields changed: attack_path, implications, mitigations, narrative, timeline, unknowns
- Sep 25, 2026 · Published version · material revision · revision 36Public fields changed: assessment_profile