WaLi: Can Pressure Sensors in HVAC Systems Capture Human Speech?

This paper introduces WaLi, a novel attack framework that leverages standard HVAC pressure sensors to reconstruct intelligible human speech from noisy, low-resolution data using a complex-valued conformer and Complex Global Attention Block, thereby revealing a significant, previously unaddressed privacy vulnerability in building infrastructure.

The Gist

Imagine your building's heating and air conditioning system (HVAC) as the lungs of a building. Just like human lungs, they need to constantly check the air pressure to know if the "breathing" is working correctly. To do this, they use tiny, sensitive pressure sensors hidden inside the walls, near vents, or in the ducts.

For years, we thought these sensors were just boring mechanical parts, only listening to the "wind" of the air. But this paper, titled "WaLi" (Wall can Listen), reveals a scary secret: these sensors can actually hear you talk.

Here is the story of how this works, explained simply:

1. The Accidental Eavesdropper

When you speak, your voice creates tiny ripples in the air pressure. Think of it like throwing a pebble into a pond; the ripples spread out.

• The Problem: These pressure sensors are so sensitive that they can feel those ripples even when you are standing a few feet away.
• The Catch: The sensors are like old, low-quality radios. They are designed to check air pressure, not record music. They "sample" (take a snapshot of) the sound very slowly (only 500 to 2,000 times a second).
• The Result: If you recorded your voice with these sensors, it would sound like a garbled, robotic mess. It's like trying to understand a song by looking at only 5 blurry frames of a music video. You can't make out the words.

2. The Magic Trick: "WaLi"

The researchers built a new AI system called WaLi that acts like a super-smart audio restorer. Its job is to take that garbled, robotic mess and turn it back into clear, intelligible speech.

Think of it like this:

• The Input: A blurry, low-resolution photo of a face.
• The AI: A digital artist who knows exactly what a human face looks like.
• The Output: A crystal-clear, high-definition portrait.

WaLi does this by using a special type of AI brain (a "Complex-Valued Conformer") that understands two things at once:

1. The Volume (Magnitude): How loud the sound is.
2. The Timing (Phase): The precise rhythm and timing of the sound waves.

Most previous attempts at this only looked at the volume, which is like trying to understand a song by only looking at the volume knob. WaLi looks at the timing too, which is crucial for understanding words, especially when there is background noise like a loud fan.

3. The "Ghost in the Machine"

The scariest part is how easy it is for an attacker to do this. They don't need to break into your house or plant a microphone.

• The Access: Building managers and maintenance crews already have access to the data from these sensors to check if the air filters are clogged or if the temperature is right.
• The Attack: An attacker could pretend to be a maintenance worker, log into the building's computer system, download the "pressure data," and run it through WaLi.
• The Outcome: Suddenly, they can hear your private conversations in the office, the hospital room, or the cleanroom, even though you were just talking to a colleague next to a vent.

4. Why This Matters (The "So What?")

The researchers tested this in real industrial buildings and found that:

• It works: They could reconstruct sentences clearly enough for a computer to read them back to you (with about 20-30% error, which is actually quite good for such a weird source).
• It works even with noise: Even with the loud hum of fans and air ducts, WaLi could filter out the noise and hear the voice.
• It works on strangers: The AI doesn't need to know your voice beforehand. It can learn to hear anyone talking.

5. How to Stop It (The Defenses)

The paper also suggests some simple fixes, like putting a sound-dampening foam box around the sensor (like putting a pillow over a microphone) or using longer tubes to connect the sensor to the air. This blocks the sound waves from reaching the sensor while still letting the air pressure through.

The Bottom Line

This paper is a wake-up call. We treat our smart buildings as helpful tools, but they are full of hidden ears. WaLi proves that if you talk near an air vent, you might as well be shouting your secrets into a microphone that the building management system is recording. It turns the "lungs" of the building into a spy tool.

Technical Summary

Here is a detailed technical summary of the paper "WaLi: Can Pressure Sensors in HVAC Systems Capture Human Speech?"

1. Problem Statement

The paper identifies a critical privacy vulnerability in modern Heating, Ventilation, and Air Conditioning (HVAC) systems.

• The Vulnerability: Differential Pressure Sensors (DPS), integral to HVAC systems for monitoring air filters, duct pressure, and room pressure, operate within a pressure range of 0–10 Pa and support sampling frequencies of 0.5–2 kHz.
• The Threat: Human speech generates pressure fluctuations within the same 0–10 Pa range and has an intelligible bandwidth of up to 4 kHz. Because DPSs are often installed near humans (e.g., in corridors, near diffusers, or in cleanrooms), they inadvertently capture acoustic vibrations caused by speech.
• The Challenge: Reconstructing intelligible speech from these sensors is difficult due to two main factors:
  1. Aliasing: The sensor sampling rates (0.5–2 kHz) are significantly lower than the Nyquist rate required for 4 kHz speech, causing severe aliasing and loss of high-frequency components.
  2. Transient Noise: HVAC systems generate significant transient noise (fan vibrations, duct turbulence, physical shocks) that corrupts the signal, degrading the Signal-to-Noise Ratio (SNR) and distorting both magnitude and phase.
• Limitations of Prior Work: Previous studies could only detect "hot words" or required ground-truth audio of the specific victim for training. They also failed to reconstruct clean phase information under noisy conditions, resulting in unintelligible audio.

2. Methodology: The WaLi System

The authors propose WaLi (Wall can Listen), a deep learning-based acoustic eavesdropping system designed to reconstruct intelligible speech from low-resolution, noisy pressure sensor data.

A. Core Architecture

WaLi utilizes a Complex-Valued U-Net architecture with the following components:

• Complex-Valued Input: Instead of treating the signal as real-valued magnitude only, WaLi processes the data as Complex Time-Frequency (T-F) Spectrograms (containing both Magnitude and Phase). This is crucial because phase information is vital for speech intelligibility, especially in noisy environments.
• Complex Encoders/Decoders: The network uses complex-valued convolutions, Complex Batch Normalization (CBN), and Complex ReLU activations to preserve the relationship between real and imaginary parts of the signal throughout the network.
• Complex Conformer: Located in the bottleneck layer, this module combines Convolutional Neural Networks (CNNs) and Transformers. It captures both local dependencies (via CNNs) and global context (via self-attention) to map low-frequency aliased components to missing high-frequency speech components.
• Complex Global Attention Block (CGAB): A novel component designed to capture long-range correlations along both the time axis (inter-phoneme dependencies) and the frequency axis (harmonic/formant relationships). Unlike prior work that only analyzed time, CGAB jointly models the T-F structure.
• Complex Skip Connections: These allow high-dimensional complex features to flow from encoders to decoders, aiding in the reconstruction of fine spectral details.

B. Training and Loss Function

• Complex Multi-Resolution STFT Loss: WaLi is trained using a loss function that separately evaluates the error on both the real (magnitude) and imaginary (phase) parts of the Short-Time Fourier Transform (STFT) across multiple resolutions. This ensures the model learns to reconstruct clean phase information, not just magnitude.
• Training Data: The model is trained on a mix of real-world HVAC pressure data and the VCTK speech corpus. Crucially, it is trained to generalize across different speakers without needing the victim's specific voice data.

3. Key Contributions

1. First Intelligible Speech Reconstruction: WaLi is the first method to reconstruct unrestricted vocabulary intelligible speech from pressure sensors, whereas previous works were limited to keyword spotting.
2. Complex-Valued Phase Reconstruction: It introduces a complex-valued network architecture that jointly reconstructs magnitude and phase, overcoming the limitations of real-valued networks that fail to recover clean phase in noisy conditions.
3. Robustness to Transient Noise: The system effectively handles HVAC-specific transient noise (fans, vibrations) by reconstructing the missing high-frequency components and cleaning the phase, achieving intelligibility even at low SNR.
4. Speaker Independence: The model does not require ground-truth audio of the specific victim for training, making the attack more practical and flexible compared to prior side-channel attacks.

4. Experimental Results

The authors evaluated WaLi in two anonymous industrial facilities (including an FDA-compliant cleanroom) using three different commercial DPS models (SDP810-125PA, SDP810-500PA, SETRA264).

• Performance Metrics: Evaluated using six metrics: Log Spectral Distance (LSD), NISQA-MOS, SI-SDR, PESQ, STOI, and Word Error Rate (WER).
• Upsampling Results (500 Hz to 8 kHz):
  • LSD: Improved from 3.45 (raw) to 1.24 (reconstructed).
  • NISQA-MOS: Improved from 0.84 (raw) to 1.78 (reconstructed).
  • PESQ: Improved from 0.87 to 1.51.
  • WER: Reduced from 98% (raw) to **38%** (reconstructed) using Whisper and AssemblyAI.
• Noise Robustness: In noisy conditions, WaLi significantly outperformed the Griffin-Lim algorithm (used in prior works) and real-valued networks, demonstrating superior phase recovery.
• Attack Feasibility: The attack is feasible when the speaker is within 1.2 meters, speaking at ≥60 dB, with an orientation near 0° relative to the sensor. Empirical studies suggest ~25% of conversations near entrance doors meet these constraints.

5. Significance and Implications

• Privacy Threat: The paper demonstrates that standard building infrastructure (HVAC sensors) can be weaponized for high-fidelity eavesdropping. This poses a severe risk to confidential discussions in corporate offices, hospitals, and industrial facilities.
• Paradigm Shift: It challenges the assumption that low-sampling-rate sensors are safe from audio eavesdropping. The ability to reconstruct full-bandwidth speech from sub-Nyquist sampling rates via deep learning is a significant advancement in side-channel attacks.
• Countermeasures: The authors propose practical defenses, including:
  • Audio Damping: Using longer sampling tubes (>1m) or enclosing sensors in sound-damping foam.
  • Sampling Rate Reduction: Lowering the sampling frequency below 500 Hz (though this may compromise HVAC control performance in some applications).

In conclusion, WaLi represents a critical security finding, proving that the "Internet of Things" in building automation can inadvertently serve as a powerful surveillance tool, necessitating immediate attention to sensor privacy in smart building design.