Technical Summary: Acoustic Adversarial Attacks to Computer Vision Applications

Problem Statement

Artificial Intelligence (AI) systems, particularly those relying on Computer Vision (CV) for critical tasks like autonomous control and security, are increasingly vulnerable to physical-world adversarial attacks. While prior research has established that ultrasonic frequencies (>20 kHz) can disrupt camera stabilization mechanisms, these attacks suffer from rapid signal attenuation in air, limiting their effective range to short distances. Furthermore, existing literature has largely overlooked the potential of lower, audible frequencies (<20 kHz). These lower frequencies possess longer wavelengths, enabling them to diffract around obstructions and propagate further, making them potentially more viable for real-world, long-range attacks. The core problem addressed is the lack of understanding regarding how audible acoustic vibrations interact with commodity camera hardware to induce physical distortions that deceive object detection models.

Methodology

The authors propose a physical attack pipeline where acoustic signals induce mechanical vibrations in a camera, distorting the captured image before it is processed by an AI model. The experimental setup and procedure were as follows:

• Hardware Configuration: The study utilized a Logitech C930e Business Webcam, a commodity device lacking dedicated image stabilization hardware. The camera was rigidly mounted to a high-fidelity speaker to ensure direct mechanical coupling. This setup tested the hypothesis that even without active stabilization sensors, the floating lens autofocus assembly and internal components are susceptible to acoustic resonance.
• Signal Generation: Acoustic waveforms were generated using a Tektronix AFG3100 arbitrary function generator. The researchers focused on sine waves within the audible range (5 Hz to 30 kHz), specifically targeting lower frequencies (0–200 Hz) known to induce mechanical resonance. Signals were transmitted at a fixed amplitude of 8 Vpp.
• Experimental Protocol: The camera recorded a monitor displaying 100 images from the COCO dataset. During a 3-second recording window, specific resonant frequencies were emitted continuously. Preliminary frequency sweeps were conducted to identify "resonant bands" that caused visible video distortions.
• Detection and Analysis: The captured footage was processed using YOLOv11, a one-stage object detection architecture. The analysis involved:
  • Preprocessing: Cropping video frames to isolate the target image.
  • Inference: Running YOLOv11 to generate bounding boxes and confidence scores.
  • Metric Extraction: Calculating average RGB values, pixel areas, detection confidence, and accuracy across the video duration.
  • Error Classification: Categorizing failures into three types: Misclassification (incorrect labels), Suppression (failure to detect existing objects), and Spurious Detection (false positives/hallucinations).

Key Contributions

This work extends the domain of adversarial machine learning by shifting focus from ultrasonic to audible low-frequency acoustic attacks. The primary contributions include:

1. Expansion of Frequency Range: Demonstrating the viability of acoustic attacks using frequencies <20 kHz, which offer superior propagation characteristics compared to the ultrasonic signals used in previous studies.
2. Hardware-Agnostic Vulnerability: Showing that object detection models are vulnerable even when the target camera lacks active image stabilization hardware, provided the physical components (lens assembly, sensor mounts) can resonate.
3. Systematic Analysis of Error Types: Providing a detailed breakdown of how acoustic perturbations degrade model performance, specifically quantifying the shift from correct detection to misclassification, suppression, and hallucination.
4. Real-World Simulation: Utilizing a dynamic setup with live video feeds of standard datasets to approximate real-world conditions, moving beyond static or purely digital simulations.

Results

The experiments revealed that low-frequency acoustic perturbations significantly degrade the performance of the YOLOv11 object detection model:

• Frequency-Dependent Vulnerability: Two specific frequency bands—20–30 Hz and 155–180 Hz—consistently caused the most severe degradation. In these bands, the detection rate dropped by nearly 10% compared to the baseline (no sound) condition.
• Confidence Reduction: At resonant frequencies, the average detection confidence score decreased by over 7%, indicating increased model uncertainty.
• Visual Artifacts: The induced vibrations caused micro-movements in the lens and sensor, resulting in motion blur, geometric skew, and frame jitter. These physical distortions were sufficient to confuse the feature extraction layers of the neural network.
• Specific Failure Modes:
  • Misclassification: Objects were assigned incorrect labels (e.g., a road segment misclassified as a person).
  • Suppression: Legitimate objects were entirely missed (e.g., bowls and cups failing to trigger detection).
  • Spurious Detection: The model hallucinated objects in blank areas, likely interpreting motion artifacts as valid object features.

Significance and Claims

The paper claims that this research highlights a critical, often overlooked physical security risk in AI perception systems. The significance lies in the nature of the attack:

• Stealth and Accessibility: Unlike digital adversarial examples that require model knowledge or direct access to the input pipeline, this attack can be executed with basic audio equipment from a distance, without accessing the software or hardware internals of the target system.
• Ineffectiveness of Traditional Defenses: Because the attack distorts the physical capture process rather than manipulating digital pixel values, traditional defenses such as adversarial training or input pre-processing are ineffective.
• Broader Applicability: The findings suggest that the vulnerability is not limited to cameras with active stabilization but extends to the fundamental mechanical design of commodity cameras. The authors argue that this necessitates a re-evaluation of hardware security in CV applications and the development of novel mitigation strategies that account for physical-sensor interactions.

The authors maintain a modest stance, acknowledging limitations such as the use of a single camera model (C930e) and a fixed, directional acoustic source. They posit that future work must explore a wider variety of camera architectures and dynamic, multi-source interference scenarios to fully characterize the threat landscape.