Pith. sign in

REVIEW 3 major objections 6 minor 96 references

EveGuard: Defeating Vibration-based Side-Channel Eavesdropping with Audio Adversarial Perturbations

T0 review · 3 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read EveGuard scrambles speech for vibration spies, not for human ears.

desk verdict A well-engineered software-only defense against vibration eavesdropping, but the core frequency-response assumption is only validated on low-bandwidth sensors; a wideband vibrometer could bypass the main perturbation component. read the letter →

arxiv 2411.10034 v2 pith:M7NQNUKG submitted 2024-11-15 cs.CR cs.MMcs.SDeess.AS

Jung-Woo Chang , Ke Sun , David Xia , Xinyu Zhang , Farinaz Koushanfar This is my paper · ORCID
classification cs.CRcs.MMcs.SDeess.AS
keywords adversarialaudioperturbationsside-channeleavesdroppingmmWaveradarvoiceprivacygenerativenetworkfew-shotdomaintranslationlow-frequencyspeechrecognitionresistance
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that vibration-based side-channel eavesdropping—recovering speech from mmWave radar, accelerometers, or optical sensors that pick up sound-induced vibrations—can be defeated in software before the audio is even played. EveGuard adds perturbations concentrated below 500 Hz, where these sensors listen but human hearing is least sensitive, so the eavesdropper's reconstruction becomes noise while the legitimate listener still hears clean speech. To train those perturbations, the paper builds Eve-GAN, a differentiable few-shot translator that simulates the eavesdropping channel from unpaired audio and sensor samples, enabling end-to-end optimization against an ensemble of surrogate attack models. If the central claim is right, this would give loudspeaker owners a practical, hardware-free privacy defense that works across attack distances, materials, and sensor types.

What carries the argument

Two learned components carry the argument. Eve-GAN is a few-shot unpaired audio-to-side-channel translator: given clean audio and one reference eavesdropped sample, it outputs what that audio would sound like after passing through a particular sensor channel, making the attacker's reconstruction differentiable for gradient-based optimization. The Perturbation Generator Model (PGM) is a two-stage network: an FIR generator produces time-varying frequency-domain filters through a VAE-GAN bottleneck for spectral reshaping, and an LFAP generator emits random low-frequency (below 500 Hz) noise normalized by SNR; a discriminator keeps the output close to natural speech and diversifies the perturbations. Together they convert the defense into an end-to-end optimizable problem whose solution is imperceptible to humans but destructive to vibration-based eavesdroppers.

What would settle it

Run EveGuard against a side channel whose sensor has a flat, high-sensitivity response below 500 Hz, such as a high-end laser vibrometer or an accelerometer mounted directly on the speaker enclosure, and measure whether reconstructed speech still exceeds the reported WER and MCD thresholds; if the eavesdropper recovers intelligible speech, the surrogate-transfer assumption fails.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central claim is that the frequency-response gap between vibrometry sensors and microphones is a reliable handle for privacy: side channels capture mostly low-frequency vibration while microphones and ears perceive the full band, with minimal human sensitivity below 500 Hz. EveGuard exploits this by generating two kinds of perturbations—a VAE-GAN-driven FIR filter that reshapes the audio spectrum and low-frequency adversarial perturbations—trained end-to-end through Eve-GAN and an ensemble of ten surrogate speech recognizers and classifiers. The reported result is that eavesdropped audio becomes unintelligible: Mel-Cepstral Distortion rises from roughly 3.4 to 13.6, Word Error Rate exceeds 68 percent, digit-classifier accuracy drops below 5 percent, while PESQ stays at 3.42, meaning the perturbed audio is perceptually close to the original, confirmed by a user study. EveGuard also reports robustness to adversarial training, perturbation removal, and speech transformations, and low enough latency for VoIP. The paper explicitly scopes EveGuard to loudspeaker playback and notes that it does not cover throat-vibration eavesdropping on live human speech.

Load-bearing premise

The whole defense rests on the assumption that the differentiable Eve-GAN surrogate faithfully matches the real eavesdropping channel in the low-frequency band where perturbations live, so that perturbations optimized against it transfer to real sensors.

Editorial extensions

If this is right

  • Loudspeaker privacy can be protected without hardware jammers, shields, or vibration motors, simply by preprocessing audio before playback.
  • The same defense transfers across mmWave radar frequencies, sampling rates, antenna configurations, distances, angles, volumes, insulators, and reverberating materials, because perturbations are placed in the band every tested sensor hears.
  • Perturbation diversity from random latent vectors makes it hard for an attacker who knows about EveGuard to train a denoiser or robust recognizer, since the perturbation distribution is not fixed.
  • EveGuard is deployable in real-time voice pipelines: 50 ms segments process in 2.7 to 11.7 ms on tested hardware, under the 150 ms VoIP budget.
  • Because the defense acts before playback, it also works for optical and accelerometer side channels, not just mmWave radar.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same low-frequency insertion principle could be ported to electromagnetic side channels and other vibration sensors if they exhibit a comparable low-frequency-dominant response, a direction the paper itself flags as future work.
  • The method's success hinges on low-frequency perturbations surviving the acoustic path to the vibrating object; testing in noisier, more reverberant, or more damped rooms where LFAP energy dissipates would be a natural stress test not covered by the reported scenarios.
  • If Eve-GAN's surrogate underestimates the true channel's sensitivity at higher frequencies for some sensor, the defense may need per-sensor calibration or an expanded ensemble to stay effective.
  • The few-shot, unpaired translation recipe could be reused to model other sensing channels, such as through-wall radar or lidar, for other privacy defenses without collecting paired clean and eavesdropped audio.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes EveGuard, a software-only defense that adds imperceptible low-frequency adversarial perturbations to loudspeaker audio before playback, aiming to make vibration-based side-channel eavesdropping (mmWave radar, accelerometer, optical/laser sensor) fail to recover intelligible speech. The defense is a two-stage Perturbation Generator Model (PGM) combining FIR filtering with low-frequency adversarial perturbations (LFAPs), trained end-to-end through a learned differentiable surrogate of the eavesdropping channel called Eve-GAN, which uses few-shot unpaired audio-to-SSEA translation to reduce data collection cost. Evaluation on re-implemented SSEAs across sensors, distances, angles, materials, sampling rates, and adaptive attacks reports MCD above 13.4, WER above 68%, DDR at or below 3%, PESQ 3.42, and a 24-participant user study.

Significance. If the frequency-response premise holds, EveGuard is a valuable contribution: it is a software-only, hardware-free defense against multiple vibration side channels, with a plausible transfer mechanism and unusually broad experimental coverage including unseen rooms, materials, and adaptive attackers. The few-shot Eve-GAN is a practical modeling contribution, and the explicit comparison against Gaussian noise and vanilla adversarial perturbations is informative. The paper also ships a public demo audio page, which strengthens the perceptual claims. However, the claimed generality over all vibration-based SSEAs is not yet established because the central premise that side channels are insensitive above roughly 2 kHz is untested for wideband vibrometers; with that caveat, the contribution is significant but needs additional validation.

major comments (3)
  1. [Section 4.1, Table 1, Table 11] The defense's load-bearing premise is that vibration-based side channels have near-zero SNR above roughly 2 kHz, so an inaudible LFAP below 500 Hz dominates the eavesdropped signal. This premise is not tested for wideband sensors. The paper itself concedes that a high-end laser vibrometer (LV-FS01) can enhance the frequency response (Section 4.1), and Table 1 lists VibSpeech with up to 16 kHz sampling. All EveGuard experiments use a 77/60 GHz mmWave radar with a 10 or 12 kHz chirp, a 500 Hz accelerometer, and a low-end optical sensor; no wideband vibrometer is evaluated. Since Table 11 shows that LFAP is the component responsible for the MCD increase (13.1 vs. 4.8 for FIR alone), an attacker who can recover the untouched bands above 500 Hz could bypass most of the defense. Please add an evaluation against a wideband sensor (e.g., a VibSpeech-class or LV-FS01-class device), or explicitly restrict the threat model to sensors with poor high-frequency response.
  2. [Section 6.4, Tables 5 and 9] The main quantitative claims are reported as single-point MCD, WER, and DDR values without error bars, standard deviations, or test-set sizes. Because the central claim of more than 97% protection and the comparisons to Gaussian and VAP baselines depend on these numbers, the paper should report means and confidence intervals over repeated sensor captures and over the test utterances. Without these, it is difficult to assess whether the differences between conditions and baselines are significant, and the reader cannot gauge run-to-run variability of the sensor channel.
  3. [Section 5.3, Section 6.7] The fidelity of the surrogate Eve-GAN is quantified only by SSIM on full spectrograms (94.02% for mmWave and 96.51% for accelerometer), which does not directly constrain the sub-500 Hz band where LFAP energy is placed. The end-to-end transfer experiments in Section 6.4 provide indirect evidence that the surrogate works for the specific sensor hardware evaluated, but they do not establish gradient alignment for unseen wideband hardware. If the surrogate diverges in the LFAP band for a different sensor, the optimized perturbations may not transfer. Please report a spectral fidelity metric focused on the LFAP band, or evaluate with a second independently built surrogate channel, to strengthen this link.
minor comments (6)
  1. [Section 6.1] There is a typo: "EvGuard" should be "EveGuard".
  2. [Figure 12(b)] The text says "WER of up to 85.5" in the caption; this should be "85.5%".
  3. [Equation (10)] The symbol Y^k_s is used for a probability of a class label; please use a probability notation such as P^k_s for consistency with P r^k_s.
  4. [Appendix H] Appendix H contains the program committee meta-review from a prior venue. This is not part of the scientific content of a journal submission and should be removed before publication.
  5. [Section 5.1, Equation (1)] The objective in Equation (1) is written as an arg max with hard constraints, while the training loss in Equation (7) is a weighted sum. Please clarify how the constraints are enforced or map the Lagrangian weights to the constraints.
  6. [Section 6.6] Please report whether all 24 participants heard the same 30 audio pairs and how the Likert-scale responses were aggregated into the reported averages.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: EveGuard's headline protection numbers are validated against independently re-implemented SSEAs, and the differentiable Eve-GAN is a modeling tool rather than the benchmark.

full rationale

The derivation chain is self-contained with respect to the central claims. Eve-GAN (Eq. 6, Sec. 5.3) is trained on real SSEA samples but is used only as a differentiable surrogate for end-to-end PGM optimization; the reported defense results (Sec. 6.4, Table 5: MCD 13.6, WER 70.1%, DDR 2%, PESQ 3.42) are obtained by replaying perturbed audio through separately re-implemented real mmWave/IMU/optical SSEA pipelines (Sec. 6.1, Table 14) with hardware, rooms, and datasets distinct from EveGuard's training (Sec. 6.2, Appendix C). The training losses Lens and Lrec in Eqs. 10-11 are objectives, not the measured evaluation metrics, so the performance claims are not equal to the optimization objective by construction. The SNR parameter rho is tuned in Fig. 15, but rho controls perturbation power; it is not a renamed prediction of MCD or PESQ, and the defense is also tested across distances, angles, volumes, materials, sampling rates, and adaptive attacks. The one author self-citation, [10], supports the observation that diverse random perturbations make adaptive training hard; it is not load-bearing because Table 12 directly demonstrates that result. The wideband-vibrometer concern raised in Sec. 4.1 is a generalization/correctness risk, not circularity: the evaluated sensors match the low-frequency premise, and no claim in the paper asserts that LFAP is tested on a wideband LV-FS01-class sensor.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new physical entities; Eve-GAN and PGM are machine-learning models, not postulated physical objects. The ledger captures the tuning parameters and domain assumptions that the central claim depends on, especially the frequency-response separation between human hearing and vibration sensors and the fidelity of the Eve-GAN surrogate.

free parameters (4)
  • LFAP SNR rho = 16 dB
    Empirically chosen in Sec. 6.7 (Figure 15) to balance MCD and PESQ; the defense's perceptual-quality and effectiveness claims depend on this value.
  • PGM loss weights lambda_kl, lambda_ens, lambda_rec = 1, 1, 10
    Set in Appendix E; tuned to stabilize PGM training and are not derived from first principles.
  • Eve-GAN loss weights beta_con, beta_fm = 1, 1
    Set in Appendix E; hyperparameters of the few-shot translator training.
  • LFAP cutoff frequency = 500 Hz
    Chosen based on the preliminary frequency-response study (Sec. 4.1-4.2); a design assumption that human ear and side-channel responses separate at this frequency, not fitted to defense metrics.
assumptions (5)
  • domain assumption Vibrometry-based side channels have consistently low SNR above roughly 1-2 kHz across hardware and scenarios (Sec. 4.1, Fig. 3, Appendix A).
    Supported by the authors' measurements on three sensor types; the defense relies on this to place perturbations below 500 Hz. If a future attacker's sensor has flat response up to 4 kHz, the LFAP strategy weakens.
  • domain assumption Human hearing is insensitive to frequencies below 500 Hz, so perturbations there are imperceptible (Sec. 4.2, Fig. 4).
    Based on equal-loudness contours and a small AWGN listening test (n=24); the structured LFAP may behave differently from AWGN, and the user study is modest in size.
  • standard math Adversarial perturbations trained on an ensemble of surrogate models transfer to black-box attacker models (Sec. 5.4, Eq. 10).
    Standard transferability assumption in adversarial ML, cited [8], [43]. The paper provides empirical support in its evaluation, but transfer is not guaranteed.
  • domain assumption Eve-GAN's spectrogram SSIM of 94% (Sec. 6.7) implies the surrogate accurately models the true SSEA channel for optimization purposes.
    High SSIM does not guarantee gradient alignment in the low-frequency band where perturbations are injected; this is a load-bearing modeling assumption.
  • domain assumption The attacker's ML models (cGAN enhancement, transformer STT, digit classifier) represent realistic SOTA eavesdroppers (Sec. 6.1, Appendix B).
    The evaluation is against author re-implementations following published methods; real attackers could use different architectures, so the absolute protection rate is an estimate.

how reviews work

0 comments
Cite this review

Pith. "Pith review of EveGuard: Defeating Vibration-based Side-Channel Eavesdropping with Audio Adversarial Perturbations." pith.science (2026). https://pith.science/paper/M7NQNUKG

@misc{pith2026241110034,
  author       = {Pith},
  title        = {Pith review of: EveGuard: Defeating Vibration-based Side-Channel Eavesdropping with Audio Adversarial Perturbations},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/M7NQNUKG}},
  note         = {Machine review of arXiv:2411.10034}
}
read the original abstract

Vibrometry-based side channels pose a significant privacy risk, exploiting sensors like mmWave radars, light sensors, and accelerometers to detect vibrations from sound sources or proximate objects, enabling speech eavesdropping. Despite various proposed defenses, these involve costly hardware solutions with inherent physical limitations. This paper presents EveGuard, a software-driven defense framework that creates adversarial audio, protecting voice privacy from side channels without compromising human perception. We leverage the distinct sensing capabilities of side channels and traditional microphones, where side channels capture vibrations and microphones record changes in air pressure, resulting in different frequency responses. EveGuard first proposes a perturbation generator model (PGM) that effectively suppresses sensor-based eavesdropping while maintaining high audio quality. Second, to enable end-to-end training of PGM, we introduce a new domain translation task called Eve-GAN for inferring an eavesdropped signal from a given audio. We further apply few-shot learning to mitigate the data collection overhead for Eve-GAN training. Our extensive experiments show that EveGuard achieves a protection rate of more than 97 percent from audio classifiers and significantly hinders eavesdropped audio reconstruction. We further validate the performance of EveGuard across three adaptive attack mechanisms. We have conducted a user study to verify the perceptual quality of our perturbed audio.

Figures

Figures reproduced from arXiv: 2411.10034 by the authors.

Figure 1
Figure 1. Overview of EveGuard, inserting imperceptible [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Feasibility study settings and results (The sampling rate of smartphone’s accelerometer is [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 4
Figure 4. Equal-soundness contour and imperceptibility gain curve. (a) AWGN (under 500Hz) (b) AWGN (under 1000Hz) [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figures from the paper (12 more)
Figure 5
Figure 5. Figure 5: Impact of AWGN with different frequency bands [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: EveGuard training and deployment process. [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: The general workflow of few-shot Eve-GAN consists of a few-shot audio translator and discriminator. [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 8
Figure 8. Figure 8: Visualization of PGM. Yellow modules form the FIR generator; purple modules form the LFAP generator. [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 9
Figure 9. Figure 9: Layout of the experimental environment. (a) The [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]
Figure 10
Figure 10. Figure 10: Spectrograms measured by different side chan [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 11
Figure 11. Figure 11: Micro benchmark. V, O, and R denote voice source, reverberating object, and radar, respectively. [PITH_FULL_IMAGE:figures/full_fig_p011_11.png]
Figure 12
Figure 12. Figure 12: MCD, WER, and DDR of different (a) insulators [PITH_FULL_IMAGE:figures/full_fig_p012_12.png]
Figure 14
Figure 14. Figure 14: User study assessing the intelligibility of eaves [PITH_FULL_IMAGE:figures/full_fig_p013_14.png]
Figure 13
Figure 13. Figure 13: MCD, WER, and DDR of different (a) place [PITH_FULL_IMAGE:figures/full_fig_p013_13.png]
Figure 15
Figure 15. Figure 15: Impact of LFAP’s power [PITH_FULL_IMAGE:figures/full_fig_p014_15.png]
Figure 17
Figure 17. Figure 17: Comparison of measured frequency responses [PITH_FULL_IMAGE:figures/full_fig_p017_17.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

96 extracted references · 69 canonical work pages

  1. [1]

    Your android’s accelerometer could be used to eavesdrop on your calls, 2019

    2019

  2. [2]

    Normal equal-loudness-level contours

    ISO Acoustics. Normal equal-loudness-level contours. ISO, 226:2003, 2003

    2003

  3. [3]

    Robust adversarial attacks against dnn-based wireless communication systems

    Alireza Bahramali, Milad Nasr, Amir Houmansadr, Dennis Goeckel, and Don Towsley. Robust adversarial attacks against dnn-based wireless communication systems. In Proceedings of the 2021 ACM SIGSAC conference on computer and communications security, pages 126–140, 2021

    2021

  4. [4]

    mmspy: Spying phone calls using mmwave radars

    Suryoday Basak and Mahanth Gowda. mmspy: Spying phone calls using mmwave radars. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1211–1228. IEEE, 2022

    2022

  5. [5]

    Interpreting and explaining deep neural networks for classification of audio signals

    S ¨oren Becker, Marcel Ackermann, Sebastian Lapuschkin, Klaus- Robert M¨uller, and Wojciech Samek. Interpreting and explaining deep neural networks for classification of audio signals. arXiv preprint arXiv:1807.03418, 2018

    arXiv 2018

  6. [6]

    Ex- perimental study on sound quality of various audio fade lengths

    Jedrzej Borowski, Krzysztof Bulawski, and Krzysztof Goliasz. Ex- perimental study on sound quality of various audio fade lengths. In Audio Engineering Society Convention 144 . Audio Engineering Society, 2018

    2018

  7. [7]

    Informational and energetic masking effects in the perception of two simultaneous talkers

    Douglas S Brungart. Informational and energetic masking effects in the perception of two simultaneous talkers. The Journal of the Acoustical Society of America , 109(3):1101–1109, 2001

    2001

  8. [8]

    Blackbox attacks via surrogate en- semble search

    Zikui Cai, Chengyu Song, Srikanth Krishnamurthy, Amit Roy- Chowdhury, and Salman Asif. Blackbox attacks via surrogate en- semble search. Advances in Neural Information Processing Systems , 35:5348–5362, 2022

    2022

Show all 96 references
  1. [9]

    Audio adversarial examples: Targeted attacks on speech-to-text

    Nicholas Carlini and David Wagner. Audio adversarial examples: Targeted attacks on speech-to-text. In 2018 IEEE security and privacy workshops (SPW), pages 1–7. IEEE, 2018

    2018

  2. [10]

    Magmaw: Modality-agnostic adversarial attacks on machine learning-based wireless communica- tion systems

    Jung-Woo Chang, Ke Sun, Nasimeh Heydaribeni, Seira Hidano, Xinyu Zhang, and Farinaz Koushanfar. Magmaw: Modality-agnostic adversarial attacks on machine learning-based wireless communica- tion systems. In 2025 Network and Distributed System Security Symposium (NDSS), 2025

    2025

  3. [11]

    Metamorph: Injecting inaudible commands into over-the-air voice controlled systems

    Tao Chen, Longfei Shangguan, Zhenjiang Li, and Kyle Jamieson. Metamorph: Injecting inaudible commands into over-the-air voice controlled systems. In Network and Distributed Systems Security (NDSS) Symposium, 2020

    2020

  4. [12]

    {Devil’s} whisper: A general approach for physical adversarial attacks against commercial black- box speech recognition devices

    Yuxuan Chen, Xuejing Yuan, Jiangshan Zhang, Yue Zhao, Shengzhi Zhang, Kai Chen, and XiaoFeng Wang. {Devil’s} whisper: A general approach for physical adversarial attacks against commercial black- box speech recognition devices. In 29th USENIX Security Symposium (USENIX Securit...

    2020

  5. [13]

    Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition

    Valeriia Cherepanova, Micah Goldblum, Harrison Foley, Shiyuan Duan, John Dickerson, Gavin Taylor, and Tom Goldstein. Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition. arXiv preprint arXiv:2101.07922 , 2021

    2021 arXiv

  6. [14]

    Tempest comeback: A realistic audio eavesdropping threat on mixed-signal socs

    Jieun Choi, Hae-Yong Yang, and Dong-Ho Cho. Tempest comeback: A realistic audio eavesdropping threat on mixed-signal socs. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pages 1085–1101, 2020

    2020

  7. [15]

    Alexa and google home devices leveraged to phish and eavesdrop on users, again, 2019

    Catalin Cimpanu. Alexa and google home devices leveraged to phish and eavesdrop on users, again, 2019

    2019

  8. [16]

    Jammer enforcement, 2020

    Federal Communications Commission. Jammer enforcement, 2020

    2020

  9. [17]

    Rf-net: A uni- fied meta-learning framework for rf-enabled one-shot human activity recognition

    Shuya Ding, Zhe Chen, Tianyue Zheng, and Jun Luo. Rf-net: A uni- fied meta-learning framework for rf-enabled one-shot human activity recognition. In Proceedings of the 18th Conference on Embedded Networked Sensor Systems , pages 517–530, 2020

    2020

  10. [18]

    Darpa timit acoustic-phonetic continous speech corpus cd-rom

    John S Garofolo, Lori F Lamel, William M Fisher, Jonathan G Fiscus, and David S Pallett. Darpa timit acoustic-phonetic continous speech corpus cd-rom. nist speech disc 1-1.1. NASA STI/Recon technical report n, 93:27403, 1993

    1993

  11. [19]

    Generative adversarial nets

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in neural information process- ing systems, 27, 2014

    2014

  12. [20]

    Connectionist temporal classification: labelling unseg- mented sequence data with recurrent neural networks

    Alex Graves, Santiago Fern ´andez, Faustino Gomez, and J ¨urgen Schmidhuber. Connectionist temporal classification: labelling unseg- mented sequence data with recurrent neural networks. In Proceedings of the 23rd international conference on Machine learning, pages 369– 376, 2006

    2006

  13. [21]

    Specpatch: Human-in-the-loop adversarial audio spectrogram patch attack on speech recognition

    Hanqing Guo, Yuanda Wang, Nikolay Ivanov, Li Xiao, and Qiben Yan. Specpatch: Human-in-the-loop adversarial audio spectrogram patch attack on speech recognition. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , pages 1353–1366, 2022

    2022

  14. [22]

    Hierarchical patch vae-gan: Generating diverse videos from a single sample

    Shir Gur, Sagie Benaim, and Lior Wolf. Hierarchical patch vae-gan: Generating diverse videos from a single sample. Advances in Neural Information Processing Systems , 33:16761–16772, 2020

    2020

  15. [23]

    mmecho: A mmwave-based acoustic eavesdropping method

    Pengfei Hu, Wenhao Li, Riccardo Spolaor, and Xiuzhen Cheng. mmecho: A mmwave-based acoustic eavesdropping method. In Proceedings of the ACM Turing Award Celebration Conference-China 2023, pages 138–140, 2023

    2023

  16. [24]

    Milliear: Millimeter-wave acoustic eavesdropping with unconstrained vocabulary

    Pengfei Hu, Yifan Ma, Panneer Selvam Santhalingam, Parth H Pathak, and Xiuzhen Cheng. Milliear: Millimeter-wave acoustic eavesdropping with unconstrained vocabulary. In IEEE INFOCOM 2022-IEEE Conference on Computer Communications , pages 11–20. IEEE, 2022

    2022

  17. [25]

    Accear: Accelerometer acoustic eavesdropping with unconstrained vocabu- lary

    Pengfei Hu, Hui Zhuang, Panneer Selvam Santhalingam, Riccardo Spolaor, Parth Pathak, Guoming Zhang, and Xiuzhen Cheng. Accear: Accelerometer acoustic eavesdropping with unconstrained vocabu- lary. In 2022 IEEE Symposium on Security and Privacy (SP) , pages 1757–1773. IEEE, 2022

    2022

  18. [26]

    Mul- timodal unsupervised image-to-image translation

    Xun Huang, Ming-Yu Liu, Serge Belongie, and Jan Kautz. Mul- timodal unsupervised image-to-image translation. In Proceedings of the European conference on computer vision (ECCV), pages 172–189, 2018

    2018

  19. [27]

    {WaveGuard}: Understanding and mitigating audio adversarial examples

    Shehzeen Hussain, Paarth Neekhara, Shlomo Dubnov, Julian McAuley, and Farinaz Koushanfar. {WaveGuard}: Understanding and mitigating audio adversarial examples. In 30th USENIX Security Symposium (USENIX Security 21) , pages 2273–2290, 2021

    2021

  20. [28]

    Awr1843boost and iwr1843boost single-chip mmwave sensing solution user’s guide (rev

    Texas Instruments. Awr1843boost and iwr1843boost single-chip mmwave sensing solution user’s guide (rev. b), 2020

    2020

  21. [29]

    Iwr6843, iwr6443 single-chip 60- to 64-ghz mmwave sensor, 2021

    Texas Instruments. Iwr6843, iwr6443 single-chip 60- to 64-ghz mmwave sensor, 2021

    2021

  22. [30]

    The lj speech dataset, 2017

    Keith Ito and Linda Johnson. The lj speech dataset, 2017

    2017

  23. [31]

    Openwifi csi fuzzer for authorized sensing and covert channels

    Xianjun Jiao, Michael Mehari, Wei Liu, Muhammad Aslam, and Ingrid Moerman. Openwifi csi fuzzer for authorized sensing and covert channels. In Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks , pages 377– 379, 2021

    2021

  24. [32]

    Stargan-vc: Non-parallel many-to-many voice conversion using star generative adversarial networks

    Hirokazu Kameoka, Takuhiro Kaneko, Kou Tanaka, and Nobukatsu Hojo. Stargan-vc: Non-parallel many-to-many voice conversion using star generative adversarial networks. In 2018 IEEE Spoken Language Technology Workshop (SLT), pages 266–273. IEEE, 2018

    2018

  25. [33]

    Cyclegan-vc3: Examining and improving cyclegan-vcs for mel- spectrogram conversion

    Takuhiro Kaneko, Hirokazu Kameoka, Kou Tanaka, and Nobukatsu Hojo. Cyclegan-vc3: Examining and improving cyclegan-vcs for mel- spectrogram conversion. arXiv preprint arXiv:2010.11672 , 2020

    2010 arXiv

  26. [34]

    Adam: A method for stochastic optimization

    Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 , 2014

    2014 arXiv

  27. [35]

    Fundamentals of acoustics

    Lawrence E Kinsler, Austin R Frey, Alan B Coppens, and James V Sanders. Fundamentals of acoustics . John wiley & sons, 2000

    2000

  28. [36]

    Synthesizer voice quality of new languages calibrated with mean mel cepstral distortion

    John Kominek, Tanja Schultz, and Alan W Black. Synthesizer voice quality of new languages calibrated with mean mel cepstral distortion. In SLTU, pages 63–68, 2008

    2008

  29. [37]

    Hifi-gan: Generative adversarial networks for efficient and high fidelity speech synthesis

    Jungil Kong, Jaehyeon Kim, and Jaekyoung Bae. Hifi-gan: Generative adversarial networks for efficient and high fidelity speech synthesis. Advances in neural information processing systems, 33:17022–17033, 2020

    2020

  30. [38]

    Fool- ing end-to-end speaker verification with adversarial examples

    Felix Kreuk, Yossi Adi, Moustapha Cisse, and Joseph Keshet. Fool- ing end-to-end speaker verification with adversarial examples. In 2018 IEEE international conference on acoustics, speech and signal processing (ICASSP), pages 1962–1966. IEEE, 2018

    2018

  31. [39]

    Autoencoding beyond pixels using a learned similarity metric

    Anders Boesen Lindbo Larsen, Søren Kaae Sønderby, Hugo Larochelle, and Ole Winther. Autoencoding beyond pixels using a learned similarity metric. In International conference on machine learning, pages 1558–1566. PMLR, 2016

    2016

  32. [40]

    Magear: eavesdropping via audio recovery using magnetic side channel

    Qianru Liao, Yongzhi Huang, Yandao Huang, Yuheng Zhong, Huitong Jin, and Kaishun Wu. Magear: eavesdropping via audio recovery using magnetic side channel. In MobiSys, pages 371–383, 2022

    2022

  33. [41]

    A technique for the measurement of attitudes

    Rensis Likert. A technique for the measurement of attitudes. Archives of psychology, 1932

    1932

  34. [42]

    Few-shot unsupervised image-to- image translation

    Ming-Yu Liu, Xun Huang, Arun Mallya, Tero Karras, Timo Aila, Jaakko Lehtinen, and Jan Kautz. Few-shot unsupervised image-to- image translation. In Proceedings of the IEEE/CVF international conference on computer vision , pages 10551–10560, 2019

    2019

  35. [43]

    Delving into transferable adversarial examples and black-box attacks

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks. arXiv preprint arXiv:1611.02770, 2016

    2016 arXiv

  36. [44]

    Leakypick: Iot audio spy detector

    Richard Mitev, Anna Pazii, Markus Miettinen, William Enck, and Ahmad-Reza Sadeghi. Leakypick: Iot audio spy detector. In Proceed- ings of the 36th Annual Computer Security Applications Conference , pages 694–705, 2020

    2020

  37. [45]

    Engineering acoustics

    Michael M ¨oser. Engineering acoustics. Nova York (Estados Unidos): Springer Publishing, 2009

    2009

  38. [46]

    Lamphone: Real-time passive sound recovery from light bulb vibrations

    Ben Nassi, Yaron Pirutin, Adi Shamir, Yuval Elovici, and Boris Zadov. Lamphone: Real-time passive sound recovery from light bulb vibrations. Cryptology ePrint Archive , 2020

    2020

  39. [47]

    V oiceblock: Privacy through real-time adversarial attacks with audio-to-audio models

    Patrick O’Reilly, Andreas Bugler, Keshav Bhandari, Max Morrison, and Bryan Pardo. V oiceblock: Privacy through real-time adversarial attacks with audio-to-audio models. Advances in Neural Information Processing Systems, 35:30058–30070, 2022

    2022

  40. [48]

    Effective and inconspicuous over-the-air adversarial examples with adaptive filtering

    Patrick O’Reilly, Pranjal Awasthi, Aravindan Vijayaraghavan, and Bryan Pardo. Effective and inconspicuous over-the-air adversarial examples with adaptive filtering. In ICASSP 2022-2022 IEEE In- ternational Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 6...

    2022

  41. [49]

    Librispeech: an asr corpus based on public domain audio books

    Vassil Panayotov, Guoguo Chen, Daniel Povey, and Sanjeev Khu- danpur. Librispeech: an asr corpus based on public domain audio books. In 2015 IEEE international conference on acoustics, speech and signal processing (ICASSP) , pages 5206–5210. IEEE, 2015

    2015

  42. [50]

    Audio sampling and sample rate, 2024

    Picovoice. Audio sampling and sample rate, 2024

    2024

  43. [51]

    Perceptual evaluation of speech quality (pesq): An objective method for end-to-end speech quality assessment of narrow-band telephone networks and speech codecs

    ITU-T Recommendation. Perceptual evaluation of speech quality (pesq): An objective method for end-to-end speech quality assessment of narrow-band telephone networks and speech codecs. Rec. ITU-T P . 862, 2001

    2001

  44. [52]

    Intelligent virtual assistance (iva) industry overview, 2023

    Emergen Research. Intelligent virtual assistance (iva) industry overview, 2023

    2023

  45. [53]

    Ac-vc: non-parallel low latency phonetic posteriorgrams based voice conversion

    Damien Ronssin and Milos Cernak. Ac-vc: non-parallel low latency phonetic posteriorgrams based voice conversion. In 2021 IEEE Automatic Speech Recognition and Understanding Workshop (ASRU), pages 710–716. IEEE, 2021

    2021

  46. [54]

    Lidarphone: acoustic eavesdropping using a lidar sensor

    Sriram Sami, Sean Rui Xiang Tan, Yimin Dai, Nirupam Roy, and Jun Han. Lidarphone: acoustic eavesdropping using a lidar sensor. In Proceedings of the 18th Conference on Embedded Networked Sensor Systems, pages 701–702, 2020

    2020

  47. [55]

    Transmission systems and media, digital systems and networks

    G Series. Transmission systems and media, digital systems and networks. Digital sections and digital line system—Metallic access networks. ITU-T G , 993, 2003

    2003

  48. [56]

    Fawkes: Protecting privacy against unauthorized deep learning models

    Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y Zhao. Fawkes: Protecting privacy against unauthorized deep learning models. In 29th USENIX security symposium (USENIX Security 20), pages 1589–1604, 2020

    2020

  49. [57]

    ipet: privacy enhancing traffic per- turbations for secure iot communications

    Akshaye Shenoi, Prasanna Karthik Vairam, Kanav Sabharwal, Jialin Li, and Dinil Mon Divakaran. ipet: privacy enhancing traffic per- turbations for secure iot communications. Proceedings on Privacy Enhancing Technologies, 2023

    2023

  50. [58]

    Rf-protect: privacy against device-free human tracking

    Jayanth Shenoy, Zikun Liu, Bill Tao, Zachary Kabelac, and Deepak Vasisht. Rf-protect: privacy against device-free human tracking. In Proceedings of the ACM SIGCOMM 2022 Conference , pages 588– 600, 2022

    2022

  51. [59]

    Privacy leakage via speech-induced vibrations on room objects through remote sensing based on phased-mimo

    Cong Shi, Tianfang Zhang, Zhaoyi Xu, Shuping Li, Donglin Gao, Changming Li, Athina Petropulu, Chung-Tse Michael Wu, and Yingying Chen. Privacy leakage via speech-induced vibrations on room objects through remote sensing based on phased-mimo. In Proceedings of the 2023 ACM SIGS...

    2023

  52. [60]

    End-to-end speech recognition using a high rank lstm-ctc based model

    Yangyang Shi, Mei-Yuh Hwang, and Xin Lei. End-to-end speech recognition using a high rank lstm-ctc based model. In ICASSP 2019- 2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 7080–7084. IEEE, 2019

    2019

  53. [61]

    Ir- shield: A countermeasure against adversarial physical-layer wireless sensing

    Paul Staat, Simon Mulzer, Stefan Roth, Veelasha Moonsamy, Markus Heinrichs, Rainer Kronberger, Aydin Sezgin, and Christof Paar. Ir- shield: A countermeasure against adversarial physical-layer wireless sensing. In 2022 IEEE Symposium on Security and Privacy (SP) , pages 1705–17...

    2022

  54. [62]

    Video conferencing market statistics, 2023

    Kate Sukhanova. Video conferencing market statistics, 2023

    2023

  55. [63]

    Stealthyimu: Stealing permission-protected private information from smartphone voice assistant using zero-permission sensors

    Ke Sun, Chunyu Xia, Songlin Xu, and Xinyu Zhang. Stealthyimu: Stealing permission-protected private information from smartphone voice assistant using zero-permission sensors. Network and Dis- tributed System Security (NDSS) Symposium, 2023

    2023

  56. [64]

    Sok: Secure human-centered wireless sensing

    Wei Sun, Tingjun Chen, and Neil Gong. Sok: Secure human-centered wireless sensing. Proceedings on Privacy Enhancing Technologies , 2024

    2024

  57. [65]

    A feasi- bility study of radio-frequency retroreflector attack

    Satohiro Wakabayashi, Seita Maruyama, Tatsuya Mori, Shigeki Goto, Masahiro Kinugawa, Yu-ichi Hayashi, and Michael Smith. A feasi- bility study of radio-frequency retroreflector attack. In 12th USENIX Workshop on Offensive Technologies (WOOT 18) , 2018

    2018

  58. [66]

    Sok: assessing the threat potential of vibration-based attacks against live speech using mobile sensors

    Payton Walker and Nitesh Saxena. Sok: assessing the threat potential of vibration-based attacks against live speech using mobile sensors. In Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks , pages 273–287, 2021

    2021

  59. [67]

    mmeve: eavesdropping on smartphone’s earpiece via cots mmwave device

    Chao Wang, Feng Lin, Tiantian Liu, Kaidi Zheng, Zhibo Wang, Zhengxiong Li, Ming-Chun Huang, Wenyao Xu, and Kui Ren. mmeve: eavesdropping on smartphone’s earpiece via cots mmwave device. In Proceedings of the 28th Annual International Conference on Mobile Computing And Networki...

    2022

  60. [68]

    Vibspeech: Exploring practical wideband eavesdropping via bandlimited signal of vibration-based side channel

    Chao Wang, Feng Lin, Hao Yan, Tong Wu, Wenyao Xu, and Kui Ren. Vibspeech: Exploring practical wideband eavesdropping via bandlimited signal of vibration-based side channel. In 33rd USENIX security symposium (USENIX Security 24) , 2024

    2024

  61. [69]

    Wireless eavesdrop- ping on wired audio with radio-frequency retroreflector attack

    Genglin Wang, Zheng Shi, Yanni Yang, Zhenlin An, Guoming Zhang, Pengfei Hu, Xiuzhen Cheng, and Jiannong Cao. Wireless eavesdrop- ping on wired audio with radio-frequency retroreflector attack. IEEE Transactions on Mobile Computing , 2024

    2024

  62. [70]

    Is word error rate a good indicator for spoken language understanding accuracy

    Ye-Yi Wang, Alex Acero, and Ciprian Chelba. Is word error rate a good indicator for spoken language understanding accuracy. In 2003 IEEE workshop on automatic speech recognition and understanding (IEEE Cat. No. 03EX721) , pages 577–582. IEEE, 2003

    2003

  63. [71]

    Image quality assessment: from error visibility to structural similarity

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing , 13(4):600–612, 2004

    2004

  64. [72]

    Speech commands: A dataset for limited-vocabulary speech recognition

    Pete Warden. Speech commands: A dataset for limited-vocabulary speech recognition. arXiv preprint arXiv:1804.03209 , 2018

    2018 arXiv

  65. [73]

    Status-based detection of malicious code in internet of things (iot) devices

    Dongdi Wei and Xiaofeng Qiu. Status-based detection of malicious code in internet of things (iot) devices. In 2018 IEEE Conference on Communications and Network Security (CNS) , pages 1–7. IEEE, 2018

    2018

  66. [74]

    Acoustic eavesdropping through wireless vibrometry

    Teng Wei, Shu Wang, Anfu Zhou, and Xinyu Zhang. Acoustic eavesdropping through wireless vibrometry. In Proceedings of the 21st Annual International Conference on Mobile Computing and Networking, pages 130–141, 2015

    2015

  67. [75]

    Enabling fast and universal audio adversarial attack using generative model

    Yi Xie, Zhuohang Li, Cong Shi, Jian Liu, Yingying Chen, and Bo Yuan. Enabling fast and universal audio adversarial attack using generative model. In Proceedings of the AAAI conference on artificial intelligence, volume 35, pages 14129–14137, 2021

    2021

  68. [76]

    Cstr vctk corpus: English multi-speaker corpus for cstr voice cloning toolkit (version 0.92)

    Junichi Yamagishi, Christophe Veaux, Kirsten MacDonald, et al. Cstr vctk corpus: English multi-speaker corpus for cstr voice cloning toolkit (version 0.92). 2019

    2019

  69. [77]

    Parallel wavegan: A fast waveform generation model based on generative adversarial networks with multi-resolution spectrogram

    Ryuichi Yamamoto, Eunwoo Song, and Jae-Min Kim. Parallel wavegan: A fast waveform generation model based on generative adversarial networks with multi-resolution spectrogram. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) ...

    2020

  70. [78]

    The feasibility of injecting inaudible voice commands to voice assistants

    Chen Yan, Guoming Zhang, Xiaoyu Ji, Tianchen Zhang, Taimin Zhang, and Wenyuan Xu. The feasibility of injecting inaudible voice commands to voice assistants. IEEE Transactions on Dependable and Secure Computing, 18(3):1108–1124, 2019

    2019

  71. [79]

    Design of a novel drfm jamming system based on afb-sfb

    Jing Yang, Xiaoxu Guo, and Yunjie Li. Design of a novel drfm jamming system based on afb-sfb. In IET International Radar Conference 2013, pages 1–5. IET, 2013

    2013

  72. [80]

    Appcontext: Differentiating malicious and benign mobile app behaviors using context

    Wei Yang, Xusheng Xiao, Benjamin Andow, Sihan Li, Tao Xie, and William Enck. Appcontext: Differentiating malicious and benign mobile app behaviors using context. In 2015 IEEE/ACM 37th IEEE international conference on software engineering , volume 1, pages 303–313. IEEE, 2015

    2015

  73. [81]

    Rf-parrot: Wireless eavesdropping on wired audio

    Yanni Yang, Genglin Wang, Zhenlin An, Guoming Zhang, Xiuzhen Cheng, and Pengfei Hu. Rf-parrot: Wireless eavesdropping on wired audio. In IEEE INFOCOM 2024-IEEE Conference on Computer Communications, pages 701–710. IEEE, 2024

    2024

  74. [82]

    Torchaudio: Building blocks for au- dio and speech processing

    Yao-Yuan Yang, Moto Hira, Zhaoheng Ni, Artyom Astafurov, Caro- line Chen, Christian Puhrsch, David Pollack, Dmitriy Genzel, Donny Greenberg, Edward Z Yang, et al. Torchaudio: Building blocks for au- dio and speech processing. In ICASSP 2022-2022 IEEE International Conference o...

    2022

  75. [83]

    Interference-negligible privacy- preserved shield for rf sensing

    Yao Yao, Yan Li, and Ting Zhu. Interference-negligible privacy- preserved shield for rf sensing. IEEE Transactions on Mobile Com- puting, 2023

    2023

  76. [84]

    {SMACK}: Semantically meaningful adversarial audio attack

    Zhiyuan Yu, Yuanhaur Chang, Ning Zhang, and Chaowei Xiao. {SMACK}: Semantically meaningful adversarial audio attack. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 3799–3816, 2023

    2023

  77. [85]

    Antifake: Using adver- sarial audio to prevent unauthorized speech synthesis

    Zhiyuan Yu, Shixuan Zhai, and Ning Zhang. Antifake: Using adver- sarial audio to prevent unauthorized speech synthesis. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communi- cations Security, pages 460–474, 2023

    2023

  78. [86]

    I spy you: Eavesdrop- ping continuous speech on smartphones via motion sensors

    Shijia Zhang, Yilin Liu, and Mahanth Gowda. I spy you: Eavesdrop- ping continuous speech on smartphones via motion sensors. Proceed- ings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, 6(4):1–31, 2023

    2023

  79. [87]

    Ra- dio2text: Streaming speech recognition using mmwave radio signals

    Running Zhao, Jiangtao Yu, Hang Zhao, and Edith CH Ngai. Ra- dio2text: Streaming speech recognition using mmwave radio signals. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiq- uitous Technologies, 7(3):1–28, 2023

    2023

  80. [88]

    Black-box adversarial attacks on commercial speech platforms with minimal information

    Baolin Zheng, Peipei Jiang, Qian Wang, Qi Li, Chao Shen, Cong Wang, Yunjie Ge, Qingyang Teng, and Shenyi Zhang. Black-box adversarial attacks on commercial speech platforms with minimal information. In Proceedings of the 2021 ACM SIGSAC conference on computer and communication...

    2021

  81. [89]

    Dehirec: Detecting hidden voice recorders via adc electromagnetic radiation

    Ruochen Zhou, Xiaoyu Ji, Chen Yan, Yi-Chao Chen, Wenyuan Xu, and Chaohao Li. Dehirec: Detecting hidden voice recorders via adc electromagnetic radiation. In 2023 IEEE Symposium on Security and Privacy (SP), pages 3113–3128. IEEE, 2023

    2023

  82. [90]

    Un- paired image-to-image translation using cycle-consistent adversarial networks

    Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei A Efros. Un- paired image-to-image translation using cycle-consistent adversarial networks. In Proceedings of the IEEE international conference on computer vision, pages 2223–2232, 2017. Appendix A. Additional Frequency Resp...

    2017

  83. [91]

    IWR1843-Boost(with 76-81GHz)2. IWR6843-Boost(with 60-64GHz) LG V50(with 500Hz)Figure 9(b) EveGuardLogitechZ313 IWR1642-Boost(with 76-81GHz)Samsung S20(with 500Hz)Figure 9(a) TABLE 15: Training dataset used for SSEA and EveGuard. AE, STT, and AC stand for audio enhancement, spe...

  84. [92]

    • 18-29 • 30-39 • 40-49 • Over 50

    Please select your age group. • 18-29 • 30-39 • 40-49 • Over 50

  85. [93]

    Please rate your intelligibility of the eavesdropped au- dio quality on a scale from 1 to 5. • 1 (None of the original speech is recovered) • 2 (Little of the original speech is recovered) • 3 (Half of the original speech is recovered) • 4 (Most of the original speech is recov...

  86. [94]

    • 1 (Bad) • 2 (Poor) • 3 (Fair) • 4 (Good) • 5 (Excellent) Appendix G

    Please rate your perception of the audio quality on a scale from 1 to 5. • 1 (Bad) • 2 (Poor) • 3 (Fair) • 4 (Good) • 5 (Excellent) Appendix G. Details of Speech Transformation WaveGuard [27] leverages audio transformation to mit- igate adversarial perturbations. In an eavesdr...

    2025

  87. [95]

    The methodology, particularly the use of Eve-GAN and adversarial perturbations, is robust and convincingly validated through comprehensive experimentation

    Creates a New Tool to Enable Future Science: Eve- Guard presents a software-based approach for defend- ing against vibration-induced side-channel attacks. The methodology, particularly the use of Eve-GAN and adversarial perturbations, is robust and convincingly validated throu...

  88. [96]

    The proposed PGM and Eve-GAN end-to-end design improves both defense effectiveness and usability

    Provides a Valuable Step Forward in an Established Field: EveGuard effectively addresses a recognized se- curity threat, improving the flexibility and applicability of existing defense solutions. The proposed PGM and Eve-GAN end-to-end design improves both defense effectivenes...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.