~/shanegraffiti.com/research/acoustic-adversarial-attacks
Shane Graffiti Inc. Semantic Adversarial Research Division 2026

GIVING AI
A
HEADACHE

Most adversarial-attack research assumes a hand on the input pixels a patch glued to a stop sign, a sticker on a face, a few flipped values in a tensor. This work reaches further upstream, into the physical act of capturing the image. Acoustic energy at the right frequency can mechanically excite a camera's lens assembly or sensor mount before a single pixel exists, producing blur and geometric distortion that an object detector reads as an entirely different scene. Earlier work relied on ultrasonic frequencies above 20kHz, which attenuate quickly and only function at close range. This study instead sweeps the audible low-frequency band 0 to 200Hz against a commodity webcam with no dedicated image-stabilization hardware, feeding live footage of COCO images into a YOLOv11 detector. Two resonant bands, roughly 20–30Hz and 155–180Hz, consistently degrade detection: objects get mislabeled, legitimate detections vanish, and the model hallucinates objects that were never there without touching the digital input or the model's weights at any point.

Division Semantic Adversarial Research
Domain Physical-World Adversarial AI / Hardware Security
Published arXiv 2606.14658 2026
Key Result ~10% detection-rate drop at resonance, zero pixel access
Acoustic Adversarial Attack◆ Mechanical Resonance◆ YOLOv11◆ Image Stabilization Exploit◆ Low-Frequency Excitation◆ Physical-World Attack◆ Misclassification◆ Suppression◆ Spurious Detection◆ Sensor Spoofing◆ Black-Box Attack◆ COCO Dataset◆ Acoustic Adversarial Attack◆ Mechanical Resonance◆ YOLOv11◆ Image Stabilization Exploit◆
§ 2.0 Core Concepts

Image stabilization sensors exist to drive lens elements or imaging sensors against small, low-frequency disturbances from operator movement. Target the same hardware with vibration it was never designed to correct for, and the correction itself becomes the vulnerability.

Acoustic Excitation
Sound pressure waves at a camera's resonant frequency couple mechanically into its lens assembly, sensor mount, or floating-autofocus components inducing real physical motion before any image-processing pipeline sees a frame.
Low-Frequency vs. Ultrasonic
Prior attacks used >20kHz signals, which attenuate rapidly and only work at short range. Audible low frequencies (5Hz–30kHz tested, <200Hz analyzed) diffract around obstacles and travel further, trading stealth-from-detection for reach.
Floating-Lens Autofocus Vulnerability
The Logitech C930e has no dedicated image stabilizer, yet its lightweight autofocus assembly a lens that translates freely along the imaging axis has little inertia and is inherently receptive to acoustic vibration.
Physical vs. Digital Adversarial Attack
The attack never modifies pixel values, weights, or the input pipeline. It distorts the physical sensing process itself which means traditional digital defenses like adversarial training or input pre-processing have nothing to act on.
Three Failure Modes
Detection degradation under acoustic perturbation splits cleanly into three categories: misclassification (wrong label), suppression (no detection at all), and spurious detection (a confident label for an object that isn't there).
Model-Agnostic, Stealthy Access
No knowledge of YOLOv11's parameters or architecture is required. With multiple coordinated emitters the attack can in principle be made inaudible outside a target region a black-box attack delivered entirely through commodity audio equipment.
§ 3.0 The Attack Pipeline

Four stages, repeated across 100 COCO images and multiple frequency conditions: generate a known signal, couple it physically into the camera, capture live footage under perturbation, then post-process every frame through the detector.

01
Frequency Signal Generation
A Tektronix AFG3100 function generator produces sine waves from 5Hz to 30kHz at a fixed 8 Vpp amplitude, transmitted through a compact high-fidelity speaker. Sine waves concentrate energy at a single frequency, ideal for isolating resonant mechanical effects.
02
Physical Coupling
The webcam is rigidly mounted to the acoustic speaker so any induced vibration directly affects the camera frame. Preliminary sweeps in 10–50Hz increments first localize the "resonant bands" worth deeper testing.
03
Live Capture Under Perturbation
The webcam records a monitor displaying full-screen COCO images while a resonant frequency plays continuously for 3 seconds per trial replicating a real-time object-detection scenario rather than a single static frame.
04
Post-Processing & Detection
Footage is cropped to the test image, run through YOLOv11 for bounding boxes and confidence scores, then aggregated by class, frequency, and photo ID into a master dataset for downstream analysis.
§ 4.0 Failure Taxonomy

Spatial noise and motion blur are enough to confuse YOLOv11's early convolutional layers the ones responsible for detecting edges and shapes and the resulting errors persist through the rest of the network.

Misclassification
Correctly detected zebras, at full confidence, collapse under acoustic perturbation into a single low-confidence "person" label assigned to part of a road the object identity is lost entirely, not just degraded.
Suppression
Bowls and a cup, cleanly boxed and labeled at baseline, produce zero bounding boxes once the resonant frequency is active the objects are still in frame, but the model no longer sees them at all.
Spurious Detection
A correctly identified traffic light is relabeled "person" under perturbation motion-blur artifacts form pattern-like distortions that the network misreads as valid object features where none exist.
§ 5.0 Resonant-Band Results

Detection rate is defined as the proportion of detections with confidence ≥0.5. Two frequency bands consistently degrade both detection rate and model confidence across the full 100-image sweep.

20–30Hz
First resonant band sharpest detection-rate drop
155–180Hz
Second resonant band same degradation pattern
~10%
Detection-rate drop vs. no-sound baseline at resonance
~7%
Average confidence drop higher model uncertainty
Property
Prior Ultrasonic Attacks
This Work
Frequency Range
>20kHz, exploiting camera stabilization sensors directly via known resonant frequencies of the stabilization hardware.
0–200Hz, audible band
Effective Range
Short ultrasonic signals attenuate rapidly in air, limiting the attack to close proximity to the target camera.
Longer low-frequency diffraction
Hardware Requirement
Targets cameras with dedicated inertial-sensor-based image stabilization specifically.
Works with no stabilizer at all
Detection Difficulty
High-frequency emission can be more conspicuous to detect with standard audio monitoring equipment.
Harder to flag as anomalous
§ 6.0 Why Commodity Cameras Are Vulnerable

The vulnerability sits at the physics-sensor interaction stage a layer beneath where almost all adversarial-ML defense research currently operates.

01
Mechanical Resonance, Not Software
Lens assemblies, CMOS sensor mounts, and stabilization components can all vibrate in response to low-frequency sound. The micro-vibrations introduce subpixel motion and spatial distortion that propagate through the entire CV pipeline before any neural network runs.
02
Lack of Damping in Commodity Hardware
Consumer cameras are built light and cheap, with little mechanical damping and components that sit close to resonant frequencies already present in the ordinary audio spectrum not exotic, hard-to-produce tones.
03
Early Layers Are the Bottleneck
YOLOv11's early convolutional layers are highly sensitive to edge clarity, texture gradients, and object boundaries exactly what acoustic motion blur destroys first. Errors introduced this early persist and compound through every later layer.
04
Traditional Defenses Have Nothing to Grab
Because the attack never touches pixel values, adversarial training and input pre-processing the standard digital countermeasures are structurally blind to it. New defenses would need to target the physical capture stage itself, an area with little active research.
§ 7.0 Limitations & Future Work

The study deliberately scopes itself to a single, minimal hardware case to isolate the effect cleanly which also marks out exactly where the next round of testing needs to go.

01
Single Camera, No Stabilizer
Only the Logitech C930e was tested, and it has no dedicated image-stabilization hardware. Cameras built around more advanced stabilizers exactly the systems ultrasonic attacks originally targeted remain untested against the low-frequency band.
02
Fixed, Directional Source
The acoustic emitter was rigidly mounted and aimed at a single point. Real-world interference is more likely to arrive from multiple, mobile, or uncoordinated sources a harder and more realistic threat model to characterize.
03
Defense Research Is Effectively Unstarted
Because the attack bypasses every digital defense by construction, mitigation has to happen at the mechanical or acoustic layer damping, isolation, or vibration-aware stabilization redesign a research direction with almost no existing literature to build on.
~/conclusion
$ query: what does this attack actually touch // not the pixels. not the weights. the lens, before the frame exists. // no model access required basic audio equipment is sufficient. $ query: what does this cost the attacker // a function generator, a speaker, and a known resonant frequency band. // audible, longer-range, harder to flag than the ultrasonic predecessor. $ query: what is the actual result // ~10% detection-rate drop, ~7% confidence drop, at 20–30Hz and 155–180Hz. // misclassification, suppression, and outright hallucinated objects.

THE ATTACK
NEVER
TOUCHES
THE
PIXELS.