With the increasing popularity of smart wearable devices, such as earbuds and smart watches, presents new challenges for seamless and secure user authentication due to their limited user interfaces. Conventional biometric methods, including voice, fingerprints, and facial recognition often face issues such as usability limitations, interference from noise, or vulnerability to spoofing attacks. This paper introduces a novel authentication system called BaroAuth, which utilizes the stable and unique Speech-aware Pressure Sequences (SPSs) patterns captured by a miniaturized MEMS barometer embedded in earbuds. The design of BaroAuth hinges on two important observations. First, the production of speech relies on the coordinated movements of articulatory organs, including the tongue, jaw, and soft palate. These organs, through the activity of the temporomandibular joint (TMJ), alter the shape of the ear canal, thereby causing subtle pressure changes that encode the speaker's unique physiological characteristics and articulatory dynamics. Second, SPSs show significant intra-individual consistency and considerable inter-individual variability, which barometers can effectively measure. Meanwhile, we develop the BaroAuth prototype and carry out comprehensive experiments based on it. The experimental findings reveal that BaroAuth demonstrates a mean false-acceptance rate (FAR) of 0.41% and a false-rejection rate (FRR) of 1.23%, respectively, even under complex attack scenarios.

The growing adoption of smart wearable devices (e.g., earbuds and smart watches) poses new challenges for secure and seamless user authentication due to their limited interaction interfaces. Conventional biometric methods, including fingerprints, voice, and facial recognition, often suffer from usability constraints, noise interference, or susceptibility to spoofing attacks. In this paper, we propose BaroAuth, a novel authentication system that utilizes the stable and distinctive patterns of Speech-aware Pressure Sequences (SPSs) captured by miniature MEMS barometers embedded in earbuds. The design of BaroAuth is based on two key observations. First, speech production involves coordinated movements of articulatory organs, such as the jaw, tongue, and soft palate, which reshape the ear canal geometry via the temporomandibular joint (TMJ), generating subtle pressure variations that encode the speaker’s unique articulatory dynamics and physiological traits. Second, SPSs demonstrate strong intra-individual consistency and notable inter-individual variability, which can be effectively captured by barometers. We implement the prototype of BaroAuth and conduct comprehensive experiments on it. Experimental results demonstrate that BaroAuth achieves a mean false-acceptance rate (FAR) and false-rejection rate (FRR) of 1.62% and 1.74%, respectively, even under sophisticated attack scenarios.

Speech Emotion Recognition (SER), as a core technology in intelligent interaction and affective computing, faces critical privacy security challenges. Speech not only contains emotional information, but also encompasses sensitive data such as conversational content and speaker identity markers. The sensitive information could be potentially reconstructed through Automatic Speech Recognition (ASR), posing substantial privacy leakage risks. Existing privacy protection methods focus mainly on suppressing the leakage of demographic characteristics such as speaker identity, while there is a lack of systematic research on the speech content. The traditional SER and ASR joint training paradigm relies on the sequence alignment mechanism of ASR, which leads to deep coupling of emotion features with the corresponding text, causing a fundamental contradiction between “performance improvement” and “privacy protection”. To address this problem, this paper proposes an attentionbased cascaded learning enabling privacy-preserving (Aclipse) strategy, which is divided into two stages. In the first stage, the emotion-retaining (ER) module and semantics-obfuscating (SO) module in cascaded manner, which consist of the channel-level attention mechanism, guides the targeted injection of adversarial perturbation by identifying and strengthening high-frequency feature channels that are critical to ASR performance, thereby significantly improving the semantic obfuscation to achieve speech privacy protection while minimizing the negative impact on SER performance. In the second stage, we freeze the SO module parameters to maintain its interference effect on ASR, and fine-tune the ER to improve the performance of SER by adjusting the channel-level attention mechanism to focus on emotion-related information. The experimental results on the IEMOCAP dataset show that Aclipse achieves an effective balance between performance and privacy protection, providing a new idea to build a trustworthy SER system.

3D face recognition systems are frequently susceptible to spoofing attacks, with 3D face presentation attacks being particularly notorious. Attackers commonly exploit 3D scanning and printing techniques to generate masks of target individuals, a method proven successful in various real-world scenarios. A defining characteristic of these attacks involves acquiring 3D face models via 3D scanning, a process that is notably more expensive and cumbersome compared to obtaining 2D photos. In this work, we introduce DREAM, a novel method for recovering 3D face models from a single 2D image. Specifically, our approach adopts a black-box strategy, reconstructing sufficient depth information to compromise target recognition models—such as face identification and authentication systems—by merely accessing their output and the corresponding RGB photo. Our key insight is that achieving successful attacks doesn’t necessitate restoring the precise ground-truth depth values; instead, it only requires recovering the essential features that are salient to the target model’s decision-making process. We evaluate DREAM’s effectiveness using four public 3D face datasets. Experimental results indicate that DREAM achieves a 94% success rate on face authentication models, even in cross-dataset testing. For face identification models, the success rate is 36%. Building upon DREAM, we further propose DREAM-3D, which leverages a 3D GAN to reconstruct depth images for deceiving 3D face recognition systems. Additionally, we evaluate DREAM-3D’s effectiveness on two datastes. Experimental results indicate that DREAM-3D achieves attack success rates exceeding 90% and approximately 50% against different models.

Voice assistants, increasingly integrated into wearable devices with limited human-computer interaction modalities, are susceptible to voice spoofing attacks. Such attacks exploit pre-recorded or synthesized voice commands to trick the assistants into executing actions unauthorized by legitimate users. In this work, we propose GyroTalk, a novel approach extracts individual and reliable features from speech movement sequences of users, using built-in gyroscopes in wearables, to differentiate between legitimate users and malicious attackers. GyroTalk is inspired by two critical insights. First, speech, as a highly intricate motor task, necessitates the synchronized coordination of multiple respiratory, laryngeal, lingual and mandibular muscles. These collective muscle movements propagate throughout the body, providing unique movement signatures. Second, the distinctive speech movement sequences of individual speakers, essential for generating specific words, can be grabbed by embedded IMU of wearables. We conduct a comprehensive evaluation of GyroTalk across various COTS Android devices, including smart phones, watches and glasses. Our experimental results demonstrate that GyroTalk can achieve a mean FAR of 2.23% and a FRR of 2.48%, even in the face of complicated voice spoofing attacks.

3D face recognition is subject to frequent spoofing attacks, in which 3D face presentation attack is one of the most notorious attacks. The attacker takes advantages of 3D scanning and printing techniques to generate masks of targets, which has found success in numerous real-life examples. The salient feature in such attacks is to obtain 3D face models through 3D scanning, though relatively more expensive and inconvenient when comparing with 2D photos. In this work, we propose a new method, DREAM, to recover 3D face models from single 2D image. Specifically, we adopt a black-box approach, which recovers 'sufficient' depths to defeat target recognition models (e.g., face identification and face authentication models) by accessing its output and the corresponding RGB photo. The key observation is that it is not necessary to restore the true value of depths, but only need to recover the essential features relevant to the target model. We used four public 3D face datasets to verify the effectiveness of DREAM. The experimental results show that DREAM can achieve a success rate of 94% on face authentication model, even in cross-dataset testing, and a success rate of 36% on face identification model.

Studies have proven that applying patch stickers generated through adversarial training to target objects can effectively deceive classifiers or target detectors. These ’Print-and-paste’ adversarial attacks however have three shortcomings. First, touching the target object physically is required, which may be infeasible in practice. Second, stickers might be taken as evidence to identify attackers. Third, the attack effect decreases significantly in poor light, especially at long distances. To overcome above limitations, we introduce OptiCloak, a car vanishing attack, which fools the Object Detector (OD) of a vision-based autonomous driving systems with transient projection pattern. We establish three digital-to-physical mapping models to compensate the distortions caused by perspective deformation, double image and partial light reflection in real-world. Furthermore, to avoid adversarial functionality degeneration caused by the loss of patch details in long-range attacks, we utilize MeanShift Filtering to constrain the ’resolution’ of pixels in a patch during training. We propose a gradient-free patch updating approach, which utilizes ZO-AdaMM to approximate gradients and model parameters through confidence scores of OD, making OptiCloak can work well in both white-box and black-box scenarios. We deploy OptiCloak in real-world driving scenarios, and the extensive experimental results demonstrate that OptiCloak achieves similar Attack Success Rates (ASRs) as printed patches in bright environments, while significantly improving the attack performance in gloomy environments. This effect is validated across all settings, including different angles, imaging devices, and film transparency rates. In black-box settings, the average ASR can reach 71%, with a maximum attack distance of approximately 10m.

Physical adversarial attacks directly apply adversarial perturbations to real-world objects. Perturbations usually are printed as patches and pasted on target objects. This requires attackers in the vicinity of targets, which may not be feasible in practice. In this paper, we propose a stealthy physical adversarial attack by taking advantage of the transient of light projection. The attacker utilizes a drone with a portable projector to project the adversarial light pattern on the rear windshield of a vehicle to obstruct the object detector (OD) in autonomous driving systems. This can lead to serious safety vulnerability. We train digital perturbations by back propagation on the OD in an iterative manner. Unfortunately, they do not work well in the form of light patterns due to distortion, double imaging and partial reflectance when projected as light pattern. Hence, we model the mapping from digital to light projections, and use the inverse of the mapping to compensate the projection distortion in each iteration. We employ four state-of-the-art ODs to demonstrate the effectiveness and robustness of our proposed attack.

Simple Serial Synchronized (SSS) Multistage Interconnection Network (MIN) is a novel MIN architecture for connecting processors and memory modules in multiprocessors. Synchronized bit-serial communication simplifies the structure/control, and also solves the pin-limitation problem. Here, design, implementation, and evaluation of a multiprocessor prototype called SNAIL with the SSS-MIN are presented. The heart of SNAIL is the prototype 1 /mu CMOS SSS-MIN gate array chip which exchanges packets from 16 inputs with 50MHz clock. The message combining is implemented only with 20% increases of the hardware. From the empirical evaluation with some application programs, it appears that the latency and synchronization overhead of the SSSMIN are tolerable, and the bandwidth of the SSS-MIN is sufficient. Although the performance improvement with the bit serial message combine is not so large (1%) when instructions are stored in the local memory, it becomes up to 400% when instructions are stored in the shared memory.