§ 2.0
Core Concepts
Image stabilization sensors exist to drive lens elements or imaging sensors against small, low-frequency disturbances from operator movement. Target the same hardware with vibration it was never designed to correct for, and the correction itself becomes the vulnerability.
Acoustic Excitation+
Sound pressure waves at a camera's resonant frequency couple mechanically into its lens assembly, sensor mount, or floating-autofocus components inducing real physical motion before any image-processing pipeline sees a frame.
Low-Frequency vs. Ultrasonic+
Prior attacks used >20kHz signals, which attenuate rapidly and only work at short range. Audible low frequencies (5Hz–30kHz tested, <200Hz analyzed) diffract around obstacles and travel further, trading stealth-from-detection for reach.
Floating-Lens Autofocus Vulnerability+
The Logitech C930e has no dedicated image stabilizer, yet its lightweight autofocus assembly a lens that translates freely along the imaging axis has little inertia and is inherently receptive to acoustic vibration.
Physical vs. Digital Adversarial Attack+
The attack never modifies pixel values, weights, or the input pipeline. It distorts the physical sensing process itself which means traditional digital defenses like adversarial training or input pre-processing have nothing to act on.
Three Failure Modes+
Detection degradation under acoustic perturbation splits cleanly into three categories: misclassification (wrong label), suppression (no detection at all), and spurious detection (a confident label for an object that isn't there).
Model-Agnostic, Stealthy Access+
No knowledge of YOLOv11's parameters or architecture is required. With multiple coordinated emitters the attack can in principle be made inaudible outside a target region a black-box attack delivered entirely through commodity audio equipment.
§ 3.0
The Attack Pipeline
Four stages, repeated across 100 COCO images and multiple frequency conditions: generate a known signal, couple it physically into the camera, capture live footage under perturbation, then post-process every frame through the detector.
Step {{ s.n }}
{{ s.name }}
{{ s.desc }}
§ 4.0
Failure Taxonomy
Spatial noise and motion blur are enough to confuse YOLOv11's early convolutional layers the ones responsible for detecting edges and shapes and the resulting errors persist through the rest of the network.
Misclassification
Correctly detected zebras, at full confidence, collapse under acoustic perturbation into a single low-confidence "person" label assigned to part of a road the object identity is lost entirely, not just degraded.
Suppression
Bowls and a cup, cleanly boxed and labeled at baseline, produce zero bounding boxes once the resonant frequency is active the objects are still in frame, but the model no longer sees them at all.
Spurious Detection
A correctly identified traffic light is relabeled "person" under perturbation motion-blur artifacts form pattern-like distortions that the network misreads as valid object features where none exist.
§ 5.0
Resonant-Band Results
Detection rate is defined as the proportion of detections with confidence ≥0.5. Two frequency bands consistently degrade both detection rate and model confidence across the full 100-image sweep.
20–30Hz
First resonant band sharpest detection-rate drop
155–180Hz
Second resonant band same degradation pattern
~10%
Detection-rate drop vs. no-sound baseline at resonance
~7%
Average confidence drop higher model uncertainty
| Property | Prior Ultrasonic Attacks | This Work |
|---|
| Frequency Range | >20kHz, exploiting camera stabilization sensors directly via known resonant frequencies of the stabilization hardware. | 0–200Hz, audible band |
| Effective Range | Short ultrasonic signals attenuate rapidly in air, limiting the attack to close proximity to the target camera. | Longer low-frequency diffraction |
| Hardware Requirement | Targets cameras with dedicated inertial-sensor-based image stabilization specifically. | Works with no stabilizer at all |
| Detection Difficulty | High-frequency emission can be more conspicuous to detect with standard audio monitoring equipment. | Harder to flag as anomalous |
§ 6.0
Why Commodity Cameras Are Vulnerable
The vulnerability sits at the physics-sensor interaction stage a layer beneath where almost all adversarial-ML defense research currently operates.
01Mechanical Resonance, Not Software+
Lens assemblies, CMOS sensor mounts, and stabilization components can all vibrate in response to low-frequency sound. The micro-vibrations introduce subpixel motion and spatial distortion that propagate through the entire CV pipeline before any neural network runs.
02Lack of Damping in Commodity Hardware+
Consumer cameras are built light and cheap, with little mechanical damping and components that sit close to resonant frequencies already present in the ordinary audio spectrum not exotic, hard-to-produce tones.
03Early Layers Are the Bottleneck+
YOLOv11's early convolutional layers are highly sensitive to edge clarity, texture gradients, and object boundaries exactly what acoustic motion blur destroys first. Errors introduced this early persist and compound through every later layer.
04Traditional Defenses Have Nothing to Grab+
Because the attack never touches pixel values, adversarial training and input pre-processing the standard digital countermeasures are structurally blind to it. New defenses would need to target the physical capture stage itself, an area with little active research.
§ 7.0
Limitations & Future Work
The study deliberately scopes itself to a single, minimal hardware case to isolate the effect cleanly which also marks out exactly where the next round of testing needs to go.
01Single Camera, No Stabilizer+
Only the Logitech C930e was tested, and it has no dedicated image-stabilization hardware. Cameras built around more advanced stabilizers exactly the systems ultrasonic attacks originally targeted remain untested against the low-frequency band.
02Fixed, Directional Source+
The acoustic emitter was rigidly mounted and aimed at a single point. Real-world interference is more likely to arrive from multiple, mobile, or uncoordinated sources a harder and more realistic threat model to characterize.
03Defense Research Is Effectively Unstarted+
Because the attack bypasses every digital defense by construction, mitigation has to happen at the mechanical or acoustic layer damping, isolation, or vibration-aware stabilization redesign a research direction with almost no existing literature to build on.
$ query: what does this attack actually touch
// not the pixels. not the weights. the lens, before the frame exists.
// no model access required basic audio equipment is sufficient.
$ query: what does this cost the attacker
// a function generator, a speaker, and a known resonant frequency band.
// audible, longer-range, harder to flag than the ultrasonic predecessor.
$ query: what is the actual result
// ~10% detection-rate drop, ~7% confidence drop, at 20–30Hz and 155–180Hz.
// misclassification, suppression, and outright hallucinated objects.