Imagine: you are listening to music or an advertisement, and at that time the audio file is transmitting a hidden command to your voice assistant that is inaudible to humans. The assistant could open a door or transfer money. This threat was described by Qiang Zeng, an associate professor in the Department of Computer Science at George Mason University. Together with graduate student Ying Meng, he developed the DivNet method, which makes such attacks harder without slowing down devices or requiring companies to expensively retrain AI systems. The work was presented in the summer of 2026 at the ACM International Conference on Mobile Systems, Applications, and Services (MobiSys) in Cambridge (UK).
The danger is heightened by the fact that manufacturers often install identical AI models on millions of devices. It is as if every house in a neighborhood had the same lock: one key fits them all. An attacker who has hacked one device can use the same recording against others. Training complex models is expensive, so it is not profitable for companies to create a separate model for each customer.
DivNet creates many slightly different versions of a single AI model. Instead of identical protection for all devices, each one receives a slightly different model. To do this, the researchers analyze millions of numerical values - so-called weights - that help the neural network process information. Some weights are important for recognizing ordinary speech, while others have little effect on it but are critical to the success of audio attacks. DivNet identifies and selectively modifies the latter. By combining different sets of weights, the scientists obtain a huge number of unique models that still accurately recognize legitimate speech but react differently to malicious recordings.
Tests on existing speech recognition systems showed that DivNet significantly reduces the success rate of attacks while barely degrading ordinary recognition. Unlike many other defenses, the method does not add time to speech processing. After the initial analysis, creating a new variant takes just milliseconds. The number of possible variants exceeds the estimated number of atoms in the observable universe, which provides an enormous choice. Even a single voice assistant can periodically switch between variants, making it harder to develop and reuse attacks. The main practical advantage is low cost: training an AI system is expensive because it requires powerful graphics processing units (GPUs).
The researchers created a project website with demonstrations and technical information, including audio examples showing how identical malicious recordings produce different results on different variants of the model. Zeng, who has five Alexa speakers at home, uses voice assistants himself and sees the benefit for consumers. The team is aiming for commercialization and is filing patents, believing that the approach will interest major technology companies.