{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,13]],"date-time":"2025-11-13T18:50:47Z","timestamp":1763059847332,"version":"3.45.0"},"reference-count":72,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,10,8]],"date-time":"2025-10-08T00:00:00Z","timestamp":1759881600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,8]],"date-time":"2025-10-08T00:00:00Z","timestamp":1759881600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["1942700,2053383"],"award-info":[{"award-number":["1942700,2053383"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,10,8]]},"DOI":"10.1109\/ismar67309.2025.00158","type":"proceedings-article","created":{"date-parts":[[2025,11,11]],"date-time":"2025-11-11T18:26:11Z","timestamp":1762885571000},"page":"1543-1553","source":"Crossref","is-referenced-by-count":0,"title":["Siren Song: Acoustic Attacks on Pose Estimation in XR Headsets"],"prefix":"10.1109","author":[{"given":"Zijian","family":"Huang","sequence":"first","affiliation":[{"name":"University of Michigan,Ann Arbor"}]},{"given":"Yicheng","family":"Zhang","sequence":"additional","affiliation":[{"name":"University of California,Riverside"}]},{"given":"Sophie","family":"Chen","sequence":"additional","affiliation":[{"name":"University of Michigan,Ann Arbor"}]},{"given":"Nael","family":"Abu-Ghazaleh","sequence":"additional","affiliation":[{"name":"University of California,Riverside"}]},{"given":"Jiasi","family":"Chen","sequence":"additional","affiliation":[{"name":"University of Michigan,Ann Arbor"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/VR50410.2021.00081"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420957"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1177\/0278364915620033"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TRO.2021.3075644"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/AIxVR59861.2024.00010"},{"key":"ref7","first-page":"6345","article-title":"Adversary is on the road: Attacks on visual SLAM using unnoticeable adversarial patch","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Chen","year":"2024"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/ISMAR-Adjunct64951.2024.00200"},{"key":"ref9","article-title":"When the user is inside the user interface: An empirical study of UI security properties in augmented reality","volume-title":"USENIX Security Symposium","author":"Cheng","year":"2024"},{"key":"ref10","first-page":"911","article-title":"Exploring user reactions and mental models towards perceptual manipulation attacks in mixed reality","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Cheng","year":"2023"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3581791.3596830"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/ISMAR.2014.6948441"},{"key":"ref13","article-title":"Controlling {UAVs} with sensor input spoofing attacks","volume-title":"10th USENIX workshop on offensive technologies (WOOT 16)","author":"Davidson","year":"2016"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23059"},{"key":"ref15","article-title":"Hololens 2 sensor streaming","author":"Dibene","year":"2022","journal-title":"arXiv preprint"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/ICRA40945.2020.9196524"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.3390\/s20216157"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3636534.3696215"},{"key":"ref20","article-title":"AR overlay: Training image pose estimation on curved surface in a synthetic way","author":"Huang","year":"2024","journal-title":"arXiv preprint"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/IISWC53511.2021.00014"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/MM.2022.3161018"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/LRA.2022.3150031"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.24112"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00091"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3526114.3558722"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ISMAR62088.2024.00015"},{"volume-title":"3D user interfaces: theory and practice","year":"2017","author":"LaViola","key":"ref28"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.13"},{"key":"ref30","first-page":"2543","article-title":"{AdCube}: {WebVR} ad fraud and practical confinement of {ThirdParty} ads","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Lee","year":"2021"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3465026"},{"issue":"2","key":"ref32","article-title":"Adversarial camera stickers: A physical camera attack on deep learning classifier","volume":"2","author":"Li","year":"2019","journal-title":"arXiv preprint"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ISMAR62088.2024.00027"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2019.8802674"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/765891.765971"},{"key":"ref36","first-page":"317","article-title":"GhostImage: Remote perception attacks against camera-based image classification systems","volume-title":"23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020)","author":"Man","year":"2020"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/2046707.2046771"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/ISMAR-Adjunct60411.2023.00076"},{"article-title":"Set up your boundary for Meta Quest","volume-title":"Meta.","year":"2024","key":"ref39"},{"key":"ref40","first-page":"1053","article-title":"Gyrophone: Recognizing speech from gyroscope signals","volume-title":"23rd USENIX Security Symposium (USENIX Security 14)","author":"Michalevsky","year":"2014"},{"article-title":"Microsoft Azure Spatial Anchors","volume-title":"Microsoft","year":"2024","key":"ref41"},{"article-title":"Getting around HoloLens 2","volume-title":"Microsoft","year":"2021","key":"ref42"},{"article-title":"Mixed Reality Toolkit","volume-title":"Microsoft","year":"2022","key":"ref43"},{"key":"ref44","article-title":"Unique identification of 50,000+ virtual reality users from head & hand motion data","volume-title":"USENIX Security","author":"Nair","year":"2023"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/2162081.2162095"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3544548.3581089"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3586183.3606750"},{"key":"ref48","article-title":"Secure multi-user content sharing for augmented reality applications","author":"Ruth","year":"2019","journal-title":"USENIX Security"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/TMC.2020.3007740"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3447993.3483272"},{"key":"ref52","article-title":"Going through the motions: AR\/VR keylogging from user head motions","volume-title":"USENIX Security","author":"Slocum","year":"2023"},{"key":"ref53","first-page":"2761","article-title":"That doesn\u2019t go there: Attacks on shared state in MultiUser augmented reality applications","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Slocum","year":"2024"},{"key":"ref54","first-page":"881","article-title":"Rocking drones with intentional sound noise on gyroscopic sensors","volume-title":"24th USENIX security symposium (USENIX Security 15)","author":"Son","year":"2015"},{"key":"ref55","article-title":"Physical adversarial examples for object detectors","volume-title":"12th USENIX workshop on offensive technologies (WOOT 18)","author":"Song","year":"2018"},{"key":"ref56","article-title":"Remote keylogging attacks in multi-user vr applications","author":"Su","year":"2024","journal-title":"arXiv preprint"},{"key":"ref57","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2013","journal-title":"arXiv preprint"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2017.42"},{"key":"ref59","first-page":"1545","article-title":"Injected and delivered: Fabricating implicit control over actuation systems by spoofing inertial sensors","volume-title":"27th USENIX security symposium (USENIX Security 18)","author":"Tu","year":"2018"},{"key":"ref60","article-title":"HoloLens 2 research mode as a tool for computer vision research","author":"Ungureanu","year":"2020","journal-title":"arXiv preprin"},{"volume-title":"Unity","key":"ref61","article-title":"Unity XR SDK"},{"article-title":"Unity manual - Shaders","volume-title":"Unity","year":"2024","key":"ref62"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/ISMAR-Adjunct64951.2024.00013"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/ISMAR62088.2024.00049"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484766"},{"key":"ref66","first-page":"1","article-title":"Sonic gun to smart devices: Your devices lose control under ultrasound\/sound","volume-title":"Black Hat USA","author":"Wang","year":"2017"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/ISMAR-Adjunct64951.2024.00078"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1587\/transfun.2021CIP0017"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-51630-6_4"},{"key":"ref70","article-title":"It\u2019s all in your head(set): Side channel attacks on augmented reality systems","volume-title":"USENIX Security","author":"Zhang","year":"2023"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354259"},{"key":"ref72","article-title":"Invisible mask: Practical attacks on face recognition with infrared","author":"Zhou","year":"2018","journal-title":"arXiv preprint"}],"event":{"name":"2025 IEEE International Symposium on Mixed and Augmented Reality (ISMAR)","start":{"date-parts":[[2025,10,8]]},"location":"Daejeon, Korea, Republic of","end":{"date-parts":[[2025,10,12]]}},"container-title":["2025 IEEE International Symposium on Mixed and Augmented Reality (ISMAR)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11220258\/11220261\/11220548.pdf?arnumber=11220548","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,13]],"date-time":"2025-11-13T18:42:36Z","timestamp":1763059356000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11220548\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,8]]},"references-count":72,"URL":"https:\/\/doi.org\/10.1109\/ismar67309.2025.00158","relation":{},"subject":[],"published":{"date-parts":[[2025,10,8]]}}}