{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,13]],"date-time":"2026-04-13T20:04:44Z","timestamp":1776110684639,"version":"3.50.1"},"reference-count":131,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2022,4,1]],"date-time":"2022-04-01T00:00:00Z","timestamp":1648771200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100001602","name":"Science Foundation Ireland","doi-asserted-by":"publisher","award":["19\/FFP\/6775"],"award-info":[{"award-number":["19\/FFP\/6775"]}],"id":[{"id":"10.13039\/501100001602","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Proc. IEEE"],"published-print":{"date-parts":[[2022,4]]},"DOI":"10.1109\/jproc.2022.3153167","type":"journal-article","created":{"date-parts":[[2022,3,11]],"date-time":"2022-03-11T20:23:11Z","timestamp":1647030191000},"page":"476-507","source":"Crossref","is-referenced-by-count":71,"title":["Personal Voice Assistant Security and Privacy\u2014A Survey"],"prefix":"10.1109","volume":"110","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4453-2274","authenticated-orcid":false,"given":"Peng","family":"Cheng","sequence":"first","affiliation":[{"name":"School of Cyber Science and Technology and the Key Laboratory of Blockchain and Cyberspace Governance of Zhejiang Province, Zhejiang University, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4020-0889","authenticated-orcid":false,"given":"Utz","family":"Roedig","sequence":"additional","affiliation":[{"name":"School of Computer Science and Information Technology (CSIT), University College Cork, Cork, Ireland"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Nest Secure\u2019s Control Hub has a Microphone\u2014Users Only Found Out When it Became Google Assistant Enabled This Week","year":"2019"},{"key":"ref2","volume-title":"The Smart Audio Report","year":"2018"},{"key":"ref3","volume-title":"Mobile Fact Sheet","year":"2021"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3274371"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/2594368.2594386"},{"key":"ref6","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1097\/00003086-900000000-98288","article-title":"SonarSnoop: Active acoustic side-channel attacks","volume":"abs\/1808.10250","author":"Cheng","year":"2018","journal-title":"CoRR"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/2666620.2666623"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134052"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23288"},{"issue":"9","key":"ref10","article-title":"Personalized hey siri\u2014Apple","volume-title":"Apple Mach. Learn. J.","volume":"1","year":"2018"},{"key":"ref11","first-page":"1","article-title":"Using AI to hack IA: A new stealthy spyware against voice assistance functions in smart phones","volume":"abs\/1805.06187","author":"Zhang","year":"2018","journal-title":"CoRR"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TASL.2012.2201472"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3267357.3267359"},{"key":"ref14","first-page":"33","article-title":"Skill squatting attacks on Amazon Alexa","volume-title":"Proc. 27th USENIX Secur. Symp. (USENIX Security)","author":"Kumar"},{"key":"ref15","article-title":"Acoustic-channel attack and defence methods for personal voice assistants","author":"Cheng","year":"2020"},{"key":"ref16","volume-title":"Computer Security: Principles and Practice","author":"Stallings","year":"2018"},{"key":"ref17","volume-title":"Australia Smart Speaker Consumer Adoption Report 2019","year":"2019"},{"key":"ref18","article-title":"Smart speakers and screens\u2014Global smart speaker vendor & OS shipment and installed base market share by region: Q4 2018","author":"Watkins","year":"2019"},{"key":"ref19","volume-title":"Is Anyone Listening to You on Alexa? A Global Team Reviews Audio","year":"2019"},{"key":"ref20","volume-title":"Yep, Human Workers are Listening to Recordings From Google Assistant, Too","year":"2019"},{"key":"ref21","volume-title":"Gavin Williamson Interrupted by Siri During Commons Statement","year":"2018"},{"key":"ref22","volume-title":"Project Alias","author":"Karmann","year":"2019"},{"key":"ref23","volume-title":"Mycroft\u2014Open Source Voice Assistant","author":"Schweppe","year":"2019"},{"key":"ref24","volume-title":"2018 Reform of EU Data Protection Rules"},{"key":"ref25","volume-title":"California Consumer Privacy Act (CCPA)","year":"2018"},{"key":"ref26","article-title":"Zul\u00e4ssigkeit der transkribierung und auswertung von mitschnitten der sprachsoftware \u2018Alexa\u2019 durch Amazon","author":"Dienste","year":"2019"},{"key":"ref27","volume-title":"Information Privacy: Other Connected Device With a Voice Recognition Feature AB-1395","year":"2019"},{"key":"ref28","first-page":"451","article-title":"More than smart speakers: Security and privacy perceptions of smart home personal assistants","volume-title":"Proc. 15th Symp. Usable Privacy Secur. (SOUPS)","author":"Abdi"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/3081333.3081366"},{"key":"ref30","volume-title":"Automatic Speech Recognition: A Deep Learning Approach","author":"Yu","year":"2014"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/5.18626"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TASL.2011.2134090"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.21437\/interspeech.2015-350"},{"key":"ref34","volume-title":"An All-Neural On-Device Speech Recognizer","year":"2019"},{"key":"ref35","article-title":"Generating adversarial examples for speech recognition","author":"Iter","year":"2017"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00009"},{"key":"ref37","first-page":"49","article-title":"CommanderSong: A systematic approach for practical adversarial voice recognition","volume-title":"Proc. 27th USENIX Secur. Symp. (USENIX Security)","author":"Yuan"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM41043.2020.9155483"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.17487\/rfc4949"},{"issue":"3","key":"ref40","first-page":"1","article-title":"The CIA strikes back: Redefining confidentiality, integrity and availability in security","volume":"10","author":"Samonas","year":"2014","journal-title":"J. Inf. Syst. Secur."},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/1621995.1622039"},{"key":"ref42","first-page":"1","article-title":"\u2018Alexa, stop recording\u2019: Mismatches between smart speaker privacy controls and user needs","volume-title":"Proc. 14th Symp. Usable Privacy Secur. (SOUPS)","author":"Lau"},{"key":"ref43","first-page":"1","article-title":"Older adults\u2019 perceptions of intelligent voice assistant privacy, transparency, and online privacy guidelines","volume-title":"Proc. 16th Symp. Usable Privacy Secur. (SOUPS)","author":"Bonilla"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-32552-1_63"},{"key":"ref45","first-page":"513","article-title":"Hidden voice commands","volume-title":"Proc. 25th USENIX Secur. Symp. (USENIX Security)","author":"Carlini"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2019.00035"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133962"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-10-7245-1_59"},{"key":"ref49","volume-title":"Amazon\u2019s Alexa Can Now Recognize Different Voices and Give Personalized Responses","year":"2017"},{"key":"ref50","volume-title":"Link Your Voice to Your Google Assistant Device With Voice Match","year":"2020"},{"key":"ref51","first-page":"1","article-title":"The insecurity of home digital voice assistants\u2014Amazon Alexa as a case study","volume":"abs\/1712.03327","author":"Lei","year":"2017","journal-title":"CoRR"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.21437\/Eurospeech.1999-283"},{"key":"ref53","first-page":"36","article-title":"On the vulnerability of automatic speaker recognition to spoofing attacks with artificial signals","volume-title":"Proc. 20th Eur. Signal Process. Conf. (EUSIPCO)","author":"Alegre"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2009.4960401"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/APSIPA.2013.6694344"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2018.8462693"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1016\/j.sigpro.2013.11.023"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/89.861378"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.21437\/interspeech.2016-1125"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1016\/j.specom.2014.10.005"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2015-462"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/JSTSP.2017.2671435"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.21437\/Odyssey.2018-42"},{"key":"ref64","volume-title":"ASVspoof 2019: Automatic Speaker Verification Spoofing and Countermeasures Challenge Evaluation Plan","year":"2019"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.21437\/ASVSPOOF.2021-8"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2017.133"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3117811.3117823"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359830"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/3351258"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978296"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3212480.3212505"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1145\/3380991"},{"key":"ref73","first-page":"547","article-title":"Inaudible voice commands: The long-range attack and defense","volume-title":"Proc. 15th USENIX Symp. Netw. Syst. Design Implement. (NSDI)","author":"Roy"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1145\/3300061.3345429"},{"key":"ref75","first-page":"1","article-title":"Cocaine noodles: Exploiting the gap between human and machine speech recognition","volume-title":"Proc. 9th USENIX Workshop Offensive Technol. (WOOT)","author":"Vaidya"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23362"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00009"},{"key":"ref78","first-page":"1","article-title":"Did you hear that? Adversarial examples against automatic speech recognition","volume":"abs\/1801.00554","author":"Alzantot","year":"2018","journal-title":"CoRR"},{"key":"ref79","first-page":"1","article-title":"Targeted adversarial examples for black box audio systems","volume":"abs\/1805.07820","author":"Taori","year":"2018","journal-title":"CoRR"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2019-2420"},{"key":"ref81","first-page":"1","article-title":"Robust audio adversarial example for a physical attack","volume":"abs\/1810.11793","author":"Yakura","year":"2018","journal-title":"CoRR"},{"key":"ref82","first-page":"5231","article-title":"Imperceptible, robust, and targeted adversarial examples for automatic speech recognition","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Qin"},{"key":"ref83","article-title":"Perceptual based adversarial audio attacks","author":"Szurley","year":"2019","journal-title":"arXiv:1906.06355"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427276"},{"key":"ref85","first-page":"1","article-title":"Characterizing audio adversarial examples using temporal dependency","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Yang"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.23055"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423348"},{"key":"ref88","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. 3rd Int. Conf. Learn. Represent. (ICLR)","author":"Goodfellow"},{"key":"ref89","first-page":"1","article-title":"Deep speech: Scaling up end-to-end speech recognition","volume":"abs\/1412.5567","author":"Hannun","year":"2014","journal-title":"CoRR"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1121\/1.4799190"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24551"},{"key":"ref92","first-page":"2667","article-title":"Devil\u2019s whisper: A general approach for physical adversarial attacks against commercial black-box speech recognition devices","volume-title":"Proc. 29th USENIX Secur. Symp. (USENIX Security)","author":"Chen"},{"key":"ref93","article-title":"On the human evaluation of audio adversarial examples","author":"Vadillo","year":"2020","journal-title":"arXiv:2001.08444"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00016"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1145\/3229565.3229573"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1145\/3384419.3430727"},{"key":"ref97","volume-title":"Raspberry Pi","year":"2021"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2019.8682336"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.21437\/interspeech.2018-2032"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.21437\/interspeech.2020-1333"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP40776.2020.9053172"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2019.8683721"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1016\/j.csl.2019.06.001"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/ATSIP.2018.8364513"},{"key":"ref105","first-page":"201","article-title":"CryptoNets: Applying neural networks to encrypted data with high throughput and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Gilad-Bachrach"},{"key":"ref106","first-page":"1501","article-title":"XONN: XNOR-based oblivious deep neural network inference","volume-title":"Proc. SEC","author":"Riazi"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2018.8461451"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.21437\/interspeech.2018-2186"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2019.8683546"},{"key":"ref110","first-page":"16937","article-title":"Inverting gradients\u2014How easy is it to break privacy in federated learning?","volume-title":"Advances in Neural Information Processing Systems","volume":"33","author":"Geiping","year":"2020"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2020-2944"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1145\/3274783.3274855"},{"key":"ref113","first-page":"1","article-title":"Crafting adversarial examples for speech paralinguistics applications","volume":"abs\/1711.03280","author":"Gong","year":"2017","journal-title":"CoRR"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2019.8682394"},{"key":"ref115","article-title":"Emotionless: Privacy-preserving speech analysis for voice assistants","author":"Aloufi","year":"2019","journal-title":"arXiv:1908.03632"},{"key":"ref116","first-page":"1","article-title":"The smart2 speaker blocker: An open-source privacy filter for connected home speakers","volume":"abs\/1901.04879","author":"Champion","year":"2019","journal-title":"CoRR"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.2966\/scrip.170220.238"},{"key":"ref118","volume-title":"Techdispatch #1: Smart Speakers and Virtual Assistants","year":"2021"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1109\/PerComWorkshops48775.2020.9156182"},{"key":"ref120","first-page":"17","article-title":"Soundcomber: A stealthy and context-aware sound trojan for smartphones","volume-title":"Proc. NDSS","volume":"11","author":"Schlegel"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1145\/2627393.2627417"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1145\/2789168.2790122"},{"key":"ref123","first-page":"1","article-title":"Hearing your touch: A new acoustic side channel on smartphones","volume":"abs\/1903.11137","author":"Shumailov","year":"2019","journal-title":"CoRR"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1145\/3372224.3380884"},{"key":"ref125","first-page":"1727","article-title":"Person identification from walking sound on wooden floor","volume-title":"Proc. Euronoise","author":"Diapoulis"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-44371-2_25"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00074"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243777"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1145\/2973750.2973764"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.1145\/3131897"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1145\/3307334.3326074"}],"container-title":["Proceedings of the IEEE"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/5\/9747956\/09733178.pdf?arnumber=9733178","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,10,1]],"date-time":"2024-10-01T17:29:18Z","timestamp":1727803758000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9733178\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,4]]},"references-count":131,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/jproc.2022.3153167","relation":{},"ISSN":["0018-9219","1558-2256"],"issn-type":[{"value":"0018-9219","type":"print"},{"value":"1558-2256","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,4]]}}}