International Association for Cryptologic Research

International Association
for Cryptologic Research

Transactions on Cryptographic Hardware and Embedded Systems, Volume 2024

Laser-Based Command Injection Attacks on Voice-Controlled Microphone Arrays

Hetian Shi
Tsinghua University, Beijing, China

Yi He
Tsinghua University, Beijing, China

Qing Wang

Jianwei Zhuge
Tsinghua University, Beijing, China; Zhongguancun Laboratory, Beijing, China

Qi Li
Tsinghua University, Beijing, China

Xin Liu
Lanzhou University, Lanzhou, Gansu, China

Keywords: laser command injection, voice-controlled systems, photoacoustic effect, pulse-width modulation, laser transmitters array, electrostatic effect


Voice-controlled (VC) systems, such as mobile phones and smart speakers, enable users to operate smart devices through voice commands. Previous works (e.g., LightCommands) show that attackers can trigger VC systems to respond to various audio commands by injecting light signals. However, LightCommands only discusses attacks on devices with a single microphone, while new devices typically use microphone arrays with sensor fusion technology for better capturing sound from different distances. By replicating LightCommands’s experiments on the new devices, we find that simply extending the light scope (just as they do) to overlap multiple microphone apertures is inadequate to wake up the device with sensor fusion. Adapting LightCommands’s approach to microphone arrays is challenging due to their requirement for multiple sound amplifiers, and each amplifier requires an independent power driver with unique settings. The number of additional devices increases with the microphone aperture count, significantly increasing the complexity of implementing and deploying the attack equipment. With a growing number of devices adopting sensor fusion to distinguish the sound location, it is essential to propose new approaches to adapting the light injection attacks to these new devices. To address these problems, we propose a lightweight microphone array laser injection solution called LCMA (Laser Commands for Microphone Array), which can use a single laser controller to manipulate multiple laser points and simultaneously target all the apertures of a microphone array and input light waves at different frequencies. Our key design is to propose a new PWM (Pulse Width Modulation) based control signal algorithm that can be implemented on a single MCU and directly control multiple lasers via different PWM output channels. Moreover, LCMA can be remotely configured via BLE (Bluetooth Low Energy). These features allow our solution to be deployed on a drone to covertly attack the targets hidden inside the building. Using LCMA, we successfully attack 29 devices. The experiment results show that LCMA is robust on the newest devices such as the iPhone 15, and the control panel of the Tesla Model Y.


Transactions of Cryptographic Hardware and Embedded Systems, Volume 2024, Issue 2



Artifact number

Artifact published
May 31, 2024

IACR CHES Artifacts Available


ZIP (7630412 Bytes)  

View on Github

Creative Commons License This work is licensed under the Creative Commons Attribution 4.0 International License.

Some files in this archive are licensed under a different license. See the contents of this archive for more information.

BibTeX How to cite

Shi, H., He, Y., Wang, Q., Zhuge, J., Li, Q., & Liu, X. (2024). Laser-Based Command Injection Attacks on Voice-Controlled Microphone Arrays. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2024(2), 654–676. Artifact available at