As a versatile AI application, voice assistants (VAs) have become increasingly popular, but are vulnerable to security threats. Attackers have proposed various inaudible attacks, but are limited by cost, distance, or LoS. Therefore, we propose \name~Attack, a long-range, cross-barrier, and interference-free inaudible voice attack via solid channels. We begin by thoroughly analyzing the dispersion effect in solid channels, revealing its unique impact on signal propagation. To avoid distortions in voice commands, we design a modular command generation model that parameterizes attack distance, victim audio, and medium dispersion features to adapt to variations in the solid-channel state. Additionally, we propose SUAD Defense, a universal defense that uses ultrasonic perturbation signals to block inaudible voice attacks (IVAs) without impacting normal speech. Since the attack can occur at arbitrary frequencies and times, we propose a training method that randomizes both time and frequency to generate perturbation signals that break ultrasonic commands. Notably, the perturbation signal is modulated to an inaudible frequency without affecting the functionality of voice commands for VAs. Experiments on six smartphones have shown that SUAD Attack achieves activation success rates above 89.8% and SUAD Defense blocks IVAs with success rates exceeding 98%.

翻译：作为一项多功能人工智能应用，语音助手日益普及，但其安全威胁问题突出。攻击者已提出多种人耳不可感知的攻击方法，但这些方法受成本、距离或视距限制。为此，我们提出\name~攻击——一种通过固体信道实现的长距离、跨屏障、无干扰的不可感知语音攻击方法。首先，我们深入分析了固体信道中的色散效应，揭示了其对信号传播的独特影响。为避免语音指令失真，我们设计了模块化指令生成模型，将攻击距离、目标音频及介质色散特性参数化，以适应固体信道状态的变化。此外，我们提出SUAD防御——一种利用超声波扰动信号阻断不可感知语音攻击的通用防御方法，该防御不影响正常语音功能。由于攻击可能发生在任意频率和时刻，我们提出一种通过随机化时间与频率的训练方法，生成能破坏超声指令的扰动信号。值得注意的是，该扰动信号被调制到不可感知频率，且不影响语音助手对语音指令的功能响应。在六款智能手机上的实验表明：SUAD攻击的激活成功率超过89.8%，而SUAD防御对不可感知语音攻击的阻断成功率高达98%以上。