Et Tu, MacBook? Unprivileged Keystroke Inference and Context Profiling via the Built-in IMU Side Channel Jiaji He1 , Yi Shi1 , Junfeng Cai1 , Chang Liu2 , Yongqiang Lyu1,3
arXiv:2609.21569v1 [cs.CR] 18 Sep 2026
1 Tianjin University
2 National University of Singapore
1 {dochejj, shiyi2498, 3020232023}@tju.edu.cn
Abstract
As the primary MacBook input modality, keyboard input carries sensitive content and is a longstanding sidechannel target. Physical side-channel attacks (PSCAs) analyze keystroke-induced sound, electromagnetic or wireless effects, and vibration. They use external receivers or co-located sensors [3, 14, 58, 60, 62, 87, 92], or access target-integrated microphones, cameras, accelerometers, and gyroscopes to recover keys, PINs, and text [23, 26, 41, 64, 66, 69, 70, 91]. Software side-channel attacks (SSCAs) instead infer when keys are pressed, which keys are pressed, or what was typed from encrypted traffic, inter-keystroke intervals, and cache accesses [38, 67, 71, 74, 79]. Applying these attacks to Apple Silicon Macs faces practical obstacles. External physical observation requires additional hardware within sensing range. Target-integrated sensors avoid that deployment, but macOS protects camera and microphone access through TCC [7] and exposes no supported API for third-party applications to read raw chassis accelerometer or gyroscope data [8, 21]. SSCAs need no sensor hardware but depend on available software traces: traffic attacks require distinguishable input-driven communication [67]; timing attacks expose intervals rather than key identities and require behavioral data and candidate or language priors [71,79]; direct-key cache attacks require key-dependent accesses, version-specific profiling, and processor-specific probes [38, 50, 74, 95]. These constraints motivate examining MacBook-embedded sensors and their software access paths. Recently, Bourbonnais et al. [21] discovered that Apple embeds an undocumented inertial measurement unit (IMU) in MacBooks to monitor device motion. They showed that a rootprivileged process can access the raw IMU stream and use it to infer fine-grained physiological signals, including a user’s pulse [20, 21]. Their implementation treats root privilege as a prerequisite for accessing the sensor data [20]. This discovery raises two immediate security questions. First, does the undocumented MacBook IMU expose an access path to unprivileged applications? Second, if so, what sensitive information can the raw sensor stream reveal? We find that prior work’s assessment of the access bound-
Recent generations of Apple MacBooks embed an inertial measurement unit (IMU) within their unibody chassis for device orientation and motion sensing. However, this IMU inadvertently captures not only intended device-level information but also subtle physical vibrations from user interactions and the surrounding environment. These signals establish a novel, previously unexplored side channel. We uncover a vulnerability allowing non-root access to IMU data via an IOKit driver, alongside two content-free system metadata interfaces (HIDIdleTime and CGEventSource) that further enrich the side-channel leakage. Through rigorous characterization of the IMU data, we reveal that the leakage spans three core dimensions: (1) keystroke identity (which key is typed), (2) desk surface (where the laptop is placed), and (3) user behavior (who is typing). Leveraging these findings, we introduce BRUTUS, the first comprehensive unprivileged side-channel attack targeting built-in IMU sensors on Apple MacBooks. BRUTUS achieves a character-level accuracy of 89.1% to 97.5% in key recovery. Furthermore, aided by language models, it can successfully reconstruct certain sentences with 100% accuracy. For user identification and environment profiling, BRUTUS correctly discovers user and environment profiles without labels and correctly assigns subsequent segments to their corresponding profiles. Ultimately, this work highlights the urgent necessity of strictly regulating access to built-in IMU sensors.
1
3 Tsinghua University
Introduction
Mac devices equipped with Apple Silicon dominate the global personal computing and enterprise markets due to their outstanding performance and energy efficiency. Their massive market share and highly unified, closed-loop hardware design make them attractive targets for system security research. Consequently, the security community actively explores vulnerabilities in Apple Silicon, proposing numerous side-channel attacks (SCAs) against these platforms [24, 34, 41, 43, 48–50, 56, 72, 82, 86, 95, 96]. 1
2
ary is overly optimistic [20]: an unprivileged application can read raw IMU data through IOKit without root or runtime elevation. Section 4 then shows that key position, strike force, and supporting surface leave distinguishable vibration features. Their persistence across MacBooks and evaluated noise conditions provides the basis for inferring input, user behavior, and usage context. Based on these findings, we present BRUTUS (Built-in sensoR exploitation of User Typing via imU Side channel), an unprivileged side-channel attack framework that uses keystroke-induced chassis vibrations captured by the undocumented MacBook IMU to infer typed content, typistdependent characteristics, and the laptop’s placement surface. We evaluate these three tasks in Sections 5.2–5.4. On 8-to-10character passwords from three held-out participants using held-out devices, BRUTUS achieves an average characterlevel accuracy of 94.0% and a Top-5 accuracy of 86.7%; without user or environment labels, it also discriminates among typists, distinguishes among laptop placement surfaces, and assigns subsequent segments to their corresponding profiles. Contributions. We summarize our contributions as follows:
2.1
Background Side-Channel Attacks
Side-channel attacks infer sensitive information from unintended signals accompanying system execution, device operation, or user activity. They have recovered cryptographic keys and memory contents, identified websites and application activity, inferred address layouts, and analyzed user interactions such as keystrokes [14, 24, 46, 50, 82]. Physical side channels observe power consumption, electromagnetic and acoustic emissions, temperature, optical changes, motion, and mechanical vibration. Attackers capture these signals using dedicated instruments, nearby mobile or wearable devices, or software-readable sensors and telemetry on the target itself [14, 16, 62, 63, 87]. Software side channels exploit observable network, execution, or shared-resource states, including encrypted-traffic patterns, execution latency, caches, branch predictors, prefetchers, and interrupts [38, 43, 50, 86, 96]. They enable website and application fingerprinting, memory disclosure, address-layout inference, and cryptographic-secret recovery [24, 46, 50, 82]. Physical leakage and software observation may also be combined by reading sensors or telemetry through software interfaces or translating physical effects into software-observable timing [55, 66, 82, 89]. Practical deployment depends on signal observability and stability. Physical observations are affected by sensor placement, distance, line of sight, environmental noise, and attenuation; target-integrated sensors are further constrained by interface availability, access control, sampling rate, and background execution. Software channels depend on stable changes in communication, execution, or shared resources and may be constrained by network protocols, application implementations, binary layouts, processor architectures, and available timing or probing primitives.
• We show that unprivileged applications can directly read raw data from the undocumented IMU built into MacBooks through IOKit without root privileges, runtime privilege elevation, or explicit user authorization, demonstrating that platform sensor access controls must also cover undocumented, vendor-internal sensor interfaces. • We systematically characterize physical leakage from the MacBook IMU, demonstrating reliable distinctions among key positions, strike forces, and supporting surfaces and evaluating the effects of device variation and common noise. Based on these findings, we design BRUTUS, which, to our knowledge, is the first side-channel attack framework to use an unprivileged local access path to the undocumented MacBook IMU for keystroke and context inference.
2.2
Inertial Measurement Units in MacBooks
An inertial measurement unit (IMU) typically combines a three-axis accelerometer with a three-axis gyroscope. The accelerometer measures linear acceleration along three spatial axes, whereas the gyroscope measures angular velocity about those axes, together providing six-axis inertial measurements. When mounted inside a laptop chassis, an IMU senses not only rigid-body translation and rotation but also mechanical vibrations transmitted through the structure. Apple introduced the Sudden Motion Sensor (SMS) in its laptops in 2005. The SMS used a three-axis accelerometer to detect drops and protect mechanical hard drives [6]. Apple later phased out the SMS as MacBooks transitioned to solid-state storage. A subsequent logic-board teardown of the MacBook Air M2 identified a Bosch Sensortec six-axis MEMS accelerometer and gyroscope [44]. Apple has not
• We evaluate BRUTUS on three tasks: keystroke inference, user profiling, and environment profiling. Our results show that BRUTUS recovers typed content from held-out participants on unseen devices, identifies individual typists, and discriminates among laptop placement surfaces. Vulnerability Disclosure. We reported the IMU vulnerability and the SCA vectors to Apple in March 2026. In their response in May 2026, Apple acknowledged the vulnerability and confirmed the successful reproduction of the IMU data leakage. Apple is currently analyzing the root cause and developing a security patch to mitigate this issue. 2
and merely inherit its group memberships. Root execution requires a separate runtime-elevation mechanism such as sudo; administrator membership permits requesting elevation but does not make a normally launched application root [9, 11]. The active console user occupies the Mac’s current graphical desktop. Apple’s SCDynamicStoreCopyConsoleUser returns that user’s name and UID while excluding sessions switched out through Fast User Switching [13]. Applications launched in the desktop session run under this console UID. Console status follows from login and neither grants administrator or root privileges nor requires a separate authorization. macOS separately governs application capabilities through TCC and code-signing entitlements. TCC Input Monitoring controls whether an application can monitor keyboard, mouse, and trackpad input across applications [7]; an entitlement embedded in the code signature grants a designated system capability [12]. We use unprivileged application for an application running under the active console user’s non-root UID, even when that user belongs to the administrator group, without runtime elevation, a special entitlement for the target interface, or TCC Input Monitoring authorization.
Figure 1: Raw six-axis IMU signal during password entry. Dashed lines mark keystroke onsets (keys T, R, O, R, P): (a) accelerometer and (b) gyroscope. publicly documented the full role of this IMU in modern MacBooks, and macOS does not expose raw acceleration or angular-velocity data from the MacBook chassis through a supported third-party motion API [8, 21]. In 2026, Bourbonnais documented an IOKit-based method for accessing this IMU. The work identified the undocumented AppleSPUHIDDevice HID service and decoded its report format; the accompanying implementation runs as root and uses the resulting motion measurements to analyze fine-grained physiological signals such as pulse [20, 21]. AppleSPUHIDDevice thus provides a user-space data path from the MacBook’s built-in IMU. Figure 1 shows a representative six-axis IMU trace that we collected through this data path during password entry. Each keystroke produces a sharp vibration transient that is visible in both the accelerometer and gyroscope channels, and waveform shapes exhibit observable differences across key positions. These traces show that the MacBook IMU senses not only rigid-body motion but also fine-grained structural vibrations generated by physical keyboard input. Once such physical measurements are delivered to user space, whether an ordinary application can read them depends on the account, login-session, and application-authorization checks that macOS applies to the data path.
2.3
3
Threat Model
In this paper, we assume an unprivileged attacker who exploits the MacBook’s built-in IMU side channel. The attacker aims to extract sensitive information, such as exact keystrokes, user identities, and the laptop’s external environment. Operating environment. We assume the victim operates an Apple MacBook equipped with a built-in IMU, running a standard, unmodified macOS installation. The experiments in this study are conducted on the latest MacBook models and macOS versions available at the time of writing. Furthermore, we assume the victim is the device owner and is logged in as the active console user using the administrator account created during standard macOS setup. As discussed in Section 2, this administrator-group membership is a pre-existing property of the victim’s account; the malicious process does not request administrator credentials or trigger an authentication prompt. IMU data capturing and exfiltration. In line with the threat models of conventional software-based side-channel attacks [24, 46, 96], we assume the attacker can execute an unprivileged background process under the victim’s active user account without triggering any macOS authentication prompts. This malicious process interfaces with the IOKit driver to continuously capture IMU data streams at a sampling rate of 800 Hz. Finally, we assume the attacker can exfiltrate the acquired sensor data via covert channels [22, 76] to perform the necessary offline analysis remotely.
macOS Account and Session Model
macOS distinguishes standard and administrator accounts. The first user created during setup is automatically an administrator, making administrator-group membership the default for the initial Mac user [10]. Applications launched normally from that account still execute under the user’s identifier (UID) 3
4.2
Table 1: Evaluation devices. Serial numbers show only the first three characters for privacy. Device Model
Chip macOS
Serial
D1 D2 D3 D4 D5 D6 D7 D8 D9 D10
M4 M4 M4 M5 M5 M3 M3 M5 M4 M3
CT6xxxxxxx JWKxxxxxxx CD6xxxxxxx KKXxxxxxxx D04xxxxxxx M3Pxxxxxxx LD7xxxxxxx HLGxxxxxxx K7Lxxxxxxx HXVxxxxxxx
MacBook Air 13” MacBook Air 13” MacBook Air 13” MacBook Air 13” MacBook Air 15” MacBook Air 15” MacBook Air 15” MacBook Air 13” MacBook Air 15” MacBook Air 13”
Tahoe 26.5 Tahoe 26.3 Sequoia 15.5 Tahoe 26.3 Tahoe 26.3 Sonoma 14.7 Sequoia 15.4 Tahoe 26.4 Tahoe 26.5 Tahoe 26.3
4
Characterization of IMU
4.1
Experimental Setup
Prior work on the MacBook IMU [20] assumed that root privileges are required to read the sensor, which would severely limit the attack surface. If that assumption held, an attacker would need to first escalate privileges before exploiting the IMU, making a side-channel attack less practical. We therefore systematically audit the real privilege boundaries of all IMU-related interfaces on macOS. As discussed in Section 2.3, the initial device-owner account created during standard macOS setup belongs to the administrator group, and its UID becomes the current console UID when the owner logs in to the graphical session. A process launched normally in this session therefore inherits both conditions without executing as root, invoking privilege elevation, or triggering an authentication or TCC prompt. Beyond the privilege question, another challenge motivates our interface selection. Prior keystroke side-channel work typically segments individual keystrokes from the sensor stream using signal-level energy thresholding [14, 41, 88]. However, the built-in IMU is rigidly coupled to the entire laptop chassis and records not only keystroke vibrations but also trackpad interactions, palm contacts, and other mechanical events at comparable amplitudes. In our preliminary experiments, the peak energy distributions of detected keyboard and trackpad events exhibited substantial overlap, and no energy threshold could reliably separate the two event types: at moderate sensitivity, a large fraction of detected events were trackpad interactions rather than keystrokes. Liu et al. [58] observed a similar limitation on smartwatch accelerometers and resorted to a co-located microphone for segmentation. We therefore ask whether macOS exposes any content-free system interface that could provide precise keystroke timing from the software layer, bypassing the signal-level segmentation problem entirely. macOS protects conventional input-event access through the TCC-protected CGEventTap and IOHIDManager interfaces, which expose raw key values and require explicit consent through the system-level Input Monitoring dialog [7]. We enumerate all IOKit HID services and CoreGraphics event interfaces that could leak keystroke-related information without revealing key values. Three interfaces survive this filter: HIDIdleTime provides sub-millisecond keystroke timestamps, CGEventSourceSecondsSinceLastEventType discriminates keyboard events from trackpad input, and AppleSPUHIDDevice delivers the raw six-axis IMU stream. Table 3 contrasts these interfaces with the TCC-protected interfaces. The three interfaces used by BRUTUS reveal no key values and require neither root nor TCC authorization. The three interfaces impose progressively stricter access conditions: unrestricted local access, an active GUI login session, and the combination of administrator-group membership and active-console-user status, respectively. First, HIDIdleTime, an IOKit Registry property on the
We conduct the IMU characterization experiments on 10 MacBook Air laptops, as summarized in Table 1. All devices are equipped with a built-in IMU sampled at approximately 800 Hz. The evaluation spans three chip generations (M3, M4, M5), two screen sizes (13” and 15”), and three macOS releases (Sonoma 14, Sequoia 15, and Tahoe 26). Each device is assigned a fixed identifier (D1 through D10) used throughout the paper to reference individual machines. To systematically characterize the IMU side channel, participant P1 records all datasets in this section under controlled conditions on device D1 (unless otherwise noted). During recording, macOS Input Monitoring is temporarily enabled to obtain ground-truth key labels and per-keystroke timestamps; this authorization is absent in the attack scenario. Experiments use either controlled single-key repetitions or a fixed passage from Pride and Prejudice covering all 26 letters and the space bar. Table 2 summarizes the four characterization datasets. Full participant recruitment (ten participants, P1–P10) and attack-specific dataset details are described in Section 5.1.
Table 2: Characterization datasets (Section 4). Passage: fixed English excerpt covering all 26 letters and space. All 9: nine desk surfaces in Section 4.5. Dataset
Section
Device
Surface
Content
Key position Typing force Desk material Cross-device
§4.3 §4.4 §4.5 §4.6
D1 D1 D1 D1–D10
Wood Wood All 9 Wood
50/key 50/level Passage Passage
Access Control of IMU Data
4
Table 3: macOS input-related interfaces and their access conditions. Interface
Key Val.
TCC
Access Cond.
TCC-protected CGEventTap IOHIDManager
✓ ✓
✓ ✓
Console user Console user
Exploited in this work HIDIdleTime CGEventSourcea AppleSPUHIDDevice
✗ ✗ ✗
✗ ✗ ✗
None Console user Admin group + console UID
a
SecondsSinceLastEventType: keyboard/trackpad discrimination.
Figure 2: Normalized IMU response across six channels for ten keys.
IOHIDSystem service node, is readable by any local process via IORegistryEntryCreateCFProperty, regardless of privilege level, session context (GUI, SSH, or launchd), or TCC state. It resets to zero on every HID event; polling it at over 100 kHz yields sub-millisecond keystroke timestamps. Second, CGEventSourceSecondsSinceLastEventType, which discriminates keyboard events from trackpad input, requires only an active GUI login session. It imposes no administrator-group requirement and requires no TCC authorization. Finally and most importantly, AppleSPUHIDDevice delivers the raw six-axis IMU stream at up to 800 Hz. Its data path traverses four IOKit API stages. IOServiceGetMatchingService locates the AppleSPUHIDDevice node, and IOHIDDeviceCreate constructs a device reference. IOHIDDeviceOpen opens the device for reading and checks administrator-group membership. IOHIDDeviceRegisterInputValueCallback registers the data stream and performs a per-delivery User ID (UID) check that matches the caller against the current console owner. Our experiments confirm that these checks are enforced at runtime: an administrator-group process connected over SSH or running as a launchd daemon under a different account receives no callbacks, and a Fast User Switch suspends delivery to the original account within 3 seconds. We audited all three interfaces across the ten devices in Table 1, spanning three Apple Silicon generations (M3, M4, M5) and three macOS releases (Sonoma, Sequoia, Tahoe); all findings are consistent across configurations. We also verified that toggling Input Monitoring authorization has no effect on the direct AppleSPUHIDDevice path, which continues to deliver approximately 800 Hz accelerometer and gyroscope data in both states. This result shows that TCC Input Monitoring protects conventional input-event interfaces that expose key values, but does not cover the IMU data path exploited here.
faces without TCC authorization, a dedicated entitlement, or any user-visible indicator, leaving this side-channel path outside the Input Monitoring gate that protects conventional input-event APIs.
4.3
Sensitivity to Key Positions
Pressing a key transmits vibrations through the laptop chassis. Because the IMU is mounted off-center on the logic board [98], each key has a different distance and angle to the sensor, creating a distinct mechanical lever arm. The resulting vibration pattern therefore differs from key to key in both amplitude and phase across the six IMU axes [62]. To quantify this, we select ten representative keys spanning the full keyboard layout (1, 0, Z, W, F, SPACE, L, T, B, U) and record 50 keystrokes per key on D1. To minimize interference from force variation, a single operator (P1) types all keystrokes within the same session at a deliberately steady pace. Figure 2 visualizes the normalized standard deviation of each IMU channel per key. Every key exhibits a distinct six-channel signature, confirming that key position is reliably encoded in the IMU signal. This per-key discriminability forms the physical basis for keystroke inference. Security Insight 2: Different key positions produce distinguishable six-channel IMU signatures, providing the physical basis for keystroke inference from a single vibration window.
4.4
Sensitivity to Typing Forces
Typing force varies across keystrokes: a harder press increases the impulse and vibration amplitude, whereas the key mechanism and chassis determine the waveform’s oscillation and decay. We test this separation by pressing key M 50 times at each of four force levels, from light touch to deliberate hard press, and compute orientation-independent accelerometer
Security Insight 1: Contrary to prior assumptions [20] that root privileges are required, a non-root process in the common device-owner session can access all three inter-
5
Figure 4: Normalized standard deviation of each IMU channel across nine desk surfaces. Figure 3: Waveforms of key M at four force levels. (a) Accelerometer magnitude. (b) Gyroscope magnitude. and gyroscope magnitudes: q ∥a∥ = a2x + a2y + a2z ,
∥ω∥ =
q
ω2x + ω2y + ω2z .
a visually distinct six-channel signature, confirming that the desk material leaves a measurable fingerprint in the IMU signal. This observation motivates environment-aware training for keystroke inference (Section 5) and enables surface identification as a standalone profiling capability.
(1)
Security Insight 4: Each of nine desk surfaces produces a distinct six-channel IMU fingerprint. This enables environment classification as a standalone attack and necessitates multi-surface training for robust keystroke inference.
Figure 3 shows that force scales amplitude while preserving the oscillation pattern, peak timing, and decay profile, allowing shape-based key features to generalize across natural force variation. Security Insight 3: Force variation scales only the vibration amplitude; the waveform shape that encodes key identity is preserved. A classifier trained on shape-based features can therefore generalize across natural force variation.
4.5
4.6
Cross-Device Consistency
Cross-device attacks require the key-dependent signatures in Sections 4.3–4.5 to reflect the shared keyboard-chassis design rather than individual units. P1 types the passage (Table 2) on D1–D10 on a wood desk, yielding approximately 900 keystrokes per device across 27 keys. The pipeline in Section 5.1 converts each keystroke into Fk ∈ R240×12 , and the same InceptionTime backbone maps it to a 128-dimensional embedding. We train on D1– D7 with supervised contrastive learning, pulling same-key embeddings together across devices and separating different keys. Held-out D8–D10 span M3–M5 and both 13” and 15” chassis. Using cosine similarity, we report ROC AUC for pairwise same-key versus different-key discrimination. All held-out devices exceed 91% AUC: D8, D9, and D10 achieve 91.2%, 98.5%, and 96.2%, respectively. On D9, samekey similarities concentrate near 0.994 and different-key pairs near 0.932 (Figure 5(a)); Figure 5(b) shows consistent ROC separation across all three devices. The results cover three chip generations, two chassis sizes, and three macOS releases, supporting that key-dependent representations transfer across the tested MacBook designs rather than reflecting a single unit.
Impact of Desk Materials
The surface beneath the laptop affects how keystroke vibrations propagate through the chassis. On a rigid surface (e.g., wood, steel), the laptop is mechanically well-coupled to the desk and keystroke energy dissipates rapidly into the supporting structure, producing lower residual vibration at the IMU. On a compliant surface (e.g., mattress, sofa, lap), the laptop rests on a yielding base that reflects rather than absorbs the impulse; the chassis oscillates longer and with greater amplitude [28]. We type the passage (Table 2) on D1 at consistent typing force across nine surfaces: four rigid (wood, glass, steel, plastic) and five non-rigid (leather sofa, soft mattress, mouse pad, lap, laptop stand with structural compliance). Figure 4 plots the normalized standard deviation of each IMU channel per surface. Consistent with the physics above, compliant surfaces (mattress, sofa, lap) exhibit higher normalized variability than rigid surfaces (wood, glass, steel), confirming the predicted coupling behavior. Each surface produces 6
Table 4: Pairwise AUC (%) under offline noise injection, averaged over five deterministic draws. 1×
5×
10×
25×
None (clean) External Speaker MacBook Speaker Network Traffic CPU Load
98.7 98.7 98.7 98.7 98.7
98.7 98.7 95.0 98.7 98.7
98.7 98.7 76.9 98.7 98.7
98.7 98.7 52.1 98.5 98.7
ments reused across amplification levels. At the recorded amplitude (1×), Table 4 shows mean AUC changes below 0.03 percentage points under every condition, within variation across the five draws. External Speaker, Network Traffic, and CPU Load remained close to the clean result even at 25×, with a maximum decrease of 0.25 percentage points. Only MacBook Speaker caused clear degradation, lowering AUC to 95.0%, 76.9%, and 52.1% at 5×, 10×, and 25×. Its vibrations originate inside the chassis and share the mechanical path that carries keystroke vibrations. Pairwise discrimination therefore remained stable under the recorded conditions; substantial degradation occurred only for amplified, chassis-coupled speaker vibration.
Figure 5: Cross-device keystroke discrimination on held-out devices. (a) Cosine similarity distributions on D9: same-key pairs concentrate near 1.0, while different-key pairs spread below 0.95. (b) ROC curves for pairwise discrimination on D8, D9, and D10.
4.7
Condition
Effects of Noise
To assess robustness under common operating conditions, we used offline additive-noise injection: recorded noise was added to the test windows, after which pairwise AUC was recomputed [30]. We recorded 120-second, keystroke-free IMU traces under four conditions: a phone on the same desk playing music at 50–60% volume (External Speaker), the MacBook’s built-in speakers at a comparable system volume (MacBook Speaker), dense local TCP traffic (Network Traffic), and four sustained SHA-256 workers (CPU Load). System-activity traces were recorded in the order idle, Network Traffic, and CPU Load, with quiet intervals of 30 and 60 seconds before the latter two recordings. For each IMU channel, we estimated the contribution of the tested condition from the difference in AC power between the condition and idle recordings [19]: q σsource = max σ2condition − σ2idle , 0 . (2)
5
BRUTUS: IMU Side-channel Attacks
Building on Section 4, BRUTUS infers what is typed (Section 5.2), who is typing (Section 5.3), and where the laptop is placed (Section 5.4). A timing oracle segments the shared six-axis IMU stream. Keystroke inference classifies individual windows, whereas label-free profiling aggregates interchannel coupling over typing segments to discover recurring groups.
5.1
Attack Overview
Participants and datasets. We recruit ten regular laptop users (P1–P10), aged 22–35 with an equal sex split. P1 performs the characterization (Section 4) and environment profiling; P1– P8 contribute to user profiling, and P1–P7 provide keystrokeinference training data. P8–P10 contribute no such training data and serve as held-out victims (Section 5.2). Each training session adds 20 random passwords (10 each of lengths 8 and 9) to the passage, covering 37 classes and approximately 1,070 keystrokes. Desk-material characterization and environment profiling share recordings. Feature representation. A physical keystroke generates a transient mechanical impulse in the laptop chassis, producing a sharp onset, rapid resonant peak, and damped decay. Section 4.4 shows that strike force scales the amplitude without changing this waveform shape, which returns to the noise floor within approximately 200 ms.
We centered each condition trace and scaled it to the resulting source amplitude. Using one-second blocks, we performed block resampling [52] and computed Bonferroni-adjusted onesided simultaneous lower bounds across the six channels [31]; a channel was injected only when its lower bound on variance increase over idle was positive. For each test window, we added a 240-sample source segment to the six raw channels at 1×, 5×, 10×, or 25× amplitude and recomputed the first-difference channels [94]. Each condition used five deterministic draws, with the same seg7
We therefore extract a 300 ms asymmetric window around each onset timestamp tk , obtained from labeled training data or the real-time timing oracle in Section 5.2. Sampling [tk − 100 ms, tk + 200 ms] from the continuous approximately 800 Hz IMU stream yields Wk ∈ R240×6 , comprising three accelerometer and three gyroscope axes. The 100 ms preonset interval provides a quiescent baseline, while the 200 ms post-onset interval covers the impact and decay. To encode the dynamics of each vibration channel beyond raw amplitude, we augment each window with first-order temporal differences: Dk [t, c] = Wk [t+1, c] − Wk [t, c]
(3)
Figure 6: End-to-end BRUTUS pipeline. The timing oracle segments the six-axis IMU stream into keystroke windows. Keystroke inference uses 12-channel features, InceptionTime, and language-model decoding; label-free profiling instead aggregates cross-axis correlations over typing segments, selects k by prediction strength, and clusters recurring user or environment profiles with k-means.
The first-order differences capture the key-dependent onset slopes and decay rates identified in Section 4.3 and complement the raw amplitude profiles. Per-channel z-score normalization, using µ and σ computed on the training data and reused at inference, yields Fk ∈ R240×12 for the keystroke classifier and supervised characterization models. The labelfree attacks instead derive the segment representation in Section 5.3 directly from the six raw channels. Classifier architecture. Under the same cross-validation protocol, we compared InceptionTime [45], a three-layer 1D CNN, a Transformer encoder, and a gradient-boosted ensemble on a held-out keystroke dataset. InceptionTime achieved 4–14 percentage points higher top-1 accuracy than the alternatives while using the fewest trainable parameters among the neural candidates, so we use it for keystroke inference. InceptionTime extends the Inception module [81] to onedimensional time series using parallel convolutions at multiple temporal scales. Our configuration has three cascaded Inception blocks with kernels of 10, 20, and 40 samples (approximately 12.5 ms, 25 ms, and 50 ms at 800 Hz), a bottleneck dimension of 32, and a max-pooling branch. The shorter kernels resolve impact transients, while the longer kernels capture chassis resonance and decay (Sections 4.3 and 4.5). Global average pooling produces a 128-dimensional vector, which a linear head maps to 37 key classes. The model has approximately 480K trainable parameters. Section 4.6 uses the same backbone with a supervised contrastive objective and confirms that it captures key-dependent structure across three chip generations. Training methodology. The supervised models use categorical cross-entropy and Adam (initial learning rate 10−3 , weight decay 10−4 ), with cosine annealing and early stopping. We use five-fold, session-level GroupKFold cross-validation: all windows from a recording session remain in the same fold. The label-free attacks require no classifier training; their clustering procedure is specified in Section 5.3.
5.2
unseen devices and in self-selected environments, BRUTUS achieves an overall Character Error Rate (CER) of 2.5%– 10.9% (Table 5). Challenge and solution. Recovering a complete sequence first requires locating each keystroke in the continuous IMU stream. IMU-only segmentation is unreliable because successive vibrations overlap and ambient transients can mimic keystroke onsets. BRUTUS combines the content-free metadata interfaces characterized in Section 4.2 to obtain precise onset timestamps without exposing key values. It polls IOHIDSystem HIDIdleTime at over 100,000 iterations per second and records each HID reset. A 4 ms debounce filter merges the key-down/key-up resets from one physical press, after which CGEventSourceSecondsSinceLastEventType removes trackpad events. The resulting timestamps segment the continuous IMU stream into per-keystroke windows. Per-keystroke classification. For each retained event, the sub-millisecond timestamp indexes the IMU buffer to extract the 300 ms, 12-channel window defined in Section 5.1. InceptionTime classifies it over 37 keys (a–z, 0–9, space) and retains the full softmax distribution for sequence decoding. Sequence-level text recovery. The per-position softmax distributions are assembled into a ranked list of candidate strings via beam search with width B=100 and per-position expansion K=6: at each character position, the K highestprobability classes extend the current B partial sequences by cumulative log-probability, and only the top B extensions survive to the next position. When the input contains linguistic structure, a trigram language model augments the search at word boundaries. The language model is trained on the Brown corpus (∼1M tokens) with Laplace smoothing, and its vocabulary is supplemented by the NLTK English word list (∼236K
Keystroke Inference
Keystroke inference recovers the exact character sequence typed by the victim. Against three held-out participants on 8
entries). The combined score at each word boundary balances classifier evidence and linguistic plausibility: Sword (w) = Scls (w) + α · log PLM (w | w−2 , w−1 )
Table 5: Keystroke inference results (%). Overall combines password and sentence CER. Averages are weighted by character count.
(4)
Password
where Scls (w) is the cumulative character-level log-probability and α = 0.5. A sensor-constrained rescue mechanism prevents the language model from overriding high-confidence classifier predictions: character positions where the softmax probability exceeds a threshold are frozen, and candidate words are accepted only if their per-position characters fall within the classifier’s top-K predictions at the majority of positions. Evaluation metrics. We report two metrics for keystroke inference. Character Error Rate (CER) is the edit distance between the predicted and ground-truth character sequences, normalized by the ground-truth length; it captures substitutions, insertions, and deletions. Top-5 accuracy is the fraction of test sequences for which the correct string appears among the five highest-scoring candidates produced by beam search. Results. We train on the Section 5.1 data from P1–P7 operating D1–D7 across the surfaces in Section 4.5. We first evaluate generalization among the training participants: each of P1–P7 switches to a MacBook not used during their own training sessions and independently selects a typing environment, then types 15 random alphanumeric passwords (five each of length 8, 9, and 10) followed by ten meaningful English sentences. The upper portion of Table 5 reports the per-participant cross-test results. To simulate a realistic attack against unseen victims, three participants (P8–P10) who did not contribute to the keystroke inference training set are each assigned a MacBook not used during training (D8–D10) and independently select a natural typing environment: P8 types at a café table, P9 on their lap, and P10 on a soft mattress. Each follows the same protocol: 15 passwords (five each of length 8, 9, and 10), then ten sentences. The lower portion of Table 5 reports these end-to-end results. Notably, P8 achieves an overall CER of 2.5%, comparable to the best cross-test participants, demonstrating that the model does not degrade simply because the user, device, and environment are all unseen during training. Failure analysis: P9. P9 exhibits the highest raw CER among all ten participants: 15.6% for passwords, 10.0% for sentences, and 10.9% overall. It is also the only case in which languagemodel augmentation degrades sentence recovery, increasing CER from 10.0% to 11.5%. We observe that P9’s shorter interkeystroke intervals can cause three or four consecutive 300 ms classification windows to overlap, contaminating each target window with multiple neighboring keystrokes. The resulting substitutions may span distant keyboard positions and form valid English words that the language model has little basis to reject. In one representative sentence, five of the seven raw character errors formed valid words; although the language model corrected two non-word errors, it increased the total error count from seven to nine. This pattern occurs in three of
User
Device
Cross-test P1 D3 P2 D7 P3 D5 P4 D1 P5 D2 P6 D6 P7 D4
Surface
CER
Top-5
CER
+LM
Overall
Wood Lap Laptop stand Wood Plastic Lap Mouse pad
7.4 2.2 8.9 6.7 5.2 7.4 5.9
100.0 100.0 93.3 100.0 100.0 100.0 93.3
5.5 2.0 6.5 5.0 4.1 5.7 4.7
0.8 0 0.8 0 0 0.8 0.7
5.8 2.0 6.8 5.3 4.2 5.9 4.9
6.2
98.1
4.8
0.4
5.0
4.4 15.6 9.6
93.3 80.0 86.7
2.1 10.0 4.3
1.4 11.5 2.2
2.5 10.9 5.0
9.9
86.7
5.3
4.8
6.0
Avg. End-to-end P8 D8 P9 D9 P10 D10 Avg.
Sentence
Café table Lap Mattress
P9’s ten test sentences and accounts for the higher CER after language-model rescoring.
5.3
Label-Free User Profiling
In shared-console settings, a recurring group may take turns at a logged-in MacBook while its account and UID remain fixed. From the IMU stream, BRUTUS estimates the number of user profiles and assigns subsequent typing segments to them. Attack preparation. Eight participants (P1–P8; four men and four women, ages 22–35) type the Section 4.1 passage on D1 on a wood desk. After filtering backspace, return, punctuation, and modifier combinations, each contributes 1,188 windows: the first 891 form nine discovery segments and the remaining 297 form three subsequent segments, totaling 72 and 24 segments. Fixing text, device, and surface isolates typing dynamics. Segment representation. Idle gaps divide the onset stream into typing segments of approximately 99 windows. For each window, BRUTUS computes all 15 pairwise Pearson correlations among the six IMU channels; seven distribution summaries per pair yield an ℓ2 -normalized, 105-dimensional segment representation. Inter-axis correlations characterize coupled multiaxis motion [17] and are invariant to the amplitude scaling caused by strike force (Section 4.4), while retaining relative propagation across axes. Aggregation captures recurring hand posture, finger assignment, and striking motion [33, 35, 68]. Clustering and attribution both use the full 105-dimensional space. Profile discovery and attribution. With the representation and criterion fixed before evaluation, BRUTUS applies 9
Figure 7: Label-free user profiling. (a) t-SNE of discovery segments (circles), subsequent segments (triangles), and centroids (stars); colors show participants after evaluation alignment. (b) Prediction strength versus k; the dashed line marks the 0.80 threshold and the ring marks k = 8.
Figure 8: Label-free environment profiling. (a) t-SNE of discovery segments (circles), subsequent segments (triangles), and centroids (stars); colors show environments after alignment. (b) Prediction strength versus k; the dashed line marks 0.80 and the ring marks k = 9.
Lloyd’s k-means [59] and uses prediction strength to test reproducibility across data splits [83], selecting the largest k with PS(k) ≥ 0.80. For adjacent accepted solutions, nested purity—standard purity relative to the coarser partition [61]— equals 1.0 when every finer cluster lies within one coarser cluster. BRUTUS then refits on all discovery segments and assigns subsequent segments to the nearest centroid in the full space. Attack output. Figure 7(b) shows PS(7) = 0.827 and PS(8) = 0.896, both above the selection threshold; the score falls to 0.349 at k = 9. BRUTUS therefore selects the largest accepted solution, k̂ = 8. The transition from k = 7 to k = 8 has nested purity 1.0: the joint P2/P3 cluster divides into separate profiles while the other six clusters remain intact. After Hungarian matching aligns the discovered clusters with participant identifiers for evaluation [51], the eight clusters correspond to P1–P8, and all 72 discovery segments and 24 subsequent segments are assigned to the correct profiles. Figure 7(a) visualizes this hierarchy using t-SNE [85]. P2 and P3 form the closest pair. Both are women aged 24 and 25 with similar builds and type with extended fingers held relatively flat against the keys. This shared posture couples impacts into the chassis similarly, merging their profiles at k = 7. They use different fingers for some keys, however, changing impact direction and cross-axis propagation. Ag-
gregating approximately 99 keystrokes per segment exposes these persistent differences, separating the profiles at k = 8 and assigning subsequent segments accordingly. Thus, k = 7 captures their shared coarse-grained posture, whereas k = 8 distinguishes the user-specific mechanics introduced by their different finger assignments.
5.4
Label-Free Environment Profiling
Because the support condition changes keystroke propagation across IMU axes, BRUTUS groups recurring typing segments into environment profiles and attributes subsequent segments. Attack preparation. P1 types the Section 4.1 passage on D1 across nine surfaces: wood, steel, plastic, glass, mouse pad, laptop stand, leather sofa, soft mattress, and lap. After filtering, each environment contributes 1,188 windows: 891 form nine discovery segments and 297 form three subsequent segments, totaling 81 and 27 segments. Fixing typist, device, and content isolates the support condition. Profile discovery and attribution. BRUTUS reuses the segment representation and prediction-strength procedure from Section 5.3, assigning subsequent segments to discovery centroids. As Section 4.5 shows, stiffness, damping, and contact geometry shape propagation among IMU channels, producing recurring environment profiles. 10
Attack output. Figure 8(b) gives prediction strength 0.878 at k = 9, so BRUTUS selects k̂ = 9. After Hungarian matching, the nine clusters correspond to the nine environments, and all 81 discovery and 27 subsequent segments are assigned correctly. In Figure 8(a), each surface forms a distinct discovery region and subsequent segments lie near the corresponding centroid, showing persistent support-dependent propagation.
6 6.1
Table 6: Keystroke recovery under rate limiting (%), averaged over five same-rate session-level folds. Password CER
Top-5
CER
+LM
800 Hz 200 Hz 100 Hz 50 Hz
3.33 26.56 36.38 62.00
96.00 31.00 8.00 0.00
4.14 23.67 25.38 43.36
0.86 18.59 16.78 35.86
HIGH_SAMPLING_RATE_SENSORS permission for sampling rates exceeding 200 Hz [5]. Following Section 4.1, P1 types on D1 on a wood desk at 800, 200, 100, and 50 Hz. Every rate uses the same 1,842character corpus: 50 passwords each of lengths 8 and 9 plus 12 sentences. Training uses all length-8 passwords, 30 length9 passwords, and 9 sentences (1,406 characters); testing uses the remaining 20 length-9 passwords and 3 sentences (436 characters). We train from scratch and test at the same rate using the five-fold session-level protocol from Section 5.1. Table 6 shows substantial degradation: password Top-5 recovery falls from 96.00% at 800 Hz to 31.00%, 8.00%, and 0% at 200, 100, and 50 Hz, while password CER reaches 62.00% at 50 Hz. Language-model-assisted sentence CER rises from 0.86% to 35.86%. Rate limiting therefore suppresses fine-grained vibration information and complements access control. Noise injection. Calibrated driver-level noise requires no application cooperation. Section 4.7 shows that additive, chassiscoupled vibration impairs cross-device discrimination; targeting the keystroke band could obscure this channel while preserving coarse orientation and motion sensing.
Other Exploitations
Limitations
The IMU path requires the process to run under the active console user’s UID and that account to belong to the administrator group (Section 4.2); the initial, typically sole Mac user commonly satisfies both. GUI processes, SSH sessions under that UID, and same-UID LaunchAgents can acquire the full 800 Hz stream. A secondary SSH or su user, even an administrator, receives kIOReturnNotPrivileged at IOHIDDeviceOpen because its UID differs from the console owner. Fast User Switching also disconnects the stream within three seconds, without an error or handle invalidation.
6.3
Rate
Discussion
Trackpad side channel. The built-in IMU can capture vibrations from Force Touch taps, clicks, and swipes [62, 66]; whether they reveal click targets or gestures remains future work. Other devices. Similar leakage may arise where a keyboard and software-readable IMU share a rigid structure; for example, iOS CMMotionManager exposes motion data at approximately 100 Hz in the foreground [8]. Cross-platform evaluation remains future work.
6.2
Sentence
7
Related Work
Prior inference techniques span three targets: user identity, device environment, and keystroke content. We organize related work accordingly and compare sensor placement, external hardware, active probing, label requirements, and user enrollment.
Mitigation
We propose three complementary system- and driver-level defenses. Access-control enforcement. The AppleSPUHIDDevice path lacks the mediation applied to comparable mobile sensor interfaces. Extending TCC to this IOKit path, analogous to protecting Intel power interfaces [55], would block unauthorized reads. Equivalent checks on HIDIdleTime and CGEventSourceSecondsSinceLastEventType would also remove the content-free timing oracle used to synchronize keystrokes. Rate limiting. Sensor rate limiting has emerged as a standard defense against motion-based side channels across major mobile platforms: iOS restricts CMMotionManager to approximately 100 Hz [8], while Android 12 mandates the
7.1
User Identification
Keystroke dynamics. Classical keystroke biometrics construct a user template from key-hold and inter-key timings, and then verify a claimed identity or identify one typist from an enrolled gallery [39, 47, 68]. TypeNet and Type2Branch learn embeddings that transfer to identities excluded from model training [2, 37]. Nevertheless, both classical templates and learned embeddings require identity labels during training or enrollment: every test user must first contribute an identity-linked reference set. This per-user registration makes 11
the attack expensive to scale and leaves an attacker who obtains only unlabeled sessions without the references needed to separate those sessions by user. Touch and motion behavior. Touchalytics and SilentSense authenticate a phone owner from touchscreen gestures and touch-induced device motion [18,32]. Other systems combine touch or keystroke events with a phone’s accelerometer and gyroscope [33, 35, 77], while BehaveFormer learns a supervised representation from keystroke and IMU sequences [75]. Owner-verification systems answer whether the current operator matches one enrolled account; gallery-based systems select among identities registered in advance. In either case, the attacker must know the candidate identities and collect labeled reference data for each new target, so the method cannot discover the number or membership of users directly from unlabeled observations. Wearables and external sensing. WACA records typing motion from a smartwatch worn by the user, and Lee et al. actively vibrate a smartwatch and measure the wearer’s response [1, 54]. Roth et al. place a microphone near the keyboard to identify typists from keystroke sounds [73]; VibWrite attaches an actuator and vibration sensors to the input surface [57]. These prerequisites sharply restrict deployability: an attacker must place a sensor near the victim, control a device worn by the victim, or touch and instrument the input surface. None can be launched solely by local malware already running on an otherwise unmodified target computer. Speech-induced motion. Gyrophone recognizes a fixed set of speakers by measuring gyroscope responses to speech from an external loudspeaker [65]; Spearphone and AccelEve exploit coupling between a phone’s own loudspeaker and accelerometer [4, 15]. These attacks require speech playback or speaking, sufficiently strong loudspeaker–sensor coupling, and labeled samples for a predetermined set of talkers. Changing that set requires another identity-linked collection and enrollment process. Comparison with BRUTUS. Existing user-identification methods generally rely on identity labels and per-user enrollment. Methods using a smartwatch, an external microphone, or active vibration further require the attacker to control a victim-worn device, place a sensor near the victim, or instrument the input surface, making them difficult to deploy through local malware alone on the target computer. BRUTUS uses only the MacBook’s built-in IMU to estimate the number of user clusters from unlabeled sessions and group sessions by user, without identity labels, per-user enrollment, or external sensing hardware.
7.2
vibration motor for pressure inference [36]. Hasegawa et al. emit tones through a phone’s built-in speaker and analyze the signal returned to its microphone [42]. Kunze and Lukowicz combine vibration, acceleration, sound, and a downwardfacing extra loudspeaker [53]. These active paths require the attacker to control an actuator and inject a known probe before measurement, preventing passive inference from ordinary device use. Their measurements are tied to the probe hardware, orientation, and contact geometry, while expanding the target class set requires another labeled collection campaign. Specialized material sensors. Strese et al. use a custom haptic stylus with accelerometers, microphones, force sensors, external acquisition hardware, and close-up surface images [80]. Harrison and Hudson build a separate multispectral optical prototype that actively illuminates nearby material [40]. Such instrumentation must be installed on or brought into contact with the target environment, making the attack conspicuous and dependent on prior physical access; it cannot be executed by software on an unmodified victim computer. Both approaches also require labeled examples for their predefined material classes. Comparison with BRUTUS. Existing environmentidentification methods either control a vibrator or loudspeaker to emit a probe, or use custom haptic and optical instruments, and train on labeled examples of predefined material, location, or posture classes. These prerequisites require the attacker to control an actuator or physically access the environment to deploy specialized instrumentation, limiting stealth and deployability. BRUTUS uses only the MacBook’s built-in IMU to estimate the number of environment clusters from unlabeled sessions and group sessions by physical environment during natural typing, without environment labels, external instrumentation, or active sound or vibration.
7.3
Keystroke Recovery
Keystroke eavesdropping attacks can be divided into physical side-channel attacks (PSCAs) and software side-channel attacks (SSCAs). Acoustic, electromagnetic, and wireless PSCAs. Acoustic attacks record key-dependent sound using a nearby microphone or an accessible audio stream [14, 78, 84, 97]. Their models are sensitive to the keyboard, typist, microphone placement, and ambient noise; without access to a suitable audio path, the leakage is unavailable. Electromagnetic and wireless attacks instead capture keyboard emanations or key-induced perturbations to Wi-Fi and radio signals [3, 87, 88, 92]. They require an electromagnetic receiver, controllable wireless infrastructure, or a tag and reader near the victim, exposing the attack to physical discovery and preventing deployment by target-local software alone. Mechanical-vibration PSCAs. A smartphone placed on the same desk can sense keyboard vibration [62]; smartwatches and headphones can capture related wrist or head
Environment Identification
Active vibration and acoustics. VibePhone and Diaconita et al. activate a phone’s vibration motor and classify the accelerometer response [25,29]; GripSense combines touch and gyroscope signals for hand-posture sensing and pulses the 12
8
motion [58, 60, 90]. The sensing device must lie on the vibration path between the keyboard and the attacker. Moving the phone, changing the support material, or removing the wearable breaks that path, while pre-positioning the hardware requires physical proximity or control of a victim-owned accessory.
Conclusion
In this paper, we present BRUTUS, an unprivileged sidechannel attack framework that exploits the undocumented IMU built into Apple MacBooks. BRUTUS reads raw IMU data through IOKit without root privileges or runtime privilege elevation and combines the sensor stream with two content-free system metadata interfaces to infer keystrokes, typists, and laptop placement surfaces. Against three held-out participants on unseen devices, BRUTUS achieves a characterlevel accuracy of 89.1% to 97.5%. Without user or environment labels, it also discovers user and environment profiles and assigns subsequent segments to their corresponding profiles. Our results show that platform sensor access controls must extend to undocumented, vendor-internal sensor interfaces.
Built-in sensors. Camera and microphone streams exposed to conferencing applications support video- and audio-based recovery [27, 93], but macOS places camera and microphone access behind Transparency, Consent, and Control authorization [7]. On phones and watches, motion attacks recover keys, PINs, and longer text through public sensor APIs [23, 64, 66, 69, 70, 91]. That deployment path does not carry over to MacBooks: Apple’s supported Core Motion interface is unavailable on macOS [8], leaving no documented third-party API for the chassis IMU.
Ethical Considerations
SSCAs. Network-based attacks infer input from encryptedtraffic timing and size patterns, as in search-engine autocomplete [67]; they observe only inputs that trigger distinguishable communication, so offline, buffered, or purely local typing leaves no corresponding trace, and protocol or application changes can invalidate the model. Timing attacks exploit interkeystroke intervals in interactive sessions [71, 79]. Because an interval does not directly identify either key, reconstruction depends on candidate corpora, dictionaries, or language priors and degrades on random secrets and atypical timing. Cache attacks locate keystroke-related execution paths and data accesses [38, 74]; they require processor-specific cache primitives and stable application binaries, and software updates or architectural changes can invalidate the learned templates.
Participants and data handling. Our evaluation involved ten adult participants in controlled experiments. All participants provided informed consent before data collection and received US$100 for their participation. They typed passages supplied for the study, randomly generated alphanumeric passwords, and test sentences. We refer to participants and devices only by the identifiers P1–P10 and D1–D10. The research team stores the source data, and participants may request deletion of their records. Before release, the raw IMU data from Section 4 are de-identified by removing names, account information, device serial numbers, absolute file paths, original collection times, and other identifying metadata. The participant data, trained models, and end-to-end attack implementation from Section 5 are retained within the research team. Potential impact and risk management. The stakeholders in this work include the study participants, users of IMUequipped MacBooks, Apple, and the security research community. All experiments were conducted with consenting participants on controlled devices using inputs supplied for the study. The IMU access path has dual-use implications: it enables researchers to evaluate the platform’s sensor access controls, but it could also allow malicious local software to infer typed content, typist characteristics, and the laptop’s physical context. The public artifact contains the access-control audit and physical-leakage characterization from Section 4. These materials support independent validation of the underlying system and physical evidence. The participant data, trained models, and complete attack pipeline from Section 5 remain internal. Responsible disclosure and publication. We disclosed the IMU access-control issue and the resulting side-channel vectors to Apple in March 2026. In May 2026, Apple acknowledged the report and confirmed that it had reproduced the IMU data leakage. At the time of submission, Apple was investigating the root cause and developing mitigations. Pub-
Comparison with BRUTUS. On MacBooks, existing physical attacks either require sensors to be placed near the victim or require camera or microphone permission; inertial attacks on mobile devices rely on public motion-sensor APIs, but macOS provides no corresponding public interface for reading the MacBook’s built-in IMU. Among software attacks, traffic-based methods apply only to online interactive settings in which each input triggers network transmission, leaving no per-keystroke traffic for local, offline, or buffered input; timing methods require key-labeled samples from the target user to train or adapt a personal timing model; cache attacks that directly reveal key values must first locate keycode-related code or data addresses in the target program and depend on a specific application, binary version, shared mapping, and processor cache primitives, so application updates or platform changes invalidate the template. BRUTUS reads the factoryinstalled IMU through an undocumented IOKit path and recovers keys from keystroke-induced vibrations independent of the target application, without labeled training data from the target user, external hardware, active sound or vibration, or camera or microphone permission. The same data stream also supports label-free user and environment analysis. 13
lishing these findings enables independent examination of the exposed sensor path and provides evidence for platformlevel access controls, sampling rate limits, and user-visible permission mechanisms.
[4] S. Abhishek Anand, Chen Wang, Jian Liu, Nitesh Saxena, and Yingying Chen. Spearphone: A lightweight speech privacy exploit via accelerometer-sensed reverberations from smartphone loudspeakers. In Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), pages 288–299. ACM, 2021. doi:10.1145/3448300.3468 499.
Open Science An anonymized artifact is available at https://anonymou s.4open.science/#!/r/submission-artifact-604F/. It includes a demonstration video recorded by the authors and the complete experimental materials for the IMU characterization in Section 4. The materials cover the accesscontrol audit, key-position and typing-force characterization, supporting-surface characterization, cross-device evaluation, and noise evaluation. For each experiment, the artifact provides de-identified raw six-axis IMU recordings, the experimental protocol and configuration, labels and provenance metadata, analysis scripts, and expected outputs. The accompanying documentation maps these materials to the corresponding figures, tables, and findings in the paper. The Section 4 artifact supports independent verification of the access-control and physical-leakage properties underlying the attacks in Section 5. Reacquiring the sensor stream and repeating the access-control audit require a compatible Apple Silicon MacBook with a built-in IMU and an appropriate macOS configuration. The packaged recordings and analysis scripts support offline reproduction of the Section 4 analyses. The public release covers Section 4. The participant datasets, trained models, and end-to-end attack implementation from Section 5 are retained by the research team. All released files, including the demonstration video, are anonymized to remove participant, device, institution, and author identifiers.
[5] Android Developers. Sensors overview. https://de veloper.android.com/develop/sensors-and-l ocation/sensors/sensors_overview, 2024. Documents the HIGH_SAMPLING_RATE_SENSORS permission introduced in Android 12. [6] Apple Inc. About the sudden motion sensor. https: //support.apple.com/en-us/102457, 2005. Threeaxis accelerometer introduced in the PowerBook G4 (2005) to park the hard-disk head on free-fall detection. [7] Apple Inc. Change Privacy & Security settings on Mac. https://support.apple.com/guide/mac-help/ change-privacy-security-settings-on-mac-m chl211c911f/mac, 2024. Apple Support documentation on Transparency, Consent, and Control (TCC). [8] Apple Inc. CMMotionManager | Apple developer documentation. https://developer.apple.com/docume ntation/coremotion/cmmotionmanager, 2024. The device-motion interface is unavailable on macOS. [9] Apple Inc. How to enable the root user or change the root password on Mac. https://support.apple.co m/en-us/102367, 2025. Updated 2025-12-08. [10] Apple Inc. Add a user or group on Mac. https:// support.apple.com/guide/mac-help/add-a-use r-or-group-mchl3e281fc9/mac, 2026. Mac User Guide; accessed 2026-08-25.
References [1] Abbas Acar, Hidayet Aksu, A. Selcuk Uluagac, and Kemal Akkaya. WACA: Wearable-assisted continuous authentication. In Proceedings of the 2018 IEEE Security and Privacy Workshops (SPW), pages 264–269. IEEE, 2018. doi:10.1109/SPW.2018.00042.
[11] Apple Inc. Enter administrator commands in terminal on Mac. https://support.apple.com/guide/ terminal/apd5b0b6259-a7d4-4435-947d-0dff5 28912ba/mac, 2026. Terminal User Guide; accessed 2026-08-26.
[2] Alejandro Acien, Aythami Morales, John V. Monaco, Ruben Vera-Rodriguez, and Julian Fierrez. TypeNet: Deep learning keystroke biometrics. IEEE Transactions on Biometrics, Behavior, and Identity Science, 4(1):57– 70, 2022. doi:10.1109/TBIOM.2021.3112540.
[12] Apple Inc. Entitlements | Apple Developer Documentation. https://developer.apple.com/docume ntation/bundleresources/entitlements, 2026. Accessed 2026-08-25.
[3] Kamran Ali, Alex X. Liu, Wei Wang, and Muhammad Shahzad. Keystroke recognition using WiFi signals. In Proceedings of the 21st Annual International Conference on Mobile Computing and Networking (MobiCom), pages 90–102. ACM, 2015. doi:10.1145/2789168. 2790109.
[13] Apple Inc. SCDynamicStoreCopyConsoleUser | Apple Developer Documentation. https://developer.ap ple.com/documentation/systemconfiguration/ scdynamicstorecopyconsoleuser(_:_:_:), 2026. Accessed 2026-08-25. 14
[14] Dmitri Asonov and Rakesh Agrawal. Keyboard acoustic emanations. In Proceedings of the 2004 IEEE Symposium on Security and Privacy (S&P), pages 3–11. IEEE, 2004. doi:10.1109/SECPRI.2004.1301311.
[24] Boru Chen, Yingchen Wang, Pradyumna Shome, Christopher Fletcher, David Kohlbrenner, Riccardo Paccagnella, and Daniel Genkin. GoFetch: Breaking Constant-Time Cryptographic Implementations Using Data Memory-Dependent Prefetchers. In Proceedings of the USENIX Security Symposium (USENIX Security), pages 1117–1134. USENIX, 2024.
[15] Zhongjie Ba, Tianhang Zheng, Xinyu Zhang, Zhan Qin, Baochun Li, Xue Liu, and Kui Ren. Learning-based practical smartphone eavesdropping with built-in accelerometer. In Proceedings of the 2020 Network and Distributed System Security Symposium (NDSS). Internet Society, 2020. doi:10.14722/NDSS.2020.24076.
[25] Jungchan Cho, Inhwan Hwang, and Songhwai Oh. VibePhone: Efficient surface recognition for smartphones using vibration. Pattern Analysis and Applications, 19(1):251–265, 2016. doi:10.1007/s10044 -015-0460-8.
[16] Michael Backes, Markus Dürmuth, and Dominique Unruh. Compromising reflections – or – how to read LCD monitors around the corner. In Proceedings of the 2008 IEEE Symposium on Security and Privacy (S&P), pages 158–169. IEEE, 2008. doi:10.1109/SP.2008.25.
[26] Youngtak Cho, Sanket Suresh Badgujar, Srinivasan Murali, Xuhao Xie, and Ming Li. OptiVibe: Keystroke inference attacks through a new optical-vibration side channel. In Proceedings of the 46th IEEE International Conference on Distributed Computing Systems (ICDCS), pages 840–850. IEEE, 2026. doi:10.1109/2575-841 1.2026.00085.
[17] Ling Bao and Stephen S. Intille. Activity recognition from user-annotated acceleration data. In Pervasive Computing, volume 3001 of Lecture Notes in Computer Science, pages 1–17. Springer, 2004. doi:10.1007/97 8-3-540-24646-6_1.
[27] Alberto Compagno, Mauro Conti, Daniele Lain, and Gene Tsudik. Don’t skype & type! Acoustic eavesdropping in voice-over-IP. In Proceedings of the 12th ACM Asia Conference on Computer and Communications Security (AsiaCCS), pages 703–715. ACM, 2017. doi:10.1145/3052973.3053005.
[18] Cheng Bo, Lan Zhang, Xiang-Yang Li, Qiuyuan Huang, and Yu Wang. SilentSense: Silent user identification via touch and movement behavioral biometrics. In Proceedings of the 19th Annual International Conference on Mobile Computing and Networking (MobiCom). ACM, 2013. doi:10.1145/2500423.2504572.
[28] Lothar Cremer, Manfred Heckl, and Björn A. T. Petersson. Structure-Borne Sound: Structural Vibrations and Sound Radiation at Audio Frequencies. Springer, 3rd edition, 2005. doi:10.1007/b137728.
[19] Steven F. Boll. Suppression of acoustic noise in speech using spectral subtraction. IEEE Transactions on Acoustics, Speech, and Signal Processing, 27(2):113– 120, 1979. doi:10.1109/TASSP.1979.1163209.
[29] Irina Diaconita, Andreas Reinhardt, Delphine Christin, and Christoph Rensing. Inferring smartphone positions based on collecting the environment’s response to vibration motor actuation. In Proceedings of the 11th ACM Symposium on QoS and Security for Wireless and Mobile Networks (Q2SWinet), pages 99–106. ACM, 2015. doi:10.1145/2815317.2815342.
[20] Olivier Bourbonnais. apple-silicon-accelerometer: Reading the undocumented MEMS accelerometer and gyroscope on Apple Silicon MacBooks via IOKit HID. https://github.com/olvvier/apple-silicon-a ccelerometer, 2026. [21] Olivier Bourbonnais. Your MacBook has an accelerometer, and you can read it in real time in Python. https: //medium.com/@oli.bourbonnais/your-macbook -has-an-accelerometer-and-you-can-read-i t-in-real-time-in-python-28d9395fb180, 2026.
[30] Ngoc-Tuan Do, Van-Phuc Hoang, Van Sang Doan, and Cong-Kha Pham. On the performance of non-profiled side channel attacks based on deep learning techniques. IET Information Security, 17(3):377–393, 2023. doi: 10.1049/ise2.12102.
[22] Serdar Cabuk, Carla E. Brodley, and Clay Shields. IP covert timing channels: Design and detection. In Proceedings of the 11th ACM Conference on Computer and Communications Security (CCS), pages 178–187. ACM, 2004. doi:10.1145/1030083.1030108.
[31] Olive Jean Dunn. Multiple comparisons among means. Journal of the American Statistical Association, 56(293):52–64, 1961. doi:10.1080/01621459 .1961.10482090.
[23] Liang Cai and Hao Chen. TouchLogger: Inferring keystrokes on touch screen from smartphone motion. In Proceedings of the 6th USENIX Workshop on Hot Topics in Security (HotSec). USENIX Association, 2011.
[32] Mario Frank, Ralf Biedert, Eugene Ma, Ivan Martinovic, and Dawn Song. Touchalytics: On the applicability of touchscreen input as a behavioral biometric for continuous authentication. IEEE Transactions on 15
Information Forensics and Security, 8(1):136–148, 2013. doi:10.1109/TIFS.2012.2225048.
[41] Joshua Harrison, Ehsan Toreini, and Maryam Mehrnezhad. A practical deep learning-based acoustic side channel attack on keyboards. In 2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). IEEE, 2023. doi:10.1109/EuroSPW59978.2023.00034.
[33] Hugo Gascon, Sebastian Uellenbeck, Christopher Wolf, and Konrad Rieck. Continuous authentication on mobile devices by analysis of typing motion behavior. In Sicherheit 2014, 2014.
[42] Tatsuhito Hasegawa, Satoshi Hirahashi, and Makoto Koshino. Determining smartphone’s placement through material detection, using multiple features produced in sound echoes. IEEE Access, 5:5331–5339, 2017. doi:10.1109/ACCESS.2017.2687467.
[34] Tyler Giallanza, Travis Siems, Emily Smith, Erik Gabrielsen, Ian Johnson, Mitchell A. Thornton, and Eric C. Larson. Keyboard snooping from mobile phone arrays with mixed convolutional and recurrent neural networks. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, 3(2):1–22, 2019.
[43] Lorenz Hetterich and Michael Schwarz. Branch Different - Spectre Attacks on Apple Silicon. In SIG SIDAR Conference on Detection of Intrusions and Malware & Vulnerability Assessment, pages 116–135. Springer, 2022.
[35] Cristiano Giuffrida, Kamil Majdanik, Mauro Conti, and Herbert Bos. I sensed it was you: Authenticating mobile users with sensor-enhanced keystroke dynamics. In Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), pages 92–111. Springer, 2014. doi:10.1007/978-3-319-08509-8_6.
[44] iFixit. MacBook Air (M2, 2022) logic board and chip identification. https://www.ifixit.com/Guide/M acbook+Air+(M2+2022)+Logic+Board+and+Chip+ Identification/151816, 2022. Chip identification listing a Bosch Sensortec six-axis MEMS accelerometer and gyroscope; accessed 2026-08-26.
[36] Mayank Goel, Jacob O. Wobbrock, and Shwetak N. Patel. GripSense: Using built-in sensors to detect hand posture and pressure on commodity mobile phones. In Proceedings of the 25th Annual ACM Symposium on User Interface Software and Technology (UIST), pages 545– 554. ACM, 2012. doi:10.1145/2380116.2380184.
[45] Hassan Ismail Fawaz, Benjamin Lucas, Germain Forestier, Charlotte Pelletier, Daniel F. Schmidt, Jonathan Weber, Geoffrey I. Webb, Lhassane Idoumghar, Pierre-Alain Muller, and François Petitjean. InceptionTime: Finding AlexNet for time series classification. Data Mining and Knowledge Discovery, 34(6):1936– 1962, 2020.
[37] Nahuel González, Giuseppe Stragapede, Ruben VeraRodriguez, and Ruben Tolosana. Type2Branch: Keystroke biometrics based on a dual-branch architecture with attention mechanisms and Set2set loss. IEEE Transactions on Information Forensics and Security, 20:5859–5871, 2025. doi:10.1109/TIFS.2025.3574 992.
[46] Hyerean Jang, Taehun Kim, and Youngjoo Shin. SysBumps: Exploiting Speculative Execution in System Calls for Breaking KASLR in macOS for Apple Silicon. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 64–78. ACM, 2024.
[38] Daniel Gruss, Raphael Spreitzer, and Stefan Mangard. Cache template attacks: Automating attacks on inclusive Last-Level caches. In Proceedings of the 24th USENIX Security Symposium (USENIX Security), pages 897–912. USENIX Association, 2015.
[47] Kevin S. Killourhy and Roy A. Maxion. Comparing anomaly-detection algorithms for keystroke dynamics. In Proceedings of the 2009 IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), pages 125–134. IEEE, 2009. doi: 10.1109/DSN.2009.5270346.
[39] Daniele Gunetti and Claudia Picardi. Keystroke analysis of free text. ACM Transactions on Information and System Security, 8(3):312–347, 2005. doi:10.1145/ 1085126.1085129.
[48] Jason Kim, Jalen Chuang, Daniel Genkin, and Yuval Yarom. FLOP: Breaking the Apple M3 CPU via False Load Output Predictions. In Proceedings of the USENIX Security Symposium (USENIX Security), pages 2595– 2614, 2025.
[40] Chris Harrison and Scott E. Hudson. Lightweight material detection for placement-aware mobile computing. In Proceedings of the 21st Annual ACM Symposium on User Interface Software and Technology (UIST), pages 279–282. ACM, 2008. doi:10.1145/1449715.1449 761.
[49] Jason Kim, Daniel Genkin, and Yuval Yarom. SLAP: Data Speculation Attacks via Load Address Prediction 16
on Apple Silicon. In Proceedings of the IEEE Symposium on Security and Privacy (S&P), pages 3549–3566, 2025.
inference with smartwatch. In Proceedings of the 22nd ACM Conference on Computer and Communications Security (CCS), pages 1273–1285. ACM, 2015. doi: 10.1145/2810103.2813668.
[50] Jason Kim, Stephan Van Schaik, Daniel Genkin, and Yuval Yarom. iLeakage: Browser-based Timerless Speculative Execution Attacks on Apple Devices. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 2038–2052, 2023.
[59] Stuart P. Lloyd. Least squares quantization in PCM. IEEE Transactions on Information Theory, 28(2):129– 137, 1982. doi:10.1109/TIT.1982.1056489. [60] Anindya Maiti, Oscar Armbruster, Murtuza Jadliwala, and Jibo He. Smartwatch-based keystroke inference attacks and context-aware protection mechanisms. In Proceedings of the 11th ACM Asia Conference on Computer and Communications Security (AsiaCCS), pages 795– 806. ACM, 2016. doi:10.1145/2897845.2897905.
[51] Harold W. Kuhn. The hungarian method for the assignment problem. Naval Research Logistics Quarterly, 2(1–2):83–97, 1955. doi:10.1002/nav.3800020109. [52] Hans R. Künsch. The jackknife and the bootstrap for general stationary observations. The Annals of Statistics, 17(3):1217–1241, 1989. doi:10.1214/aos/117634 7265.
[61] Christopher D. Manning, Prabhakar Raghavan, and Hinrich Schütze. Introduction to Information Retrieval. Cambridge University Press, 2008.
[53] Kai Kunze and Paul Lukowicz. Symbolic object localization through active sampling of acceleration and sound signatures. In Proceedings of the 9th International Conference on Ubiquitous Computing (UbiComp), pages 163–180. Springer, 2007. doi:10.1007/ 978-3-540-74853-3_10.
[62] Philip Marquardt, Arunabh Verma, Henry Carter, and Patrick Traynor. (sp)iPhone: Decoding vibrations from nearby keyboards using mobile phone accelerometers. In Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS), pages 551– 562. ACM, 2011. doi:10.1145/2046707.2046771.
[54] Sunwoo Lee, Wonsuk Choi, and Dong Hoon Lee. Usable user authentication on a smartwatch using vibration. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 304–319. ACM, 2021. doi:10.1145/3460120.3484 553.
[63] Ramya Jayaram Masti, Devendra Rai, Aanjhan Ranganathan, Christian Müller, Lothar Thiele, and Srdjan Capkun. Thermal Covert Channels on Multi-core Platforms. In Proceedings of the USENIX Security Symposium (USENIX Security), pages 865–880, 2015. [64] Maryam Mehrnezhad, Ehsan Toreini, Siamak F. Shahandashti, and Feng Hao. Stealing PINs via mobile sensors: Actual risk versus user perception. International Journal of Information Security, 17(3):291–313, 2018. doi:10.1007/s10207-017-0369-x.
[55] Moritz Lipp, Andreas Kogler, David Oswald, Michael Schwarz, Catherine Easdon, Claudio Canella, and Daniel Gruss. PLATYPUS: Software-based Power SideChannel Attacks on x86. In Proceedings of the IEEE Symposium on Security and Privacy (S&P), pages 355– 371. IEEE, 2021.
[65] Yan Michalevsky, Dan Boneh, and Gabi Nakibly. Gyrophone: Recognizing speech from gyroscope signals. In Proceedings of the 23rd USENIX Security Symposium (USENIX Security), pages 1053–1067. USENIX Association, 2014.
[56] Chang Liu, Yu Jin, Yucheng Fan, Tianrui Xiao, Lingfeng Yin, Trevor E Carlson, Shuwen Deng, and Dongsheng Wang. SSBench: Automated Characterization of Memory Dependence Predictors on Modern CPUs. In The International Symposium on Computer Architecture (ISCA), 2026.
[66] Emiliano Miluzzo, Alexander Varshavsky, Suhrid Balakrishnan, and Romit Roy Choudhury. TapPrints: Your finger taps have fingerprints. In Proceedings of the 10th International Conference on Mobile Systems, Applications, and Services (MobiSys), pages 27–40. ACM, 2012. doi:10.1145/2307636.2307666.
[57] Jian Liu, Chen Wang, Yingying Chen, and Nitesh Saxena. VibWrite: Towards finger-input authentication on ubiquitous surfaces via physical vibration. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 73– 87. ACM, 2017. doi:10.1145/3133956.3133964.
[67] John V. Monaco. What are you searching for? a remote keylogging attack on search engine autocomplete. In Proceedings of the 28th USENIX Security Symposium (USENIX Security), pages 959–976. USENIX Association, 2019.
[58] Xiangyu Liu, Zhe Zhou, Wenrui Diao, Zhou Li, and Kehuan Zhang. When good becomes evil: Keystroke 17
[68] Fabian Monrose and Aviel D. Rubin. Keystroke dynamics as a biometric for authentication. Future Generation Computer Systems, 16(4):351–359, 2000.
[77] Zdeňka Sitová, Jaroslav Šedeňka, Qing Yang, Ge Peng, Gang Zhou, Paolo Gasti, and Kiran S. Balagani. HMOG: New behavioral biometric features for continuous authentication of smartphone users. IEEE Transactions on Information Forensics and Security, 11(5):877–892, 2016. doi:10.1109/TIFS.2015.2506542.
[69] Emmanuel Owusu, Jun Han, Sauvik Das, Adrian Perrig, and Joy Zhang. ACCessory: Password inference using accelerometers on smartphones. In Proceedings of the 13th Workshop on Mobile Computing Systems and Applications (HotMobile). ACM, 2012. doi: 10.1145/2162081.2162095.
[78] David Slater, Scott Novotney, Jessica Moore, Sean Morgan, and Scott Tenaglia. Robust keystroke transcription from the acoustic side-channel. In Proceedings of the 35th Annual Computer Security Applications Conference (ACSAC), pages 515–525. ACM, 2019. doi: 10.1145/3359789.3359816.
[70] Dan Ping, Xin Sun, and Bing Mao. TextLogger: Inferring longer inputs on touch screen using motion sensors. In Proceedings of the 8th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec). ACM, 2015. doi:10.1145/2766498.2766511.
[79] Dawn Xiaodong Song, David Wagner, and Xuqing Tian. Timing analysis of keystrokes and timing attacks on SSH. In Proceedings of the 10th USENIX Security Symposium (USENIX Security). USENIX Association, 2001.
[71] Mufan Qiu, Lihsuan Chuang, Dohhyun Kim, Huaizhi Qu, Tianlong Chen, and Andrew Kwong. KeyTAR: Practical keystroke timing attacks and input reconstruction. In Proceedings of the 2026 IEEE Symposium on Security and Privacy (S&P). IEEE, 2026. doi: 10.1109/SP63933.2026.00106.
[80] Matti Strese, Clemens Schuwerk, Alina Iepure, and Eckehard Steinbach. Multimodal feature-based surface material classification. IEEE Transactions on Haptics, 10(2):226–239, 2017.
[72] Joseph Ravichandran, Weon Taek Na, Jay Lang, and Mengjia Yan. PACMAN: Attacking ARM Pointer Authentication with Speculative Execution. In The International Symposium on Computer Architecture (ISCA), pages 685–698, 2022.
[81] Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 1–9, 2015.
[73] Joseph Roth, Xiaoming Liu, Arun Ross, and Dimitris Metaxas. Investigating the discriminative power of keystroke sound. IEEE Transactions on Information Forensics and Security, 10(2):333–345, 2015. doi: 10.1109/TIFS.2014.2374424.
[82] Hritvik Taneja, Jason Kim, Jie Jeff Xu, Stephan van Schaik, Daniel Genkin, and Yuval Yarom. Hot pixels: Frequency, power, and temperature attacks on GPUs and arm SoCs. In Proceedings of the USENIX Security Symposium (USENIX Security), pages 6275–6292, 2023.
[74] Martin Schwarzl, Erik Kraft, and Daniel Gruss. Layered binary templating. In Proceedings of the 21st International Conference on Applied Cryptography and Network Security (ACNS), pages 33–58. Springer, 2023. doi:10.1007/978-3-031-33488-7_2.
[83] Robert Tibshirani and Guenther Walther. Cluster validation by prediction strength. Journal of Computational and Graphical Statistics, 14(3):511–528, 2005. doi:10.1198/106186005X59243.
[75] Dilshan Senarath, Sanuja Tharinda, Maduka Vishvajith, Sanka Rasnayaka, Sandareka Wickramanayake, and Dulani Meedeniya. BehaveFormer: A framework with spatio-temporal dual attention transformers for IMUenhanced keystroke dynamics. In Proceedings of the 2023 IEEE International Joint Conference on Biometrics (IJCB), pages 1–9. IEEE, 2023. doi:10.1109/IJ CB57857.2023.10448997.
[84] Yazhou Tu, Liqun Shan, Md Imran Hossen, Sara Rampazzi, Kevin Butler, and Xiali Hei. Auditory eyesight: Demystifying µs-precision keystroke tracking attacks on unconstrained keyboard inputs. In Proceedings of the 32nd USENIX Security Symposium (USENIX Security). USENIX Association, 2023. [85] Laurens van der Maaten and Geoffrey Hinton. Visualizing data using t-SNE. Journal of Machine Learning Research, 9:2579–2605, 2008. URL: https://www.jm lr.org/papers/v9/vandermaaten08a.html.
[76] Gaurav Shah, Andrés Molina, and Matt Blaze. Keyboards and covert channels. In Proceedings of the 15th USENIX Security Symposium (USENIX Security), pages 59–75. USENIX Association, 2006. URL: https: //www.usenix.org/conference/15th-usenix-s ecurity-symposium/keyboards-and-covert-cha nnels.
[86] Jose Rodrigo Sanchez Vicarte, Michael Flanders, Riccardo Paccagnella, Grant Garrett-Grossman, Adam Morrison, Christopher W Fletcher, and David Kohlbrenner. 18
Augury: Using Data Memory-Dependent Prefetchers to Leak Data at Rest. In Proceedings of the IEEE Symposium on Security and Privacy (S&P), pages 1491–1505. IEEE, 2022.
Attacks on the Apple M1 via Hardware Synchronization Instructions. In Proceedings of the USENIX Security Symposium (USENIX Security), pages 1973–1990, 2023. [96] Xin Zhang, Chang Liu, Jiajun Zou, Yi Yang, Qingni Shen, Zhi Zhang, and Trevor E. Carlson. Towards Practical Interrupt Side Channel Attacks on macOS for Apple Silicon. In The International Symposium on Computer Architecture (ISCA), 2026.
[87] Martin Vuagnoux and Sylvain Pasini. Compromising electromagnetic emanations of wired and wireless keyboards. In Proceedings of the 18th USENIX Security Symposium (USENIX Security), pages 1–16. USENIX Association, 2009.
[97] Li Zhuang, Feng Zhou, and J. D. Tygar. Keyboard acoustic emanations revisited. In Proceedings of the 12th ACM Conference on Computer and Communications Security (CCS), pages 373–382. ACM, 2005. doi:10.1145/1102120.1102169.
[88] Qijun Wang, Chunqi Qian, and Huacheng Zeng. RadKey: An LLM-guided RF backscatter system for through-wall keystroke inference. In Proceedings of the 2026 IEEE Symposium on Security and Privacy (S&P). IEEE, 2026.
[98] Christian Zibreg. Why does Apple’s M2 MacBook Air have an accelerometer sensor? https://www.idow nloadblog.com/2022/07/20/m2-macbook-air-a ccelerometer/, 2022. Teardown revealing a Bosch Sensortec six-axis MEMS accelerometer and gyroscope in the MacBook Air M2.
[89] Yingchen Wang, Riccardo Paccagnella, Elizabeth Tang He, Hovav Shacham, Christopher W Fletcher, and David Kohlbrenner. Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86. In Proceedings of the USENIX Security Symposium (USENIX Security), pages 679–697. USENIX, 2022. [90] Raveen Wijewickrama, Maryam Abbasihafshejani, Anindya Maiti, and Murtuza Jadliwala. OverHear: Headphone based multi-sensor keystroke inference. arXiv preprint arXiv:2311.02288, 2023. [91] Zhi Xu, Kun Bai, and Sencun Zhu. TapLogger: Inferring user inputs on smartphone touchscreens using on-board motion sensors. In Proceedings of the 5th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), pages 113–124. ACM, 2012. doi:10.1145/2185448.2185465. [92] Edwin Yang, Song Fang, Ian Markwood, Yao Liu, Shangqing Zhao, Zhuo Lu, and Haojin Zhu. Wireless training-free keystroke inference attack and defense. IEEE/ACM Transactions on Networking, 30(4):1804– 1819, 2022. doi:10.1109/TNET.2022.3147721. [93] Zhuolin Yang, Yuxin Chen, Zain Sarwar, Hadleigh Schwartz, Ben Y. Zhao, and Haitao Zheng. Towards a general video-based keystroke inference attack. In Proceedings of the 32nd USENIX Security Symposium (USENIX Security). USENIX Association, 2023. [94] Shi Yin, Chao Liu, Zhiyong Zhang, Yiye Lin, Dong Wang, Javier Tejedor, Thomas Fang Zheng, and Yinguo Li. Noisy training for deep neural networks in speech recognition. EURASIP Journal on Audio, Speech, and Music Processing, 2015(1):2, 2015. doi:10.1186/s1 3636-014-0047-0. [95] Jiyong Yu, Aishani Dutta, Trent Jaeger, David Kohlbrenner, and Christopher W Fletcher. Synchronization Storage Channels (S2C): Timer-less Cache Side-Channel 19