From Profiling to Parameterization: Physics-Guided Acoustic Eavesdropping via Smartphone Accelerometers Guangyuan Ji∗ ,† , Wenjing Wang† ,† , and Bingsheng Zhang∗ ,B ∗ The State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China † School of Cyber Science and Technology, Wuhan University, Wuhan, China
arXiv:2607.25461v1 [cs.CR] 28 Jul 2026
Email: {guangyuanji, bingsheng}@zju.edu.cn, wenjing [email protected]
Abstract—Learning-based physical side-channel attacks often face the cross-device generalization bottleneck – the captured physical signals are usually entangled with the source hardware. Smartphone acoustic eavesdropping via accelerometer signals is a representative example. Speech from a builtin loudspeaker induces structure-borne vibrations, yet the leaked traces are heavily shaped by device-specific acoustic and structural properties. Existing state-of-the-art attacks therefore typically rely on target-device traces for training or finetuning, which ties the attack to the target device. As tasks move from isolated keywords to continuous speech recognition, the required speech diversity grows alongside hardware diversity; this makes physical device-by-device collection unscalable, forming the primary barrier to cross-device generalization. We present L EAK F ORGE, a device-agnostic framework that converts cross-device accelerometer eavesdropping into a physics-guided data-generation problem. Crucially, devicespecific leakage is not arbitrary; its dominant variation lies within a constrained family of audio-to-accelerometer transfer functions. L EAK F ORGE samples this family to synthesize large-scale, device-diverse accelerometer traces from ordinary speech, explicitly modeling electromechanical transfer, structural resonances, filtering, and aliasing. An eavesdropping model trained entirely in this synthetic domain can then be applied directly to traces from previously unseen smartphones. Across heterogeneous smartphones, L EAK F ORGE consistently improves cross-device eavesdropping performance under strict zero-target-data conditions. Compared to representative prior pipelines on closed-set tasks (AccelEve [NDSS’20] and ISpyU [UbiComp’23]), L EAK F ORGE achieves average crossdevice relative improvements of 74.9% and 57.7% in digit recognition, and 45.8% and 76.7% across keyword tasks, respectively. For continuous sentence-level recognition, L EAK F ORGE reaches up to 67.7% word accuracy and yields an 97.0% average improvement over prior work. Simulation and ablation studies further show that both transfer-function diversity and aliasing-aware sampling are effective for cross-device transfer. These results demonstrate that target-independent synthesis challenges the conventional view that hardwarediverse side-channel evaluation requires device-by-device training collection.
1. Introduction Physical side-channel attacks are shifting from manually crafted proof-of-concept exploits toward automated, data-driven paradigms. This shift is crucial for vulnerabilities whose exploitability depends on complex interactions among software interfaces, operating-system mediation, hardware behavior, and physical signals. In such settings, the security question is no longer limited to whether a leakage path exists; it also concerns whether the leakage can be characterized, generalized, and exploited across heterogeneous real-world deployments. At an abstract level, a physical side channel maps a source signal or state s through a hardware-, environment-, or system-dependent channel Hθ into a leakage trace: ℓθ = Hθ (s) + η,
(1)
where θ captures factors such as device type, sensor characteristics, firmware, and sampling rate, and η denotes noise. This view clarifies the central generalization challenge. In many data-driven side-channel attacks, the source distribution is easier to obtain or compute than the corresponding leakage distribution. The limiting factor is the devicespecific leakage data produced by each channel instance. Mobile sensor-based side-channel attacks, particularly accelerometer-based acoustic eavesdropping, provide a concrete instance of this problem. When a smartphone loudspeaker is in use, emitted speech induces structural vibrations that propagate through the chassis, PCB, and sensor package, perturbing the proof mass and embedding speechcorrelated components into the accelerometer stream. However, extracting intelligible text from this stream is hindered by severe bandwidth constraints. Unlike microphone audio, accelerometer leakage is observed through a low-rate sensing readout. The structural and Micro-Electro-Mechanical Systems (MEMS) paths first impose frequency-selective shaping on the vibration signal; low-rate sampling then folds out-of-band speech components into the observable sensor band. This aliasing can carry high-frequency speech cues into the accelerometer stream, but it also creates a many-toone mapping in which distinct acoustic components collapse
into the same frequency bins. Transcript inference is therefore constrained by both device-specific transfer shaping and aliasing-induced ambiguity. To tackle these degraded sensor representations, prior data-driven methods have explored diverse strategies, advancing from mapping isolated tokens to labels [5], [7], [20], [40] to sentence-level transcript inference [41] and acoustic reconstruction [22]. However, these approaches do not construct an explicit physical model of the sourceto-leakage channel Hθ . By relying on measured leakage data to implicitly resolve hardware distortions, they keep the underlying speech s entangled with the device-specific transfer response. Consequently, the learned representations remain tied to the hardware-shaped leakage distributions observed during training. While clean speech s can be readily scaled via public corpora, the corresponding sensor leakage ℓθ is tightly bound to the specific hardware channel Hθ that produced it. Scaling this paradigm across devices therefore requires replaying speech corpora on each target device, with synchronized sensor capture and alignment before exploitation. Under strict profiling-free conditions—where no targetdevice accelerometer traces are used for training, calibration, or adaptation—representative systems degrade substantially: robustness-oriented systems such as InertiEAR [20] average 33.1% cross-device digit accuracy, and ISpyU’s [41] zeroshot sentence recognition drops to 5.1%. The remaining challenge is therefore not whether accelerometer leakage can be learned, but whether training data can cover devicespecific channel shaping without per-device trace collection. This fundamental limitation in the prevailing data-driven paradigm motivates our core research question: Can source-to-leakage channel modeling enable device-agnostic accelerometer-based acoustic eavesdropping under strict profiling-free conditions? Our Approach. In this work, we answer this question through physics-guided source-to-leakage data generation. L EAK F ORGE casts accelerometer eavesdropping as transferfunction sampling. The key intuition is that although exact audio-to-accelerometer transfer functions vary substantially across smartphones, the dominant distortion mechanisms are structurally shared across devices. To enable cross-device generalization without target-device traces, we explicitly model the primary acoustic-to-mechanical transformations in the transduction chain: resonant coupling along the loudspeaker–chassis–sensor path, the MEMS mass–spring response, readout filtering, and sampling-induced aliasing. We formalize these mechanisms into a parameterized simulator. By randomizing the corresponding parameters over physically plausible ranges, L EAK F ORGE samples a constrained family of audio-to-accelerometer transfer functions. Passing ordinary speech through this channel family produces device-diverse synthetic accelerometer traces, exposing the recognizer during training to a spectrum of realistic channel distortions. This design encourages the recognizer to rely on speech-relevant structure that remains
TABLE 1: Comparison with mobile motion-sensor eavesdropping systems. Work
Sensor
Primary output
AccelEve [7] SpearPhone [5] StealthyIMU [36] AccEar [22] VoiceListener [37] ISpyU [41] L EAK F ORGE
Accel Accel IMU Accel IMU/Mag. IMU Accel
Class label Class label Entity Audio Audio Transcript Transcript
Zero Device Automatic Sentence profiling agnostic recognition level × × × × ✓ × ✓
× × × × × × ✓
✓ ✓ ✓ × ✓ ✓ ✓
× × × ✓ × ✓ ✓
stable across channel variations, establishing a basis for cross-device recognition that requires no target traces. This methodology shifts the evaluation paradigm from profiling a specific device to assessing scalable, trace-free exploitation. We characterize this exploitability gap along four axes. First, the attacker should not need victim-device traces for training, fine-tuning, calibration, or simulator fitting (zero profiling). Second, the trace-free model should retain useful performance on previously unseen hardware (device-agnostic). Third, the output should be directly usable without manual interpretation (automatic recognition). Finally, the system should handle continuous speech beyond isolated labels (sentence-level). Together, these axes capture whether an eavesdropping attack moves from a profiled laboratory setting toward scalable exploitation. Table 1 positions L EAK F ORGE against prior mobile motion-sensor eavesdropping systems along these dimensions. Our evaluation across heterogeneous devices shows that physics-guided modeling improves both simulation fidelity and recognition generalization. L EAK F ORGE achieves an average SSIM of 0.709 against real-device accelerometer traces, compared with 0.281–0.380 for baseline simulations. Under strict profiling-free conditions, L EAK F ORGE improves digit recognition by 57.7%–74.9%, keyword tasks by 45.8%–76.7%. For sentence-level recognition, L EAK F ORGE achieves a peak WAcc of 67.7% and an average WAcc of 46.3% across heterogeneous devices, corresponding to a 97.0% average relative improvement over fine-tuned iSpyU baselines. In summary, this paper makes the following three contributions: Physics-guided source-to-leakage simulation. We reframe hardware heterogeneity as a structured source-to-leakage transfer distribution and develop a simulator that parameterizes structural coupling, transduction, and sampling-induced aliasing. This maps ordinary speech to a physically constrained family of transfer responses, shifting cross-device generalization from profiling to parameter space coverage. Aliasing-aware transcript recognition. We design an endto-end transcript recognizer architecturally tailored to the unique time-frequency signatures of aliased sensor data. By explicitly capturing aliasing-folded speech cues, this model enables continuous-text inference directly from frequencycollapsed accelerometer measurements. Profiling-free cross-device characterization. We evaluate L EAK F ORGE across heterogeneous smartphones under strict profiling-free conditions, covering digit, keyword, and con-
tinuous sentence recognition. Beyond achieving a 97.0% average relative WAcc gain over prior baselines, our results show physics-guided simulation overcomes dependence on per-device traces, enabling cross-device generalization through systematic channel modeling. Our reproduction instructions are detailed in Appendix A.
2. Background and Related Work This section provides the technical context for accelerometer-based acoustic eavesdropping. We first summarize the electromechanical coupling that maps speech playback into accelerometer leakage. We then situate physics-guided simulation within broader side-channel generalization efforts. Finally, we review prior acoustic eavesdropping systems through the lens of device-dependent transfer channels.
2.1. Accelerometer-based Acoustic Eavesdropping Accelerometer-based acoustic eavesdropping arises from a mechanically mediated transduction chain. Speech playback drives the smartphone speaker, whose diaphragm injects structure-borne vibration into the chassis and PCB. The resulting base motion excites the accelerometer proof mass, allowing speech-correlated components to appear in the accelerometer stream. Below its mechanical resonance, the relative proof-mass displacement is approximately proportional to the applied acceleration: a(t) ≈
ka xa (t), ma
(2)
where xa (t) is the proof-mass displacement relative to the accelerometer housing, ma is the proof mass, and ka is the effective spring constant. Eq. 2 captures only the local linear readout principle. In practice, the observed leakage is shaped by the full audio-toaccelerometer transfer process: speaker dynamics, structural propagation, accelerometer resonance, readout bandwidth, and low-rate sampling. These frequency-selective stages make the accelerometer trace a device-specific projection of the original audio. This physical transfer view motivates the transfer-function modeling introduced in § 4.2.1.
2.2. Evolution and Limits of Acoustic Eavesdropping Mobile device sensors, primarily accelerometers and gyroscopes, are established side channels for acoustic eavesdropping [7], [20], [22], [26], [36], [38], [41]. Viewed through the audio-to-accelerometer transfer channel, the trajectory of this field is shaped by two coupled objectives: expanding recoverable speech content and reducing dependence on device-specific leakage traces. Constrained-vocabulary inference. Early systems focus on recognizing limited vocabularies, such as digits, keywords, or voice commands [5], [7], [20], [38], [40]. These systems
demonstrate that motion sensors can expose speech semantics. Their robustness across hardware remains limited because device-specific chassis and sensor resonances reshape the leakage trace of even short tokens. Systems designed for device independence, such as InertiEAR [20], still report limited cross-device transfer, with 33.1% average and 49.8% peak digit-recognition accuracy on unseen smartphones. Spectrogram reconstruction. Spectrogram-reconstruction systems attempt to recover wide-band acoustic representations from low-resolution motion signals [22], [25], [35]. Approaches such as AccEar [22] and AccMyrinx [25] use generative models to map degraded traces back to audio spectrograms. This formulation faces a measurement bottleneck: the accelerometer bandwidth is limited, highfrequency speech components may be attenuated or aliased, and the observed trace becomes a device-specific manyto-one projection. Generative models can infer plausible missing structure, but their outputs remain constrained by the information preserved by the channel. These methods typically require paired sensor-audio traces from measured hardware, limiting their applicability under strict profilingfree conditions. End-to-end sentence recognition. Moving from intermediate spectrogram reconstruction to direct transcript inference exposes a stronger data-scarcity bottleneck. A sentencelevel recognizer must cover substantial linguistic, acoustic, and speaker variation, making empirical leakage collection across heterogeneous devices difficult to scale. ISpyU [41] addresses this challenge in part by using synthesized accelerometer data for pre-training, but still relies on real target-phone traces for fine-tuning. Under strict profilingfree conditions, its zero-shot sentence-recognition accuracy drops to 5.1%. This limitation motivates a targetindependent formulation in which training data must cover plausible device transfer responses without relying on real traces from the target phone. Broader physical side channels, simulation, and generalization. The data-scaling barrier above is not unique to accelerometer eavesdropping. In power and electromagnetic SCA, cross-device portability has long been recognized as a first-order limitation: models trained under one chip, board, probe position, key, or acquisition setup can fail under another. This has motivated multi-device training [11], [17], [18], domain-adaptation and portability studies [12], [28], adversarial feature alignment [13], and meta-transfer learning [39]. A parallel line of simulation-based SCA estimates power leakage from RTL-level activity or test-pattern analysis, replacing measured traces with modeled surrogates for pre-silicon assessment [21], [42]. Together, these works establish that side-channel evaluation cannot be reduced to single-domain fitting. However, their solutions are still anchored either in measured leakage from representative devices/domains or in a specific hardware implementation whose internal activity and leakage assumptions are available. A similar channel dependence appears in noncryptographic physical side channels. Acoustic and thermal keystroke recovery [6], [24], optical vibration recovery such
4.2 2) Model training 111111111111111
Conv
"The billing zip code is nine zero ..."
3) Language model post-processing
4.3
Figure 1: An overview of the proposed attack framework L EAK F ORGE. as Visual Microphone and Lamphone [19], [27], mmWave vibration-based eavesdropping [8], [9], and attacks targeting earphones and AR/VR headsets [14], [15], [32] all exploit transfer paths shaped by object geometry, material properties, sensor placement, environment, and sensing modality. On the defense side, auxiliary-sensor monitoring [29] and adversarial audio perturbations [16] further highlight the operational relevance of these channels. Yet training and evaluation in these systems generally remain tied to measured objects, users, environments, sensing geometries, or target hardware. This leaves open the stricter source-toleakage question studied in this paper: whether unavailable target leakage can be replaced by a modeled family of physical source-to-leakage channels.
3. Threat Model Adversary Goal and Scenario. We consider a victim who renders sensitive speech through the built-in loudspeaker of a commodity Android smartphone, such as speakerphone calls, voice messages, video-conferencing audio, voiceassistant responses, and navigation instructions. Consistent with prior motion-sensor eavesdropping work such as AccelEve [7], ISpyU [41], and VoiceListener [37], we model the adversary as a post-install malicious app running inside the standard Android sandbox. Given accelerometer traces captured during loudspeaker-rendered speech, the adversary aims to perform open-vocabulary continuous speech recognition, recovering sentence-level transcripts of previously unseen speech. Attacker Capabilities and Limitations. The attacker knows that the victim device runs Android and contains an on-board accelerometer, but does not know its exact hardware model or hardware-specific transfer parameters. Crucially, the attacker has no pre-attack access to targetdevice accelerometer data for calibration, training, or parameter estimation. The only target-device signal available to the attacker is the accelerometer trace captured during the victim’s speech rendering. The adversary operates without
root privilege, physical access, or access to protected sensors such as the microphone, relying exclusively on accelerometer data available to ordinary apps. On Android 12 and above, accessing sensor streams above 200 Hz requires the HIGH_SAMPLING_RATE_SENSORS permission. Because Android classifies this permission as normal, the malicious app can declare it in AndroidManifest.xml without triggering a runtime permission prompt. We assume that the app registers an accelerometer listener and requests high-rate samples when supported by the device. Environmental Assumptions and Scope. We focus on structure-borne speech leakage generated by the built-in loudspeaker and propagated to the on-board accelerometer through the chassis and motherboard. The phone may be placed on a surface or held in the hand, and the attacker’s sensor client remains active during the speech-rendering window. Headphone output and earpiece-only playback are outside the primary scope because they do not excite the same loudspeaker-to-chassis vibration path and are expected to produce substantially weaker structural coupling at the accelerometer location.
4. System Design This section presents the design of L EAK F ORGE, an end-to-end acoustic eavesdropping framework that operates under strict profiling-free conditions. We first introduce the system architecture and the main technical challenges, and then describe the physical simulation and eavesdropping components.
4.1. Overview L EAK F ORGE is designed to recognize speech from accelerometer traces on unseen devices without using any target-device accelerometer data for training or calibration. As shown in Figure 1, the framework consists of two stages: 1) an offline model-building stage, where ordinary speech corpora are converted into synthetic accelerometer traces
1
Speech Audio Labeled Dataset
Speaker Vibration Modeling
§4.2.1 Accelerometer Data Simulating 2 Accelerometer Data Modeling and 3 Enhancement via 4 Transfer-Function Simulated Randomization Speaker Data
§4.2.2 Preprocessing
Simulated Accelerometer Data
§4.2.3 Model Training
Simulated Accelerometer Dataset
Eavesdropping Model
Figure 2: 2: The The workflow of generating Figure generating the the eavesdropping eavesdroppingmodel. model. and used to train the why recognizer; andpossible 2) an to attack-time which can demonstrate it is even simulate profiling-free eavesdropping stage, where the trained recogaccelerometer data from audio data. nizer is applied unchanged to accelerometer traces captured an unseen victim device. ❶from Speaker vibration modeling using forced damped In theThe model stage, L EAK ORGE first vibration. sound building of a speaker is due to Fthe vibration uses a physics-based simulator to model the audio-toof the speaker diaphragm. To simulate the vibrations of accelerometer transfer process, speakerwaveform, vibration, the speaker diaphragm based including on the audio structural propagation, sensor dynamics, readout we reformulated this problem as a series of shaping, physical and low-rate sampling. The synthesized tracesdigital are thenaudio used transformations. We first convert the to train a speech recognition model that is encouraged to waveform to an analog voltage signal that drives the current learn acoustic structures that remain stable across randomthrough the speaker voice coil. Because of the interaction ized hardware responses. that occurs between the electrical current passing In the eavesdropping stage, L EAK F ORGE takesthrough an acthe relevant components and the static magnetic field celerometer trace captured from an unseen victim device established by the permanent magnet, a Lorentz force is as input. It converts the trace into a low-resolution accreated. Lorentz force serves as the driving mechanism, celerometer spectrogram, predicts a raw grapheme sequence, causing the speaker diaphragm to vibrate.post-processing to and optionally applies language-model First, the transformation from produce sentence-level transcripts.an audio waveform to the voltage that drives the speaker can be defined Challenges. The profiling-free setting imposes as three design challenges that determine the structure of L EAK F ORGE. V (t) transfer = α v(t),variation without tar(2) 1) Covering cross-device get data. The speaker–chassis–accelerometer path varies where is a proportionality constant. In the time domain, acrossαdevices, producing different resonances, attenuation the appliedand voltage V (t) thattarget-device drives the speaker can often be patterns, noise, while calibration is untaken as proportional the audio waveform signal v(t)there[33]. available in realistic to exploitation. L EAK F ORGE must In train addition, relationship between the appliedplausible voltage fore on athebroad distribution of physically Vtransfer (t) and responses. the resulting current i(t) through the voice coil can be described as a first-order linear differential 2) ideally Learning from degraded accelerometer-domain speech i.e., cues. Unlike microphone audio, accelerometer equation, speech signals are low-rate, bandwidth-limited, and ofd ten aliased. Speech in V (t), preserved (3) Re i(t)information + Le i(t)is=therefore a distorted spectro-temporal dt form, making conventional microphone-ASR assumptions unsuitable. where Re is the electrical resistance of the voice coil, e is 3) Recognizing continuous sentence-level speech. TheLtarthe inductance of the voice coil. get task moves beyond closed-set command classification to In the following, the recognition. force enforced the speaker continuous sentence-level Sinceonaccelerometerdiaphragm is driven by the Lorentz force, defined as: derived grapheme predictions contain character confusions, missing word boundaries, and insertion/deletion errors, the F (t) = Bl · i(t), (4) system must reconstruct coherent transcripts from noisy intermediate sequences. where B is the magnetic flux density in the gap, l is the effective length of the voice coilGeneration wire within the magnetic 4.2. Eavesdropping Model field, and Bl is treated as a constant electro-mechanical transduction factor. The goal of the model building stage is to construct a training distribution for (4), profiling-free Combining equations (3) and the drivingeavesdropforce can Since target-device traces are unavailbeping. considered as a functionaccelerometer of the applied voltage: able, L EAK F ORGE synthesizes accelerometer ! signals didusing a randomized rectly from ordinary speech i(t) V (t)corpora − Le dt . (5) F (t) = Bl · Re
d physical transfertomodel. As shown in Figure According the above equation (5), L2, i(t)stage is ace dtthis consists of three steps: physical data simulation, tually dismissed. The reason is that according topreproour excessing into the accelerometer-domain spectrograms, and CTCperiments, accelerometer usually cannot capture vibrabased acoustic training. Text is labels are normalized tion when themodel frequency range higher than 1500 by Hz. lower-casing charactersdomain, and removing punctuation to obtain In the low-frequency the inductive reactance ωLe grapheme-level training targets. remains small compared to the resistive component Re , i.e., Le ≪ Re /ω . As a result, we approximate the relationship 4.2.1. Accelerometer Dataand Simulation. We model the as between the driving force the input applied voltage audio-to-accelerometer mapping as a cascade of physically linear for modeling purposes. Accordingly, the driving force interpretable stages. Speech audio first drives the is simplified transfer as: loudspeaker diaphragm; the induced vibration then propaF (t) = βV (t), (6) gates through the chassis and PCB; finally, the resulting Bl base the accelerometer proof massconversion and is is an effective electro-mechanical wheremotion β = Rexcites e captured constant.through accelerometer readout and low-rate sampling. Ratherwe than fitting the this vibration cascade to device, at Finally, calculate of athetarget diaphragm Leach EAKmoment. F ORGE samples its parameters from behavior a broad physical The mechanical dynamic of the diprior, producing diverse accelerometer traces for aphragm assembly is described and regulated by training. the second❶ Speaker vibration modeling using forced order linear differential equation that characterizesdamped a damped vibration. Loudspeaker sound originates from diaphragm forced harmonic oscillator. vibration. In a standard voice-coil driver, the playback chain (DAC/amplifier) input audio v(t) into a drive(7) ms ẍsconverts (t) + cs ẋthe s (t) + ks xs (t) = F (t), voltage V (t) applied to the coil. The resulting current flows where m is the effective moving field massofofthethe speaker’s through thes coil in the static magnetic permanent diaphragm and voice coil, cs force is thethat mechanical magnet, producing a Lorentz drives thedamping coil– coefficient assembly. of the speaker, ks is the mechanical stiffness diaphragm Accordingly, we model the speaker of athecascade suspension of the is athe as of ansystem electrical stagespeaker, (V → iand → xFs)(t)and diaphragm stage displacement mechanical (F → Xsof ). the speaker. Note the thattransformation our simulationfrom of speaker data is carried First, an audio waveform toout the in voltage that drives the speaker can we be defined the frequency domain. Therefore, need to as take a Fourier transform of equation (7) to obtain: V (t) = α v(t), (3) (−ω 2 ms + jωcs + ks )Xs (ω) = F (ω), (8) where α is a proportionality constant. The X voltage–current relation of the voicetransforms coil is modeled where are the Fourier of the s (ω) and F (ω) as diaphragm displacement and driving force, respectively, and d ω is the angularRfrequency. i(t) = V (t), (4) e i(t) + Le dt of the speaker’s diaphragm We further get the spectrum where Re andas: Le are the coil resistance and inductance, displacement respectively. F (ω) In the following, on the , speaker di-(9) Xs (ω)the = force exerted ω 2 + jωc s − msforce, s aphragm is driven by the kLorentz defined as and the mechanical transfer function Hs (ω), which is used F (t) = Bl · i(t), (5) to model the mapping between the original audio waveform and theBl spectrum the diaphragm displacement, where is the ofelectromechanical force factor isofdefined the as: speaker. Xsmicro-speakers (ω) 1 Since H smartphone typically exhibit a = , (10) s (ω) = (ω) ks [34], − mswithin ω 2 + jωc very small voice-coilFinductance ours band of interest (f F ≤(ω) 3 kHz thedriving inductive reactance Le remains Since is )the force of the 2πf diaphragm, here
we still have to replace it with the audio waveform signal
much smaller than the coil resistance Re , so we neglect Le i̇(t) in (4) and approximate i(t) ≈ V (t)/Re . Substituting this approximation into (5) yields the following voltage-toforce relation F (t) = βV (t),
(6)
Bl is an effective electro-mechanical conversion where β = R e constant. Next, we calculate the vibration of the diaphragm at each moment. The mechanical dynamics of the diaphragm are governed by the differential equation of a damped forced harmonic oscillator.
ms ẍs (t) + cs ẋs (t) + ks xs (t) = F (t),
(7)
where ms , cs , and ks are the effective moving mass, total damping, and stiffness of the diaphragm assembly, and xs (t) is the diaphragm displacement. Solving (7) in the frequency domain yields F (ω) , Xs (ω) = ks − ms ω 2 + jωcs
(8)
Substituting F (ω) = αβ v(ω) (from (3) and (6)) into (8), we define the audio-to-diaphragm transfer function as Hs (ω) =
αβ Xs (ω) = . v(ω) ks − ms ω 2 + jωcs
(9)
Finally, given the original audio spectrum in the frequency domain as v(ω), the diaphragm displacement spectrum is computed by multiplying the audio spectrum and the transfer function as Xs (ω) = Hs (ω) v(ω).
(10)
❷ Structural propagation, sensor dynamics, and readout modeling. Since the speaker and accelerometer are typically mounted on the same mainboard, speaker-induced vibrations can propagate through the chassis/PCB and excite the accelerometer housing. We model this propagation as: diaphragm displacement Xs → local acceleration near the speaker region As → base acceleration at the accelerometer Ab → accelerometer pre-sampling output Apre . In the frequency domain, the local acceleration near the speaker mounting region is As (ω) = −ω 2 Xs (ω).
(11)
Ab (ω) = Hstruct (ω) As (ω).
(12)
We model this structural path as a linear time-invariant transfer function To capture the multi-resonant nature of the smartphone chassis, the structural dynamics are approximated by retaining M dominant lightly damped modes. Accordingly, Hstruct (ω) is represented by a low-order modal expansion as Hstruct (ω) =
M X i=1
ri
ωi2 . ωi2 − ω 2 + j 2ζi ωi ω
(13)
where each term corresponds to a single-degree-of-freedom (SDOF) forced damped oscillator (a second-order resonant element) with natural angular frequency ωi and damping ratio ζi . The residue ri captures the modal participation between the speaker region and the accelerometer location, and M is the number of retained structural modes. Combining (11) with (10) yields As (ω), and applying (12) yields the base acceleration spectrum Ab (ω) = −ω 2 Hstruct (ω) Hs (ω) v(ω).
(14)
ma Ab (ω). ka − ma ω 2 + j ω ca
(15)
ka Xa (ω). ma
(16)
An accelerometer can be modeled as a mass–spring– damper system under base excitation Ab (ω). Let Xa (ω) denote the proof-mass displacement in the housing frame. Solving the base-excited mass–spring–damper model yields Xa (ω) = −
Consistent with the fundamental accelerometer principle defined in (2), the pre-sampling output spectrum is proportional to the proof-mass displacement Apre (ω) =
Substituting (14) into (15) and then applying (16), we derive Apre (ω) =
ka ω 2 · Hstruct (ω)Hs (ω) v(ω), ka − ma ω 2 + jωca
(17)
where Hs (ω) is defined in (9). Before low-rate sampling, we further account for the finite temporal aperture of sensor readout. A reported MEMS sample may average or accumulate motion over a short readout interval. This finite-aperture measurement introduces a sinc-shaped attenuation envelope in the frequency response, while ideal point sampling corresponds to no such attenuation. We therefore write p ω Aap (ω) = Hap (ω)Apre (ω), Hap (ω) = sinc , ωap (18) where sinc(x) = sin(πx)/(πx), ωap controls the aperture scale, and p controls the envelope strength. Since vibration components above 3 kHz are strongly attenuated, we restrict the simulated spectrum to this physically relevant band when transforming back to the time domain. In implementation, this corresponds to applying a brick-wall filter (zeroing out frequency bins above ωc ) before the inverse STFT. We denote the resulting simulated accelerometer waveform sampled at Fw as asim [n] = F −1 Aap (ω) · 1|ω|≤ωc [n], (19) which will be used as the input to the low-rate sampling model in the next subsection. ❸ Modeling enhancement considering signal aliasing and random downsampling. Digital-output MEMS accelerometers report a discrete-time sequence at an output data rate
Fa . Under ideal uniform sampling at rate Fa , a component at f folds into the baseband according to
the model to learn speech-correlated structures that persist across transfer variations.
Fa . (20) 2 Rather than treating aliasing only as information loss, we preserve the folded components because they can carry highfrequency speech cues into the accelerometer baseband. Unlike ideal uniform decimation, commodity digital MEMS accelerometers can exhibit sampling-rate variability (cycle-to-cycle timing uncertainty), so the effective sampling instants are mildly nonuniform; we emulate this intrinsic randomness by drawing a jittered integer hop ∆ni around the nominal hop Fw /Fa as Fw 2 ,σ , ∆ni = max 1, round N Fa (21) ni = ni−1 + ∆ni .
4.2.2. Preprocessing of Simulated Dataset. We apply the same normalization and spectrogram construction to simulated training traces and attack-time accelerometer traces. During training, we additionally inject band-limited Gaussian magnitude noise into simulated spectrograms. 1) Spectral normalization: for each spectrum, we normalize magnitudes by the maximum amplitude to reduce volume- and device-dependent scale variations. 2) Low-frequency suppression: we discard the lowest 10% frequency bins globally to reduce non-speech motion interference. 3) Additive selfnoise injection: we inject band-limited Gaussian magnitude noise into the simulated accelerometer spectrograms, with the SNR range listed in Appendix B.
falias = min |f − kFa |, k∈Z
falias ≤
and sample asamp [i] = asim [ni ].
(22)
This randomized low-rate sampling introduces in-band aliased components (spectral folding) and may additionally cause slight spectral spreading due to the nonuniform sampling grid, which is consistent with aliasing concerns inherent to digital-output MEMS accelerometers. ❹ Cross-Device Generalization via Transfer-Function Randomization. The forward model above contains hardware-dependent parameters, including structural resonances, damping, modal residues, sensor response, readout aperture, sampling jitter, and noise. Since these quantities are unavailable for a target device, L EAK F ORGE treats them as randomized variables and samples them from a broad simulation prior p(θ). This prior is not fitted to any particular smartphone. Instead, it specifies coarse engineering ranges that cover diverse but physically plausible audio-to-accelerometer responses. These ranges are fixed before evaluation and used uniformly for all target devices; the concrete parameter space is given in Appendix B. For each audio utterance, L EAK F ORGE samples θ ∼ p(θ)
and generates a simulated accelerometer trace through ãθ = Sθ F −1 {Gθ (ω)v(ω)} , (23)
where Gθ (ω) is the randomized audio-to-accelerometer transfer response and Sθ (·) denotes the low-rate sampling and noise process. Training over this randomized simulation distribution optimizes min E(v,y)∼Daudio Eθ∼p(θ) L fϕ (ãθ ), y , (24) ϕ
where fϕ is the speech recognizer and y is the transcript. Because the hardware response varies independently of the transcript during training, device-specific resonances and sampling distortions become nuisance factors, encouraging
4.2.3. Model Architecture and Training. Inspired by DeepSpeech2 [4], we use a CNN-RNN-CTC model as a controlled recognizer for accelerometer-domain speech. Our goal is to quantify how much linguistic information is physically leaked through the accelerometer side channel, rather than how much missing content can be completed by a strong pre-trained ASR decoder. Encoder-decoder ASR systems, such as Whisper-style models [31], embed substantial speech-language priors through autoregressive decoding, making it harder to separate vibration-derived evidence from decoder-side linguistic completion. In contrast, CTC provides alignment-free training and predicts grapheme sequences without an autoregressive text decoder. The model maps low-sample-rate accelerometer spectrograms to text sequences over 28 output symbols: 26 letters, space, and CTC blank. Since accelerometer sensing typically operates at ∼ 500 Hz, the resulting temporal resolution and observable bandwidth are approximately 1/32 of those of 16 kHz audio. To avoid the low-frequency bias of mel warping, we use a linear-frequency STFT spectrogram with uniform frequency resolution. Compared with the original DeepSpeech2 front end, we adapt the encoder to the coarse and aliased spectrogram grid by: 1) replacing multi-scale or large kernels with VGG-style stacks of 3 × 3 convolutions to extract local energy patterns within the limited bandwidth; 2) restricting temporal downsampling to a single 2× max-pooling step to preserve sparse temporal structure; and 3) using deeper BiLSTMs to model bidirectional long-range dependencies and disambiguate noisy or aliased patterns. We additionally apply SpecAugment-style time/frequency masking to accelerometer spectrograms during training. The model architecture and implementation details are provided in Appendix C and Appendix D.
4.3. Profiling-free Eavesdropping Attack As illustrated in Fig. 1, we implement an end-to-end prototype to validate the practicality of L EAK F ORGE under profiling-free conditions. For our Android evaluation, the proof-of-concept records accelerometer streams using the
TABLE 2: Details of mobile devices and underlying OSes. Model
Sampl. Rate Release Date
Mi 11 Youth Samsung S25 Samsung S24U Vivo X200 Pixel 6a Pixel 9
≈ 502 Hz ≈ 466 Hz ≈ 460 Hz ≈ 459 Hz ≈ 448 Hz ≈ 404 Hz
1
Sep 2021 Feb 2025 Jan 2024 Oct 2024 May 2022 Aug 2024
TABLE 3: SSIM of simulated accelerometer spectrograms.
OS
Device
Naive
ISpyU-sim [41]
Android 13 Android 16 Android 15 Android 16 Android 12 Android 14
Mi11Y S25 S24U X200 P6a P9 Mean
0.479 0.309 0.251 0.520 0.255 0.464 0.380
0.562 0.261 0.259 0.264 0.193 0.151 0.281
The device’s sampling rate is determined by computing the average number of samples per second over a 30-second recording interval.
fastest sensor mode available to the app and passes the captured traces through the same preprocessing stages used for simulated data (§ 4.2.2) and into the eavesdropping model (§ 4.2) to yield CTC-decoded grapheme sequences. Because accelerometer-derived CTC outputs often contain character confusions, insertion/deletion errors, and missing word boundaries, L EAK F ORGE applies a text-level post-processing step after grapheme decoding. Specifically, an off-the-shelf LLM (e.g., via the ChatGPT API) operates exclusively on the acoustic model’s output, taking the noisy grapheme sequence as its sole input to produce a sentencelevel transcript by correcting local spelling errors and restoring word boundaries. To separate this post-processing effect from the acoustic recognizer, Section 5.3 evaluates both the standalone acoustic accuracy and the LLM-enhanced performance.
5. Evaluation Results In this section, we evaluate L EAK F ORGE by answering three research questions. RQ1: Can physically simulated accelerometer traces capture the key time–frequency structures observed across mobile devices? RQ2: How accurately can L EAK F ORGE recognize continuous sentence-level speech from real accelerometer traces under profiling-free exploitation? RQ3: Can L EAK F ORGE generalize better than prior accelerometer-based eavesdropping methods across devices and evaluation tasks? To address these questions, we evaluate L EAK F ORGE across multiple devices, datasets, and tasks under the common setup outlined below.
5.1. Experimental Setup Devices and recording. Unless otherwise stated, we conduct replay-based experiments on six Android devices (Table 2) by replaying audio through the phone speaker and recording high-frequency accelerometer traces. Datasets. For sentence-level eavesdropping, our model is trained solely on simulated accelerometer data derived from LibriSpeech train-960 and is evaluated on replayrecorded accelerometer traces of a LibriSpeech dev-clean subset (1,355 utterances from 20 unseen speakers). For
Ours TM RA TM & RA 0.762 0.561 0.772 0.309 0.567 0.695 0.305 0.596 0.722 0.373 0.614 0.781 0.268 0.434 0.632 0.273 0.411 0.651 0.382 0.531 0.709
comparison with ISpyU, we evaluate both methods on the same subset. For benchmark comparisons, we use AudioMNIST [10] for digits and a keyword corpus constructed by sampling the public PGP list [23] and synthesizing audio with ChatTTS [2]. Metrics and Cross-device Protocol. Simulation fidelity is measured by the Structural Similarity Index (SSIM), which evaluates the structural match between simulated and real spectrograms. For sentence-level recognition, we report Word and Character Accuracy (WAcc/CAcc), derived from the Levenshtein edit distance: S+D+I , (25) Acc = max 0, 1 − N where S, D, I denote the number of substitutions, deletions, and insertions, and N is the reference length (words for WAcc, characters for CAcc). We also report post-processed WAcc after text-level correction. Digit and 58-class keyword recognition tasks use standard accuracy; the 8-class keyword detection task is evaluated via True Positive Rate (TPR) and False Positive Rate (FPR). To quantify generalization across M devices, let Si,j denote the performance of a model trained on device di and tested on dj . For device-specific baselines (trained on di ), we report the mean over unseen devices; for our deviceagnostic model (trained on simulation), we report the mean over all test devices: M 1 X 1 X OODbase (i) = Si,j , OODours = Sours,j . M −1 M j=1 j̸=i (26) Additional training/implementation details are provided in Appendix D, and detailed dataset splits and prior-work reproduction protocols are provided in Appendix E.
5.2. Simulation Coverage and Ablation This subsection answers RQ1 by evaluating how effectively our randomized simulation prior captures the time– frequency structures of real accelerometer leakage. Aligning with our strict profiling-free protocol, we evaluate the simulator through two complementary properties: 1) spectral coverage, measuring the structural similarity between real accelerometer spectrograms and multiple simulated candidates generated from the same audio; and 2) task-level utility, evaluating downstream task performance by training models on data generated by different simulation variants.
TABLE 4: Sentence-level WAcc under different simulation variants. Device
Naive
ISpyU-sim [41]
Mi11Y S25 S24U X200 P6a P9 Mean
0.0 0.0 0.0 0.0 0.0 0.0 0.0
16.9 15.1 15.3 10.6 5.9 5.1 11.5
Ours RA TM & RA 30.1 67.7 28.9 59.9 29.8 57.2 17.5 37.3 8.7 31.2 6.7 24.2 20.3 46.3
Real Accelerometer Spectrogram 250
1
200
0.8
150
0.6 0.4
100
0.2
50
0
0
1
250 Frequency
5.2.2. Spectral Coverage Results. Table 3 reports the structural similarity between replay-recorded accelerometer spectrograms and simulated spectrograms. For stochastic variants, we report SSIM@1000, defined as the maximum SSIM over 1000 independently sampled simulations generated from the same audio. This best-of-1000 protocol evaluates whether the simulation prior contains plausible transfer responses close to the observed device response. It is used only for simulation analysis and is not used in downstream training, where parameters are sampled randomly without target-device selection. Overall, the full TM&RA simulator achieves the highest mean SSIM across devices. The improvement over Naive and ISpyU-sim shows that accelerometer leakage cannot be explained solely by low-frequency truncation or fixedrate aliasing. Adding TM improves the structural match by introducing frequency-selective resonances and attenuation, while RA improves the match by modeling stochastic folding and spreading effects from low-rate nonuniform sampling. Their combination provides the strongest spectral coverage, indicating that transfer-function randomization and randomized aliasing capture complementary aspects of the real leakage process. Fig. 3 visualizes a representative comparison between real and simulated accelerometer spectrograms. The simulated spectrogram reproduces the main speech-active regions and the coarse time–frequency energy distribution observed in the real accelerometer trace, supporting the quantitative SSIM results. Downstream utility. We further train the same eavesdropping architecture using data generated by each simulation variant and evaluate the resulting word accuracy. The downstream ablation results show the same trend as the SSIM evaluation: the full TM&RA simulator yields the strongest recognition performance, while removing either transferfunction modeling or randomized aliasing reduces WAcc. Together, these results show that the prior is not only visually plausible but also task-useful, indicating that improvements in spectral fidelity align closely with downstream
TM 47.0 34.7 30.8 19.8 14.7 8.9 26.0
All values are reported as percentages (%).
Frequency
5.2.1. Benchmark Configurations. We compare our simulation approach with two baselines and two ablated variants. Naive directly truncates the 16 kHz audio spectrogram to the 0–250 Hz band, corresponding to the nominal observable band of a 500 Hz accelerometer. ISpyU-sim replicates the data generation strategy from ISpyU [41] by applying fixed ×32 subsampling to the original audio, producing an effective 500 Hz signal with deterministic aliasing; the full ISpyU system, which additionally requires real-device traces for fine-tuning, is evaluated as a recognition baseline in §5.4. TM adds randomized frequency-selective transfer modeling for the speaker–chassis–accelerometer path, including resonances, attenuation, and sensor-side response variation. RA applies randomized low-rate sampling to emulate stochastic aliasing caused by mildly nonuniform sampling. TM&RA combines both components and corresponds to the full simulator. Detailed variant definitions are provided in Appendix H.
2
3
4 5 6 Time Simulated Accelerometer Spectrogram
7 1 0.8
200
0.6
150
0.4
100
0.2
50
0
0
1
2
3
4 Time
5
6
7
Figure 3: Real vs. simulated accelerometer spectrograms on Mi 11 Youth (best-of-1000 for stochastic variants). recognition gains. Full end-to-end sentence-level results follow in § 5.3.
5.3. Device-Agnostic Sentence Recognition This subsection answers RQ2 by evaluating end-to-end sentence-level eavesdropping under the profiling-free setting. We train a single device-agnostic model using only simulated accelerometer data and evaluate it on replayrecorded traces using WAcc and CAcc. Comparisons with representative prior systems are presented in § 5.4. We present the results in two parts. Fig. 4 evaluates L EAK F ORGE under different operating and device settings, including volume, placement, sampling rate/device model, and speaker gender. Fig. 5 further analyzes sentence-level behavior, including per-sentence WAcc distribution, sentence length impacts, and training-set size effects. 5.3.1. Impact of playback and device factors. Fig. 4 analyzes the robustness of L EAK F ORGE under varying physical conditions. As shown in Fig. 4a, playback volume is the dominant factor governing recognition quality. Under stable on-desk placement, increasing the volume from 50% to 100% raises the average post-processed WAcc from 11.2% to 46.3%, a more than four-fold improvement. This sharp scaling indicates that stronger acoustic excitation substantially improves the signal-to-noise ratio of the vibration
0.8
0.8
0.6
WAcc
WAcc
1
Mi 11 Youth avg (AccMic) Mi 11 Youth avg (AccMic+LLM) All devices avg (AccMic) All devices avg (AccMic+LLM)
0.4
0.6
0
S24U
P9
(a) Sound volume and phone placement.
0.6 0.4 0.2
400
On-Desk On-Desk On-Desk Hand-Hold 50% Vol. 75% Vol. 100% Vol. 100% Vol.
Mi11Y
S25
AccMic AccMic+LLM
0.8
X200 P6a
0.4 0.2
0.2
1
WAcc (AccMic) WAcc (AccMic + LLM)
WAcc
1
420
440
460
480
Sampling Rate (Hz)
0
500
Male
(b) Different effective sampling rates.
Female
All
(c) Gender.
Figure 4: L EAK F ORGE performance under different settings.
0.8
0.8
0.6
Accuracy
CDF
1
WAcc (AccMic) CAcc (AccMic) WAcc (AccMic+LLM) CAcc (AccMic+LLM)
0.4 0.2
1
WAcc (AccMic) WAcc (AccMic+ LLM) CAcc (AccMic) CAcc (AccMic+ LLM)
0.8
WAcc
1
0.6 0.4
0.2
0.4
0.6
0.8
1
0 20
0.6 0.4 0.2
0.2
0
Mi 11 Youth avg (AccMic) Mi 11 Youth avg(AccMic+LLM) All devices avg (AccMic) All device avg (AccMic+LLM)
0 40
60
80
100
<10
10-20 20-30 30-40
40+
Accuracy
Training Data Ratio (%)
Number of Words
(a) CDF of accuracy across sentences.
(b) Accuracy across training data sizes.
(c) Accuracy under sentence lengths.
Figure 5: Performance across sentences. leakage, helping the captured signal rise above the mechanical noise floor of the sensing path. In contrast, physical placement has a secondary but still measurable effect. At maximum volume, moving the device from a hand-held posture to a stable desk surface increases the average postprocessed WAcc from 41.5% to 46.3%. This gap is consistent with the damping effect of the human hand, which absorbs structure-borne vibrations and introduces additional motion artifacts; nevertheless, the 41.5% hand-held result suggests that L EAK F ORGE remains effective even under less controlled placement. Fig. 4b further compares WAcc across smartphone models under a fixed setting (on-desk, 100% volume). Overall, devices with higher measured accelerometer sampling rates generally achieve higher WAcc (e.g., Mi 11 Youth ≈502 Hz reaches 57.7% WAcc and 67.7% after LLM postprocessing). However, sampling rate alone does not explain all cross-device variation: X200 and Samsung S24U have comparable sampling rates yet differ substantially in WAcc. As shown in Fig. 6, while the S24U exhibits a pronounced, continuous aliasing structure with a low noise floor, the X200 lacks significant signal energy in specific frequency bands, resulting in incomplete spectral structure. These visual distinctions correlate directly with performance, indicating that signal fidelity (specifically, the preservation of aliased cues across the spectrum) is as critical as the raw sampling rate. (We defer the physical analysis of these artifacts to §6.)
Finally, Fig. 4c shows no statistically significant performance difference between male and female speakers under a fixed device and setting (Mi 11 Youth, on-desk, 100% volume). The corpus-level WAcc values are 57.5% and 57.9% for male and female speakers, respectively (p = 0.652); after LLM post-processing, they become 69.2% and 67.3%, respectively (p = 0.115). This suggests that speaker gender is not a dominant factor in our system under this setting. 5.3.2. Sentence-level Recognition Analysis. Fig. 5 analyzes sentence-level recognition behavior across representative-device and cross-device aggregate settings. Fig. 5a shows the CDF of per-sentence WAcc and CAcc on Mi 11 Youth under on-desk placement and 100% volume. The distribution follows a smooth S-shaped curve, showing that recognition quality varies continuously across utterances. Text-level post-processing shifts the WAcc distribution to the right, increasing the median WAcc from 57.7% to 67.7%. This indicates consistent transcript-level gains across the sentence set, driven by local spelling correction and word-boundary restoration. Fig. 5b shows the effect of simulated training-data size, averaged across the evaluated test devices. As the training ratio increases from 20% to 100%, raw WAcc rises monotonically from 17.9% to 38.1%, and raw CAcc increases from 52.3% to 65.5%. After text-level post-processing, WAcc also increases at every training ratio, from 24.9% at 20% training data to 46.3% at 100%. This scaling trend
TABLE 5: Comparison of Cross-device Digit and Keyword Recognition Accuracy. Model
AccelEve [7] Train
Ours
ISpyU [41]
Ours
Mi11Y
S25
S24U
X200
P6a
P9
-
Mi11Y
S25
S24U
X200
P6a
P9
-
Mi11Y 84.7 S25 35.6 S24U 56.7 X200 24.6 P6a 22.1 P9 14.2 OOD Mean 30.6
50.5 71.6 66.1 43.0 48.0 31.8 47.9
43.5 50.1 78.5 32.9 43.1 23.6 38.6
51.9 54.2 58.4 77.1 51.5 41.6 51.5
34.2 38.0 48.1 59.4 71.7 58.5 47.6
31.1 37.3 39.1 51.0 52.1 73.3 42.1
79.1 76.0 82.1 77.3 73.7 64.3 75.4
79.7 53.3 61.2 48.5 40.4 28.1 46.3
62.6 73.1 62.5 46.6 54.9 39.3 53.2
68.4 63.8 71.8 47.3 44.8 32.5 51.4
50.0 33.9 36.6 78.7 32.3 39.1 38.4
49.4 47.6 51.4 55.2 62.7 62.2 53.2
45.3 35.9 39.3 52.5 48.3 67.2 44.3
79.1 76.0 82.1 77.3 73.7 64.3 75.4
Mi11Y 80.5 S25 50.8 S24U 60.6 Keywords X200 43.4 P6a 36.7 P9 35.2 OOD Mean 45.3
62.9 79.7 52.3 27.7 32.8 36.3 42.4
56.6 41.0 71.1 62.5 35.9 39.1 47.0
55.9 42.2 67.2 80.5 60.2 46.5 54.4
48.8 50.0 59.4 45.3 71.9 40.2 48.7
37.9 46.1 57.8 39.1 58.6 74.2 47.9
80.9 76.2 74.6 63.3 65.2 56.3 69.4
77.9 45.9 61.7 25.7 16.9 17.1 33.5
47.9 70.9 54.5 33.1 22.1 19.5 35.4
46.2 40.9 76.9 34.5 17.1 25.3 32.8
33.5 32.2 54.7 57.2 22.1 26.2 33.7
32.4 32.4 48.3 36.6 47.6 34.3 36.8
32.1 42.4 51.9 37.2 30.9 50.5 38.9
82.4 80.0 77.1 51.7 43.3 39.0 62.2
Task
Digits
Test
The 8-keyword task reports TPR; all other entries report accuracy (Ncorrect /Ntotal ). All values are reported as percentages (%).
directly supports the source-to-leakage formulation: once the physical channel is modeled, we can leverage abundant source speech to synthesize large-scale supervision, directly driving cross-device performance without requiring new target traces. The divergence between WAcc and CAcc clarifies the role of text-level post-processing. Raw CAcc measures character-level acoustic evidence extracted from the accelerometer-derived grapheme sequence. Post-processed WAcc measures the sentence-level utility of the final transcript. Across all training ratios, post-processing increases WAcc while lowering CAcc relative to raw CTC decoding. For example, at 100% training data, WAcc increases from 38.1% to 46.3%, whereas CAcc changes from 65.5% to 63.1%; at 20%, CAcc changes from 52.3% to 47.2%. This metric split is informative. The post-processing model receives only the decoded grapheme sequence, without access to raw accelerometer traces, device identifiers, or reference transcripts. Its contribution therefore comes from organizing existing character-level evidence with linguistic regularities. In practice, it often removes low-confidence fragments, discards unrecoverable character spans, restores word boundaries, and rewrites noisy sequences into coherent lexical units. These edits improve word-level correctness while reducing exact character-by-character overlap with the reference. Thus, raw CAcc remains the cleaner indicator of physical acoustic evidence extracted by the recognizer, whereas post-processed WAcc captures the practical sentence-level threat after linguistic regularization. Finally, Fig. 5c shows that the mean WAcc for the Mi 11 Youth generally increases with sentence length, rising from 51.8% for utterances with fewer than 10 words to 58.8% for 30–40 words. The benefit of post-processing also becomes more pronounced for longer sentences. Longer utterances provide richer context for resolving ambiguous grapheme sequences, facilitating sentence-level correction after accelerometer-domain speech recognition.
Detailed statistics (e.g., significance tests, percentiles/threshold breakdowns, and per-length splits) are reported in Appendix F.
5.4. Cross-Device Comparison with Prior Work This section compares L EAK F ORGE with state-of-the-art accelerometer eavesdropping systems on digit, keyword, and sentence recognition. We focus on two capabilities required for practical eavesdropping: cross-device generalization and sentence-level recognition. 5.4.1. Performance of Cross-device Generalization. Acoustic eavesdropping models should remain effective when targeting devices unseen during training. Prior systems [7], [20], [22], [38], [41] often rely on real accelerometer traces for training or fine-tuning, which limits scalability and can lead to substantial degradation under cross-device transfer. Baselines. We compare against prior accelerometer-based systems that perform end-to-end recognition under a comparable high-rate sensing regime. This yields two directly comparable baselines: AccelEve [7], which trains device-specific models on real accelerometer traces for digit/keyword recognition, and ISpyU [41], which uses synthetic pre-training but still requires real target-device traces for fine-tuning. Waveform or spectrogram reconstruction systems such as AccEar [22] and AccMyrinx [25] are discussed in Related Work, but are not used as direct baselines because their primary outputs are reconstructed acoustic representations rather than automated recognition results. Since neither AccelEve nor ISpyU releases code or datasets, and their results are sensitive to device hardware and speech corpus, we re-implement both systems following their published architectures and procedures and evaluate them under a matched replay-and-record setup. Detailed dataset splits, collection settings, and reproduction configurations are provided in Appendix E.
TABLE 6: Comparison of Cross-device Sentence Recognition. Model
ISpyU [41]
Ours
Train Mi11Y S25 Test Mi11Y 45.1 34.4 S25 34.4 38.7 S24U 33.6 36.2 X200 19.9 24.2 P6a 10.8 15.9 P9 7.4 11.0 OOD Mean 21.2 24.3
S24U X200
P6a
P9
-
35.3 37.5 41.0 24.6 13.6 10.5
28.8 30.1 24.3 32.5 15.6 13.0
29.2 31.3 27.3 24.0 24.0 16.2
24.1 28.5 24.5 22.8 16.8 18.6
67.7 59.9 57.2 37.3 31.2 24.2
24.3
22.4
25.6
23.3
46.3
Values are WAcc percentages. Ours reports the end-to-end system with GPT-5.4-based text-level post-processing.
Evaluation Results. Table 5 summarizes cross-device performance on digit and keyword tasks. Across all benchmarks, L EAK F ORGE consistently achieves the highest OOD performance using entirely simulated training data. While baselines (AccelEve and ISpyU) exhibit strong same-device accuracy along the diagonal entries, they suffer severe degradation under cross-device transfer due to hardware overfitting. By exposing the model to a broad distribution of physically plausible transfer responses, L EAK F ORGE successfully learns hardwareagnostic features. For digit recognition, L EAK F ORGE achieves an OOD accuracy of 75.4%, substantially outperforming all sourcedevice configurations of both AccelEve and ISpyU. The best OOD baseline reaches 53.2%, while the average OOD performance across source devices is 43.1% for AccelEve and 47.8% for ISpyU. Notably, L EAK F ORGE even surpasses the same-device accuracy of several real-data baselines. A similar trend appears in the keyword benchmark. L EAK F ORGE achieves an OOD TPR of 69.4%, compared with an average OOD TPR of 47.6% for AccelEve. For the more challenging 58-class keyword recognition task, L EAK F ORGE achieves an OOD accuracy of 62.2%, substantially exceeding ISpyU, whose source-device OOD means range from 32.8% to 38.9%. These results indicate that simulationbased training remains effective even as the recognition vocabulary becomes substantially larger. Importantly, the improved detection performance is not obtained through a more permissive classifier. As shown in Appendix I Table 9, L EAK F ORGE maintains an average keyword FPR of 4.00%, which remains within the range observed for AccelEve (2.84%–5.88%). This suggests that the OOD improvements reflect genuine cross-device generalization. 5.4.2. Sentence-level Eavesdropping Accuracy. The ability to recognize full sentences, rather than just isolated digits or keywords, determines the scope of potential application scenarios. To this end, ISpyU stands as the most relevant benchmark for our study. Table 6 compares the accuracy of cross-device sentence-level eavesdropping between ISpyU and our method.
First, we observe a clear granularity-dependent degradation: as the recognition task advances from closed-set digit and keyword classification to continuous sentence recognition, average cross-device performance drops substantially (from 75.4% digit accuracy to 46.3% sentence-level WAcc). This degradation is fundamentally tied to the physical limits of the accelerometer side channel. Its low sampling rate, constrained bandwidth, and aliasing preserve coarse acoustic envelopes and partial temporal cues. While these preserved signals are sufficient for robust closed-set discrimination and enable practical sentence-level recognition, their limited preservation of fine-grained phonetic and temporal structure makes high-precision, continuous decoding inherently difficult. Second, for sentence-level recognition, our method achieves an average cross-device (OOD) WAcc of 46.3%. This corresponds to an 80.9% relative improvement over ISpyU’s strongest cross-device source model (25.6%) and a 97.0% improvement over its average OOD performance (23.5%). This gain is achieved without device-specific finetuning, whereas ISpyU relies on real accelerometer traces for fine-tuning and its performance degrades noticeably across unseen hardware. Furthermore, even when ISpyU is evaluated under the same-device setting, our approach still outperforms it on each of the six tested devices. This suggests that ISpyU’s target-trace adaptation captures devicespecific patterns that transfer less effectively across hardware, whereas our simulation-based training exposes the recognizer to broader transfer variations prior to exploitation. Finally, accuracy exhibits substantial variation across devices, ranging from 24.2% on Pixel 9 to 67.7% on Mi 11 Youth. This variation reflects the physical heterogeneity of accelerometer acoustic leakage: different hardware stacks preserve different amounts of speech-correlated information after mechanical filtering, sensor filtering, and lowrate sampling. Our comparative spectrogram analysis, such as the contrast between Samsung S24U and X200, further shows that devices with stronger attenuation of speechrelated vibration components impose a lower information ceiling for recognition. Overall, these results answer our core evaluation question affirmatively. A single profiling-free model trained entirely on simulated accelerometer traces can outperform target-adapted baselines across heterogeneous smartphones and recover sentence-level content without collecting traces from the victim device. At the same time, the remaining device-to-device variance clarifies the physical boundary of the attack: L EAK F ORGE improves generalization across transfer responses, while the amount of recoverable linguistic information remains constrained by each device’s mechanical and sensing chain. We discuss these implications, limitations, and potential defenses in Section 6.
6. Discussion Implications for data-driven security evaluation. For many data-driven physical side-channel attacks, the scarce resource is not source-domain data, but the leakage-domain
Frequency
X200
1
200
0.8
150
0.6
100
0.4 0.2
50 0
1
2
3
4
5
6
7
Frequency
Time S24U
1
200
0.8
150
0.6
100
0.4 0.2
50
0
0
1
2
3
4
Time
5
6
7
Figure 6: Comparison of Accelerometer Spectrograms. distribution induced by the physical channel. While sourcedomain data can be scaled through public corpora or synthetic generation, leakage traces remain strictly channelbound: they are observable only after the source has been shaped by a device-specific chain, which in our context spans structural coupling, sensor transduction, firmware filtering, and low-rate sampling. In light of this, our results demonstrate that when cross-device variability is dominated by a compact set of physically interpretable mechanisms, physics-guided channel modeling can serve as a practical substitute for per-device training or calibration trace collection. This paradigm substantially improves cross-device generalization, rendering the attack completely agnostic to exact hardware transfer functions. L EAK F ORGE instantiates this approach for accelerometer-based acoustic leakage, reframing hardware heterogeneity from a per-device collection requirement into a source-to-leakage transfer distribution that can be explicitly modeled, sampled, and trained over. The extent to which this principle generalizes depends on whether the dominant leakage mechanisms of a given side channel admit a compact parameterization–a property that varies by physical channel and warrants investigation in future work. Physical limits of cross-device eavesdropping. The devicewise results show that profiling-free eavesdropping performance remains uneven across smartphones. This variation is consistent with differences in speaker assemblies, chassis structures, sensor placements, package mountings, firmware filters, and sampling readout, all of which affect how much speech-correlated vibration appears in the accelerometer trace. For example, under matched playback, the Samsung S24U exhibits clearer aliased speech structure, whereas the X200 shows more fragmented spectrogram patterns. L EAK F ORGE improves cross-device transfer by training over diverse channel responses, but it cannot exceed the information-theoretic limit imposed by each hardware stack. System-level sampling boundary and mitigations. Recent mobile operating systems, including Android 12+, limit high-rate motion-sensor access by capping accelerometer sampling at 200 Hz unless an application declares
HIGH_SAMPLING_RATE_SENSORS. Our testing reveals a sampling-boundary weakness caused by shared sensorstream delivery. When a high-rate client activates a fast hardware stream, the sensor service may deliver high-rate events to other active listeners of the same sensor, including applications that did not request or declare high-rate access. We responsibly disclosed this shared-stream isolation vulnerability to Google, who has acknowledged the issue. Our findings suggest that the current enforcement boundary relies on request-time validation rather than per-client event delivery. Therefore, the mitigation should be applied on the delivery path: the sensor service should guarantee a maximum event rate of 200 Hz for each capped client, regardless of which hardware stream other applications have activated. Rate enforcement should also be paired with antialias filtering before downsampling, because simply dropping samples can alias speech-correlated high-frequency components into the capped client’s baseband. Together, per-client delivery control and pre-downsampling filtering address the two mechanisms that enable this leakage path: cross-client high-rate event exposure and alias-preserving decimation. Scope of the simulation prior. Our simulation prior functions as a coverage prior rather than a device-identification prior. The parameter ranges are broad, fixed before evaluation, and not fitted to any target device. Consistent with the profiling-free setting, its purpose is to expose the recognizer to a broad family of physically plausible transfer behaviors, rather than reconstructing the exact transfer function of a particular phone. Sensitivity analysis over prior ranges, distribution shapes, and device-adaptive parameter fitting remains future work; such fitting could further improve adaptation when calibration data is available, but falls outside the strict profiling-free setting studied here.
7. Conclusion We present L EAK F ORGE, a device-agnostic accelerometer eavesdropping framework for strict profiling-free conditions. L EAK F ORGE models the forward audio-toaccelerometer transfer process, synthesizes large-scale accelerometer-domain training data, and trains an end-toend recognizer over randomized transfer responses. Compared to prior cross-device baselines, L EAK F ORGE delivers relative improvements of 57.7%–74.9% in digit recognition and 45.8%–76.7% in keyword detection; for sentence-level recognition, it achieves up to 67.7% word accuracy, corresponding to a 97.0% average relative improvement over prior work. Overall, L EAK F ORGE addresses a central question in data-driven physical side-channel evaluation: whether crossdevice generalization inherently requires empirical traces from every target device. Our results show that, under a strict profiling-free setting, this dependence is not intrinsic when a channel’s cross-device variability is dominated by physically interpretable mechanisms. In such cases, simulation-based generalization becomes tractable, and the cost of scaling
an attack across hardware shrinks from field collection to parameter space coverage. This finding changes how hardware heterogeneity should be interpreted: it remains an information-preservation boundary, but it is not an inherent defense when speechcorrelated structure survives in observable sensor streams. Our Android shared-stream disclosure further shows how OS-level sensor mediation can amplify this channel by exposing high-fidelity motion observations. Together, these results show that physics-guided channel modeling can move physical side-channel attacks beyond individual device profiles, revealing hardware diversity as a structured sourceto-leakage transfer distribution that can be systematically modeled and exploited across devices.
References [1]
ADXL354/ADXL355: Low Noise, Low Drift, Low Power, 3-Axis MEMS Accelerometers Data Sheet. https://www.analog.com/media/ en/technical-documentation/data-sheets/adxl354 adxl355.pdf.
[2]
Chattts. GitHub repository. https://github.com/2noise/ChatTTS.
[3]
Eaves. GitHub repository. https://github.com/miligithub/Eaves.
[4]
Dario Amodei, Sundaram Ananthanarayanan, Rishita Anubhai, Jingliang Bai, Eric Battenberg, Carl Case, Jared Casper, Bryan Catanzaro, Qiang Cheng, Guoliang Chen, et al. Deep speech 2: end-toend speech recognition in english and mandarin. In Proceedings of the 33rd International Conference on International Conference on Machine Learning - Volume 48, pages 173–182, 2016.
[5]
S Abhishek Anand, Chen Wang, Jian Liu, Nitesh Saxena, and Yingying Chen. Spearphone: a lightweight speech privacy exploit via accelerometer-sensed reverberations from smartphone loudspeakers. In Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks, pages 288–299, 2021.
[6]
Dmitri Asonov and Rakesh Agrawal. Keyboard acoustic emanations. In IEEE Symposium on Security and Privacy, 2004. Proceedings. 2004, pages 3–11. IEEE, 2004.
[7]
Zhongjie Ba, Tianhang Zheng, Xinyu Zhang, Zhan Qin, Baochun Li, Xue Liu, and Kui Ren. Learning-based practical smartphone eavesdropping with built-in accelerometer. In Network and Distributed System Security (NDSS) Symposium, 2020.
[8]
Suryoday Basak and Mahanth Gowda. mmspy: Spying phone calls using mmwave radars. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1211–1228, 2022.
[9]
Suryoday Basak, Abhijeeth Padarthi, and Mahanth Gowda. mmwavewhisper: Phone call eavesdropping and transcription using millimeterwave radar. In ICASSP 2025-2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1–5. IEEE, 2025.
[10] Sören Becker, Johanna Vielhaben, Marcel Ackermann, Klaus-Robert Müller, Sebastian Lapuschkin, and Wojciech Samek. Audiomnist: Exploring explainable artificial intelligence for audio analysis on a simple benchmark. Journal of the Franklin Institute, pages 418–428, 2024. [11] Shivam Bhasin, Anupam Chattopadhyay, Annelie Heuser, Dirmanto Jap, Stjepan Picek, and Ritu Ranjan. Mind the portability: A warriors guide through realistic profiled side-channel analysis. In NDSS 2020Network and Distributed System Security Symposium, pages 1–14, 2020.
[17] Josef Danial, Debayan Das, Anupam Golder, Santosh Ghosh, Arijit Raychowdhury, and Shreyas Sen. Em-x-dl: Efficient cross-device deep learning side-channel attack with noisy em signatures. ACM Journal on Emerging Technologies in Computing Systems (JETC), 18(1):1–17, 2021. [18] Debayan Das, Anupam Golder, Josef Danial, Santosh Ghosh, Arijit Raychowdhury, and Shreyas Sen. X-deepsca: Cross-device deep learning side channel attack. In Proceedings of the 56th Annual Design Automation Conference 2019, pages 1–6, 2019. [19] Abe Davis, Michael Rubinstein, Neal Wadhwa, Gautham J Mysore, Fredo Durand, and William T Freeman. The visual microphone: Passive recovery of sound from video. 2014. [20] Ming Gao, Yajie Liu, Yike Chen, Yimin Li, Zhongjie Ba, Xian Xu, and Jinsong Han. Inertiear: Automatic and device-independent imubased eavesdropping on smartphones. In IEEE INFOCOM 2022 IEEE Conference on Computer Communications, pages 1129–1138, 2022. [21] Miao He, Jungmin Park, Adib Nahiyan, Apostol Vassilev, Yier Jin, and Mark Tehranipoor. Rtl-psc: Automated power side-channel leakage assessment at register-transfer level. In 2019 IEEE 37th VLSI Test Symposium (VTS), pages 1–6. IEEE, 2019. [22] Pengfei Hu, Hui Zhuang, Panneer Selvam Santhalingam, Riccardo Spolaor, Parth Pathak, Guoming Zhang, and Xiuzhen Cheng. Accear: Accelerometer acoustic eavesdropping with unconstrained vocabulary. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1757–1773, 2022. [23] Patrick Juola and Philip Zimmermann. Whole-word phonetic distances and the pgpfone alphabet. In Proceedings of the Fourth International Conference on Spoken Language Processing (ICSLP ’96), pages 98–101, 1996. [24] Tyler Kaczmarek, Ercan Ozturk, and Gene Tsudik. Thermanator: Thermal residue-based post factum attacks on keyboard data entry. In Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security, pages 586–593, 2019. [25] Yunji Liang, Yuchen Qin, Qi Li, Xiaokai Yan, Luwen Huangfu, Sagar Samtani, Bin Guo, and Zhiwen Yu. An escalated eavesdropping attack on mobile devices via low-resolution vibration signals. IEEE Transactions on Dependable and Secure Computing, 20(4):3037– 3050, 2023. [26] Yan Michalevsky, Dan Boneh, and Gabi Nakibly. Gyrophone: recognizing speech from gyroscope signals. In Proceedings of the 23rd USENIX Conference on Security Symposium, pages 1053–1067, 2014.
[12] Pei Cao, Chi Zhang, Xiangjun Lu, and Dawu Gu. Cross-device profiled side-channel attack with unsupervised domain adaptation. IACR Transactions on Cryptographic Hardware and Embedded Systems, pages 27–56, 2021.
[27] Ben Nassi, Yaron Pirutin, Raz Swisa, Adi Shamir, Yuval Elovici, and Boris Zadov. Lamphone: Passive sound recovery from a desk lamp’s light bulb vibrations. In 31st USENIX Security Symposium (USENIX Security 22), pages 4401–4417, 2022.
[13] Pei Cao, Hongyi Zhang, Dawu Gu, Yan Lu, and Yidong Yuan. Al-pa: cross-device profiled side-channel attack using adversarial learning. In Proceedings of the 59th ACM/IEEE Design Automation Conference, pages 691–696, 2022.
[28] Mabon Ninan, Evan Nimmo, Shane Reilly, Channing Smith, Wenhai Sun, Boyang Wang, and John M Emmert. A second look at the portability of deep learning side-channel attacks over em traces. In Proceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses, pages 630–643, 2024.
[14] Yetong Cao, Fan Li, Huijie Chen, Xiaochen Liu, Chunhui Duan, and Yu Wang. I can hear you without a microphone: Live speech eavesdropping from earphone motion sensors. In IEEE INFOCOM 2023-IEEE Conference on Computer Communications, pages 1–10. IEEE, 2023. [15] Derin Cayir, Reham Mohamed, Riccardo Lazzeretti, Marco Angelini, Abbas Acar, Mauro Conti, Z Berkay Celik, and Selcuk Uluagac. Speak up, i’m listening: Extracting speech from zero-permission vr sensors. In Network and Distributed System Security (NDSS) Symposium, 2025. [16] Jung-Woo Chang, Ke Sun, David Xia, Xinyu Zhang, and Farinaz Koushanfar. Eveguard: Defeating vibration-based side-channel eavesdropping with audio adversarial perturbations. In 2025 IEEE Symposium on Security and Privacy (SP), pages 4534–4552. IEEE, 2025.
[29] Hao Pan, Feitong Tan, Wenhao Li, Yi-Chao Chen, Lanqing Yang, Guangtao Xue, and Xiaoyu Ji. Magdefender: Detecting eavesdropping on mobile devices using the built-in magnetometer. In 2022 19th Annual IEEE International Conference on Sensing, Communication, and Networking (SECON), pages 28–36, 2022. [30] Vassil Panayotov, Guoguo Chen, Daniel Povey, and Sanjeev Khudanpur. Librispeech: An asr corpus based on public domain audio books. In 2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 5206–5210, 2015. [31] Alec Radford, Jong Wook Kim, Tao Xu, Greg Brockman, Christine McLeavey, and Ilya Sutskever. Robust speech recognition via largescale weak supervision. In International conference on machine learning, pages 28492–28518. PMLR, 2023.
[32] Cong Shi, Xiangyu Xu, Tianfang Zhang, Payton Walker, Yi Wu, Jian Liu, Nitesh Saxena, Yingying Chen, and Jiadi Yu. Face-mic: inferring live speech and speaker identity via subtle facial dynamics captured by ar/vr motion sensors. In Proceedings of the 27th Annual International Conference on Mobile Computing and Networking, pages 478–490, 2021. [33] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014. [34] Eric Sturtzer, Gael Pillonnet, Guy Lemarquand, and Nacer Abouchi. Comparison between voltage and current driving methods of a microspeaker. Applied Acoustics, 73(11):1087–1098, 2012. [35] Weigao Su, Daibo Liu, Taiyuan Zhang, and Hongbo Jiang. Towards device independent eavesdropping on telephone conversations with built-in accelerometer. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, 5(4):1–29, 2021. [36] Ke Sun, Chunyu Xia, Songlin Xu, and Xinyu Zhang. Stealthyimu: Stealing permission-protected private information from smartphone voice assistant using zero-permission sensors. In Network and Distributed System Security (NDSS) Symposium, 2023. [37] Lei Wang, Meng Chen, Li Lu, Zhongjie Ba, Feng Lin, and Kui Ren. Voicelistener: A training-free and universal eavesdropping attack on built-in speakers of mobile devices. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, 7(1):1– 22, 2023. [38] Qingsong Yao, Yuming Liu, Xiongjia Sun, Xuewen Dong, Xiaoyu Ji, and Jianfeng Ma. Watch the rhythm: Breaking privacy with accelerometer at the extremely-low sampling rate of 5hz. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 1776–1790, 2024. [39] Honggang Yu, Haoqi Shan, Maximillian Panoff, and Yier Jin. Crossdevice profiled side-channel attacks using meta-transfer learning. In 2021 58th ACM/IEEE Design Automation Conference (DAC), pages 703–708. IEEE, 2021. [40] Li Zhang, Parth H Pathak, Muchen Wu, Yixin Zhao, and Prasant Mohapatra. Accelword: Energy efficient hotword detection through accelerometer. In Proceedings of the 13th Annual International Conference on Mobile Systems, Applications, and Services, pages 301–315, 2015.
TABLE 7: Simulation parameter ranges. Frequencies are in Hz; damping ratios are percentages. Randomized parameters are sampled independently and uniformly within the listed ranges unless fixed. Parameter
Meaning
Range
M f1 f2 f3 f4 ζi ri α β fares ζa fap p Fa σ∆ fc SNR
Structural modes Struct. mode 1 Struct. mode 2 Struct. mode 3 Struct. mode 4 Struct. damping Modal gain Audio-to-voltage gain Voltage-to-force gain MEMS resonance MEMS damping Aperture attenuation scale Aperture envelope strength Output sampling rate Sampling-hop jitter Spectral cutoff Additive spectrogram noise level
4 100–300 300–500 500–750 750–1000 1–40% 0.1–4 1 1 1000–3000 1–40% 1500–4000 0.5–3.5 400–550 0.5 3000 5–30 dB
TABLE 8: STFT configurations used in simulation and feature extraction. Window/hop/NFFT are in samples. Stage STFTaudio STFTacc
Signal
Win
Hop
NFFT
16 kHz audio ˜500 Hz accel
1024 32
128 4
15998 78
[42] Tao Zhang, Jungmin Park, Mark M Tehranipoor, and Farimah Farahmandi. Psc-tg: Rtl power side-channel leakage assessment with test pattern generation. In DAC, pages 709–714, 2021.
are defined by broad, contiguous frequency bands and coarse damping ratios that capture the natural vibration physics of smartphone-scale mechanics. During training, the simulator samples from this shared, uncalibrated distribution for each utterance. This forces the model to learn how speech cues are transformed across a physically constrained but highly randomized family of transfer-function shapes, thereby decoupling transcript recognition from per-device parameter fitting. (Note: α and β are fixed to one, as constant gains are absorbed by spectral normalization.)
Appendix A. Artifact Availability.
Appendix C. Model Architecture
[41] Shijia Zhang, Yilin Liu, and Mahanth Gowda. I spy you: Eavesdropping continuous speech on smartphones via motion sensors. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, pages 1–31, 2023.
Will release after publishing.
Appendix B. Simulation Parameter Space Table 7 summarizes the fixed engineering prior driving our profiling-free simulator. To strictly prevent targetdata leakage, all parameter boundaries are derived from domain knowledge rather than empirical measurements of our evaluation devices. Specifically, sensor-side parameters (e.g., resonance, bandwidth, and noise density) are anchored by public commodity MEMS datasheets [1]. Structural paths
Our eavesdropping model follows a CNN–BiLSTM– CTC architecture tailored to low-rate accelerometer spectrograms. The convolutional front end uses an initial 3 × 3 convolution followed by VGG-style blocks [33], each consisting of two 3 × 3 convolutional layers. Small kernels are used because accelerometer spectrograms have much coarser time-frequency resolution than microphone audio; local energy patterns caused by aliasing can be informative, and aggressive early aggregation may discard such cues. Stacking multiple 3 × 3 layers gradually expands the effective receptive field while preserving local structure in the restricted frequency band.
To preserve temporal resolution, we avoid strided convolutions in the front end and apply only one 2× max-pooling layer. Unlike conventional ASR encoders that aggressively downsample the time axis for efficiency, we minimize temporal reduction since accelerometer traces inherently suffer from sparse temporal evidence after low-rate sampling. The resulting feature sequence is passed to four BiLSTM layers, which model bidirectional context and help disambiguate noisy, aliased motion patterns over longer time spans. Finally, a fully connected layer projects the BiLSTM outputs to the grapheme vocabulary, followed by a softmax activation at each timestep. We train the model with CTC loss, enabling alignment-free learning between variablelength accelerometer spectrograms and transcript labels. The output alphabet contains 28 symbols: 26 lowercase letters, space, and the CTC blank token.
Appendix D. Implementation Details Training Data We use LibriSpeech [30] as the source speech corpus and generate simulated accelerometer traces from LibriSpeech train-960. Unless otherwise stated, we train the main eavesdropping model on 843,723 simulated accelerometer samples. Evaluation datasets and train/test splits are described in Appendix E. Training Configuration We perform the accelerometer data simulation on a machine equipped with two Intel Xeon Platinum 8368 38-core processors and 256 GB of memory, according to § 4.2.1. The eavesdropping model is implemented using TensorFlow 2.15.0 in Python 3.10.16. We use the AdamW optimizer with a composite learning rate schedule: linear warm-up from 0 to 2.5 × 10−4 during the first three epochs, followed by cosine annealing decay to 1 × 10−6 for subsequent epochs. Each training session runs 50 epochs. The model is trained and evaluated on a dedicated GPU server equipped with four NVIDIA RTX 4090 GPUs. Data capture prototype. For replay-recorded evaluation traces, we implement an Android data-capture application based on Eaves [3]. The app records raw accelerometer samples during device-speaker playback. LLM post-processing. For sentence-level reconstruction, we use GPT-5.4 as a text-level post-processor. The model receives only the CTC-decoded grapheme sequence and does not receive raw accelerometer traces, device identifiers, or ground-truth transcripts. The same prompt is used for all samples: Convert the following ASR-recognized English sentence into a coherent, punctuation-free English version. - Only output the corrected sentence. - Do not add any explanations, notes, or formatting.
We do not manually select or edit the LLM outputs during evaluation.
Appendix E. Evaluation Details and Prior-work Reproduction This appendix complements § 5.1 with replay-recording conditions, dataset construction, and prior-work reproduction settings. Unless otherwise stated, accelerometer traces are captured during audio playback from the device speaker, with devices placed on a wooden desk in an anechoic chamber with 30–40 dB(A) ambient noise. All traces are processed using Appendix G, except when a reproduced baseline requires its original input representation. Sentence-level eavesdropping. We use LibriSpeech [30] for sentence-level evaluation. Our replay-recorded test set contains 1,355 dev-clean utterances from 20 unseen speakers. For the ISpyU reproduction, we generate 281,241 synthetic samples for pre-training, fine-tune with 8,072 real traces per device, and evaluate on 1355 held-out real traces per device. In contrast, our method is evaluated directly on the test traces using the purely simulation-trained model, requiring zero target-device data. Digit recognition. We use AudioMNIST [10], which has been widely used in prior accelerometer eavesdropping studies [7], [20], [22], [38]. For each device, we replay-record all 30,000 utterances and use 27,000 real traces for training and 2,000 for testing when reproducing device-dependent baselines. For AccelEve, we train on the 27,000 real traces from one device and test on both same-device and cross-device traces. For ISpyU, we generate 27,000 synthetic samples for pre-training and fine-tune with 6,000 real traces per device. Our model is trained on 120,000 simulated samples and evaluated on the same replay-recorded test traces without real-device training data. Keyword recognition. Because the keyword datasets used in AccelEve and ISpyU are not publicly released, we construct reproducible keyword datasets following ISpyU’s published procedure [41]: we sample keywords from the open-sourced PGP list [23] and synthesize audio with ChatTTS [2]. We evaluate both the 8-class and 58-class settings and include non-keyword utterances as negatives for false-positive-rate evaluation. For AccelEve, we collect 10,000 real traces per device for training and 1,056 for testing. For ISpyU, we generate 57,420 synthetic samples for pre-training, fine-tune with 5,800 real traces per device, and test on 580 real traces per device. Our model is trained purely on simulated data, using 102,387 samples for the 8keyword setting and 229,680 samples for the 58-keyword setting, and is evaluated on the same replay-recorded real traces used for the baselines.
Appendix F. Detailed Results for L EAK F ORGE This appendix provides additional sentence-level statistics that complement the main evaluation in § 5. Unless otherwise specified, the reported results use the on-desk, 100% volume setting.
Effect of LLM post-processing across settings. Fig. 4a shows the incremental effect of the optional LLM postprocessing stage under different recording settings. Across settings, L EAK F ORGE +LLM improves mean WAcc, with the largest gain under the best-performing setting: on-desk placement at 100% volume yields a +5.6 percentage-point increase in mean WAcc averaged over devices. Under lowervolume settings (e.g., on-desk, 50% volume), the incremental gain is smaller, indicating that semantic post-processing is most effective when the acoustic model already preserves sufficient word-level evidence. Cross-device differences under a fixed setting. Fig. 4b reports the per-device breakdown under the fixed on-desk, 100% volume setting. On the best-performing device, Mi 11 Youth measured at approximately 502 Hz, L EAK F ORGE achieves 57.7% WAcc and improves to 67.7% after LLM post-processing, corresponding to a +10.0 percentage-point gain. Fig. 6 further compares Samsung S24U and X200 under matched playback conditions, illustrating devicedependent differences in the observable aliasing structure of accelerometer spectrograms. Speaker-gender analysis. Fig. 4c reports corpus-level WAcc with 95% bootstrap confidence intervals for male and female speakers on Mi 11 Youth under the on-desk, 100% volume setting. The test set contains 648 male-speaker sentences and 707 female-speaker sentences. For L EAK F ORGE, the corpus-level WAcc values are 57.5% and 57.9% for male and female speakers, respectively, with no statistically significant difference (permutation p = 0.652, weighted Hedges’ g = −0.025). After LLM post-processing, L EAK F ORGE +LLM improves WAcc to 69.2% for male speakers and 67.3% for female speakers, and the gender difference remains statistically insignificant (permutation p = 0.115, weighted Hedges’ g = 0.090). A paired analysis by audio ID shows that LLM post-processing improves WAcc for both groups, with corpus-level gains of +11.7% for male speakers and +9.5% for female speakers. The gain is slightly larger for male speakers (+2.3%, 95% CI [+0.8%, +3.7%], permutation p = 0.002), but the effect size remains small (weighted Hedges’ g = 0.179). Overall, these results indicate that L EAK F ORGE maintains comparable recognition quality across speaker genders, while LLM post-processing provides consistent additional improvement for both groups. Per-sentence accuracy distribution. Fig. 5a reports the distribution of per-sentence WAcc and CAcc under the same fixed device and setting. LLM post-processing shifts the WAcc distribution upward: the median WAcc increases from 57.7% to 67.7%, and the 90th-percentile WAcc increases from 80.0% to 92.3%. The fraction of sentences with WAcc≥70% increases significantly from 24.9% to 47.6% (+22.7 percentage points), while the fraction with WAcc≤40% decreases from 18.1% to 15.4%. For CAcc, the median remains relatively stable (shifting slightly from 79.5% to 79.7%), but the fraction of sentences with CAcc≥70% drops from 80.1% to 71.1%. This divergence—massive gains in WAcc alongside a reduction in high-CAcc sentences—is expected because the LLM acts as a semantic post-processor rather than a character-preserving
decoder. When the raw grapheme stream contains corrupted or low-confidence word fragments, the LLM may omit them to produce a more fluent sentence. At the word level, omitting an already incorrect fragment often leaves WAcc unchanged or improves it by restoring surrounding context. At the character level, however, the omitted fragment may still contain characters that correctly overlap with the groundtruth word. Thus, this selective omission behavior preserves or boosts word-level accuracy while explicitly penalizing exact character-level alignments. Accuracy stratified by sentence length. Fig. 5c stratifies WAcc by sentence length on Mi 11 Youth under the on-desk, 100% volume setting. For L EAK F ORGE, mean WAcc is 51.8% for short sentences with fewer than 10 words, 58.8% for 30–40-word sentences, and 57.3% for sentences with more than 40 words. The benefit of LLM post-processing is larger for longer sentences: for sentences with at least 10 words, post-processing increases mean WAcc by 7.9– 13.9 percentage points. In particular, L EAK F ORGE +LLM reaches 71.4% mean WAcc for 30–40-word sentences and 71.2% for sentences with more than 40 words.
Appendix G. Preprocessing Details We apply the same feature extraction chain to simulated traces and replay-recorded accelerometer traces. Table 8 summarizes the STFT configurations. The high-rate STFT is used during simulation to generate the enhanced waveform asim [n] in (19), while the low-rate STFT is used to produce the final model input for both simulated and real accelerometer streams. Given a magnitude spectrogram S(f, t), we normalize it by its maximum magnitude: S̃(f, t) =
S(f, t) . maxf,t S(f, t) + ϵ
(27)
This step reduces volume- and device-dependent scale variation. We further remove the lowest 10% of frequency bins to suppress low-frequency motion interference caused by handling, posture changes, and other non-speech motion artifacts. The same normalization and low-frequency suppression are applied to simulated and real accelerometer spectrograms. For simulated traces, we additionally inject band-limited Gaussian self-noise before feature extraction to approximate the accelerometer noise floor. For replay-recorded traces, we first remove the DC offset from the selected z -axis segment, T
x′z (t) = xz (t) −
1X xz (t), T t=1
(28)
and then compute the low-rate STFT followed by the same normalization and low-frequency suppression steps.
TABLE 9: Cross-device keyword false positive rate (FPR) comparison. Model Train Test Mi11Y S25 S24U X200 P6a P9 OOD Mean
AccelEve [7]
Ours
Mi11Y
S25
S24U
X200
P6a
P9
-
3.66 3.31 4.76 4.88 5.77 6.71
2.42 1.73 4.14 3.10 3.31 4.58
3.15 5.87 4.69 4.81 7.24 8.35
2.47 2.70 3.64 3.20 4.14 5.65
3.25 1.95 3.61 2.60 2.89 3.87
2.75 1.65 3.53 3.15 3.11 3.43
2.43 2.99 3.38 3.67 5.35 6.16
5.09
3.51
5.88
3.72
3.06
2.84
4.00
The values are FPR for keyword detection. All values are reported as percentages (%).
Appendix H. Simulation Variants
This appendix summarizes the simulation variants used in § 5.2.1. All variants share the same preprocessing chain, model architecture, and training configuration; they differ only in how simulated accelerometer traces are generated. Naive. The Naive variant retains only the 0–250 Hz portion of the 16 kHz audio spectrogram to match the observable baseband of a 500 Hz accelerometer stream. It serves as a baseband-only reference and does not model aliasing or device-specific vibration transfer. ISpyU. Following ISpyU [41], this variant subsamples the original 16 kHz audio spectrogram by a fixed factor of 32 to emulate the time-frequency resolution of a 500 Hz accelerometer spectrogram. This provides a fixeddownsampling baseline that introduces deterministic spectral folding, while keeping the device response unchanged across samples. Transfer-Function Modeling (TM). TM applies the speaker–structure–accelerometer transfer model described in § 4.2.1. This variant introduces frequency-selective shaping caused by speaker-to-sensor vibration propagation, thereby emulating different resonance and attenuation patterns in the accelerometer channel. Random Aliasing (RA). RA replaces deterministic fixedrate subsampling with a jittered low-rate sampling grid. The sampling intervals are drawn around the nominal hop implied by the accelerometer rate, producing stochastic aliasing patterns that approximate timing variability in commodity sensor streams. Transfer-Function Modeling & Random Aliasing (TM & RA). TM & RA combines frequency-selective transfer modeling with jittered low-rate sampling. This is the full simulator used by L EAK F ORGE, generating multiple accelerometer-domain variants per utterance through randomized transfer responses and sampling patterns.
Appendix I. Cross-device Keyword False Positive Rate (FPR) Table 9 reports the cross-device FPR matrix for AccelEve and our method.