All projects

Giving AI a Headache

An acoustic attack that degrades YOLO11 object detection by physically resonating the camera itself.

Most adversarial attacks on object detection work in the digital domain — perturb the pixels, fool the model. This one never touches the image data at all. It attacks the camera: sound is used to physically resonate the device, and that motion falls outside what the camera’s internal stabilization system was built to correct. The stabilizer compensates anyway, and in doing so writes artifacts into the frame. Downstream, YOLO11 misclassifies objects, misses targets, and hallucinates ones that were never there.

Earlier work in this space used ultrasonic frequencies above 20 kHz, which attenuate quickly and confine the attack to short range. We went the other direction — into the audible band below 20 kHz — and ran physical experiments against an off-the-shelf camera and an unmodified detection model, then looked at which image and object features actually drive the vulnerability.

The interesting part is where the attack lives. There’s no adversarial patch to detect, no modified input to sanitize, nothing anomalous in the model’s weights or pipeline. The failure is introduced upstream of everything a conventional defense inspects — which is exactly what makes it worth characterizing before someone else does.

First-authored, published at SPIE 2026, with Maksim Ekin Eren, Milo Prisbrey, Ben Migliori, and Michael Teti.

Methodology overview.
Detection degrading as the camera is driven at a resonant frequency.
arXiv Code

Citation

Villavicencio-Garduño, N., Eren, M. E., Prisbrey, M., Migliori, B., & Teti, M. (2026). Giving AI a Headache: Acoustic Adversarial Attacks to Computer Vision Applications. SPIE.

BibTeX

@inproceedings{villavicencio2026headache,
  title     = {Giving AI a Headache: Acoustic Adversarial Attacks to Computer Vision Applications},
  author    = {Villavicencio-Gardu{\~n}o, Nicole and Eren, Maksim Ekin and Prisbrey, Milo and Migliori, Ben and Teti, Michael},
  booktitle = {SPIE},
  year      = {2026},
  eprint    = {2606.14658},
  archivePrefix = {arXiv}
}