Qiang Zeng, an associate professor of computer science at George Mason University, and doctoral student Ying Meng have developed a method showing promise for hardening voice assistants against concealed audio intrusions, with no added processing burden on hardware and no requirement for organisations to fund large-scale retraining of their AI models.
The research, describing a framework the team calls DivNet, was presented at MobiSys 2026, the ACM International Conference on Mobile Systems, Applications, and Services, held that year in Cambridge, England.
Zeng explained that audio commands encoded at frequencies below human hearing can be embedded within ordinary broadcast material — a commercial or a song, for example — allowing voice-activated AI systems to act on those hidden instructions while anyone in the vicinity perceives only the surface content. One factor that broadens the reach of this type of attack is the widespread industry practice of deploying the same AI models across tens of millions of devices, meaning that compromising one device through manipulation leaves open the possibility that the same captured data could be turned against multiple other targets.
Building these models at scale carries substantial costs, which reduces the business case for tailoring a separate version to each individual client. By generating many subtly distinct variants of an AI model, DivNet is designed so that a single piece of manipulated audio cannot be replayed across multiple devices with the same effect.
The framework operates by examining neural network weights — the numerical parameters that govern how a network processes data. Certain parameters carry weight when it comes to processing everyday spoken language with precision, while a separate subset of features, though of limited value for conventional recognition, proves relevant when audio-based attack methods are the goal. DivNet applies targeted modifications to that latter category, bringing those values into alignment accordingly.
By adjusting various combinations of those numerical weights, the team generated a large array of distinct model variants that kept normal speech recognition intact while reacting differently when fed adversarial audio. When tested against established speech-recognition platforms, the approach held off adversarial attacks at a high rate while keeping any reduction in ordinary recognition performance to a minimum.
When a device processes incoming speech, DivNet imposes no additional computational overhead — a distinction the researchers say sets it apart from most other protection methods currently in use. Once the preliminary analysis is complete, producing a new variant requires no more than a few milliseconds. The number of distinct variants the method can generate exceeds the estimated count of atoms in all observable space.
Rotating the behaviour of even one voice assistant at intervals raises the cost and complexity of mounting repeatable attacks. Zeng noted that retraining an AI system carries a steep price tag because the graphics processing units required for that work are costly to operate.
To accompany the research, a dedicated project website named DivNet was built out with technical documentation, live demonstrations, and audio samples that allow visitors to hear how the same adversarial recording yields divergent outputs depending on which model variant processes it.
Zeng noted that patent applications are under way for the method, and the team has described the approach as holding commercial promise. The research is documented in the group's 2026 MobiSys paper on orthogonal neural network variants and carries the identifier 10.1145/3745756.3809215 within the ACM digital index.
