One AI model, trillions of variants: Breaking mass attacks on voice assistants

Imagine sitting in your home, listening to what you think is a run-of-the-mill advertisement or perhaps a piece of music you enjoy. But while you hum along, that audio file is sending a secret, malicious audio message-imperceptible to human ears-telling your home assistant to unlock your door or maybe transfer money from your bank account.

It is this stealth threat that George Mason University Department of Computer Science associate professor Qiang Zeng is investigating.

"You hear one thing, but what the AI interprets is something else," Zeng said.

Zeng and PhD student Ying Meng developed a technique that could make such attacks more difficult, without slowing down devices or requiring companies to spend millions of dollars retraining their artificial intelligence (AI) systems.

He presented a paper outlining their approach, called DivNet, this summer at the prestigious 2026 ACM International Conference on Mobile Systems, Applications, and Services (MobiSys) in Cambridge, England.

The dangers of this melodic, malicious hack are magnified because manufacturers commonly install identical AI models across millions of devices. It would be as if every house in a neighborhood had the same lock, someone possessing one key could access each home. An attacker who successfully manipulates one device could potentially use the same recording against several others.

Training sophisticated models is expensive, so companies have little incentive to create a different one for every customer. DivNet creates numerous slightly different versions of an AI model, preventing attackers from using the same malicious audio to fool multiple devices; rather than giving every device an identical defense, it makes each AI model slightly different.

The researchers accomplish this by examining the millions of numerical values, called weights, that help a neural network process information. Some weights are important for accurately recognizing ordinary speech. Others contribute little to normal recognition but are important to the success of audio attacks. DivNet identifies and selectively changes the latter.

By modifying different combinations of these weights, the researchers produce an enormous number of distinct models that continue recognizing legitimate speech accurately but respond differently to malicious recordings.

Tests using established speech-recognition systems found that DivNet substantially reduced the success of attacks while causing minimal reductions in normal recognition accuracy. Unlike many existing defenses, DivNet also adds no processing time when a device recognizes speech. After an initial analysis, generating a new variant takes only milliseconds. The number of possible variants exceeds the estimated number of atoms in the observable universe, offering an enormous pool of alternatives. Even a single voice assistant can periodically switch variants, making attacks even harder to develop and reuse.

And perhaps its biggest practical advantage is cost. "Every time you train the AI system, it's very expensive because you need the GPU," Zeng said, referring to the powerful processors used to develop AI models.

The researchers created the DivNet project website with demonstrations and technical information, including audio examples showing how identical malicious recordings produce different results across model variants.

Zeng, who started a recent meeting about this research by casually addressing his home assistant with "Alexa, good morning," activating the lights in his home, recognizes the benefits as a consumer himself; he owns five Alexa speakers, by his count.

He said the team is pursuing commercialization, believing the approach could interest major technology companies. "We are applying for patents because we think it has some value."

And for users of the ever-expanding AI assistants, that's music-and ONLY music-to their ears.