[powrtoch]

I'm surprised that this works. I always assumed Siri etc. would do some bare-minimum pre-processing of the audio input, if only to reduce noise, of which the simplest kind would be cutting frequencies that cannot be produced or registered by humans. Any insight into why this isn't already the case?

[anonymfus]

This attack exploits non-linearity in microphones and amplifiers. ADC receives signal already demodulated to an audible frequency.

[virgil_disgr4ce]

This was my question. Seems bizarre to not bandpass everything as the first stage!

[TeMPOraL]

From skimming the paper it seems they're making the signal demodulate itself directly on the microphone - by the time it hits a low-pass filter and ADC, the audible frequencies are already injected.