InjectEave: Side-Channel Espionage via Hardware Nonlinearity and Active EM Injection

Summary: The InjectEave study published at USENIX Security 2026 shows that an externally transmitted RF signal can be modulated with audio and data and re-radiated thanks to nonlinear components in devices. In this post, I explain the injection, modulation and emission steps of the attack, its significance in terms of TEMPEST and TSCM, scenarios such as listening through a wall, and ways to protect against it.

Academic Paper Details: Haoran Yan, Ziyu Shao, Shuhao Zhang, Qinhong Jiang, Yan Long. “Injected and Leaked: Actively Inducing Side-Channel Leakage Using Electromagnetic Injection and Hardware Nonlinearity”, Proceedings of the 35th USENIX Security Symposium (USENIX Security ’26), 2026, pp. 2485-2504. arXiv Preprint: arXiv:2609.04785v1 [cs.CR] | Project Page: injecteave.github.io | Open Source Artifact: DOI: 10.5281/zenodo.18500378

1. Introduction: From Passive TEMPEST to Active RF Hybrid Espionage

In the cybersecurity and signals intelligence (SIGINT) literature, electromagnetic side-channel leaks (TEMPEST) have been known for decades. The conductive traces on a PCB of a microprocessor, display cable or analog audio circuit act like unintentional radiators, emitting the electrical signals flowing inside into the environment at the microvolt level. Defense institutions and intelligence agencies (through standards such as NATO SDIP-27) have for many years tried to protect devices in critical facilities by covering them in metal shielding or by imposing passive electromagnetic emission limits.

However, classic passive electromagnetic eavesdropping has a very fundamental dilemma arising from the laws of physics: Spectral Mismatch.

Low-frequency (LF) analog data such as human speech (20 Hz - 20 kHz), analog sensor signals or power consumption can produce almost no electromagnetic emission from centimeter-scale headphone cables or PCB traces, because their wavelengths reach tens of kilometers. For an antenna to radiate efficiently, its size must be proportional to the wavelength of the signal ($\lambda/2$ or $\lambda/4$). Weak currents at low frequency are attenuated before they can radiate out of the cable. For this reason, in traditional TEMPEST attacks, leaking audio from headphones was either considered impossible or limited to high-sensitivity magnetic probes placed a few millimeters from the device.

The InjectEave study, presented at the USENIX Security 2026 conference by researchers from the Hong Kong University of Science and Technology (Guangzhou) and Hong Kong Polytechnic University, defines an active attack class that completely overturns this physical barrier: Injection-Induced EM Side Channels.

The researchers proved that, instead of waiting passively, when an external high-frequency RF carrier wave is sent to the target, the unavoidable analog nonlinearities in modern hardware (hardware nonlinearity) multiply this carrier with the secret inside and throw it back into the air (re-radiation).

2. Physical and Mathematical Mechanism: The IME Cycle

The InjectEave attack works through a three-stage physical model called Injection - Modulation - Emission (IME).

INJECTEAVE: INJECTION - MODULATION - EMISSION (IME) CYCLE · Physical Layer Flow

• 1. INJECTION: The attacker transmits a high-frequency RF carrier wave (fc). Cables and traces draw in this energy like a receiving antenna. (RF Carrier [fc])

↓ Coupling on PCB Traces

• 2. NONLINEAR MODULATION: The nonlinear transfer characteristic inside the op-amp, ADC or MOSFET multiplies the fc and fs signals. (Intermodulation [fc ± fs])

↓ Up-conversion & Resonance

• 3. RE-RADIATION AND EMISSION: The modulated signal is scattered back into the air through the traces, which become efficient antennas at high frequency. (Backscatter)

↓ SDR Receiver & Spectrum Analyzer

• 4. DEMODULATION AND AI ENHANCEMENT (SGMSE): After AM demodulation, noise is cleaned up with a diffusion-based generative audio model and the audio is recovered. (Clear Audio & Data)

Stage 1: Injection

The attacker selects a resonance frequency suited to the target device's physical cable or trace lengths (usually in the hundreds of MHz or GHz band). Using a software-defined radio (SDR, for example USRP B210) and a directional antenna, a single-tone continuous RF carrier signal $x_{inj}(t) = A_c \cos(2\pi f_c t)$ is sent to the target. The target device's headphone cable or PCB traces act as an efficient receiving antenna at this frequency, drawing the RF energy into the device's internal circuits.

Stage 2: Hardware Nonlinearity and Modulation

Although in pure mathematical theory electronic components are assumed to be linear, in the physical world no semiconductor is perfectly linear. Headphone amplifiers (op-amps), analog-to-digital converters (ADCs), switched-mode power converters and MOSFETs inevitably have a nonlinear transfer characteristic:

$$y(t) = a_1 x(t) + a_2 x^2(t) + a_3 x^3(t) + \dots$$

The total input voltage in the circuit is the sum of the injected RF carrier and the low-frequency secret analog signal the device is currently processing (for example, the audio voltage going to the headphones, $x_s(t)$):

$$x(t) = x_{inj}(t) + x_s(t) = A_c \cos(2\pi f_c t) + s(t)$$

When the second-order square term ($a_2 x^2(t)$) is expanded, the cross product emerges:

$$x^2(t) = \dots + 2 A_c s(t) \cos(2\pi f_c t) + \dots$$

This mathematical fact means that the low-frequency secret $s(t)$ is directly up-converted onto the sidebands around the RF carrier frequency $f_c$ via amplitude modulation (AM). In other words, the high-frequency signal the attacker transmits from outside is itself modulated by the target's secret audio inside the victim's circuit components.

The researchers explain this situation in the paper with the following statements:

“The intuition is that the frequency of the secret signal and the device’s efficient EM emission frequency often face a mismatch… InjectEave follows an Injection-Modulation-Emission model. Injection: the carrier couples into the device’s unintentional antennas. Modulation: a nonlinear component mixes the secret with the carrier, up-converting it into sidebands at the carrier frequency. Emission: the device’s unintentional antennas re-radiate the modulated carrier back into the air.”

(Turkish Translation: “The basic intuition is this: the frequency of the secret signal and the device's efficient electromagnetic emission frequency often do not match… InjectEave follows an Injection-Modulation-Emission model. Injection: The carrier wave couples into the device's unintentional antennas. Modulation: A nonlinear component mixes the secret with the carrier, up-converting the secret into the sidebands of the carrier frequency. Emission: The device's unintentional antennas re-radiate the modulated carrier back into the air.”)

Stage 3: Emission and Backscatter (Emission)

The modulated signal is no longer at a low frequency but at a high RF frequency such as $f_c$. Since the device's cables and PCB traces turn into an efficient transmitting antenna at this frequency, it strongly scatters the signal back into the environment (backscatter re-radiation).

Stage 4: Reception and Clarification with Generative Artificial Intelligence

The attacker captures the sidebands at frequency $f_c$ using a directional receiving antenna and a spectrum analyzer (for example, Siglent SSA3075X Plus) and applies standard AM demodulation.

The returning audio will contain hardware distortions, intermodulation noise, and ambient interference. The researchers cleaned this signal with a diffusion-based SGMSE (Score-based Generative Model for Speech Enhancement) architecture, turning it into audio recordings that the human ear can understand and automatic speech recognition (ASR) systems can process.

3. Cybersecurity and Intelligence (SIGINT / TEMPEST / TSCM) Analysis

In terms of cybersecurity and technical intelligence doctrines, InjectEave has characteristics that overturn traditional threat modeling:

A. The Absolute Collapse of Digital Security Layers

InjectEave is a physical-layer attack completely independent of the operating system kernel, encryption algorithms, and network security protocols.

• Whether the communication is encrypted with Signal, TLS 1.3, or military encrypted radio protocols, by the time the data leaves the DAC (Digital-to-Analog Converter) chip and travels through the operational amplifier to the headphone speaker or handset, it is now an analog electrical current.
• Secure processor enclaves (Secure Enclave, TPM, ARM TrustZone) or virtualization barriers (Qubes OS, SE-Linux) cannot prevent voltage oscillations on the analog output line. The vulnerability is not in the software but in the physical nonlinearity of atoms and semiconductors.

B. The Nullification of TEMPEST Doctrine

Classical TEMPEST and TSCM (Technical Surveillance Counter-Measures) protocols are built on passive emission control. In crypto rooms or embassies (SCIF), passive spectrum scanners measure whether devices leak RF to the outside. A headphone or landline is completely silent when passive (zero emission). However, the moment InjectEave injects a radio wave into the target from outside, a device that meets passive shielding standards suddenly becomes an active radio transmitter. This reveals that even hardware that has passed passive listening tests with flying colors can be eavesdropped on with active radar/injection tactics.

C. Frequency and Spatial Target Selectivity (Selectivity)

When multiple people are sitting side by side in a room, the attacker's ability to isolate the desired target is critical for intelligence operations. Demo 10 in the paper clearly demonstrates this selectivity:

• Frequency Selectivity: Since the Philips TAH2020 and UGreen MAX2 headphones standing side by side have different internal impedance and filter structures, the attacker can instantly switch from one target to another simply by shifting the injection frequency by a few megahertz.
• Spatial Selectivity: Even when two headphones of exactly the same model are used, targets can be spatially separated from each other thanks to the narrow beam of the directional antenna (beamforming).

D. Robustness Against Ambient RF Interference (Robustness)

In Demo 9 of the article, testing was carried out in a meeting room with intense electromagnetic noise, containing Wi-Fi access points, Bluetooth (BLE) devices, and numerous running computers. The injected narrowband carrier signal was separated from the broadband digital noise floor and could be demodulated stably.

4. Main Use Cases and Attack Scenarios

The research paper shared field tests conducted on 11 different commercially available off-the-shelf (COTS) devices without any physical intervention:

1. Through-Wall Listening in Hotels and Meeting Rooms

The attacker positions themselves in the room adjacent to the target room. Despite the intervening 30 cm thick reinforced concrete wall, sounds playing in the victim's headphones or their conversations were listened to from a distance of 1 meter. The research team decrypted the target person's bank card PIN code ("9-5-2-7") and the transfer amount ("3,500 US dollars") with zero errors, even while listening to them whispered.

2. Long-Range Open-Area Espionage (Up to 30 Meters)

In an open area, an attacker setup concealed in bushes in a park or on a campus successfully captured audio data from wired and wireless headphones with the support of a low-cost commercial RF power amplifier, from 6 meters behind bushes and from a distance of 30 meters in a clear line of sight.

3. Extracting Context and Behavioral Profiles from Smart Home Devices (Behavioral Profiling)

Audio leakage is not the only threat. The low-frequency control and power signals of in-home Internet of Things (IoT) devices can also be leaked through the same mechanism:

• Smart Fans: By reading the frequency of PWM (Pulse Width Modulation) control signals through injection, the fan's speed level and whether it has switched to "Sleep Mode" were determined; thus it was confirmed that the target person was asleep.
• Smart Lighting: By remotely monitoring the power consumption depending on the lamp's brightness level, whether the user was in the room and whether they had switched to reading or resting mode was mapped as a behavioral profile.

4. Closed-Loop Conversation Manipulation (Closed-loop Eavesdrop-Synthesize-Inject)

One of the most striking scenarios in the article (Demo 7) is the closed-loop attack constructed over landline telephone lines:

1. Eavesdrop: The attacker listens to the analog conversation on the telephone line in real time with InjectEave.
2. Synthesize: When a critical moment of approval or an offer is caught in the conversation (for example, "Do you approve the price offer?"), advanced voice cloning models such as IndexTTS-2 instantly generate a fake approval sentence ("Yes, I approve") in the victim's own tone and timbre.
3. Inject: The generated fake audio signal is pushed onto the handset line via magnetic/RF injection and transmitted to the other party as if it had come out of the victim's mouth. This scenario is significant enough to sabotage high-level diplomatic or corporate telephone diplomacy.

5. How Can We Protect Ourselves? Defense and Countermeasure Strategies

Traditional software security patches are helpless against InjectEave. Defense must be constructed at the level of hardware architecture and radio frequency physics:

+-------------------------------------------------------------------------+
|                  İNJECTEAVE SAVUNMA VE SERTLEŞTİRME KATMANLARI          |
+-------------------------------------------------------------------------+
| 1. FİZİKSEL EKRANLAMA: Metal şasi, tam kapalı örgülü Faraday koruması   |
| 2. BÜKÜMLÜ ÇİFT (TWISTED-PAIR): Ortak modlu (common-mode) RF iptali     |
| 3. ANALOG RF FİLTRELEME: Op-amp ve ADC girişlerine ferrit boncuk & LC   |
| 4. TSCM & SPEKTRUM İZLEME: Ortamdaki şüpheli tek-tonlu RF sinyal tespiti|
+-------------------------------------------------------------------------+

A. Hardware Shielding

Headphone cables and in-device analog signal lines must be covered with high-density metal braid (braided shield) and foil. Shielding significantly attenuates the coupling of the external RF carrier wave into the internal conductor lines.

B. Twisted-Pair and Differential Signaling

Using differential twisted-pair lines instead of single-ended audio lines is of vital importance. The injected external RF wave will couple onto both twisted conductors in equal phase (common mode). When the differential receiver at the input takes the difference between the two lines ($V_+ - V_-$), the injected RF component mathematically cancels itself out.

C. Adding RF Attenuation Filters to Input/Output Lines

Right next to operational amplifiers, ADC chips, and headphone jacks:

• Ferrite Beads: By presenting high impedance to high-frequency RF currents, they convert RF energy into heat and attenuate it.
• Low-Pass Filters (Low-Pass LC/RC Filters): Capacitor and inductor arrays that drain all RF frequencies above 20 kHz directly to ground (GND) prevent the signal from reaching the semiconductor's non-linear region.

D. Electronic Countermeasures and TSCM Spectrum Monitoring

Corporate crisis centers and secure meeting rooms (SCIF) must have automated RF analysis sensors that continuously monitor the room's spectrum. The InjectEave attack typically emits a single narrowband, high-power RF carrier. A spectrum monitoring system that detects such unusual carrier signals can immediately raise an alarm and expose the attack.

E. The Asymmetric Limits of Defense

As the research team states in the FAQ section:

“InjectEave is immune to digital defenses such as encryption, masking, and randomization, because the leakage comes from the analog path. Hardware-aware mitigations such as twisted-pair wiring, shielding, and filtering can lower the energy that the injected carrier couples into the device, reducing the exposure. These mitigations raise the bar, but they do not guarantee immunity. Since injection-induced leakage grows with the injected power, a well-resourced adversary can often overcome them by transmitting at higher power.”

(Turkish Translation: “InjectEave is immune to digital defenses such as encryption, masking, and randomization, because the leakage comes from the analog path. Hardware-aware mitigations such as twisted-pair wiring, shielding, and filtering can lower the energy that the injected carrier couples into the device, reducing the exposure. These mitigations raise the bar, but they do not guarantee immunity. Since injection-induced leakage grows with the injected power, a well-resourced adversary can often overcome them by transmitting at higher power.”)

My reading

InjectEave delivers a very clear warning to the cybersecurity world: the strong encryption we build in the digital world can suddenly collapse at the analog boundaries where data touches the physical world.

Non-linearity in hardware components is a consequence of the laws of physics and cannot be completely eliminated from modern semiconductors. Combining active electromagnetic injection with this weakness has opened the door to a new era in TEMPEST and signals intelligence. Security architects who want to protect corporate data privacy and state-level communications cannot limit their defense strategies to software patches and VPN tunnels alone. Real security requires a holistic physical hardware awareness extending from circuit board design to cable winding geometry and RF spectrum sentinels.

References

1. Yan, H., Shao, Z., Zhang, S., Jiang, Q., & Long, Y. (2026). Injected and Leaked: Actively Inducing Side-Channel Leakage Using Electromagnetic Injection and Hardware Nonlinearity. Proceedings of the 35th USENIX Security Symposium (USENIX Security ’26), pp. 2485–2504.
2. arXiv Preprint Archive: arXiv:2609.04785v1 [cs.CR]
3. InjectEave Official Research Portal: https://injecteave.github.io/
4. Research Artifact and SGMSE Codebase: Zenodo Record (DOI: 10.5281/zenodo.18500378)