Watch the Rhythm: Breaking Privacy with Accelerometer at the Extremely-Low Sampling Rate of 5Hz

Considering the threat from on-board eavesdropping with smartphone motion sensors, Android 12 has limited the maximum sampling rate of motion sensors to 200Hz for zero-privilege access to prevent potential wiretapping. Unfortunately, there have been some attacks targeting 200Hz, making it not a safe sampling rate any more. Smartphone manufacturers may further reduce the maximum sampling rate of the accelerometer in response to this privacy concern. It can be expected that, the maximum sampling rate will gradually decrease to a very low level, as the battle between manufacturers and adversaries continues. Existing on-board eavesdropping approaches, utilizing spectral features, cannot provide acceptable accuracy at very low sampling rates, not even at 50Hz.

Therefore, this paper explores the feasibility of using the on-board accelerometer for privacy breaking with an extremely-low sampling rate, specifically, 5Hz. 5Hz is a minimum sampling rate to meet normal use, otherwise the applications can only choose to work without the accelerometer. Since the lowest fundamental frequency for humans is around 85Hz, such a low sampling rate poses a significant challenge for sound recognition. According to Nyquist's law, it seems impossible to capture 85Hz with the sampling rate of 5Hz. Fortunately, we observe that the rhythm features, including pause rhythm and intensity rhythm, of accelerometer data are relatively stable at various sampling rates. On this basis, we propose an eavesdropping approach with the accelerometer at an extremely-low sampling rate. Introducing the rhythm features, we achieve an accuracy of 95.09% at 50Hz and 78.66% at 5Hz for scene recognition. The accuracy is 90.60% at 50Hz and 47% at 5Hz for Chinese digits recognition, plus 96.63% at 50Hz and 58.67% at 5Hz for popular Chinese cities recognition. Furthermore, we achieve determination for typical places like bar, metro, bus, car, and quiet room, by analyzing the vibration of surroundings, with an average accuracy of 91.28%. Combining place determination with eavesdropping, our approach poses a serious threat to personal privacy. Since 5Hz is generally used for screen orientation detection, our attack can hide in any kind of application, not just in game or sport applications. We also suggest some countermeasures.