DivNet Creates Trillions of AI Variants to Counter Mass Voice Assistant Attacks

George Mason University researchers have introduced DivNet, a technique designed to make adversarial audio attacks against voice assistants more difficult without adding noticeable processing delays or requiring costly retraining of underlying AI models. The work was presented this summer at the 2026 ACM International Conference on Mobile Systems, Applications, and Services, or MobiSys, in Cambridge, England, by computer science associate professor Qiang Zeng and Ph.D. student Ying Meng. The research addresses a stealthy security threat in which malicious audio embedded in ordinary sounds, such as advertisements or music, instructs smart assistants to perform sensitive actions. Human users may hear only a harmless recording, while the assistant interprets hidden commands that could trigger actions such as unlocking smart locks or initiating financial transfers. DivNet targets a major weakness in current deployments: manufacturers often install identical AI models across millions of devices. That uniformity allows attackers who discover a successful malicious audio file to potentially reuse it against many devices. The researchers compare this to distributing the same lock across an entire neighborhood, making one compromised key enough to unlock many homes. To reduce that risk, DivNet creates many slightly different versions of the same speech-recognition model. It examines the millions of numerical parameters, or weights, used by neural networks and identifies values that have limited impact on accurate recognition of normal speech but play a larger role in successful adversarial attacks. By modifying different combinations of those less critical weights, the system produces numerous variants that preserve everyday performance while responding differently to malicious audio. Tests on established speech-recognition systems showed that the approach substantially reduced attack success with minimal loss in normal recognition accuracy. DivNet also generates new variants within milliseconds after an initial analysis and adds no runtime delay during speech recognition. The researchers say the number of possible variants is so large that a single device could periodically switch among them, making attacks harder to develop, test, and reuse. Beyond security, the team highlights cost as a key practical advantage. Retraining AI systems can require expensive GPU resources, while DivNet appears to provide broader model diversity without full retraining. The researchers have created a project website with demonstrations and technical information, including audio examples showing how the same malicious recording can produce different results on different model variants. Zeng said the team is pursuing patents and believes the method could attract interest from major technology companies.