Your Keyboard Sounds Like a Password: Acoustic Eavesdropping Goes Cross-Device and Cross-Environment

Acoustic side-channel attacks on keyboards escape the lab. Domain-invariant models + LLM error correction let commodity mics recover typed text across unseen keyboards, noisy rooms, and compressed channels.

You know how your phone's autocorrect can reconstruct what you meant to type even when you fat-finger half the letters? It works because the language model knows 'teh' almost certainly means 'the' — the correction layer sits on top of a noisy input channel and cleans up the mess. This paper does the same thing, except the noisy input channel is the sound your keyboard makes, and the correction layer is GPT-4. The committed claim: acoustic side-channel attacks on keyboards, previously demonstrated only under lab conditions (same keyboard for train and test, quiet room, fixed mic), now survive the open world — unseen keyboards, diverse typists, ambient noise, and compressed audio channels like Zoom calls. The mechanism is a two-stage pipeline: first, a domain-invariant acoustic classifier extracts keystroke features that generalize across devices and environments; second, a large language model corrects the noisy character-level predictions into coherent text. The paper argues that this combination is what prior work was missing — raw acoustic models overfit to a specific keyboard's sound signature, but domain adaptation techniques (the paper uses domain-adversarial training) force the model to learn features that transfer, and the LLM mops up the remaining errors. Where does this sit on the ladder? Prior acoustic side-channel work — notably Harrison et al. (2023) and Compagno et al. — achieved high accuracy (90%+) but under closed-world assumptions: train and test on the same keyboard, same environment, same user. The security-relevant question was always whether these attacks generalize. This paper directly addresses that gap. It doesn't claim to beat prior top-line accuracy numbers under ideal conditions; it claims to maintain useful accuracy under conditions where prior systems collapse. That's the right framing — the contribution is robustness, not peak performance. Architecturally, this is a domain-adversarial neural network (DANN family, after Ganin et al.) applied to mel-spectrogram keystroke features, with a frozen or API-accessed LLM as a post-processing decoder. The acoustic model learns representations that are discriminative for keystrokes but invariant to the source domain (keyboard model, room acoustics, microphone). The LLM stage is not fine-tuned — it's used as a spelling and grammar corrector on the noisy character stream, which is clever because it avoids training a custom language model and leverages the enormous implicit vocabulary of GPT-4. Integrity is the soft spot. The abstract describes the problem space compellingly but the source content is an abstract only — we cannot verify benchmark specifics, dataset composition, exact accuracy numbers, or whether baselines were chosen fairly. The cross-domain claim is the load-bearing wall, and we need to see the actual experimental matrix: how many source/target keyboard pairs, what SNR levels for noise, what compression codecs, what user diversity. Without those numbers, the claim is a promissory note. The milestone that matters for security practitioners: if cross-domain keystroke inference can reliably exceed ~85% character accuracy on compressed VoIP audio (Zoom, Teams) with LLM correction, then acoustic side-channel attacks become a real-world threat model, not a lab curiosity. The gap between 'works in a demo' and 'works over a Zoom call in a coffee shop' is the entire security relevance of the field. This paper claims to narrow that gap substantially. The obvious next experiment not run: a fully adversarial deployment — attack a user who is actively typing on an unknown keyboard model, in an uncontrolled environment, over a real (not simulated) Zoom call, with the attacker having zero prior samples of that keyboard. If the authors didn't run this end-to-end red-team scenario, the most likely reason is (a) — the logistical complexity of collecting ground-truth typed text from a realistic eavesdropping scenario is genuinely hard. But it's also possible (b) applies: real-world Zoom compression may degrade keystroke features below the threshold where the acoustic model is useful, and the LLM correction can't bridge that gap alone.