Injected and Leaked: Actively Inducing Side-Channel Leakage Using Electromagnetic Injection and Hardware Nonlinearity

This paper introduces Injection-Induced EM Side Channels, a threat model in which an attacker injects a radio-frequency carrier and exploits nonlinear hardware—amplifiers, analog-to-digital converters, switching MOSFETs, and power converters—to modulate otherwise difficult-to-leak low-frequency analog secrets onto measurable electromagnetic emissions. The resulting InjectEave system combines a USRP B210, directional antennas, spectrum analysis, and the score-based generative speech-enhancement model SGMSE, trained with synthetic distortions derived from LibriSpeech. Testing across 11 commercial devices, including Sony and Apple headphones, Xiaomi smart appliances, and a Flyingvoice landline, recovered audio, fan activity, lamp brightness, and power-consumption patterns, including through walls. With higher-power equipment, intelligible headphone speech was recovered at 30 m. On UGreen MAX2 headphones, SGMSE increased average SNR from 7.0 dB to 16.1 dB and improved STOI from 0.58 to 0.72, suppressing nonlinear harmonics and carrier noise. The study also demonstrates a closed-loop attack that eavesdrops on a landline conversation, synthesizes a context-aware response with IndexTTS-2, and injects it back into the call. As a mitigation, replacing parallel wiring with twisted-pair wiring reduced leakage SNR by 10.7 dB, although the authors argue that robust protection requires electromagnetic hardening, active carrier detection, and analog-interface security co-design.