arXiv Science⌕ Search
Home/Archive/arXiv

arXiv · 2610.08868

Visible-Spectrum Optical Covert Channels in Commodity Smart Lighting

David Noever
View original source ↗Read source document ↗Export metadata ↓

Abstract

Smart light-emitting diode (LED) bulbs are networked devices that produce information-carrying output. This study asks whether that light can carry digital data through changes small enough to be difficult for a person in the room to notice. To explore this covert communication channel, we tested an unmodified smart bulb (Philips WiZ A19) using a camera as the receiver. Binary data were encoded programmatically in nearly matched color and brightness changes. Because the differences were deliberately small across 16 million color steps, the receiver periodically measured known reference states and used them to compensate for changes in the camera and background room illumination. The color method successfully transmitted the short message 'hi' using a color difference (E) of 0.5, a standard measure of perceptual color distance. The receiver recovered 99% of the transmitted bits, and the complete message passed an integrity check. The brightness method remained decodable at the smallest nonzero integer difference tested, alternating between dimming settings 56 and 54, with 96.2% mean bit accuracy across two runs. When both binary symbols were assigned to the same brightness in a control experiment, accuracy fell to approximately chance. These results show that the visible output of an ordinary smart bulb can serve as a low-rate data channel without hardware modification. Camera color drift can overwhelm small signals unless the receiver is recalibrated during transmission, sudden changes in ambient light can disrupt decoding, and longer messages require stronger error correction. The color experiment operated at a difference below a conventional threshold for human color discrimination. The corresponding perceptual limit for the brightness method has not yet been established experimentally.

Explore related subjects

cs.CR

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

David Noever. 2026-10-06. Visible-Spectrum Optical Covert Channels in Commodity Smart Lighting. https://arxiv.org/abs/2610.08868

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

NeuPerm: Disrupting Malware Hidden in Neural Network Parameters by Leveraging Permutation Symmetry

Pretrained deep learning model sharing holds tremendous value for researchers and enterprises alike. It allows them to apply deep learning by fine-tuning models at a fraction of the cost of training a brand-new model. However, model sharing exposes end-users to cyber threats that leverage the models for malicious purposes. Attackers can use model sharing by hiding self-executing malware inside neural network parameters and then distributing them for unsuspecting users to unknowingly directly execute them, or indirectly as a dependency in another software. In this work, we propose NeuPerm, a simple yet effec- tive way of disrupting such malware by leveraging the theoretical property of neural network permutation symmetry. Our method has little to no effect on model performance at all, and we empirically show it successfully disrupts state-of-the-art attacks that were only previously addressed using quantization, a highly complex process. NeuPerm is shown to work on LLMs, a feat that no other previous similar works have achieved. The source code is available at https://github.com/danigil/NeuPerm.git.

cs.CR↗
arXiv2026

Did You Forkget It? Detecting One-Day Vulnerabilities in Open-source ForksWith Global History Analysis

Tracking vulnerabilities inherited from third-party open-source software is a well-known challenge, often addressed by tracing the threads of dependency information. However, vulnerabilities can also propagate through forking: a code repository forked after the introduction of a vulnerability, but before it is patched, may remain vulnerable long after the vulnerability has been fixed in the initial repository. History analysis approaches are used to track vulnerable software versions at scale. However, such approaches fail to track vulnerabilities in forks, leaving fork maintainers to identify them manually. This paper presents a global history analysis approach to help software developers identify one-day (known but unpatched) vulnerabilities in forked repositories. Leveraging the global graph of public code, as captured by the Software Heritage archive, our approach propagates vulnerability information at the commit level and performs automated impact analysis. Starting from 7162 repositories with vulnerable commits listed in OSV, we propagate vulnerability information to 2.2 million forks. We evaluate our approach by filtering forks with significant user bases whose latest commit is still potentially vulnerable, manually auditing the code, and contacting maintainers for confirmation and responsible disclosure. This process identified 135 high-severity one-day vulnerabilities, achieving a precision of 0.69, with 9 confirmed by maintainers.

cs.CR↗
arXiv2026

The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Search

Large language models (LLMs) remain vulnerable to jailbreak attacks that bypass safety guardrails to elicit harmful outputs. Existing approaches overwhelmingly operate within the prompt-optimization paradigm: whether through traditional algorithmic search or recent agent-based workflows, the resulting prompts typically retain malicious semantic signals that modern guardrails are primed to detect. In contrast, we identify a deeper, largely overlooked vulnerability stemming from the highly interconnected nature of an LLM's internal knowledge. This structure allows harmful objectives to be realized by weaving together sequences of benign sub-queries, each of which individually evades detection. To exploit this loophole, we introduce the Correlated Knowledge Attack Agent (CKA-Agent), a dynamic framework that reframes jailbreaking as an adaptive, tree-structured exploration of the target model's knowledge base. The CKA-Agent issues locally innocuous queries, uses model responses to guide exploration across multiple paths, and ultimately assembles the aggregated information to achieve the original harmful objective. Evaluated across state-of-the-art commercial LLMs (Gemini2.5-Flash/Pro, GPT-oss-120B, Claude-Haiku-4.5), CKA-Agent consistently achieves over 95% success rates even against strong guardrails, underscoring the severity of this vulnerability and the urgent need for defenses against such knowledge-decomposition attacks. Our codes are available at https://github.com/Graph-COM/CKA-Agent.

cs.CR↗