EchoGuard

Continuous ultrasound-based human presence verification for AI agent detection. Using only a device's built-in speaker and microphone to emit inaudible ultrasound probes, EchoGuard analyzes reflected acoustic responses to distinguish real users from automated agents in real time.

Agent Detection Continuous Verification Ultrasound Sensing Privacy-Preserving
Project Overview

Why EchoGuard?

AI agents can now mimic legitimate user behavior at scale — completing transactions, scraping data, and abusing promotions while appearing human. Existing defenses like CAPTCHAs are one-time checks that leave a critical gap after authentication. EchoGuard fills this gap with continuous, real-time human-presence verification.

1

Emit Ultrasound Challenge

The browser emits inaudible ultrasound (18–24 kHz) via the device speaker. An invisible acoustic liveness module runs continuously.

2

Receive Acoustic Response

The microphone records reflections from the user's body and surroundings. Human micro-movements produce rich, time-varying signatures.

3

Detect Agent vs. Human

Real humans generate dynamic, fluctuating reflections. Agents produce weak, static responses — enabling clear discrimination.

EchoGuard deployment scenario
Signal Processing

Transmit & Processing Pipeline

EchoGuard uses an FMCW sensing pipeline to transform raw ultrasonic reflections into amplitude-phase trajectories that reveal human presence.

  • FMCW Chirp Transmission Emits inaudible FMCW chirps sweeping 20–24 kHz via built-in speaker.
  • Bandpass Filtering RX is filtered to the chirp band, suppressing audible speech and retaining ultrasonic reflections.
  • TX–RX Cross-Correlation Cross-correlate RX with known TX chirp to find alignment peak and synchronize the stream.
  • Hilbert Transform Convert synchronized RX into an analytic signal to preserve phase-sensitive motion information.
  • Chirp Segmentation & Range Matching Segment into chirp periods; correlate delayed TX references at candidate distances with RX.
  • Amplitude–Phase Extraction Extract amplitude and phase per chirp interval, forming trajectories that distinguish human from agent.
Transmitted FMCW signal spectrogram

Transmitted FMCW Signal. Spectrogram of the 20–24 kHz sweep; chirps repeat at ~10 ms intervals.

Transmitted waveform

Transmitted Waveform. Time-domain view of the FMCW chirp signal.

Preliminary Results

Scenario Results

We evaluate EchoGuard under multiple scenarios — from baseline agent-only settings to adaptive attacks where a human is present alongside the agent to confound detection.

Setup

Recording Setup

Single-session protocol on a commodity laptop. First 5 s idle, then agent (OpenClaw) types "John Smith" with 1 s gaps J→o→h→n→ →S→m→i→t→h, followed by 5 s idle, then a human types the same string for direct comparison.

Baseline

Scenario 1: Agent vs. Real Human Typing

Agent (OpenClaw) types "John Smith" (red markers) producing flat amplitude. Human types the same string (blue markers) with rich, dynamic fluctuations from natural hand and body micro-movements.

Agent vs Real Human comparison
Control

Scenario 2: Agent Only — No Human

The agent (OpenClaw) operates the device with no human nearby. Ultrasound amplitude stays flat — agent keystrokes (red) produce no perceptible change, confirming software-only interaction lacks physical signatures.

Agent only, no human present
Adaptive Attack

Scenario 3: Agent + Human Still

Human sits still while agent types. Subtle ripple patterns from involuntary micro-movements (breathing, posture) are detectable and distinct from agent-only baseline.

Agent with human sitting still
Adaptive Attack

Scenario 4: Agent + Human Moving

Human moves around the laptop during agent typing. Movement introduces amplitude spikes that test separation of motion artifacts from genuine interaction.

Agent with human moving around
Adaptive Attack

Scenario 5: Agent + Human Gestures

Periodic hand gestures near the laptop during agent typing produce large, intermittent amplitude excursions — clearly distinguishable from flat agent traces.

Agent with human making gestures
Research Team

Investigators

HG

Hanqing Guo

PI — Indiana University Bloomington

Assistant Professor, CS. Expert in AI security, web-agent threats, and acoustic sensing. Best Paper at SenSys '21, Honorable Mention at CCS '22. Former Amazon Applied Scientist.

DL

Dong Li

Co-PI — Univ. of Maryland, Baltimore County

Assistant Professor, CSEE. Smartphone acoustic sensing, gesture tracking, Doppler-based mobile sensing. 2025 Google Research Scholar Award.

Acknowledgments

Contributing Students

Dharani Nadendla
UMBC
Yizhu Wen
University of Hawaii
Shirui Cao
UMass
Renzhi Hao
Bloomberg Inc.