arXiv subjects

Junfeng Cai

Publications and source records attributed to Junfeng Cai.

3 recordsLinked to original sources

arXiv2026

Et Tu, MacBook? Unprivileged Keystroke Inference and Context Profiling via the Built-in IMU Side Channel

Recent generations of Apple MacBooks embed an inertial measurement unit (IMU) within their unibody chassis for device orientation and motion sensing. However, this IMU inadvertently captures not only intended device-level information but also subtle physical vibrations from user interactions and the surrounding environment. These signals establish a novel, previously unexplored side channel. We uncover a vulnerability allowing non-root access to IMU data via an IOKit driver, alongside two content-free system metadata interfaces (HIDIdleTime and CGEventSource) that further enrich the side-channel leakage. Through rigorous characterization of the IMU data, we reveal that the leakage spans three core dimensions: (1) keystroke identity (which key is typed), (2) desk surface (where the laptop is placed), and (3) user behavior (who is typing). Leveraging these findings, we introduce BRUTUS, the first comprehensive unprivileged side-channel attack targeting built-in IMU sensors on Apple MacBooks. BRUTUS achieves a character-level accuracy of 89.1% to 97.5% in key recovery. Furthermore, aided by language models, it can successfully reconstruct certain sentences with 100% accuracy. For user identification and environment profiling, BRUTUS correctly discovers user and environment profiles without labels and correctly assigns subsequent segments to their corresponding profiles. Ultimately, this work highlights the urgent necessity of strictly regulating access to built-in IMU sensors.

cs.CR↗

arXiv2025

An Active Fault-Tolerant Online Control Allocation Scheme for a Dual-System UAV in Transition Flight

A novel active fault-tolerant control (AFTC) scheme for a dual-system vertical takeoff and landing (VTOL) unmanned aerial vehicle (UAV) during transition flight is proposed in this paper. The AFTC scheme is composed of a baseline control law and an online control reallocation module. First, the structured $H_{\infty}$ baseline control law is able to guarantee the stability of closed-loop systems without being reconfigured under simultaneous actuator fault conditions. Second, compared to the existing mainstream method of sliding mode control that is a discontinuous control strategy, the AFTC scheme can effectively avoid control chattering problem by adopting the structured $H_{\infty}$ baseline control law. Third, an online control allocation (CA) module is implemented to carry out a unified CA for all the available actuators. When actuator faults/failures occur, the CA matrix is updated according to fault information and real-time airspeed, which is able to redistribute the virtual control signals to the remaining healthy actuators, avoiding significant performance degradation. Based on the developed AFTC scheme, symmetric and non-symmetric actuator fault scenarios are simulated on a nonlinear six-degree-of-freedom simulator, where the cases of merely structured $H_{\infty}$ control and structured $H_{\infty}$ based AFTC are compared and analyzed. The results show that the proposed structured $H_{\infty}$ based AFTC system is capable of handling more complicated fault scenarios and model uncertainties with no need to reconfigure the baseline control law. The proposed AFTC scheme significantly improves the safety and reliability of the transition flight of dual-system VTOL UAVs.

eess.SY↗

arXiv2025

Gain-Scheduled Passive Fault-Tolerant Control Design for Dual-System UAV Transition Flight

Dual-system UAVs with vertical take-off and landing capabilities have become increasingly popular in recent years. As a safety-critical system, it is important that a dual-system UAV can maintain safe flight after faults/failures occur. This paper proposes a gain-scheduled passive fault-tolerant control (PFTC) method for the transition flight of dual-system UAVs. In this novel FTC design method, the model uncertainties arising from the loss of control effectiveness caused by actuator faults/failures, for the first time, are treated as model input uncertainty, allowing us to use multiplicative uncertainty descriptions to represent it. The advantages of the proposed method consist in significantly reducing the number of design points, thereby simplifying the control synthesis process and improving the efficiency of designing the FTC system for dual-system UAV transition flight compared with the existing FTC design methods. As a general method, it can be applied to the design of FTC systems with multiple uncertain parameters and multiple channels. The developed passive FTC system is validated on a nonlinear six-degree-of-freedom simulator. The simulation results demonstrate that the gain-scheduled structured H infinity (GS SHIF) PFTC system provides superior fault tolerance performance compared with the LQR and structured H infinity control systems, thereby showcasing the effectiveness and the advantages of the proposed GS SHIF PFTC approach.

eess.SY↗