From da8d7ef081dfcc1dd63f2b6a22164db5a6361eb5 Mon Sep 17 00:00:00 2001 From: arjunastha Date: Mon, 27 Apr 2026 11:33:39 -0700 Subject: [PATCH] feat: upgrade SAFE-UC-0010 (In-vehicle voice assistant for local controls) from seed to full draft Promotes SAFE-UC-0010 from seed stub to full draft using the SAFE-AUCA template. 8-stage cyber-physical kill chain with 7 stages flagged NOVEL versus the merged-cohort siblings (SAFE-UC-0006 telematics, SAFE-UC-0007 mobile fleet maintenance, SAFE-UC-0008 OTA). 19 SAFE-MCP techniques mapped across 8 stages with explicit framework-gap notes on physical-side-channel acoustic injection (DolphinAttack, Light Commands, NUIT), broadcast-media wake-word false-trigger (Burger King 2017 pattern), in-cabin identity hexangle, and child-occupant axis. Section 1 explicitly notes the absence of a finalized NHTSA Phase 3 voice-HMI rule and cites NHTSA Phase 1 (2013) plus Auto Innovators 2006 guidelines as the operative cross-references. 6-subsection Appendix B. Crosswalk JSON updated (status seed to draft, maturity draft, 4 NAICS codes, workflow_family in-cabin voice-assistant operations, 20 tags, 15 evidence items). Root README index status updated from Seed to Draft. Signed-off-by: arjunastha --- README.md | 2 +- use-cases.naics2022.crosswalk.json | 107 ++++- use-cases/SAFE-UC-0010/README.md | 662 ++++++++++++++++++++++++++++- 3 files changed, 749 insertions(+), 22 deletions(-) diff --git a/README.md b/README.md index b0867e5..471244e 100644 --- a/README.md +++ b/README.md @@ -81,7 +81,7 @@ Quick contributor workflow: | [SAFE-UC-0007](use-cases/SAFE-UC-0007/) | Mobile fleet-maintenance dispatch & scheduling assistant | [Other Services (except Public Administration) (81)][naics-81] | Seed | | [SAFE-UC-0008](use-cases/SAFE-UC-0008/) | Over-the-air vehicle software update orchestration | [Manufacturing (31–33)][naics-31-33] | Draft | | [SAFE-UC-0009](use-cases/SAFE-UC-0009/) | Manufacturing line visual inspection assistant | [Manufacturing (31–33)][naics-31-33] | Seed | -| [SAFE-UC-0010](use-cases/SAFE-UC-0010/) | In-vehicle voice assistant for local controls | [Manufacturing (31–33)][naics-31-33] | Seed | +| [SAFE-UC-0010](use-cases/SAFE-UC-0010/) | In-vehicle voice assistant for local controls | [Manufacturing (31–33)][naics-31-33] | Draft | | [SAFE-UC-0011](use-cases/SAFE-UC-0011/) | Banking virtual assistant | [Finance and Insurance (52)][naics-52] | Draft | | [SAFE-UC-0012](use-cases/SAFE-UC-0012/) | Interactive fraud alert & card controls assistant | [Finance and Insurance (52)][naics-52] | Seed | | [SAFE-UC-0013](use-cases/SAFE-UC-0013/) | Virtual card number generation & checkout assistant | [Finance and Insurance (52)][naics-52] | Seed | diff --git a/use-cases.naics2022.crosswalk.json b/use-cases.naics2022.crosswalk.json index 6a1651f..c12ad68 100644 --- a/use-cases.naics2022.crosswalk.json +++ b/use-cases.naics2022.crosswalk.json @@ -261,15 +261,118 @@ { "id": "SAFE-UC-0010", "title": "In-vehicle voice assistant for local controls", - "status": "seed", + "status": "draft", + "maturity": "draft", "repo_path": "use-cases/SAFE-UC-0010/README.md", "naics_2022": [ { "code": "31-33", "name": "Manufacturing" + }, + { + "code": "3361", + "name": "Motor Vehicle Manufacturing" + }, + { + "code": "3363", + "name": "Motor Vehicle Parts Manufacturing" + }, + { + "code": "5132", + "name": "Software Publishers" } ], - "summary": "In-vehicle voice agent for local controls (HVAC, media, navigation settings) with strict safety and permission boundaries." + "summary": "AI-assisted in-cabin voice assistant that interprets occupant speech, resolves natural-language intent, and actuates non-safety-critical local controls (HVAC, media, navigation, communications, comfort, voice-driven driver-assistance configuration). Sits in the cabin during operation with eyes-on-road and hands-on-wheel as the operating envelope. Cyber-physical sibling of SAFE-UC-0006 (telematics, read-side), SAFE-UC-0007 (mobile fleet maintenance, human-action), and SAFE-UC-0008 (OTA, firmware-action). Distinct surfaces: physical-side-channel acoustic injection (DolphinAttack, Light Commands, NUIT), broadcast-media wake-word false-trigger (Burger King 2017 pattern), in-cabin identity hexangle (6+ occupants), child-occupant axis, voiceprint biometric persistence (BIPA, federal Wiretap Act), voice-to-OTA bridge into SAFE-UC-0008, and the absence of a finalized NHTSA Phase 3 voice-HMI rule.", + "workflow_family": "In-cabin voice-assistant operations", + "operating_modes": [ + "manual", + "hitl", + "autonomous" + ], + "tags": [ + "voice-assistant", + "in-cabin", + "vehicle", + "cyber-physical", + "asr", + "wake-word", + "voiceprint", + "biometric", + "bipa", + "cpra", + "wiretap-act", + "nhtsa-phase-1", + "aaa-foundation-phase-ii", + "auto-innovators-guidelines", + "un-r116", + "un-r155", + "un-r156", + "iso-21434", + "iso-26262", + "eu-ai-act-article-50" + ], + "evidence": [ + { + "label": "Cerence Inc. (more than 525 million vehicles equipped with Cerence speech across 17 OEM customers; 12 OEMs explicitly named at IAA Mobility 2025: BYD, BMW, Ford, Genesis, Hyundai, Leapmotor, Lucid, Mini, Opel, Polestar, Togg, XPENG)", + "url": "https://www.cerence.com/" + }, + { + "label": "Mercedes-Benz USA: Human-like conversations with your Mercedes-Benz enabled by MBUX Voice Assistant and AI-driven knowledge feature (December 17, 2024; cumulative 3 million vehicles equipped with MBUX Voice Assistant)", + "url": "https://media.mbusa.com/releases/human-like-conversations-with-your-mercedes-benz-enabled-by-mbux-voice-assistant-and-ai-driven-knowledge-feature" + }, + { + "label": "BMW Group: BMW iX3 first to integrate Amazon Alexa+ as a Custom Assistant (CES 2026 announcement; rollout begins H2 2026)", + "url": "https://www.bmwgroup.com/en/news/general/2026/ces-2026-bmw-alexa-plus.html" + }, + { + "label": "DolphinAttack: Inaudible Voice Commands (Zhang et al., ACM CCS 2017; demonstrated on Audi Q3 navigation among 16 voice systems)", + "url": "https://acmccs.github.io/papers/p103-zhangAemb.pdf" + }, + { + "label": "Light Commands: Laser-Based Audio Injection Attacks on Voice-Controllable Systems (Sugawara, Cyr, Genkin, Kohno, Fu; USENIX Security 2020; 110 m attack range; vehicle-unlock demonstration)", + "url": "https://lightcommands.com/" + }, + { + "label": "NUIT: Near-Ultrasound Inaudible Trojan attacks on voice assistants (Xia et al., USENIX Security 2023; 16 kHz minimum carrier, 16 to 22 kHz range; less than 77 ms attack latency)", + "url": "https://www.usenix.org/conference/usenixsecurity23/presentation/xia" + }, + { + "label": "Garner v. Amazon.com (W.D. Wash.; class certification granted by Judge Lasnik on July 7, 2025; two classes certified for federal Wiretap Act and Washington Privacy Act claims over Alexa voice recordings)", + "url": "https://www.classaction.org/news/judge-grants-class-certification-in-amazon-alexa-privacy-lawsuit" + }, + { + "label": "Burger King: OK Google, what is the Whopper burger? television advertisement (April 2017; canonical broadcast-media wake-word activation precedent)", + "url": "https://www.theverge.com/2017/4/12/15259400/burger-king-tv-ad-google-home-wikipedia" + }, + { + "label": "AAA Foundation for Traffic Safety: Measuring Cognitive Distraction in the Automobile, Phase II, Assessing In-Vehicle Voice-Based Interactive Technologies (October 2014; Category 3 cognitive workload; four or five items menu cap)", + "url": "https://aaafoundation.org/measuring-cognitive-distraction-automobile-ii-assessing-vehicle-voice-based-interactive-technologies/" + }, + { + "label": "NHTSA Visual-Manual Driver Distraction Guidelines, Phase 1 (78 FR 24817, April 26, 2013; 2-second per-glance and 12-second total off-road-glance cap; Phase 3 voice rule announced as planned and not issued)", + "url": "https://www.federalregister.gov/documents/2013/04/26/2013-09883/visual-manual-nhtsa-driver-distraction-guidelines-for-in-vehicle-electronic-devices" + }, + { + "label": "Alliance of Automobile Manufacturers Driver Focus-Telematics Working Group, Statement of Principles, Criteria and Verification Procedures on Driver Interactions with Advanced In-Vehicle Information and Communication Systems (the de facto industry voice-HMI baseline since 2006)", + "url": "https://www.autoalliance.org/wp-content/uploads/2017/02/AAM-Guidelines-Version-3-2006.pdf" + }, + { + "label": "UN Regulation No. 116, Protection of motor vehicles against unauthorized use (UNECE WP.29; effective 10 February 2009)", + "url": "https://unece.org/sites/default/files/2022-08/R116e.pdf" + }, + { + "label": "California Privacy Rights Act of 2020, codified at Cal. Civ. Code 1798.100 et seq. (Office of the California Attorney General canonical reference)", + "url": "https://oag.ca.gov/privacy/ccpa" + }, + { + "label": "OWASP Top 10 for LLM Applications (2025)", + "url": "https://genai.owasp.org/llm-top-10/" + }, + { + "label": "NHTSA Cybersecurity Best Practices for the Safety of Modern Vehicles (September 2022)", + "url": "https://www.nhtsa.gov/document/cybersecurity-best-practices-safety-modern-vehicles-2022" + } + ] }, { "id": "SAFE-UC-0011", diff --git a/use-cases/SAFE-UC-0010/README.md b/use-cases/SAFE-UC-0010/README.md index 805596a..edfa40a 100644 --- a/use-cases/SAFE-UC-0010/README.md +++ b/use-cases/SAFE-UC-0010/README.md @@ -1,32 +1,656 @@ # In-vehicle voice assistant for local controls -> Seed page for **SAFE-AUCA**. Expand this into a full analysis using [`templates/use-case-template.md`](../../templates/use-case-template.md). +> **SAFE‑AUCA industry reference guide (draft)** +> +> This use case describes the workflow at the center of the modern connected-vehicle cabin: an AI-assisted voice assistant that interprets occupant speech, resolves intent against vehicle and cloud capabilities, and either reads back information or actuates non-safety-critical local controls (HVAC, media, navigation destination entry, comfort seats, ambient lighting, voice-driven driver-assistance settings). It is the **second SAFE-AUCA use case in NAICS 31-33 with a cyber-physical surface tied to a moving vehicle** and sits alongside SAFE-UC-0006 (fleet telematics, the read-side observation layer), SAFE-UC-0007 (mobile fleet maintenance, the human-action layer), and SAFE-UC-0008 (OTA software updates, the firmware-action layer). Together, the four trace a complete cyber-physical lifecycle for a connected vehicle: telematics observes, maintenance dispatches humans, OTA remediates firmware, and **the voice assistant is the in-cabin human-machine interface that sits closest to the driver during operation**. +> +> The defining characteristic of this workflow is that **the assistant is the only AI surface that operates while the vehicle is in motion, with the driver's eyes on the road and hands on the wheel**. Two NHTSA artifacts frame the regulatory shape. The 2013 Visual-Manual NHTSA Driver Distraction Guidelines (Phase 1, 78 Fed. Reg. 24818) establish a 2-second per-glance and 12-second total off-road-glance cap as the visual-manual safety envelope. The 2016 portable-and-aftermarket NPRM (Phase 2, 81 Fed. Reg. 87656) extended the visual-manual analysis to non-OEM devices but was never finalized. Phase 3 (auditory-vocal / voice) was announced as planned in the 2013 final guidance but **has not been issued**. There is no finalized federal voice-HMI standard. The de facto industry baseline is the Alliance of Automobile Manufacturers (now Auto Innovators) Driver Focus-Telematics Working Group Guidelines (2000 principles, 2006 guidelines). +> +> It focuses on: +> +> * how the workflow works in practice (tools, data, trust boundaries, autonomy) +> * what can go wrong (defender-friendly kill chain) +> * how it maps to **SAFE‑MCP techniques** +> * what controls + tests make it safer +> +> **Defender-friendly only:** do **not** include operational exploit steps, payloads, or step-by-step attack instructions. +> **No sensitive info:** do not include internal hostnames/endpoints, secrets, customer data, non-public incidents, or proprietary details. + +--- ## Metadata -| Field | Value | -|---|---| -| **SAFE Use Case ID** | `SAFE-UC-0010` | -| **Status** | `seed` | -| **NAICS 2022** | `Manufacturing (31-33)` | -| **Last updated** | `2026-02-17` | +| Field | Value | +| -------------------- | ------------------------------------------------------------------ | +| **SAFE Use Case ID** | `SAFE-UC-0010` | +| **Status** | `draft` | +| **Maturity** | draft | +| **NAICS 2022** | `31-33` (Manufacturing); `3361` (Motor Vehicle Manufacturing); `3363` (Motor Vehicle Parts Manufacturing); `5132` (Software Publishers) | +| **Last updated** | `2026-04-27` | + +### Evidence (public links) + +* [Cerence Inc. (the dominant in-vehicle voice platform; powers more than 525 million vehicles across 17 OEMs per company materials; 12 OEMs explicitly named at IAA Mobility 2025: BYD, BMW, Ford, Genesis, Hyundai, Leapmotor, Lucid, Mini, Opel, Polestar, Togg, XPENG)](https://www.cerence.com/) +* [Mercedes-Benz USA: Human-like conversations with your Mercedes-Benz enabled by MBUX Voice Assistant and AI-driven knowledge feature (December 17, 2024; cumulative 3 million vehicles equipped with MBUX Voice Assistant)](https://media.mbusa.com/releases/human-like-conversations-with-your-mercedes-benz-enabled-by-mbux-voice-assistant-and-ai-driven-knowledge-feature) +* [BMW Group: BMW iX3 first to integrate Amazon Alexa+ as a Custom Assistant (CES 2026 announcement; rollout begins H2 2026)](https://www.bmwgroup.com/en/news/general/2026/ces-2026-bmw-alexa-plus.html) +* [Smart Eye driver-monitoring announcement (24 OEMs, 372 production models, more than 3 million cars on the road as of 2025)](https://smarteye.se/news/smart-eye-named-2025-automotive-news-pace-award-finalist/) +* [DolphinAttack: Inaudible Voice Commands (Zhang et al., CCS 2017; demonstrated on Audi Q3 navigation among 16 voice systems)](https://acmccs.github.io/papers/p103-zhangAemb.pdf) +* [Light Commands: Laser-Based Audio Injection Attacks on Voice-Controllable Systems (Sugawara, Cyr, Genkin, Kohno, Fu; USENIX Security 2020; 110 m attack range; vehicle-unlock demonstration)](https://lightcommands.com/) +* [NUIT: Near-Ultrasound Inaudible Trojan attacks on voice assistants (Xia et al., USENIX Security 2023; 16 kHz minimum carrier, 16-22 kHz range; less than 77 ms attack latency)](https://www.usenix.org/conference/usenixsecurity23/presentation/xia) +* [Audio Adversarial Examples: Targeted Attacks on Speech-to-Text (Carlini and Wagner, IEEE S&P Workshops 2018)](https://arxiv.org/abs/1801.01944) +* [Garner v. Amazon.com (W.D. Wash.; class certification granted by Judge Lasnik, July 7, 2025; two classes certified for federal Wiretap Act and Washington Privacy Act claims over Alexa voice recordings)](https://www.classaction.org/news/judge-grants-class-certification-in-amazon-alexa-privacy-lawsuit) +* [Burger King: "OK Google, what is the Whopper burger?" television advertisement (April 2017; canonical broadcast-media wake-word activation precedent)](https://www.theverge.com/2017/4/12/15259400/burger-king-tv-ad-google-home-wikipedia) +* [AAA Foundation for Traffic Safety: Measuring Cognitive Distraction in the Automobile, Phase II, Assessing In-Vehicle Voice-Based Interactive Technologies (Strayer, Cooper, et al., October 2014; Category 3 cognitive workload; menu cap of "four or five items")](https://aaafoundation.org/measuring-cognitive-distraction-automobile-ii-assessing-vehicle-voice-based-interactive-technologies/) +* [NHTSA Visual-Manual Driver Distraction Guidelines, Phase 1 (Federal Register, 78 FR 24817, April 26, 2013; 2-second per-glance and 12-second total off-road-glance cap; Phase 3 voice rule was announced as planned and has not been issued)](https://www.federalregister.gov/documents/2013/04/26/2013-09883/visual-manual-nhtsa-driver-distraction-guidelines-for-in-vehicle-electronic-devices) +* [Alliance of Automobile Manufacturers Driver Focus-Telematics Working Group, Statement of Principles, Criteria and Verification Procedures on Driver Interactions with Advanced In-Vehicle Information and Communication Systems (the de facto industry voice-HMI baseline since 2006)](https://www.autoalliance.org/wp-content/uploads/2017/02/AAM-Guidelines-Version-3-2006.pdf) +* [UN Regulation No. 116, Uniform technical prescriptions concerning the protection of motor vehicles against unauthorized use (UNECE WP.29; entered into force 10 February 2009; the broader anti-theft regulation, distinct from the newer R161)](https://unece.org/sites/default/files/2022-08/R116e.pdf) +* [California Privacy Rights Act (CPRA) of 2020, codified at Cal. Civ. Code §§1798.100 et seq. (Office of the California Attorney General canonical reference)](https://oag.ca.gov/privacy/ccpa) +* [OWASP Top 10 for LLM Applications (2025)](https://genai.owasp.org/llm-top-10/) +* [NHTSA Cybersecurity Best Practices for the Safety of Modern Vehicles (September 2022; the cyber-physical baseline reused across SAFE-UC-0006, 0007, 0008, and 0010)](https://www.nhtsa.gov/document/cybersecurity-best-practices-safety-modern-vehicles-2022) + +--- + +## Minimum viable write-up (Seed → Draft fast path) + +This document covers: + +* Executive summary +* Industry context and constraints +* Workflow and scope +* Architecture (tools, trust boundaries, inputs) +* Operating modes +* Kill-chain table (8 stages) +* SAFE‑MCP mapping table (19 techniques) +* Contributors and Version History + +--- + +## 1. Executive summary (what + why) + +**What this workflow does.** +An **in-vehicle voice assistant for local controls** is an AI-augmented system that listens for a wake word or push-to-talk trigger, runs automatic speech recognition (ASR) over occupant speech, resolves natural-language intent through an in-car or cloud-routed model, and either answers conversationally or actuates a bounded set of local controls. Typical capabilities include: + +* climate (HVAC) zone control, defrost, cabin pre-conditioning +* media playback (radio, streaming, podcast, playlist) +* navigation destination entry, route adjustment, parking and charging-stop search +* communications (hands-free calling, dictated SMS, in-cabin intercom) +* comfort settings (massage seat, ambient lighting, window and sunroof position) +* voice-driven configuration of driver-assistance settings (lane-keep assist on/off, adaptive cruise gap) +* over-the-air conversational queries grounded in OEM knowledge bases (owner-manual lookups, charging-station availability, recall-status questions) +* in some 2025-2026 deployments, generative-AI conversational mode for general-knowledge questions delegated to a cloud foundation model + +Industry deployments span the full passenger-vehicle market. **Cerence** is the dominant pure-play platform: company materials cite more than 525 million vehicles equipped with Cerence speech across 17 OEM customers. The 12 OEMs Cerence named explicitly at IAA Mobility 2025 are BYD, BMW, Ford, Genesis, Hyundai, Leapmotor, Lucid, Mini, Opel, Polestar, Togg, and XPENG. Mercedes-Benz, Volkswagen Group, Renault, Geely, and Mahindra are documented Cerence customers historically and are typically cited separately. **Mercedes-Benz** publicly announced on December 17, 2024 that its MBUX Voice Assistant had reached a cumulative 3 million equipped vehicles, with the AI-driven knowledge feature integrated into MBUX. **BMW** announced at CES 2026 that the BMW iX3 will be the first vehicle on the road to integrate Amazon Alexa+ as a Custom Assistant, with rollout beginning in H2 2026. **Tesla** added a conversational mode powered by xAI Grok in July 2025. The Grok integration handles general knowledge questions, and the existing legacy voice command system continues to handle vehicle-control intents (climate, media, navigation, charging). Grok does not actuate vehicle controls. **SoundHound** is a separate platform serving Hyundai, Kia, Stellantis, Honda, and others; SoundHound and Cerence both operate at Hyundai across different model lines and the framing of either as exclusive is incorrect. **Smart Eye** provides the dominant driver-monitoring infrastructure layered alongside voice (24 OEMs, 372 production models, more than 3 million cars). + +**Why it matters (business value).** +Voice has become the consensus in-cabin human-machine interface for non-safety-critical actions performed while the vehicle is in motion. NHTSA's distraction work (cited below) and the AAA Foundation Phase II 2014 study found that voice-based interaction shifts driver workload into a Category 3 cognitive-distraction class, but in many comparison conditions voice still produces lower visual-manual demand than the equivalent touchscreen interaction. The Auto Innovators Driver Focus-Telematics Working Group Guidelines have been the industry's default baseline for HMI design since 2006 because no finalized federal voice-HMI standard has been issued. From a commercial standpoint the voice assistant is also the OEM's most direct AI-product surface to the customer, the channel through which the OEM most commonly integrates a third-party generative-AI assistant (Alexa+, ChatGPT, Grok, Cerence CaLLM), and the canvas on which the OEM will accumulate the largest behavioral and biometric corpus per customer over the vehicle life. + +**Why it is risky / what can go wrong.** +This workflow's defining trait is that **it is the AI surface in the cabin during operation, with eyes-on-road and hands-on-wheel as the operating envelope**. Distinct from prior SAFE-AUCA use cases (which describe back-office or off-vehicle workflows), eight concurrent risk surfaces make the in-vehicle voice assistant a structurally hard agentic-use-case to defend. + +* **Physical-side-channel acoustic injection.** DolphinAttack (CCS 2017) demonstrated inaudible voice commands modulated onto ultrasonic carriers against 16 voice systems including the Audi Q3 navigation system. Light Commands (USENIX Security 2020) demonstrated laser-driven audio injection at distances up to 110 meters and included a vehicle-unlock demo. NUIT (USENIX Security 2023) demonstrated near-ultrasound inaudible Trojan attacks at 16 to 22 kHz with attack latencies under 77 ms. The microphone is a sensor in the ISO/SAE 21434 sense and the airspace around it is the attack surface. +* **Multi-occupant identity confusion.** A connected vehicle can carry six or more occupants (a three-row SUV or van) and the assistant routinely reasons about who is speaking, who is authorized for which action, and how to resolve a child seated in row three asking for an action the driver did not approve. SAFE-UC-0006 introduced the five-party identity model for telematics; the in-cabin equivalent extends to 6+ occupants and adds a child-occupant axis the read-side telematics workflow does not have. +* **Wake-word false trigger from broadcast media.** A canonical April 2017 Burger King television advertisement intentionally activated Google Home devices with the phrase "OK Google, what is the Whopper burger?", illustrating that any audio source in earshot of an always-on microphone can become a command channel. In an automotive cabin the radio, streaming media, navigation prompts, in-cabin intercom from a passenger, and other vehicles' loudspeakers are all in earshot. +* **Voiceprint biometric persistence and BIPA exposure.** When the assistant identifies speakers by voice it captures voiceprint biometrics. Illinois BIPA litigation has surfaced statutory damages in the $1,000 to $5,000 per violation range, and the federal Garner v. Amazon class certification (W.D. Wash., July 7, 2025; Judge Lasnik) shows the federal Wiretap Act and Washington Privacy Act analogues are now class-actionable for voice-recording collection without consent. CPRA (Cal. Civ. Code §1798.140) classifies voiceprint biometric information as sensitive personal information. +* **Voice-to-OTA bridge into SAFE-UC-0008.** When the assistant accepts conversational instructions that adjust driver-assistance settings, schedule a software update, change a charging schedule, or modify a vehicle preference that is later persisted into a configuration baseline, the voice surface becomes a trigger into the OTA workflow described in SAFE-UC-0008. The voice assistant is upstream of the firmware-action layer. +* **NHTSA distracted-driving cap as an AI-decision constraint.** The 2013 visual-manual guidelines (Phase 1, 78 Fed. Reg. 24818) cap a single off-road glance at 2 seconds and total off-road glance time at 12 seconds for any single secondary task. AAA Foundation Phase II (October 2014) capped voice-menu prompts at "four or five items" before cognitive workload climbs out of the acceptable Category 3 range. **There is no finalized federal voice-HMI rule.** Phase 3 (auditory-vocal) was announced as planned in 2013 but has not been issued. The de facto baseline is the Auto Innovators 2006 guidelines. +* **Always-on cabin recording exposure.** If the assistant captures more than the wake word and command, the recordings touch federal Wiretap Act and state two-party-consent regimes (California, Illinois, Florida, Pennsylvania, Washington); Garner v. Amazon's class certification is the operative federal precedent for voice-recording overcollection. +* **Cyber-physical exposure when voice can adjust safety-related settings.** A voice command that disables lane-keep assist while the vehicle is in motion at highway speed crosses into ISO 26262 ASIL-relevant territory. The control surface for these settings has historically been touchscreen with explicit confirmation; voice activation introduces a verbal-confirmation pattern whose adversarial-robustness is comparatively under-tested. The cyber-physical baseline (UN R155 CSMS, UN R156 SUMS, ISO/SAE 21434, ISO 26262) applies whenever the voice surface can read or write a safety-related signal. + +A defining inversion versus the prior cyber-physical SAFE-AUCA siblings: **here the AI is the in-cabin interlocutor, not a back-office orchestrator**. SAFE-UC-0006 reads telematics from millions of vehicles. SAFE-UC-0007 dispatches humans to perform physical actions. SAFE-UC-0008 ships firmware. SAFE-UC-0010 listens to and speaks with the people inside a moving vehicle, and those people's speech is the prompt. + +--- + +## 2. Industry context & constraints (reference-guide lens) + +### Where this shows up + +Common in: + +* passenger-vehicle OEMs across every segment (Tesla, Ford, GM, Stellantis, Toyota, Hyundai-Kia, Volkswagen Group, BMW, Mercedes-Benz, Rivian, Lucid, Polestar, BYD, NIO, XPENG, Li Auto, Genesis, Mini, Opel, Leapmotor, Togg) +* OEM-OS conversational assistants (Mercedes MBUX Voice Assistant, BMW Intelligent Personal Assistant + Alexa+ on iX3, Ford SYNC 4, GM Google built-in, Stellantis SmartCockpit, Hyundai-Kia ccNC + SoundHound, Tesla legacy voice + Grok, Rivian assistant, Volkswagen Group IDA + ChatGPT) +* embedded voice platforms (Cerence CaLLM, SoundHound Houndify and Chat AI, Apple CarPlay Siri, Google Assistant on Android Auto, Amazon Alexa Auto, OpenAI integrations via OEM partnerships) +* third-party voice-skill ecosystems integrated through the OEM stack (Spotify, Pandora, Apple Music, Audible, Waze, Yelp, Plugshare and ChargePoint integrations) +* Tier 1 cabin-electronics suppliers (HARMAN, Bosch, Continental, Aptiv, Visteon, Panasonic Automotive, LG Electronics, Magna Electronics) +* driver-monitoring and occupant-monitoring (Smart Eye, Seeing Machines, Cipia, Emotive Eye, Sony, Mobileye) +* sector-overlay platforms for regulated voice content (recall lookups via NHTSA APIs, in-vehicle payments, tolling, in-cabin commerce) + +### Typical systems + +* **microphone array and DSP front end.** Multi-microphone beamforming, echo cancellation, noise suppression, blind source separation; the array is often shared with hands-free calling and active noise cancellation +* **wake-word and ASR.** A small on-device wake-word model gates a larger ASR; modern stacks blend on-device ASR (Cerence CaLLM Edge, Apple-on-device, Google on-device) with cloud ASR for long-form queries +* **NLU and intent resolution.** Domain classifier, slot extractor, command router; in 2025-2026 commonly augmented by a foundation-model conversational layer (CaLLM, GPT-class, Grok, Alexa+ LLM) +* **dialog manager.** Turn-taking, follow-up disambiguation, cancellation handling, transparent failure handling +* **vehicle bus and gateway.** Voice intents that touch vehicle controls cross into the cabin domain controller, the body controller, the infotainment head unit, and where applicable the gateway between infotainment and vehicle networks; SAE J3138_202210 is the canonical guidance for the diagnostic link connector and the same engineering discipline applies to the voice-to-bus boundary +* **cloud routing.** Most OEMs maintain a cloud routing layer with their own privacy and consent surface; CPRA and GDPR shape the consent text; in-cabin recording rules in two-party-consent states (California, Florida, Illinois, Pennsylvania, Washington) shape what is captured and retained +* **OEM and third-party knowledge graphs.** Owner-manual content, recall and service-bulletin content, charging-station and POI databases, weather, and news; the assistant's grounding corpus +* **payments and commerce surface.** In-vehicle payments (toll, parking, fuel/charging), in-cabin commerce (drive-through ordering pilots), with PCI-DSS 4.0.1 scope when card data is touched +* **driver-monitoring (DMS) and occupant-monitoring (OMS).** Smart Eye, Seeing Machines, Cipia, and others provide gaze, drowsiness, occupant detection, and in some 2025-2026 stacks, occupant-position and seat-belt-state signals that the voice surface uses for intent disambiguation + +### Constraints that matter + +* **NHTSA Visual-Manual Driver Distraction Guidelines, Phase 1 (78 Fed. Reg. 24818, April 26, 2013).** 2-second per-glance cap and 12-second total off-road-glance cap on any single secondary task. Phase 1 applied to OEM-installed visual-manual interfaces. Phase 2 (81 Fed. Reg. 87656, December 5, 2016) extended the visual-manual analysis to portable and aftermarket devices as a Notice of Proposed Rulemaking but was never finalized. **Phase 3 (auditory-vocal / voice) was announced as planned in 2013 but has not been issued.** There is currently no finalized federal voice-HMI standard. +* **Auto Innovators Driver Focus-Telematics Working Group Guidelines (2000 statement of principles, 2006 guidelines).** The de facto industry baseline. Most OEM HMI safety arguments cross-reference these because the federal voice rule does not exist. +* **AAA Foundation Phase II 2014 (Strayer, Cooper, et al., October 2014).** Voice-based interaction sits in cognitive-distraction Category 3 (touch-screen menu interaction sits higher); the practical recommendation is "four or five items" maximum in any voice menu before workload becomes problematic. +* **CPRA (Cal. Civ. Code §§1798.100 et seq.; California Consumer Privacy Act as amended November 2020).** Voiceprint biometric data is sensitive personal information under §1798.140(ae); requires opt-in consent and additional purpose limitation. +* **Illinois Biometric Information Privacy Act (740 ILCS 14).** Statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation; the operative biometric-litigation regime since *Rosenbach v. Six Flags* (2019); voiceprint is explicitly included. +* **Federal Wiretap Act (18 U.S.C. §§2510-2523) and state two-party-consent recording regimes.** Garner v. Amazon (W.D. Wash.; class certified July 7, 2025; Judge Lasnik) is the operative federal-class-action precedent for voice-recording overcollection. +* **UN Regulation No. 116 (Uniform technical prescriptions concerning the protection of motor vehicles against unauthorized use; effective 10 February 2009).** Foundational anti-theft regulation; relevant when the voice assistant can perform any vehicle-state-changing action remote-able through the same surface (door unlock, mobilizer, valet mode). UN R116 is broader and older than UN R161 (the newer impact-protection regulation); when in doubt cite R116. +* **UN R155 (CSMS) and UN R156 (SUMS).** Mandatory for type approvals in UN ECE contracting parties since July 2022 for new types and July 2024 for all new registrations. The voice surface inherits CSMS scope when cabin-IP-touched components are part of the type-approval scope. R156 SUMS scope reaches voice when the assistant code is updated by the OTA pipeline (the SAFE-UC-0008 boundary). +* **ISO/SAE 21434:2021 Cybersecurity engineering for road vehicles.** TARA covers the microphone, the wake-word stack, the ASR stack, the NLU stack, the cloud routing layer, and any vehicle-bus actuation path. The microphone array is an asset in the 21434 sense and the airspace around the vehicle is the threat boundary. +* **ISO 26262 functional safety.** When the voice surface can read or write a setting that affects ASIL-rated function (lane-keep assist, adaptive cruise, ADAS configuration), the change-impact analysis applies. ASIL-A through ASIL-D classification scopes the analysis depth. +* **NHTSA Cybersecurity Best Practices for the Safety of Modern Vehicles (September 2022).** 45 general and 23 technical best practices that shape the OEM's defensive posture against acoustic injection, voice-channel hijack, and cabin-recording overcollection. +* **EU AI Act (Regulation EU 2024/1689).** The conversational layer typically falls under Article 50 (transparency obligations: the user is informed they are interacting with an AI). Annex III §1 (biometric identification) is in scope when the assistant identifies the speaker by voice. +* **GDPR (Reg. EU 2016/679).** Article 9 special-category data covers voiceprint biometrics; Article 22 covers solely-automated decisions with legal or significant effect (rare for in-cabin voice but reachable when voice gates a regulated action like in-cabin payments). +* **Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§6501-6506) and EU GDPR Article 8.** When a child occupant interacts with the assistant the parental-consent regime applies; this is an open frontier in the cabin context. +* **Federal Communications Commission rules on automotive radar and active anti-theft.** The microphone itself is not regulated by the FCC, but the in-cabin RF environment shaped by the FCC's 24 GHz to 79 GHz radar rules and Bluetooth / Wi-Fi co-existence is part of the operating environment. +* **PCI DSS 4.0.1.** When in-cabin payments cross the voice surface, the cardholder-data scope inherits the standard. + +### Must-not-fail outcomes + +* an inaudible or out-of-band acoustic input causes the assistant to actuate a vehicle control without occupant awareness +* a misidentified occupant is granted authorization to perform an action they should not be allowed to perform +* a child occupant overrides a driver-set safety configuration through the voice surface +* a voice command disables a safety-related driver-assistance function (lane-keep assist, adaptive cruise) while the vehicle is in motion at highway speed without explicit confirmation through a non-voice channel +* a broadcast media source (radio, streaming, in-cabin intercom from another passenger) actuates a control without the driver's intent +* voiceprint biometric data is collected or retained in violation of CPRA, BIPA, or the federal Wiretap Act +* always-on recording captures more than the wake word and command in violation of two-party-consent state law +* the assistant becomes a downstream trigger into the OTA pipeline without the SAFE-UC-0008 multi-party authorization gate + +--- + +## 3. Workflow description & scope + +### 3.1 Workflow steps (happy path) + +1. The vehicle is driven and the in-cabin microphone array is powered. A small on-device wake-word model continuously evaluates the audio stream; alternative entry points include a steering-wheel push-to-talk button, a wake gesture detected by the driver-monitoring camera, and (in some stacks) a CarPlay or Android Auto bridge. +2. The wake word fires. The downstream ASR captures the next utterance with a configurable maximum capture duration; captured audio is processed through beamforming and echo cancellation to attenuate non-driver speakers. +3. The ASR transcribes; the NLU classifies the intent (HVAC, media, navigation, communications, comfort, configuration, conversational query, in-cabin payment, knowledge-graph lookup) and extracts slots. +4. The dialog manager resolves disambiguation: which occupant spoke (DMS-aided), whether the intent requires confirmation, whether the intent crosses a safety-related setting that requires a non-voice-channel attestation, whether the intent crosses a regulated boundary (payments, biometric enrollment, voice-driven OTA trigger). +5. The intent routes to the appropriate execution surface: the cabin domain controller for HVAC and seats, the head unit for media and navigation destination entry, the body controller for windows and locks, the configuration store for driver-assistance settings, the cloud routing layer for conversational answers and knowledge-graph lookups. +6. The action executes. The assistant returns a verbal confirmation, a HUD or display confirmation, or both. Driver-assistance setting changes commonly route through a verbal-plus-display dual-confirmation pattern. +7. The interaction is logged. Logging policy varies: some OEMs retain only the transcript (no audio), some retain the audio with explicit consent, some retain only the wake-word triggering audio, some retain nothing post-dialog. CPRA, BIPA, and the federal Wiretap Act shape the policy; Garner v. Amazon shapes the litigation expectation. +8. Where applicable the voice intent feeds a downstream pipeline: a recall-lookup intent feeds the NHTSA Part 573 evidence path, a charging-stop intent feeds the navigation history, a configuration change feeds the OTA-staged baseline (SAFE-UC-0008), a payment intent feeds the PCI-DSS 4.0.1-scoped processor. + +### 3.2 In scope / out of scope + +* **In scope:** wake-word and ASR stack governance; intent resolution and confirmation patterns; multi-occupant identity arbitration; voiceprint enrollment and consent; logging and retention policy; cabin-microphone egress controls; voice-driven configuration changes that touch driver-assistance settings; voice-to-OTA bridge governance; broadcast-media wake-word resilience; acoustic-injection robustness; child-occupant override controls; in-cabin payments through voice; conversational AI integration (Alexa+, ChatGPT, Grok, Cerence CaLLM, etc.); CPRA and BIPA compliance for voiceprint and audio capture. +* **Out of scope:** the OTA software-update pipeline itself (handled in SAFE-UC-0008); the upstream telematics observation layer (handled in SAFE-UC-0006); the maintenance dispatch layer (handled in SAFE-UC-0007); fully autonomous voice-driven actuation of safety-related E/E systems without confirmation; voice-driven authentication for critical financial actions without step-up authentication on a non-voice channel; voice-driven impersonation of OEM service personnel. + +### 3.3 Assumptions + +* The OEM operates a CSMS under UN R155 and SUMS under UN R156 where applicable to the vehicle's type-approval jurisdiction. +* The vehicle's in-cabin microphone array is a cybersecurity asset in the ISO/SAE 21434 sense and the airspace around it is part of the threat boundary. +* Voiceprint biometric capture is opt-in with a clear consent surface; CPRA and BIPA exposure is treated as litigation-relevant. +* Cabin-recording retention follows the strictest applicable jurisdiction (two-party-consent state law and Garner-class privacy expectations). +* Driver-assistance setting changes that touch ASIL-rated functions go through dual-channel confirmation (voice plus display) before commit. +* The voice surface does not by itself authorize a fleet-wide OTA push (the SAFE-UC-0008 multi-party authorization gate remains in place). + +### 3.4 Success criteria + +* Acoustic-injection robustness is measured against the DolphinAttack, Light Commands, and NUIT classes of attack, and the residual exposure is documented. +* Wake-word false-trigger rate from broadcast media is measured (radio, streaming, in-cabin intercom) and bounded to a published threshold. +* Multi-occupant identity arbitration produces a documented authorization decision per intent and the rationale is auditable. +* Child-occupant override is blocked or escalated for any intent that would change a driver-set safety configuration. +* Voiceprint enrollment is opt-in, the consent record is preserved, and the retention horizon is documented per CPRA, BIPA, and federal Wiretap Act analogues. +* Cabin recording does not extend beyond the wake-word and command unless explicit consent is on file. +* Driver-assistance setting changes through voice route through a dual-confirmation gate. +* Voice-driven OTA-related actions cannot bypass the SAFE-UC-0008 multi-party authorization gate. + +--- + +## 4. System & agent architecture + +### 4.1 Actors and systems + +* **Human roles:** driver; front and rear passengers (up to 6+ in three-row vehicles); child occupants; valet drivers; authorized service personnel; the OEM's privacy officer; the OEM's safety officer (ISO 26262); the OEM's cybersecurity officer (UN R155 / ISO/SAE 21434); the OEM's data-protection officer (CPRA, BIPA, GDPR); regulator-facing counsel (NHTSA, FTC, state AG, CPPA, EU DPA). +* **Agent / orchestrator:** the wake-word model, ASR, NLU, dialog manager, intent router, conversational LLM (where present), and the cabin-domain controller that translates intent into vehicle action. +* **LLM runtime:** typically a hybrid of on-device small LLM (Cerence CaLLM Edge, Apple on-device, Google on-device) and cloud foundation model (Cerence CaLLM Cloud, GPT-class, Alexa+ LLM, Grok, Gemini); per-OEM cloud routing decisions vary by jurisdiction and by data-class. +* **Tools (MCP servers / APIs / connectors):** HVAC actuator, media-player controller, navigation destination service, knowledge-graph lookup (owner manual, recall lookup, charging-station availability), comms gateway (hands-free, SMS, in-cabin intercom), driver-assistance configuration store, in-cabin payments processor, third-party skill bridge (Spotify, Pandora, Plugshare, etc.). +* **Data stores:** wake-word triggering audio buffer; ASR transcript log; voiceprint biometric template store (opt-in only); intent and tool-call audit log; conversational LLM context cache; CPRA / BIPA consent records; navigation history; in-cabin payment receipts; recall and service-bulletin grounding corpus. +* **Downstream systems affected:** the vehicle (cyber-physical via voice intent); the OTA pipeline (SAFE-UC-0008) when voice gates a configuration change; the OEM's recall pipeline (NHTSA Part 573) when voice surfaces a defect-relevant complaint; the OEM's privacy and consent ledger; the in-cabin payments processor (PCI DSS 4.0.1). + +### 4.2 Trusted vs untrusted inputs (the in-cabin identity hexangle) + +A defining feature of this workflow is a six-or-more-party in-cabin identity model that extends SAFE-UC-0006's five-party telematics quintet. The cabin can carry the driver, front passenger, second-row passengers, third-row passengers, child occupants, and (in some patterns) a valet driver or authorized-service-personnel session. Acoustic sources that are not occupants (the radio, streaming media, in-cabin intercom from a passenger, other vehicles' loudspeakers, an attacker outside the cabin operating an inaudible carrier) are also "speakers" in the microphone's view. + +| Input / source | Trusted? | Why | Typical failure / abuse pattern | Mitigation theme | +| ---------------------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | +| Driver speech | Authenticated-by-voice | the assistant has a voiceprint and a seat-position signal | replay attack with recorded driver audio; voice-cloning attack | dual-channel attestation for safety-related changes; liveness detection; DMS gaze corroboration | +| Front-passenger speech | Authenticated-by-voice | voiceprint optional; seat-position signal available | over-broad authorization; passenger overrides driver-set safety configuration | per-seat authorization scope; driver-veto on safety-related changes | +| Rear-passenger speech (rows 2 and 3) | Lower-authority | distance from microphone array degrades signal; speaker arbitration is harder | rear-occupant issues a privileged command; toddler-on-lap effect | beamforming-based speaker zone; per-seat authorization scope; safety-critical commands not accepted from rear seats | +| Child-occupant speech | Restricted | COPPA / GDPR Article 8 apply; child voiceprint is doubly sensitive | child-issued safety-config-changing intent; child-issued in-cabin-purchase intent | explicit child-occupant policy; age-assurance crossover into SAFE-UC-0030; non-voice attestation for any child-issued safety or commerce intent | +| Valet or authorized-service speech | Scoped | session-bound elevated trust for legitimate service, narrow envelope | over-broad valet privilege; persistence past session end | valet-mode policy; session timeout; named-action allow-list | +| Broadcast media (radio, streaming, podcasts) | Untrusted | the Burger King 2017 Whopper ad pattern; broadcast media is in earshot | wake-word false trigger; media-borne command | media-aware wake-word suppression during media playback; cross-microphone correlation; speaker-zone arbitration | +| Other vehicles' loudspeakers; ambient outside audio | Untrusted | windows down; convertible mode; charging-station ambient | inaudible-or-audible command from outside cabin | beamforming inward bias; in-cabin DMS occupant-location attestation | +| Acoustic-injection adversary (DolphinAttack/Light/NUIT) | Hostile | physical-side-channel attacker with ultrasonic, laser, or near-ultrasound capability | inaudible voice command actuates control without occupant awareness | ultrasonic filter on input; correlated multi-microphone sanity check; verbal-confirmation gate on any state-changing intent | +| Conversational LLM output (Alexa+, GPT, Grok, CaLLM) | Untrusted-by-construction | probabilistic; hallucination-prone | hallucinated owner-manual claim; fabricated recall status; misinformation on safety-relevant queries | grounded-retrieval-only on owner-manual and recall claims; verbatim citation; refusal pattern on safety-critical questions | +| Third-party skill / app output | Skill-scoped | skill code outside the OEM's direct security perimeter | skill manifest poisoning; skill-driven prompt injection | skill-manifest signing; skill-scope allow-list; output-validation | +| Bluetooth / Wi-Fi / paired phone audio path | Semi-trusted | paired device is the user's but may be compromised | injected audio over Bluetooth; phone-app-driven voice trigger | per-channel wake-word policy; pairing audit; no privileged actions over Bluetooth audio | +| In-cabin payment confirmation speech | Authenticated + step-up | PCI DSS scope; commerce decision | replay attack on confirmation phrase; child-occupant accidental confirmation | non-voice attestation (touchscreen confirm or paired-device confirm) for amounts above a threshold | + +### 4.3 Trust boundaries (required) + +* **Microphone air-gap to ASR.** The microphone is the cyber-physical sensor that ingests adversarial acoustic input from outside the cabin and from broadcast media; this is the boundary acoustic-injection attacks cross. +* **Speaker-zone arbitration.** The boundary between which seat the audio came from and which authorization the assistant applies; multi-occupant identity confusion lives here. +* **Driver-passenger-child authorization tiers.** The boundary at which a voice command from a child or rear-row passenger is escalated, restricted, or refused. +* **Voice to vehicle bus.** The boundary between an interpreted voice intent and a CAN or Ethernet write to a vehicle controller; the same engineering discipline as SAE J3138 applies. +* **Voice to OTA pipeline.** Any voice intent that would stage or schedule a software action passes through the SAFE-UC-0008 multi-party authorization gate; no fleet-wide push originates from a single voice intent. +* **Voiceprint enrollment and biometric retention.** The boundary at which captured audio becomes biometric data; CPRA opt-in and BIPA written-release expectations apply. +* **Cabin-recording egress.** The boundary at which the wake-word triggering audio leaves the vehicle; the federal Wiretap Act and state two-party-consent regimes apply. +* **Conversational LLM cloud routing.** The boundary at which captured speech leaves the OEM's cloud for a third-party foundation-model API (Alexa+, GPT, Grok, Gemini); the data-residency, retention, and re-training-prohibition contracts apply. + +### 4.4 Permission and approval design + +* **Safety-related driver-assistance setting changes** (lane-keep assist on/off, adaptive cruise gap, ADAS sensitivity, regenerative-braking aggression) require a non-voice attestation in addition to the voice intent (touchscreen confirm or steering-wheel button confirm). +* **In-cabin payments** above a configurable threshold require a non-voice step-up attestation (touchscreen confirm, paired-phone biometric confirm, or PIN). +* **Voice-driven OTA-related actions** (schedule update, accept update, defer update) cannot bypass the SAFE-UC-0008 multi-party authorization gate. +* **Voiceprint enrollment** requires opt-in consent; the consent record is preserved with timestamp, jurisdiction, and the verbatim consent text. +* **Always-on recording** beyond the wake-word and command requires opt-in; the federal Wiretap Act and two-party-consent state law govern. +* **Child-occupant intents** that would change a safety configuration or initiate an in-cabin payment are blocked or escalated to the driver. +* **Valet-mode** is session-bound; the named-action allow-list is published and the session timeout is enforced. + +### 4.5 Tool inventory (required) + +| Tool / connector | Read / Write | Scope | Risk class | +| ------------------------------------------------------------ | -------------- | ----------------------------------- | --------------------------------------------------------------------------- | +| Microphone array + DSP front end | Read | Per-cabin | Acoustic-injection surface; physical sensor | +| Wake-word model (on-device) | Read | Per-cabin | False-trigger surface (broadcast media, acoustic injection) | +| ASR pipeline (on-device + cloud blend) | Read | Per-utterance | Recording-overcollection surface; CPRA / BIPA / Wiretap Act-relevant | +| NLU intent classifier and slot extractor | Read + Write | Per-utterance | Misclassification leads to mis-actuation | +| Dialog manager and confirmation gate | Read + Write | Per-utterance | Confirmation-fatigue surface; T1403-relevant | +| Conversational LLM (Alexa+ / GPT / Grok / CaLLM Cloud) | Read + Write | Per-conversation | Hallucination surface for owner-manual / recall / safety-relevant claims | +| HVAC actuator | Write | Per-zone | Comfort-tier; not safety-critical | +| Media-player controller | Write | Per-cabin | Comfort-tier | +| Navigation destination service | Write | Per-route | Privacy-sensitive (location) | +| Communications gateway (hands-free, SMS, intercom) | Write | Per-call | Privacy-sensitive; CPRA / GDPR-relevant | +| Driver-assistance configuration store | Write | Per-vehicle | ASIL-rated impact when applied; ISO 26262-relevant | +| In-cabin payment processor | Write | Per-transaction | PCI DSS 4.0.1 scope | +| Recall and service-bulletin lookup | Read | Per-VIN | Authoritative; NHTSA Part 573-adjacent | +| Voiceprint biometric template store | Read + Write | Per-occupant; opt-in | Sensitive PI under CPRA; BIPA Class A under Illinois law | +| Cabin-recording retention store | Read + Write | Per-vehicle; opt-in | Federal Wiretap Act-relevant; Garner v. Amazon-relevant | +| OTA-stage-and-schedule connector | Write | Per-vehicle | Routes through SAFE-UC-0008 multi-party authorization | +| Driver-monitoring (DMS) and occupant-monitoring (OMS) inputs | Read | Per-cabin | Privacy-sensitive; supports speaker-zone arbitration | +| Bluetooth and Wi-Fi audio bridge | Read | Per-paired-device | Compromised-pairing surface | + +### 4.6 Sensitive data and policy constraints + +* **Data classes:** wake-word triggering audio buffers, ASR transcripts, voiceprint biometric templates, navigation history, in-cabin payment receipts, owner-manual and recall lookup queries, conversational LLM context. +* **Retention and logging:** voiceprint templates retained only with explicit opt-in consent; cabin recordings beyond wake-word-and-command retained only with explicit opt-in consent; CPRA and BIPA shape the retention horizon; Garner v. Amazon shapes litigation expectations. +* **Regulatory constraints:** CPRA (sensitive PI for voiceprint), BIPA (Illinois statutory damages), federal Wiretap Act (two-party-consent state law), GDPR Article 9 (special-category data) and Article 22 (solely-automated decisions), EU AI Act Article 50 (transparency) and Annex III §1 (biometric identification), COPPA and GDPR Article 8 (child occupants), CPPA enforcement frontier. +* **Output policy:** owner-manual and recall claims surface verbatim from authoritative source (the OEM's owner-manual repository, the NHTSA recall API); conversational LLM responses on safety-relevant queries refuse or hand off rather than hallucinate; the assistant identifies itself as AI per EU AI Act Article 50. + +--- + +## 5. Operating modes + +### 5.1 Manual baseline (push-to-talk, scripted-grammar voice) + +The classical pre-LLM voice assistant: push-to-talk gating, restricted grammar, narrow-domain command set (climate, media, basic navigation, hands-free calling). Most pre-2020 OEM stacks operated here. The wake-word surface is closed; the broadcast-media false-trigger surface is small; the acoustic-injection surface is bounded by the push-to-talk gate. + +**Risk profile:** lowest. Bounded by what the grammar can accept. Hallucination is structurally absent. + +### 5.2 Wake-word + scripted grammar + +Always-on microphone with wake-word activation; scripted grammar for the action. Enables hands-free initiation. The broadcast-media false-trigger surface opens (the Burger King 2017 pattern). The acoustic-injection surface opens to DolphinAttack-class attacks. Hallucination is still structurally absent. + +**Risk profile:** moderate. False-trigger and acoustic-injection are the primary novel surfaces. + +### 5.3 Wake-word + LLM-mediated NLU (the 2023-2026 default) + +Always-on microphone with wake-word activation; LLM-mediated intent resolution (still bounded to a tool-calling envelope). MBUX Voice Assistant, Cerence CaLLM, SoundHound Chat AI, Alexa+ on iX3, and similar stacks operate here. The grammar is open; the assistant can clarify, confirm, and disambiguate; the hallucination surface is bounded by tool-calling discipline. This is the default for new vehicles in 2025-2026. + +**Risk profile:** high. The acoustic-injection and broadcast-media surfaces remain open and the LLM mediation expands the attack surface (prompt injection through the captured speech, third-party-skill output contamination, conversational-context manipulation across turns). + +### 5.4 Conversational mode with general-knowledge LLM (Tesla Grok, ChatGPT in VW, Cerence CaLLM Cloud, Alexa+ general) + +The 2025-2026 frontier: the assistant accepts open-ended conversational queries on general-knowledge topics, with the cloud LLM answering. Scope is typically constrained: vehicle-control intents continue to route through the legacy stack; conversational queries route through the LLM. Tesla's July 2025 Grok integration is the canonical example: Grok answers conversationally; it does not actuate vehicle controls. The legacy voice command system continues to handle climate, media, navigation, and charging. + +**Risk profile:** highest for hallucination on safety-relevant questions; moderate for cyber-physical because vehicle-control intents are typically scoped out of the conversational layer. + +### 5.5 Bounded autonomy (rare in current production) + +Voice-driven actions executed without per-action confirmation under a narrow allow-list (e.g., HVAC set-point adjustment within a comfort range; media skip-track; navigation ETA query). Any safety-related setting change, in-cabin payment above a threshold, or OTA-related action stays HITL. + +**Risk profile:** depends on allow-list discipline. + +### 5.6 Variants + +Architectural variants teams reach for: + +1. **Cloud-routing OEM-of-record versus third-party-LLM-on-record.** OEM-of-record (Mercedes MBUX with OEM data residency) keeps cabin audio under the OEM's privacy contract; third-party-of-record (Alexa+, ChatGPT, Grok) routes through the third party's contract. The CPRA / BIPA exposure splits accordingly. +2. **On-device versus hybrid versus cloud-only.** On-device stacks (Cerence CaLLM Edge, Apple on-device, Google on-device) reduce the egress surface; cloud-only stacks maximize capability. Most production stacks blend. +3. **Driver-only versus per-occupant authorization.** Driver-only treats the assistant as a single-user surface; per-occupant uses voiceprint and DMS to arbitrate between speakers. Per-occupant arbitration is the basis for any defensible child-occupant policy. +4. **Voice-to-OTA bridge open versus closed.** Bridge-closed deployments do not let the voice surface stage OTA actions; bridge-open deployments (e.g., voice-driven schedule of an update) require explicit SAFE-UC-0008 gate inheritance. +5. **Always-on-recording versus wake-word-and-command-only.** Recording policy materially changes the CPRA / BIPA / Wiretap Act exposure; Garner v. Amazon shapes the litigation expectation. + +--- + +## 6. Threat model overview (high-level) + +### 6.1 Primary security and safety goals + +* preserve acoustic-input integrity against DolphinAttack, Light Commands, NUIT, and audio-adversarial-example attacks +* preserve wake-word integrity against broadcast-media false-trigger +* preserve speaker-zone arbitration so that authorization tracks the speaker's seat and identity +* preserve child-occupant policy (no safety-config changes; no in-cabin payments without driver attestation) +* preserve voiceprint biometric consent under CPRA and BIPA +* preserve cabin-recording boundaries under the federal Wiretap Act and two-party-consent state law +* preserve a closed bridge between voice and OTA (no fleet-wide push from a voice intent) +* preserve ISO 26262 ASIL-discipline on any voice-driven setting change that affects a safety-related E/E function + +### 6.2 Threat actors (who might attack or misuse) + +* **Physical-side-channel adversaries** with ultrasonic, laser, or near-ultrasound capability (DolphinAttack, Light Commands, NUIT) targeting parked or moving vehicles +* **Broadcast-media-driven attackers** crafting wake-word-bearing audio in advertising, podcasts, streaming media, or in-cabin device output (the Burger King 2017 pattern) +* **In-cabin malicious passengers** including unauthorized rear-occupant override, child-issued safety-changing commands, valet-mode abuse +* **Voice-cloning attackers** using a recorded sample of the driver to impersonate over the assistant +* **Compromised paired-device adversaries** injecting commands over the Bluetooth or Wi-Fi audio path +* **Third-party-skill-supply-chain compromise** (skill manifest poisoning, skill-driven prompt injection) +* **OEM-internal data-broker arms** repurposing cabin recordings or voiceprints for resale (the GM/OnStar telematics analogue applied to voice data) +* **Civil adversaries** (stalking via in-cabin intercom; domestic-abuser misuse of a paired account) +* **Researchers** disclosing in good faith via Auto-ISAC and academic venues + +### 6.3 Attack surfaces + +* the airspace around the in-cabin microphone array +* broadcast media in the cabin (radio, streaming, paired-device output, in-cabin intercom) +* the wake-word model and ASR pipeline +* the NLU, intent router, and dialog manager +* the conversational-LLM cloud routing path +* the third-party-skill bridge +* the voice-to-vehicle-bus path +* the voice-to-OTA path +* the voiceprint biometric template store +* the cabin-recording retention store +* the in-cabin payments path + +### 6.4 High-impact failures (include industry harms) + +* **Customer / consumer harm:** voice-issued safety-config change degrades a driver-assistance function during operation; child-occupant override; broadcast-media or acoustic-injection actuation without occupant awareness; voiceprint biometric collection without consent; cabin-recording overcollection across two-party-consent state lines; data-broker resale of voice data. +* **Business harm:** CPRA enforcement (sensitive PI mishandling); BIPA statutory damages ($1,000 to $5,000 per violation; class-actionable); federal Wiretap Act exposure (Garner v. Amazon shape); FTC Section 5 enforcement on always-on-recording; CPPA fines; EU AI Act enforcement on transparency or biometric identification; UN R155 incident-reporting exposure when voice surface is part of CSMS scope. +* **Cyber-physical harm:** voice-driven disable of lane-keep assist while in motion; voice-driven OTA action that bypasses SAFE-UC-0008 multi-party authorization; voice-cloning-driven door-unlock or mobilizer action under UN R116 scope. +* **Reputational harm:** Burger King-shape broadcast-media-actuation incident; DolphinAttack-shape acoustic-injection demonstration in production fleet; voice-cloning-driven civil-adversary stalking incident. + +--- + +## 7. Kill-chain analysis (stages → likely failure modes) + +> Keep this defender-friendly. Describe patterns, not "how to do it." +> +> Note: this UC uses an **eight-stage kill chain** with **seven stages flagged NOVEL** versus SAFE-UC-0006 (telematics, the read-side observation layer), SAFE-UC-0007 (mobile fleet maintenance, the human-action layer), and SAFE-UC-0008 (OTA, the firmware-action layer). The novelty centers on the in-cabin sensor-and-speaker-arbitration surface, the broadcast-media false-trigger surface, the in-cabin identity hexangle, the child-occupant axis, the voiceprint biometric persistence surface, the cross-UC voice-to-OTA bridge, and the regulatory-vacuum-as-constraint shape of the absent NHTSA Phase 3 voice rule. + +| Stage | What can go wrong (pattern) | Likely impact | Notes / preconditions | +| ----------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| 1. Acoustic input ingest with physical-side-channel injection (**NOVEL: ultrasonic / laser / NUIT**) | DolphinAttack-class ultrasonic carriers, Light Commands-class laser injection at distances up to 110 meters, NUIT-class near-ultrasound carriers in the 16 to 22 kHz band with attack latencies under 77 ms; audio-adversarial-example synthesis (Carlini and Wagner) | inaudible voice command actuates a control without occupant awareness | the microphone is a sensor in the ISO/SAE 21434 sense; the airspace around the vehicle is the threat boundary; no SAFE-MCP technique today fully covers physical-side-channel acoustic injection | +| 2. Wake-word false trigger from broadcast media (**NOVEL: Burger King 2017 pattern in cabin**) | Wake-word-bearing audio in radio, streaming, podcasts, paired-device output, in-cabin intercom, or other vehicles' loudspeakers triggers the assistant; the April 2017 Burger King "OK Google, what is the Whopper burger?" advertisement is the canonical precedent | unintended actuation; cross-vehicle escalation when one OEM's media output triggers another OEM's wake word | media-aware wake-word suppression and cross-microphone correlation are the recovery anchors | +| 3. Multi-occupant identity arbitration in the in-cabin hexangle (**NOVEL: extends SAFE-UC-0006 quintet to 6+**) | Speaker-zone arbitration mistakes a rear-row occupant or child for the driver; over-broad authorization grants a passenger the driver's privileges; voice-cloning replay of a recorded driver sample | unauthorized actuation; passenger overrides driver-set safety config | DMS / OMS occupant-position attestation and per-seat authorization scope are the recovery anchors | +| 4. Child-occupant override and age-assurance crossover into SAFE-UC-0030 (**NOVEL: child axis**) | A child occupant issues an intent that changes a safety configuration, initiates an in-cabin payment, opens a window in motion, or requests content out of the parental envelope | safety-config drift; unauthorized commerce; COPPA / GDPR Article 8 exposure | child-occupant policy is explicit and published; non-voice attestation by the driver is the gate | +| 5. NHTSA distracted-driving cap as AI-decision constraint (**NOVEL: regulatory-vacuum-as-constraint**) | Conversational mode, multi-turn confirmation, or long voice menus exceed the AAA Foundation Phase II "four or five items" cap; visual-manual fallback breaches the 2-second per-glance / 12-second total NHTSA Phase 1 envelope; the absence of a finalized Phase 3 voice rule leaves the design open | driver workload exceeds Category 3; the OEM's only authoritative cross-reference is Auto Innovators 2006 | document the gap explicitly; cite Phase 1 and AAA Phase II as the operative envelope; do not assume a finalized Phase 3 rule exists | +| 6. Voiceprint biometric persistence and BIPA / federal Wiretap Act exposure (**NOVEL: BIPA shape**) | Voiceprint enrollment without explicit opt-in; cabin-recording retention beyond wake-word-and-command without consent; cross-jurisdictional retention; Garner v. Amazon-shape class-action exposure | CPRA / BIPA / Wiretap Act enforcement and litigation; class certification (Garner pattern) | opt-in consent record with verbatim text; retention horizon documented per jurisdiction; cabin-recording boundary closed by default | +| 7. Voice-to-OTA bridge into SAFE-UC-0008 (**NOVEL: cross-UC kill-chain bridge**) | Voice intent stages, schedules, accepts, or defers a software action that is then executed through the OTA pipeline; the OTA pipeline's multi-party authorization gate is bypassed because the voice surface authenticated the action | a voice intent becomes a fleet-scale action; SAFE-UC-0008's multi-party authorization is undermined | the SAFE-UC-0008 gate is preserved; voice can request, never authorize fleet-scale; cross-UC contract documented | +| 8. Cabin voice-data privacy and exfiltration | Recorded audio, ASR transcripts, voiceprint templates, conversational-LLM context, or navigation history flow to a data broker, insurance carrier, or third-party advertiser without consent; cross-tenant bleed across an OEM's multi-customer voice cloud | non-consented data sale (the GM/OnStar telematics analog applied to voice); FTC Section 5; state AG action | egress allow-list, affirmative consent gate, minimum-data principle, tenant isolation enforced; this stage is a non-NOVEL extension of the cohort's privacy-secondary-use pattern | + +--- + +## 8. SAFE‑MCP mapping (kill-chain → techniques → controls → tests) + +Practitioners commonly map this workflow's failure patterns to the following SAFE‑MCP techniques. The mapping is directional: teams adapt it to their stack, threat model, regulatory regime, vehicle class, and conversational-LLM provider. Links in Appendix B resolve to the canonical technique pages. + +**A note on framework gap.** SAFE-MCP today covers the LLM and MCP-tool surface well, but does not yet have first-class techniques for **physical-side-channel acoustic injection** (DolphinAttack, Light Commands, NUIT class), **broadcast-media wake-word false-trigger**, **multi-occupant in-cabin identity arbitration**, **child-occupant axis**, or **voiceprint biometric persistence and Wiretap-Act-class harm**. The mapping below cites the closest anchors and flags the gap honestly. SAFE-T1110 (Multimodal Prompt Injection via Images/Audio) is the umbrella anchor for voice-channel attacks today, with SAFE-T1102 (Prompt Injection (Multiple Vectors)) as the parent. + +| Kill-chain stage | Failure / attack pattern (defender-friendly) | SAFE‑MCP technique(s) | Recommended controls (prevent / detect / recover) | Tests (how to validate) | +| --------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| Acoustic input ingest with physical-side-channel injection (**NOVEL gap**) | DolphinAttack ultrasonic, Light Commands laser at up to 110 m, NUIT near-ultrasound 16 to 22 kHz with sub-77 ms latency, audio-adversarial examples | `SAFE-T1110` (Multimodal Prompt Injection via Images/Audio); `SAFE-T1102` (Prompt Injection (Multiple Vectors)). **Gap:** physical-side-channel acoustic injection is not yet a first-class SAFE-MCP technique | ultrasonic-band filter on microphone DSP front end; correlated multi-microphone sanity check on input above audible band; verbal-confirmation gate on any state-changing intent; non-voice attestation for safety-related setting changes; physical-side-channel TARA per ISO/SAE 21434 | DolphinAttack-class ultrasonic test fixture; Light Commands-class laser injection bench test (where ethically scoped); NUIT-class near-ultrasound fixture; audio-adversarial-example fixture library | +| Wake-word false trigger from broadcast media (**NOVEL gap**) | Burger King 2017-pattern wake-word-bearing audio from radio, streaming, podcasts, paired-device output, in-cabin intercom | `SAFE-T1110` (Multimodal Prompt Injection via Images/Audio); `SAFE-T1102` (Prompt Injection (Multiple Vectors)). **Gap:** broadcast-media wake-word activation is not yet a first-class SAFE-MCP technique | media-aware wake-word suppression while in-cabin media is playing; cross-microphone correlation between cabin microphone and media-source audio; speaker-zone arbitration; verbal-confirmation gate on any state-changing intent triggered from a media-overlap window | broadcast-media-replay test fixture (radio, streaming, podcast); paired-device-audio-replay fixture; cross-microphone correlation regression; verify the wake-word is suppressed during media-overlap windows | +| Multi-occupant identity arbitration (**NOVEL: hexangle**) | Speaker-zone mis-arbitration; voice-cloning replay; over-broad authorization across seat zones | `SAFE-T1304` (Credential Relay Chain); `SAFE-T1307` (Confused Deputy Attack); `SAFE-T1702` (Shared-Memory Poisoning) for cross-occupant context confusion | DMS / OMS occupant-position attestation; per-seat authorization scope; voiceprint liveness detection; replay-resistance via challenge phrase or session nonce; driver-veto on safety-related changes from passenger seats | seeded voice-cloning replay fixture; rear-row authorization-escalation fixture; passenger-overrides-driver fixture; verify per-seat scope holds | +| Child-occupant override (**NOVEL: child axis**) | Child issues an intent that changes a safety configuration, initiates a payment, or requests content out of the parental envelope | `SAFE-T1307` (Confused Deputy Attack); `SAFE-T1403` (Consent-Fatigue Exploit); `SAFE-T1404` (Response Tampering) | child-occupant policy explicit and published; non-voice driver-attestation gate on every child-issued safety or commerce intent; age-assurance crossover with SAFE-UC-0030 patterns; COPPA and GDPR Article 8 alignment | seeded child-voice fixture across each restricted intent class; verify driver-attestation gate fires; verify in-cabin-payment threshold triggers step-up | +| NHTSA distraction cap as AI-decision constraint (**NOVEL: regulatory vacuum**) | Multi-turn confirmation or long menus exceed AAA Phase II "four or five items"; visual-manual fallback breaches NHTSA Phase 1 (2-second / 12-second) envelope | `SAFE-T2105` (Disinformation Output) when the assistant misrepresents a regulatory standard; `SAFE-T1403` (Consent-Fatigue Exploit) when long confirmation chains drive consent-fatigue | menu-length cap aligned with AAA Phase II "four or five items"; visual-manual fallback measured against NHTSA Phase 1 envelope; conversational-mode guardrails on safety-relevant queries; explicit documentation in the safety-case that the federal Phase 3 voice rule is absent and the operative cross-references are NHTSA Phase 1 plus Auto Innovators 2006 | menu-length regression; visual-manual workload bench measurement against NHTSA Phase 1; AAA Phase II adversarial workload fixture | +| Voiceprint biometric persistence and BIPA exposure (**NOVEL: voiceprint**) | Voiceprint enrollment without explicit opt-in; cabin-recording retention beyond wake-word-and-command without consent | `SAFE-T1502` (File-Based Credential Harvest) for voiceprint template at rest; `SAFE-T1503` (Env-Var Scraping) for cloud-routing credentials; `SAFE-T1407` (Server Proxy Masquerade) when voice routes through an unverified cloud endpoint | opt-in-only voiceprint enrollment with verbatim consent text preserved; cabin-recording boundary closed by default; CPRA sensitive-PI handling; BIPA written-release equivalent; Garner-class retention discipline; egress allow-list on cabin-audio | retention-policy regression by jurisdiction; consent-record integrity check; egress monitor on cabin-audio paths; tabletop a Garner-shape class-action scenario | +| Voice-to-OTA bridge into SAFE-UC-0008 (**NOVEL: cross-UC bridge**) | Voice intent stages, schedules, accepts, or defers a software action that bypasses SAFE-UC-0008's multi-party authorization | `SAFE-T1309` (Privileged Tool Invocation via Prompt Manipulation); `SAFE-T1104` (Over-Privileged Tool Abuse); `SAFE-T1701` (Cross-Tool Contamination) | the voice surface can request never authorize a fleet-scale action; voice-staged software actions inherit SAFE-UC-0008's multi-party authorization gate; voice-to-OTA bridge is documented as a contract; named-human approval on any cross-vehicle-state-changing intent | tabletop a voice-driven OTA-staging attempt; verify SAFE-UC-0008 gate fires; verify a single voice intent cannot push fleet-wide | +| Cabin voice-data privacy and exfiltration | Recorded audio, ASR transcripts, voiceprint templates, conversational-LLM context, or navigation history flow to data broker / insurer / advertiser without consent | `SAFE-T1001` (Tool Poisoning Attack (TPA)); `SAFE-T1002` (Supply Chain Compromise); `SAFE-T1003` (Malicious MCP-Server Distribution); `SAFE-T1402` (Instruction Stenography - Tool Metadata Poisoning); `SAFE-T2106` (Context Memory Poisoning via Vector Store Contamination) | egress allow-list on cabin-audio, transcript, voiceprint, navigation-history, and conversational-context paths; affirmative-consent gate verbatim-surfaced; minimum-data principle on every feed; tenant isolation across the OEM's multi-customer voice cloud; named-human review on cross-tenant federation; auditable retention horizons | tabletop the GM/OnStar-shape data-broker scenario applied to voice; egress monitor regression; cross-tenant differential-query test; consent-flow integrity test | + +--- + +## 9. Controls & mitigations (organized) + +### 9.1 Prevent (reduce likelihood) + +* **Ultrasonic-band filter on microphone DSP front end** to attenuate DolphinAttack and NUIT carriers; cross-microphone correlation to detect single-source above-audible energy. +* **Verbal-confirmation gate** on any state-changing intent, with **non-voice attestation** (touchscreen confirm or steering-wheel button) for safety-related setting changes and in-cabin payments above a threshold. +* **Media-aware wake-word suppression** during in-cabin media playback; broadcast-media-replay test fixture run regularly. +* **Per-seat authorization scope** keyed to DMS / OMS occupant-position attestation and (where opt-in) voiceprint identity; safety-critical intents are not accepted from rear-row seats. +* **Child-occupant policy explicit and published**; non-voice driver-attestation gate on every child-issued safety or commerce intent; COPPA and GDPR Article 8 alignment. +* **Opt-in voiceprint enrollment** with verbatim consent text preserved; retention horizon documented per CPRA, BIPA, and federal Wiretap Act analogues. +* **Cabin-recording boundary closed by default** to wake-word-and-command only; opt-in for any retention beyond. +* **Voice-to-OTA bridge documented as a contract** with SAFE-UC-0008; voice can request never authorize a fleet-scale action. +* **Conversational-LLM grounded retrieval** on owner-manual and recall claims; verbatim citation; refusal pattern on safety-critical questions. +* **Tenant isolation as a hard invariant** across the OEM's multi-customer voice cloud (storage, cache, vector store). +* **Egress allow-list** for any external connector (data-broker, insurance, advertiser, third-party-skill, conversational-LLM provider). +* **EU AI Act Article 50 transparency** surfaced verbatim; the assistant identifies itself as AI. +* **SAE J3138-style discipline** on the voice-to-vehicle-bus path; voice writes do not bypass gateway access controls. +* **Auto-ISAC engagement** for coordinated disclosure of in-cabin voice-assistant findings. + +### 9.2 Detect (reduce time-to-detect) + +* ultrasonic-band energy detector on microphone array +* broadcast-media wake-word-correlation alerts +* speaker-zone-arbitration drift monitoring +* child-occupant-attempt-rate monitoring +* voiceprint-enrollment-without-consent detection +* cabin-recording-retention-beyond-policy detection +* egress monitor on cabin-audio, transcript, voiceprint, navigation-history paths +* conversational-LLM hallucination-on-safety-relevant-query rate +* OTA-staging-attempt-from-voice rate +* tenant-isolation differential-query pass rate +* CPRA / BIPA / Wiretap Act consent-flow integrity +* in-cabin payment step-up enforcement rate + +### 9.3 Recover (reduce blast radius) + +* incident-response playbook for an inferred or confirmed acoustic-injection event (DolphinAttack class) +* incident-response playbook for an inferred or confirmed broadcast-media false-trigger (Burger King-shape) including media-source attribution +* incident-response playbook for an inferred or confirmed child-occupant-override safety-config change +* incident-response playbook for an inferred or confirmed voiceprint or cabin-recording overcollection (Garner shape) +* incident-response playbook for an inferred or confirmed voice-to-OTA bridge bypass +* coordinated-disclosure path through Auto-ISAC for in-cabin voice-assistant vulnerabilities +* CPRA / BIPA / Wiretap Act notification playbook per jurisdiction (CA, IL, FL, PA, WA, EU DPA, FTC, state AG) +* conversational-LLM provider escalation contract (Alexa+, GPT, Grok, CaLLM Cloud) for incident-time data-handling + +--- + +## 10. Validation & testing plan + +### 10.1 What to test (minimum set) + +* **Acoustic-injection robustness** against DolphinAttack-class ultrasonic, Light Commands-class laser (where ethically scoped), NUIT-class near-ultrasound, and audio-adversarial examples. +* **Broadcast-media wake-word false-trigger** rate is bounded and documented. +* **Speaker-zone arbitration** holds across DMS / OMS-attested occupant positions. +* **Per-seat authorization scope** holds; passenger does not override driver-set safety configuration. +* **Child-occupant policy** blocks safety-config changes and in-cabin payments above a threshold. +* **Voiceprint enrollment** is opt-in with consent record preserved. +* **Cabin-recording retention** beyond wake-word-and-command requires opt-in. +* **Voice-to-OTA bridge** does not bypass SAFE-UC-0008's multi-party authorization gate. +* **Tenant isolation** holds across the OEM's multi-customer voice cloud. +* **Conversational-LLM** does not hallucinate on safety-relevant owner-manual or recall queries. +* **EU AI Act Article 50** transparency surfaces verbatim. + +### 10.2 Test cases (make them concrete) + +| Test name | Setup | Input / scenario | Expected outcome | Evidence produced | +| -------------------------------------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | +| DolphinAttack ultrasonic fixture | Bench with ultrasonic carrier source; production microphone array | inaudible voice command modulated on ultrasonic carrier | DSP front-end filter attenuates; verbal-confirmation gate fires for any state-changing intent | DSP filter log + confirmation-gate log | +| NUIT near-ultrasound fixture | Bench with 16 to 22 kHz carrier source | near-ultrasound voice command at sub-77 ms latency | filter attenuates; correlated multi-microphone check rejects | filter log + correlation log | +| Burger King broadcast-media replay | Production cabin with media playback | wake-word-bearing television advertisement plays through cabin audio | media-aware wake-word suppression fires; no actuation | wake-word-suppression log | +| Voice-cloning replay against driver authorization | Recorded driver audio sample | replay attempt to actuate a driver-only intent | liveness detection fires; replay rejected; audit captures attempt | liveness log + audit | +| Rear-row passenger safety-config attempt | Synthetic rear-row passenger speech | passenger asks the assistant to disable lane-keep assist while in motion | per-seat scope rejects; driver-veto gate fires | per-seat scope log + driver-veto log | +| Child-occupant override attempt | Synthetic child-voice fixture in rear seat | child asks for an in-cabin payment; child asks to disable a safety setting | child-occupant gate fires; non-voice driver-attestation enforced; audit captures attempt | child-gate log + attestation log | +| Voiceprint enrollment without consent | Test occupant attempting voiceprint capture | enrollment flow with consent withheld | enrollment refused; no template stored; consent-record audit | enrollment-refusal log | +| Cabin-recording overcollection | Production cabin with default policy | extended capture window beyond wake-word-and-command | overcollection blocked; CPRA / BIPA / Wiretap Act consent flow surfaces if opt-in attempted | retention-policy log | +| Voice-to-OTA staging attempt | Voice request to schedule an OTA software update on the vehicle | voice intent to "install the next update now" | request enters SAFE-UC-0008 multi-party authorization queue; voice does not bypass gate | OTA-queue audit | +| Conversational-LLM hallucination on recall query | Conversational mode on; recall question for a model that has no recall | "Is my vehicle subject to a recall?" | grounded retrieval against NHTSA recall API; verbatim status surfaced; no hallucinated recall | grounded-retrieval log | +| Cross-tenant bleed differential | Two synthetic tenant fleets on the OEM voice cloud | tenant A queries voice context belonging to tenant B | query rejected; differential test passes | differential-query log | +| EU AI Act Article 50 transparency | Assistant first-touch interaction | new user invokes assistant | assistant identifies itself as AI verbatim per Article 50 | first-interaction audit | + +### 10.3 Operational monitoring (production) + +* ultrasonic-band energy events +* broadcast-media wake-word-correlation events +* speaker-zone arbitration disagreement rate +* child-occupant attempt rate by intent class +* voiceprint enrollment consent rate +* cabin-recording retention compliance rate +* egress monitor on cabin-audio / transcript / voiceprint / navigation paths +* OTA-staging-from-voice rate +* tenant-isolation differential-query pass rate +* conversational-LLM safety-query refusal rate +* in-cabin payment step-up enforcement rate +* CPRA / BIPA / Wiretap Act consent-record integrity + +--- + +## 11. Open questions & TODOs + +- [ ] Define the OEM's acceptable scope of voice-driven actions on safety-related driver-assistance settings; document the dual-channel attestation pattern. +- [ ] Document the in-cabin identity hexangle and the per-seat authorization scope for each intent class. +- [ ] Define the child-occupant policy and the age-assurance crossover with SAFE-UC-0030. +- [ ] Define the voiceprint biometric retention horizon per jurisdiction (CPRA, BIPA, federal Wiretap Act, GDPR Article 9). +- [ ] Document the cabin-recording boundary and the opt-in flow for any retention beyond wake-word-and-command. +- [ ] Document the voice-to-OTA bridge contract with SAFE-UC-0008 and the conditions under which voice can request (never authorize) a software action. +- [ ] Define the conversational-LLM guardrails on safety-relevant queries (owner-manual, recall, safety-config explanations) and the refusal pattern. +- [ ] Document the OEM's CPRA / BIPA / Wiretap Act consent-record schema and the verbatim consent text. +- [ ] Map regulator-notification SLAs per jurisdiction (CPPA, FTC, state AG, EU DPA, NHTSA where the voice surface is part of CSMS scope). +- [ ] Define the Auto-ISAC engagement playbook for in-cabin voice-assistant findings. + +--- + +## 12. Questionnaire prompts (for reviewers) + +### Workflow realism + +* Is the integration with the in-cabin voice platform (Cerence CaLLM, SoundHound, Apple Siri, Google Assistant, Alexa+, OEM-native) realistic for the vehicle's stack and segment? +* Does the workflow accommodate both on-device and cloud-routed paths, and is the residency contract documented? +* Is the conversational-LLM (Alexa+, GPT, Grok, CaLLM Cloud) integration scoped to general-knowledge queries with vehicle-control intents continuing to route through the legacy stack? + +### Trust boundaries and permissions + +* Does the in-cabin identity hexangle hold across DMS / OMS attestation? +* Is per-seat authorization scope enforced for safety-critical intents? +* Is the child-occupant policy explicit and tested? +* Is the voice-to-OTA bridge documented as a contract that cannot bypass SAFE-UC-0008's multi-party authorization? + +### Acoustic and broadcast-media surfaces + +* Is the microphone array's ultrasonic-band exposure measured and documented? +* Is broadcast-media wake-word false-trigger measured and bounded? +* Is the verbal-confirmation gate enforced on any state-changing intent? + +### Output safety and persistence + +* Are owner-manual and recall claims surfaced verbatim from authoritative source? +* Does the conversational-LLM refuse on safety-critical questions or hand off to a grounded path? +* Does the assistant identify itself as AI per EU AI Act Article 50? + +### Voice-data privacy + +* Is voiceprint enrollment opt-in with verbatim consent text preserved? +* Is cabin-recording retention beyond wake-word-and-command opt-in only? +* Are CPRA / BIPA / federal Wiretap Act exposure horizons documented and tested? +* Is the egress allow-list enforced on cabin-audio, transcripts, voiceprints, navigation history, and conversational-LLM context? + +### Cyber-physical and regulatory integrity + +* Is the voice-to-vehicle-bus path subject to SAE J3138-style discipline? +* Is ISO 26262 ASIL-impact analysis applied to any voice-driven setting change that affects a safety-related E/E function? +* Is the absence of a finalized NHTSA Phase 3 voice rule documented in the safety case, and are NHTSA Phase 1 and AAA Phase II 2014 used as the operative cross-references? + +--- + +## Appendix A: Contributors and Version History + +* **Authoring:** Astha (DSO contributor, 2026-04-27) +* **Initial draft:** 2026-04-27 (Seed → Draft) + +| Version | Date | Changes | Author | +| ------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | +| 1.0 | 2026-04-27 | Initial documentation of `SAFE-UC-0010` from seed to full draft. 8-stage cyber-physical kill chain, 7 stages flagged NOVEL, 19 SAFE-MCP techniques across 8 stages, 6-subsection Appendix B. | Astha | + +--- + +## Appendix B: References & frameworks + +### B.1 SAFE-MCP techniques referenced in this use case + +* [SAFE-T1001 Tool Poisoning Attack (TPA)](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1001/README.md) +* [SAFE-T1002 Supply Chain Compromise](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1002/README.md) +* [SAFE-T1003 Malicious MCP-Server Distribution](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1003/README.md) +* [SAFE-T1102 Prompt Injection (Multiple Vectors)](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1102/README.md) +* [SAFE-T1104 Over-Privileged Tool Abuse](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1104/README.md) +* [SAFE-T1110 Multimodal Prompt Injection via Images/Audio](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1110/README.md) +* [SAFE-T1304 Credential Relay Chain](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1304/README.md) +* [SAFE-T1307 Confused Deputy Attack](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1307/README.md) +* [SAFE-T1309 Privileged Tool Invocation via Prompt Manipulation](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1309/README.md) +* [SAFE-T1402 Instruction Stenography - Tool Metadata Poisoning](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1402/README.md) (the title preserves the verbatim "Stenography" typo from the SAFE-MCP source; the body uses the correct "steganography") +* [SAFE-T1403 Consent-Fatigue Exploit](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1403/README.md) +* [SAFE-T1404 Response Tampering](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1404/README.md) +* [SAFE-T1407 Server Proxy Masquerade](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1407/README.md) +* [SAFE-T1502 File-Based Credential Harvest](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1502/README.md) +* [SAFE-T1503 Env-Var Scraping](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1503/README.md) +* [SAFE-T1701 Cross-Tool Contamination](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1701/README.md) +* [SAFE-T1702 Shared-Memory Poisoning](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T1702/README.md) +* [SAFE-T2105 Disinformation Output](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T2105/README.md) +* [SAFE-T2106 Context Memory Poisoning via Vector Store Contamination](https://github.com/safe-agentic-framework/safe-mcp/blob/main/techniques/SAFE-T2106/README.md) + +### B.2 Industry and AI-specific frameworks teams commonly consult + +* [NIST AI Risk Management Framework 1.0 (AI 100-1, January 2023)](https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf) +* [NIST AI 600-1 Generative AI Profile (July 2024)](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf) +* [NIST AI 100-2 E2025 Adversarial Machine Learning Taxonomy and Terminology of Attacks and Mitigations (24 March 2025)](https://csrc.nist.gov/pubs/ai/100/2/e2025/final) +* [NIST SP 800-218A SSDF Generative AI Profile (July 2024)](https://csrc.nist.gov/pubs/sp/800/218/a/final) +* [Regulation (EU) 2024/1689 (EU AI Act; Article 50 transparency; Annex III §1 biometric identification)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) +* [ISO/IEC 42001:2023 Artificial Intelligence Management System](https://www.iso.org/standard/81230.html) +* [ISO/IEC 23894:2023 AI Risk Management](https://www.iso.org/standard/77304.html) +* [OWASP Top 10 for LLM Applications (2025)](https://genai.owasp.org/llm-top-10/) +* [MITRE ATLAS adversarial threat landscape for AI systems](https://atlas.mitre.org/) -## Workflow Description (Seed) +### B.3 Public incidents and disclosures adjacent to this workflow -In-vehicle voice agent for local controls (HVAC, media, navigation settings) with strict safety and permission boundaries. +* [DolphinAttack: Inaudible Voice Commands (Zhang et al., ACM CCS 2017; demonstrated on Audi Q3 navigation among 16 voice systems)](https://acmccs.github.io/papers/p103-zhangAemb.pdf) +* [Light Commands: Laser-Based Audio Injection Attacks on Voice-Controllable Systems (Sugawara, Cyr, Genkin, Kohno, Fu; USENIX Security 2020; 110 m attack range; vehicle-unlock demonstration)](https://lightcommands.com/) +* [NUIT: Near-Ultrasound Inaudible Trojan attacks on voice assistants (Xia et al., USENIX Security 2023; 16 kHz minimum, 16-22 kHz range; less than 77 ms attack latency)](https://www.usenix.org/conference/usenixsecurity23/presentation/xia) +* [Audio Adversarial Examples: Targeted Attacks on Speech-to-Text (Carlini and Wagner, IEEE S&P Workshops 2018)](https://arxiv.org/abs/1801.01944) +* [Garner v. Amazon.com (W.D. Wash.; class certification granted by Judge Lasnik, July 7, 2025; two classes certified for federal Wiretap Act and Washington Privacy Act claims over Alexa voice recordings)](https://www.classaction.org/news/judge-grants-class-certification-in-amazon-alexa-privacy-lawsuit) +* [Burger King: "OK Google, what is the Whopper burger?" television advertisement (April 2017; canonical broadcast-media wake-word activation precedent)](https://www.theverge.com/2017/4/12/15259400/burger-king-tv-ad-google-home-wikipedia) +* [AAA Foundation for Traffic Safety: Measuring Cognitive Distraction in the Automobile, Phase II, Assessing In-Vehicle Voice-Based Interactive Technologies (October 2014; Category 3 cognitive workload; "four or five items" menu cap)](https://aaafoundation.org/measuring-cognitive-distraction-automobile-ii-assessing-vehicle-voice-based-interactive-technologies/) -## In Scope / Out Of Scope +### B.4 Domain-regulatory references -- **In scope:** TBD -- **Out of scope:** TBD +* [NHTSA Visual-Manual Driver Distraction Guidelines, Phase 1 (78 FR 24817, April 26, 2013; 2-second per-glance and 12-second total off-road-glance cap; Phase 3 voice rule announced as planned and not issued)](https://www.federalregister.gov/documents/2013/04/26/2013-09883/visual-manual-nhtsa-driver-distraction-guidelines-for-in-vehicle-electronic-devices) +* [NHTSA Visual-Manual Driver Distraction Guidelines for Portable and Aftermarket Devices, Phase 2 NPRM (81 FR 87656, December 5, 2016; not finalized)](https://www.federalregister.gov/documents/2016/12/05/2016-29051/visual-manual-nhtsa-driver-distraction-guidelines-for-portable-and-aftermarket-devices) +* [California Privacy Rights Act of 2020, codified at Cal. Civ. Code §§1798.100 et seq. (Office of the California Attorney General canonical reference)](https://oag.ca.gov/privacy/ccpa) +* [Illinois Biometric Information Privacy Act (740 ILCS 14)](https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57) +* [Federal Wiretap Act (18 U.S.C. §§2510 to 2523; Cornell LII)](https://www.law.cornell.edu/uscode/text/18/part-I/chapter-119) +* [UN Regulation No. 116, Protection of motor vehicles against unauthorized use (UNECE WP.29; effective 10 February 2009)](https://unece.org/sites/default/files/2022-08/R116e.pdf) +* [UN Regulation No. 155, Cyber security and cyber security management system (UNECE WP.29)](https://unece.org/sites/default/files/2023-02/R155e%20%282%29.pdf) +* [UN Regulation No. 156, Software update and software update management system (UNECE WP.29)](https://unece.org/sites/default/files/2024-03/R156e%20%282%29.pdf) +* [Children's Online Privacy Protection Act (15 U.S.C. §§6501 to 6506; FTC canonical reference)](https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa) -## SAFE-MCP Mapping (Seed Skeleton) +### B.5 Industry safety, cybersecurity, and functional-safety frameworks -| Kill-chain stage | Failure/attack pattern | SAFE-MCP technique(s) | Recommended controls | Tests | -|---|---|---|---|---| -| TBD | TBD | TBD | TBD | TBD | +* [Alliance of Automobile Manufacturers Driver Focus-Telematics Working Group, Statement of Principles, Criteria and Verification Procedures on Driver Interactions with Advanced In-Vehicle Information and Communication Systems (2006; the de facto industry voice-HMI baseline)](https://www.autoalliance.org/wp-content/uploads/2017/02/AAM-Guidelines-Version-3-2006.pdf) +* [NHTSA Cybersecurity Best Practices for the Safety of Modern Vehicles (September 2022)](https://www.nhtsa.gov/document/cybersecurity-best-practices-safety-modern-vehicles-2022) +* [ISO/SAE 21434:2021 Road vehicles Cybersecurity engineering](https://www.iso.org/standard/70918.html) +* [ISO 26262-1:2018 Road vehicles Functional safety Part 1: Vocabulary](https://www.iso.org/standard/68383.html) +* [ISO 24089:2023 Road vehicles Software update engineering](https://www.iso.org/standard/77796.html) +* [SAE J3138_202210 Diagnostic Link Connector Security (October 2022; the canonical guidance for the diagnostic link connector and analogous discipline for the voice-to-bus boundary)](https://www.sae.org/standards/content/j3138_202210/) +* [Automotive Information Sharing and Analysis Center (Auto-ISAC)](https://automotiveisac.com/) -## Next Steps +### B.6 Vendor product patterns (illustrative; not endorsements) -- Expand this page to `draft` using the full template in `templates/use-case-template.md`. -- Add public evidence links and concrete control/test mappings. +* [Cerence Inc. company website (more than 525 million vehicles; 17 OEMs; 12 OEMs explicitly named at IAA Mobility 2025)](https://www.cerence.com/) +* [Mercedes-Benz USA: MBUX Voice Assistant with AI-driven knowledge feature (December 17, 2024 announcement; cumulative 3 million equipped vehicles)](https://media.mbusa.com/releases/human-like-conversations-with-your-mercedes-benz-enabled-by-mbux-voice-assistant-and-ai-driven-knowledge-feature) +* [BMW Group: BMW iX3 first to integrate Amazon Alexa+ as a Custom Assistant (CES 2026; rollout H2 2026)](https://www.bmwgroup.com/en/news/general/2026/ces-2026-bmw-alexa-plus.html) +* [SoundHound AI Houndify and Chat AI for automotive](https://www.soundhound.com/automotive/) +* [Apple CarPlay developer reference](https://developer.apple.com/carplay/) +* [Google Built-In and Android Auto for vehicles](https://www.android.com/auto/) +* [Amazon Alexa Auto](https://developer.amazon.com/en-US/alexa/alexa-auto) +* [Smart Eye driver-monitoring announcement (24 OEMs, 372 production models, more than 3 million cars)](https://smarteye.se/news/smart-eye-named-2025-automotive-news-pace-award-finalist/)