  Due to the open nature of voice input, voice assistant (VA) systems (e.g.,
Google Home and Amazon Alexa) are under a high risk of sensitive information
leakage (e.g., personal schedules and shopping accounts). Though the existing
VA systems may employ voice features to identify users, they are still
vulnerable to various acoustic attacks (e.g., impersonation, replay and hidden
command attacks). In this work, we focus on the security issues of the emerging
VA systems and aim to protect the users' highly sensitive information from
these attacks. Towards this end, we propose a system, WearID, which uses an
off-the-shelf wearable device (e.g., a smartwatch or bracelet) as a secure
token to verify the user's voice commands to the VA system. In particular,
WearID exploits the readily available motion sensors from most wearables to
describe the command sound in vibration domain and check the received command
sound across two domains (i.e., wearable's motion sensor vs. VA device's
microphone) to ensure the sound is from the legitimate user.
