Listening to disorder: acoustic physical unclonable functions for audio-enabled secure authentication

Listening to disorder: acoustic physical unclonable functions for audio-enabled secure authentication | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article Listening to disorder: acoustic physical unclonable functions for audio-enabled secure authentication Yu Wang, Ying-Hao Fu, Zi-Ting Wang, Xin-Yu Cheng, Tao Wang, Yanqing Lu This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-9353152/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted You are reading this latest preprint version Abstract Acoustic signals offer a rich yet largely untapped physical medium for secure information encoding, anti-counterfeiting, and authentication. Here, we introduce an acoustic physical unclonable function (A-PUF) that leverage ubiquitous sound as an unpredictable excitation to generate high-entropy physical signatures. The A-PUFs are based on a composite magnetic medium comprising chromium dioxide microparticles embedded within a silk fibroin matrix, in which stochastic acoustic fluctuations interact with microscale magnetic-domain disorder to produce responses that are intrinsically unclonable and irreproducible. The resulting A-PUFs uniquely integrate human-accessible audio outputs with hardware-based security, achieving a unique convergence of usability and protection. Meanwhile, the A-PUFs demonstrate excellent reconfigurability and strong resistance to machine-learning attacks, while remaining fully compatible with standard playback technologies. We demonstrate multi-channel anti-counterfeiting via frequency-domain encoding and implement multi-dimensional security by constructing hybrid acoustic-optical labels. This work establishes A-PUFs as a scalable and practical paradigm for advanced anti-counterfeiting and information protection technologies. Physical sciences/Materials science/Condensed-matter physics/Magnetic properties and materials Physical sciences/Physics/Applied physics/Acoustics Figures Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 Introduction Sound, as a ubiquitous and information-rich physical signal, offers a versatile medium for information encoding and storage. Acoustic signals encode data across frequency, amplitude, phase, and temporal domain 1 , 2 , and uniquely travel through opaque environments without requiring line-of-sight conditions 3 – 5 . Beyond their communicative function, they intrinsically embed system-dependent physical fingerprints arising from generation, propagation, and recording processes. Such multimodal encoding and environmental sensitivity have recently attracted interest in acoustic sensing 6 , 7 and recognition systems 8 , 9 , yet their potential for physically rooted security remains largely unexplored. In particular, the absence of a materialized acoustic labeling framework has limited the translation of recorded sound from a signal-level descriptor to a hardware-level security element. Existing audio authentication strategies predominantly operate in the digital domain by assessing the integrity of the signal itself. Conventional approaches include the active embedding of imperceptible feature signals, such as acoustic watermarking 10 – 13 , and passive identification based on descriptors such as frequency spectra, temporal envelopes, energy distributions, and noise patterns to establish identity 14 – 17 . While these methods are cost-effective and readily deployable, their security is increasingly undermined by the rapid advancement of high-fidelity audio synthesis and deepfake technologies, which can convincingly replicate or manipulate acoustic signatures. Deep learning approaches have further improved authentication performance by enabling high-dimensional feature extraction 18 – 24 ; however, they typically rely on large-scale datasets and substantial computational resources, and remain susceptible to adversarial attacks. Emerging meta-learning strategies 25 , 26 partially mitigate data dependence, yet they do not fundamentally resolve the vulnerability of algorithmic systems to model-targeted attacks. These challenges call for a foundation shift from algorithmic verification to physically grounded security. Physical unclonable functions (PUFs), which exploit the inherent randomness of physical systems to generate unique and irreproducible response 27 – 30 , offer such a paradigm. By translating microscopic physical disorder into a measurable and distinctive output, PUFs provide a hardware-rooted mechanism for authentication that is virtually impossible to replicate or predict. Within this context, acoustics represents an unconventional yet powerful modality for PUF implementation. The formation of a recorded acoustic signal is governed by coupled stochastic processes spanning sound generation, environmental propagation and material transduction. As a result, even nominally identical recording conditions can produce distinct waveform signatures. Critically, when acoustic signals are recorded onto a physical medium, intrinsic material inhomogeneities impose random, spatially varying modulations on the stored signal. For example, in magnetic recording media, microscopic disorder in magnetic domains introduces stochastic encoding variations that couple with the acoustic waveform fluctuations, producing a medium-specific, irreproducible fingerprint. This coupling of signal-level variability and material-level disorder offers a fundamentally new pathway for constructing high-security PUFs. Here, we introduce an acoustic physical unclonable function (A-PUF) that exploits recorded sound within a magnetic strip composed of chromium dioxide (CrO 2 ) microparticles embedded in a silk fibroin (SF) matrix as a robust source of physical entropy. Distinct from prior PUF implementations based solely on structural randomness, our approach integrates stochastic acoustic excitation with intrinsic material disorder to generate unique, irreproducible responses. We show that each recording event produces characteristic temporal and spectral signatures governed by this coupled variability, enabling robust authentication and cryptographic key generation. Importantly, the encoded signals remain human-perceptible, allowing simultaneous information storage and verification within a single platform. The resulting A-PUF labels are reconfigurable, and exhibit strong resilience against machine learning (ML) evaluated using multiple models. Furthermore, we demonstrate multi-channel anti-counterfeiting through frequency-division encoding, and multidimensional acoustic-optical hybrid labels that integrate structural color, phosphorescence, and audio functionalities. Results A-PUF labels with coupled audio and security channels Conventional PUF systems generate device-specific physical fingerprints, but their functionality is typically confined to an authentication task. They do not intrinsically carry meaningful user-level information, nor do they provide an intuitive human-machine interface. In contrast, the A-PUF platform developed here uniquely merges concealed, retrievable audio information with hardware-embedded physical unclonability within a single material system (Fig. 1 a). This dual functionality transforms the A-PUF from a passive security element into an active information medium—one that is simultaneously machine-verifiable and human-interpretable. The A-PUF is constructed by embedding CrO 2 microparticles within a SF matrix to form a flexible magnetic composite strip capable of storing and transducing acoustic information. Owing to the broad size distribution of CrO 2 microparticles, the resulting composite exhibits a stratified microstructure characterized by a macroscopically continuous yet microscopically stochastic, undulating bilayer interface between the CrO 2 domain and the overlying SF matrix. Upon magnetization, these microstructural irregularities translate directly into spatially random fluctuations in local magnetic field strength (Fig. 1 b). When a magnetic read head scans the strip, this chaotic field distribution modulates the induced voltage, resulting in position-dependent variations that encode a unique acoustic response. Figure 1 c illustrates the working principle of the A-PUF. Audio recording in the A-PUF is achieved via electromagnetic induction. During the writing process, acoustic waves are first transduced into a time-varying electrical signal, which is subsequently converted by the magnetic head into a spatial arrangement of magnetized CrO 2 microparticles embedded within the A-PUF strip. During playback, the magnetic signal stored in the A-PUF is reconverted through a “magnetic-electrical-acoustic” transformation 31 , recovering the original audio content (i.e., the information channel). Simultaneously, the raw electrical signal acquired during playback can be sampled and visualized to generate a time-domain waveform diagram that exhibits pronounced stochastic variations in amplitude, frequency components, and temporal profiles, thereby constituting a parallel security channel. Notably, the final randomness of the waveform after Mel-frequency cepstral coefficient (MFCC) processing stems from the convolution of two independent entropy sources: the intrinsic stochasticity of the acoustic signal and the irreversible physical disorder of the magnetic medium. This coupling produces a robust set of challenge-response pairs (CRPs). By applying threshold segmentation and binarization to the Mel spectrum coefficient matrix, a high-entropy binary bitstream is generated, serving as a unique and irreproducible “identity marker” for the A-PUF. Ultimately, authentication is achieved by verifying this bitstream, thereby discriminating genuine from forged audio signals. The A-PUF labels demonstrate exceptionally high encoding capacity because the rich acoustic features enable a dense accumulation of data per area. Unlike traditional PUFs with fixed CRPs, the A-PUF design allows stored audio content to be dynamically updated or rewritten without affecting the underlying physical randomness, supporting reconfigurable anti-counterfeiting strategies. Additionally, A-PUFs are naturally resistant to ML attacks. The stochastic magnetic landscape randomly modulates the stored acoustic features, generating highly random bitstreams without learnable patterns, while the high frame rate and feature dimensionality together introduce sufficient entropy to hinder model-based prediction or simulation. Beyond acoustic data, the SF matrix offers a flexible platform for adding extra optical channels into the same label, enabling multi-dimensional authentication. Importantly, these labels can be read using simple, widely available audio readout devices, providing a scalable and low-cost solution for data collection and verification. The favorable features of the A-PUFs are summarized in Fig. 1 d. Compared with conventional electrical and optical PUFs, A-PUFs offer distinct advantages in entropy generation, overall PUF performance, and functional integration (Supplementary Table S1 ). Acoustic performance characterization The audio information in A-PUF labels is encoded through the magnetization of embedded CrO 2 microparticles; consequently, the CrO 2 loading governs both the magnetic response of the label and the fidelity of audio recording. A series of composites with varying CrO 2 -to-SF fibroin mass ratios was therefore prepared. As shown in Fig. 2 a, c, the remanent magnetization of the A-PUF labels increases markedly with increasing CrO 2 content. When the same audio waveform is written onto these samples, the reconstructed signals exhibit a monotonic increase in average loudness with CrO 2 loading (Fig. 2 b, c). However, higher CrO 2 loadings markedly degrade mechanical integrity, as evidenced by a sharp reduction in fracture strain that increases susceptibility to mechanical failure during handling and readout (Fig. 2 c, Supplementary Fig. S1 ). Balancing magnetic readability against mechanical robustness, we identify a CrO 2 -to-SF mass ratio of 3:10 as the optimal formulation, which delivers sufficient audio fidelity while maintaining mechanical resilience suitable for practical deployment. Building on the optimized composition, we examined the structural morphology and acoustic response of the A-PUF labels. Cross-sectional scanning electron microscopy (SEM) imaging of the A-PUF strip (Fig. 2 d) reveals a heterogeneous bilayer architecture, with CrO 2 particles of varying sizes predominantly enriched on one side of the SF film. These magnetic particles form a randomly undulating interface with the SF-rich layer, resulting in a non-uniform magnetic layer thickness across the structure. Upon magnetization, this spatially irregular configuration induces region-dependent magnetic responses, which in turn translate into intrinsically stochastic modulation of the acoustic readout. Consistent with this mechanism, when a 600 Hz single-frequency tone is written and subsequently read out from an A-PUF label (Fig. 2 e), the reconstructed signal exhibits pronounced, irregular amplitude fluctuations with non-periodic peaks and troughs, despite the simplicity of the input (Fig. 2 f). Beyond the intrinsic microstructure of the A-PUF labels, the properties of the input sound source (including intensity, frequency, and waveform) critically govern the encoding process. Reducing the input loudness from 100% to 30% leads to a proportional decrease in output signal amplitude (Fig. 2 g, Supplementary Fig. S2), reflecting weaker magnetization induced in the CrO 2 -based recording layer at lower acoustic intensities. The input frequency further determines the spectral distribution of the readout signal, with higher frequencies producing correspondingly high-frequency-dominated outputs and lower frequencies shifting the spectral content downward (Fig. 2 h-j). Leveraging this frequency selectivity, multiple sound sources with distinct carrier frequencies can be integrated on a single platform (Fig. 2 k), thus enhancing the information capacity of the system. In addition, under identical frequency and amplitude conditions, different input waveforms generate distinct and reproducible output signatures (Supplementary Fig. S3), demonstrating the capacity of A-PUF labels to encode complex acoustic information beyond simple intensity or frequency modulation. Digital Encoding and Performance Evaluation of A-PUFs To quantitatively evaluate A-PUF performance, their acoustic responses were converted into stable, information-dense digital signatures suitable for statistical analysis. Under controlled measurement conditions, the acoustic output of each label was recorded and digitally sampled, followed by feature extraction using MFCC analysis (Fig. 3 a, and Supplementary Fig. S4 and Note S1). To preserve fine spectral-temporal details and maximize information entropy, a one-second segment of the spoken phrase “silkoptics” was acquired at a sampling rate of 48 kHz (Fig. 3 b). The recorded signals were subsequently transformed into a log-Mel spectrogram matrix (Fig. 3 c) and the corresponding MFCC feature set (Fig. 3 d). The MFCC dataset were binarized using the adaptive thresholds for each dimension, assigning “1” to values above the median and “0” to those below. The resulting binarized maps (Fig. 3 e) exhibit highly irregular distributions, highlighting the inherent randomness and uniqueness required for reliable PUF operation. To quantitatively evaluate the performance of the A-PUF, we analyzed three key statistical parameters—bit uniformity, uniqueness, and repeatability (Supplementary Note S2)—based on characteristic matrix extracted from 30 individual PUF labels. Bit uniformity quantifies the balance between “0” and “1” bits within a PUF response, ideally approaching 0.5 for a truly random binary distribution. As shown in Fig. 3 f, the average bit uniformity values for acoustic samples are 0.5, indicating the emergence of high randomness. Uniqueness, expressed as the average inter-Hamming distance (inter-HD), measures the dissimilarity between responses from different PUFs under the same challenge. The ideal inter-HD value is 0.5, ensuring that each device generates a distinct, unclonable signature. In our A-PUF system, the average inter-HD values are 0.4953 (Fig. 3 g), confirming excellent distinctiveness among different PUF instances. Repeatability, expressed as the intra-Hamming distance (intra-HD), evaluates the stability of a PUF’s response to repeated identical challenges. The ideal intra-HD value is 0, indicating perfect consistency. In our devices, the intra-HDs from the first and second measurements of the same PUF labels give an average value of 0.0717 (Fig. 3 g). The intra-HDs, which are close to the ideal value, ensure the stability of the data stream read from the same PUF during twice measurements (Fig. 3 h), guaranteeing the practical feasibility of A-PUF for real-world authentication. Based on the calculated inter-HD and intra-HD values, we further estimated the verification threshold using Gaussian fitting of each HD distribution (Fig. 3 i). The intersection of the two Gaussian curves defines the optimal decision boundary at an HD threshold of 0.3385, corresponding to a false negative rate (FNR) of 9.8787 × 10⁻ 45 and a false positive rate (FPR) of 2.5122 × 10⁻ 43 . These minimal values demonstrate the robustness and reliability of the authentication performance. We calculated the theoretical encoding capacity of the A-PUF, given by \(\:{C}^{t\times\:n}\) , which represents the maximum number of CRPs that can be generated 32 , 33 . In our work, \(\:C\) is 2, \(\:t\) corresponds to the number of frames for the samples after frame segmentation during MFCC processing, and \(\:n\) corresponds to the MFCC feature dimension. By enabling audio input on both sides of the label, the theoretical coding capacity for a one-second A-PUF reaches 1.7×10 7257 . Increasing the audio duration, the frame number, or the feature dimensionality would further expand the encoding capacity exponentially. For practical deployment, PUF labels must combine reliable authentication with operational robustness against environmental and input perturbations. We therefore systematically evaluated the stability of the A-PUF responses by monitoring the evolution of the HD under variations in acoustic excitation, temperature, humidity, and UV irradiation. To specifically assess tolerance to changes in sound characteristics, the input power and frequency were deliberately modulated to emulate different loudness levels and tonal conditions. Despite these perturbations, the average inter-HD values remain high (> 0.45 for power and > 0.42 for frequency; Fig. 3 j, k), demonstrating that the A-PUF responses are largely insensitive to excitation fluctuations and enabling reliable authentication under diverse real-world audio inputs. Thermal stability was further assessed by comparing responses before and after heat treatment (Fig. 3 l, Supplementary Fig. S5). Samples maintain low intra-HD values below the verification threshold up to 50°C, indicating reproducible signatures and temperature-independent operation. At 60°C, however, intra-HD exceeded the threshold, leading to authentication failure, which is attributed to thermally induced weakening of magnetic domains that destabilizes the acoustic response and degrades signal fidelity. In addition, the A-PUF labels demonstrate adaptability to high-humidity environments and resistance to deep UV light (254 nm, 10 W) exposure. Their performance remains essentially unchanged after 30 days under 70–80% relative humidity or following 24 hours of deep UV exposure. These results demonstrate that the A-PUFs exhibit excellent stability and authentication reliability under normal environmental conditions. Furthermore, the A-PUF costs as little as US $ 0.000073 per square millimeter, benefiting from the use of low-cost materials (Supplementary Note S3), rendering it an economically viable solution for practical anticounterfeiting applications. Reconfigurability of A-PUFs The intrinsic ability of CrO 2 to reversibly redefine its magnetic domain structure under modest external fields (e.g., 150 mT) 34 enables precise modulation of the A-PUF magnetization, allowing reversible erasure and rewriting of recorded audio information (Fig. 4 a). As shown in Fig. 4 b, cyclic recording and erasing of the audio signals “silkoptics”, “丝蛋白光学”, and “melody” yield highly reliable and clearly distinguishable magnetic responses. Furthermore, the label demonstrates remarkable endurance, with the average loudness decreasing by only 3.8% after 100 erase/write cycles using the same acoustic input (Fig. 4 c). This rewritable magnetic behavior underscores the feasibility of developing reconfigurable PUF systems capable of secure data reprogramming and long-term operational stability. Reconfigurable PUFs enable the ability to adapt their challenge-response mapping dynamically while maintaining the device’s core identity and security features. This flexibility directly tackles one of the main vulnerabilities in traditional PUF technology—modeling attacks—while also supporting advanced cryptographic functions like proactive key renewal, revocation, and adaptive authentication. To assess the performance of the A-PUF during reconfiguration, a representative label underwent 100 successive erase/write cycles using the same audio source. Audio data were extracted every tenth cycle for PUF verification. Supplementary Fig. S6 and Fig. 4 d show significant differences in audio waveforms and the related bitstreams across these cycles. The security of these rewritten CRPs was measured using entropy analysis. Reconfigured samples reach an ideal entropy score of 1 (Fig. 4 e), indicating truly random CRPs. The average inter-HD between the original CRP and the 10 rewritten CRPs is 0.4901 (Fig. 4 f), very close to the ideal of 0.5. Additionally, CC analysis among the 11 CRPs shows that identical CRPs have a CC of 1, while different CRPs display much lower CC values (Fig. 4 g), confirming that the rewritten CRPs are non-repetitive and can be considered entirely new, independent identifiers. Overall, these results demonstrate that A-PUFs can deliver reliable, rewritable functionality while preserving high security and reproducibility, representing a major step forward in reconfigurable PUF technology. The resilience of A-PUFs to machine learning-assisted attacks As with other cryptographic technologies, PUFs exist within a continual arms race between attack and defense. Among the various attack strategies, ML has emerged as one of the most powerful and concerning tools for modeling PUF behavior. By training parameterized models on a limited set of known CRPs, attackers can potentially predict unknown CRPs with high accuracy, thereby compromising system security. To evaluate the robustness of the A-PUFs against ML-based modeling attacks, we employed a multi-layer perceptron (MLP) model—an efficient and widely adopted neural network architecture—following methodologies commonly used in PUF security assessments (Supplementary Note S4) 35 . To systematically examine the susceptibility of the A-PUFs, MLP models with different hidden layers (3, 4, 5 layers) were constructed to predict CRPs under varying network complexities (Supplementary Fig. S7). The dataset comprises 25 A-PUFs recorded at a sampling rate of 9 kHz with 100% input power and standard input frequency. Of these, 18 CRPs were used for training, and the remaining for testing. The model employs an adaptive learning algorithm to ensure efficient prediction. As shown in Fig. 4 a-c, the HD, CC, and prediction accuracy were calculated by comparing 5 predicted CRPs with 5 known CRPs for models with 3, 4, and 5 hidden layers, respectively. The results indicate that the HD and CC values remain close to the ideal values of 0.5 and 0, respectively, indicating that the predicted CRPs are statistically uncorrelated with the authentic responses. The prediction accuracy fluctuates near 50%, and shows minimal dependence on network depth. To further evaluate resilience, the dataset was expanded to 100 CRPs, partitioned into training (80%), testing (10%), and validation (10%) subsets. The validation results (Fig. 4 d-f) confirm that the HD and CC values remain near the ideal values of 0.5 and 0, respectively, while the prediction accuracy persists near 50%. Importantly, no improvement in prediction accuracy is observed even as the number of tests increases, confirming that the A-PUF exhibits strong inherent resistance to ML-based modeling attacks. To further evaluate the resistance of the A-PUF against ML attacks, we conducted additional attacks using Fourier regression and generative adversarial network (GAN) models (Supplementary Note S4) 36 . As shown in Fig. 4 g-i, Fourier regression models with different Fourier orders (50, 100, and 200) were constructed to predict CRPs. The validation results across these orders are consistent with those obtained using the MLP model, with the inter-HD and CC values remaining close to the ideal values of 0.5 and 0, respectively, while the prediction accuracy stays near 50%. For the GAN-based attack, two deep neural networks (a generator and a discriminator) were trained in a contrarious framework to minimize the maximum loss. When both networks approached convergence, the attack performance was evaluated. As shown in Fig. 4 j, the resulting HD and CC values again remain close to the ideal values of 0.5 and 0, respectively, with prediction accuracy around 0.5, indicating that the generated responses fail to reproduce the genuine CRPs. These results demonstrate that the A-PUF exhibits strong resistance to ML-based modeling attacks. Moreover, increasing the sampling rate or extending the audio duration would further enhance attack resistance by increasing the complexity and entropy of the underlying data stream. Multichannel and multidimensional counterfeiting applications By embedding rewritable, user-defined audio signals into physical randomness, the A-PUF introduces a new class of multimodal anticounterfeiting labels capable of providing both content-level security and material-level authenticity. More importantly, the encoded audio signal allows for multi-channel information storage and transmission across different frequency domains, significantly boosting information capacity and encryption complexity. To demonstrate this capability, we constructed a triple-frequency-channel anti-counterfeiting label, in which Morse codes representing “physical” (2800 Hz), “unclonable” (1300 Hz), and “functions” (400 Hz) are mixed and recorded onto an A-PUF magnetic strip (Fig. 6 a). Because audio signals at different frequencies interfere when played simultaneously, the written information becomes indistinguishable to conventional playback, providing a primary layer of anti-counterfeiting. Accurate recovery of the message requires frequency-selective separation and ordering of the individual channels using their respective frequencies as decoding “keys”, thereby reconstructing the correct information “physical unclonable functions” (Fig. 6 b, and Supplementary Fig. S8). The extracted information is finally verified through the PUF authentication, establishing an integrated anti-counterfeiting system that spans from information concealment to physical fingerprint validation. Moreover, the inherently functionalizable SF matrix allows the seamless incorporation of additional optical channels into the A-PUF label, enabling the construction of hybrid acoustic-optical systems for multidimensional information encryption and high-security anti-counterfeiting. This capacity is demonstrated by integrating the structural color, phosphorescence, and the audio channels into a single label (Fig. 6 c,d, Supplementary Fig. S9). Based on this integrated label system, we demonstrate its applicability in scenarios involving multi-level anti-counterfeiting and high-security information transmission. We first developed a multi-level anti-counterfeiting label for pharmaceuticals (Fig. 6 e-i), comprising four hierarchically organized layers that collectively form a comprehensive security framework. The first layer leverages the angle-dependent structural color of embedded photonic crystals to display the product name “Aspirin”, providing primary optical authentication under ambient light (Fig. 6 e-ii). The second layer conceals the serial number “2024” in a phosphorescent channel (Fig. 6 e-iii), visible only after 254 nm UV light cessation. The third layer directly encodes an audible “Medicine” message (Fig. 6 e-iv), providing an additional acoustic authentication channel. The fourth A-PUF layer acts as the highest security tier, requiring manufacturers to preregister audio fingerprints in a secure database. End-users can then use portable readers to extract the embedded audio and transmit it to a cloud server for real-time authentication. By combining structural color, phosphorescence, and audio in a multi-channel architecture, this design dramatically enhances the security of pharmaceutical authentication. The rapid proliferation of artificial intelligence (AI)-generated voices has lowered barriers to producing convincing synthetic audio, increasing the risk of fraud. A-PUFs provide a technological solution to this threat by integrating authentication directly into the information carrier. As an illustrative scenario, consider Mr. Red transmitting a confidential message, “Vote for Mr. Green”, to Mr. Blue (Fig. 6 f). To prevent tampering or substitution during transmission, an acoustic-optical coupled PUF label encodes the recipient identifier (“To Mr. Blue”) within the structural color channel, the message is split across acoustic (“Vote for”) and phosphorescence (“Mr. Green”) channels (Fig. 6 f-i, top), minimizing the risk of full-message interception. Attackers, however, can leverage similar fabrication methods and AI-based voice synthesis to produce counterfeit labels carrying falsified information (Fig. 6 f-i, bottom). The high perceptual quality of the visual outputs and forged audio makes routine inspection insufficient to verify authenticity. By activating PUF authentication, Mr. Blue reads the embedded acoustic information and transmits it to a secure backend, enabling reliable verification of the genuine label (Fig. 6 f-ii). The stored message can then be erased via a permanent magnet to prevent secondary leakage. This workflow establishes a comprehensive security protocol, including transmission, content concealment, authenticity verification, and post-read destruction, demonstrating the capacity of A-PUFs to safeguard information integrity against AI-enabled forgeries. Conclusion We have demonstrated the potential of acoustic signatures in developing robust PUF systems with high encoding capacity, reconfigurable architectures, strong ML resistance, and convenient verification methods. By harnessing the inherent stochasticity and non-reproducibility of acoustic wave–medium interactions, A-PUFs expand the concept of hardware security beyond traditional optical or electronic systems. Importantly, the seamless integration of audio information with security authentication within a single system further broadens the functional scope of PUF technologies, moving beyond device-specific physical fingerprints to enable multi-layered, information-rich security solutions. Multi-channel and broadband acoustic encoding strategies, incorporating frequency, phase, temporal, and spatial dimensions, significantly increase the complexity and entropy of acoustic challenge–response pairs. Beyond their strong security performance, A-PUFs benefit from the natural compatibility of sound with human perception and common audio hardware, enabling accessible, low-cost solutions for identity verification, anti-counterfeiting traceability, communication encryption, and secure information transfer. Hybrid authentication schemes integrating A-PUFs with complementary optical, magnetic, or electronic modalities can further strengthen robustness while preserving user-friendly verification. This work establishes a conceptual framework linking the fields of information security and physical acoustics, positioning sound as a universal, human-accessible medium for secure authentication across digital and physical domains. Methods Preparation of SF solution. The SF solution was prepared following established protocols 37 . Briefly, Bombyx mori cocoons were cut into small pieces and boiled in an aqueous Na 2 CO 3 solution (0.02 M) for 30 min to remove sericin. The resulting degummed silk was thoroughly rinsed with deionized water and air-dried at room temperature for 48 h. The dried fibers were subsequently dissolved in LiBr solution (9.3 M) at 60°C to obtain a 20 wt/vol% SF solution. This solution was dialyzed against deionized water for 3 days to remove residual salts, followed by centrifugation at 11,000 rpm for 20 min to eliminate insoluble particulates, yielding a clear and homogeneous SF solution for subsequent use. Pretreatment of CrO 2 . CrO 2 particles were surface-modified with a silica (SiO 2 ) shell to improve their dispersibility within the SF solution. The coating procedure followed a previously reported sol-gel method 38 , 39 . Briefly, pristine CrO 2 powder was first ball-milled at 1,500 rpm for 2 h to reduce particle size and narrow the size distribution. Subsequently, 0.4 g of the milled CrO 2 particles was dispersed in 80 mL of ethanol and ultrasonicated for 5 min to achieve a homogeneous suspension. Aqueous ammonia solution (28 wt%, 6 mL) was then added as a catalyst. Under vigorous stirring (300 rpm), 20 mL of tetraethyl orthosilicate solution in ethanol (2 vol%) was slowly introduced dropwise, and the reaction was allowed to proceed for 3 h at room temperature. The resulting SiO 2 -coated CrO 2 particles were collected by filtration, washed three times with ethanol, and dried at 60°C to obtain the final powder. Preparation of A-PUF label. The silica-coated CrO 2 powder was dispersed in deionized water at a concentration of 0.2 g mL − 1 and ultrasonicated for 10 min to form a homogeneous suspension. This suspension was subsequently mixed with SF solution and glycerol at a mass ratio of CrO 2 : glycerol : SF = 3 : 4 : 10, followed by thorough mechanical stirring to ensure uniform dispersion. The resulting CrO 2 /SF precursor was rapidly cast onto a silicon wafer pretreated with trichloro( 1 H, 1 H, 2 H, 2 H-perfluorooctyl)silane to facilitate film peel-off. The cast film was dried in a sealed chamber under controlled conditions (25°C, 50% relative humidity) for 24 h, yielding freestanding CrO 2 @SF composite film. The dried film was then cut into rectangular strips with dimensions of 50 mm × 3.5 mm to form A-PUF labels. Preparation of room-temperature phosphorescent silk fibroin (RTP-SF) solution. The RTP-SF solution was prepared by mixing an aqueous SF solution (12 wt%, 3 mL) with 3-biphenylboronic acid (5 mg dissolved in 4 mL of deionized water) and ammonium hydroxide (1 mL) 40 . The mixture was stirred at 80°C for 20 min to allow the reaction to proceed. The resulting solution was subsequently dialyzed against deionized water for 48 h to remove unreacted species and low-molecular-weight by-products, yielding the RTP-SF solution. Fabrication of hybrid acoustic-optical labels. Acoustic–optical labels were fabricated by integrating structural color and phosphorescent patterns into the CrO 2 @RTP-SF matrix. Structural color patterns were generated using inverse opal photonic crystals, prepared following previously reported methods 41 , 42 . Briefly, 30 µL of a monodisperse polystyrene microsphere suspension (600 nm diameter, carboxyl-functionalized, 6 wt%, dispersed in a 1:1 water/ethanol mixture; Huge biotechnology) was drop-cast onto the surface of water to form a floating monolayer. Microspheres that sank into the aqueous phase were removed, and a few drops of sodium dodecyl sulfate were added to facilitate the formation of a large-area, hexagonally close-packed PS monolayer at the air-water interface. The self-assembled monolayer was then transferred onto a hydrophobic substrate (silicon wafer treated with trichloro( 1 H, 1 H, 2 H, 2 H-perfluorooctyl)silane). To create patterned opal templates, a commercial CO 2 laser cutter (Speedy100R, Trotec Laser, Austria) was used to selectively remove polystyrene spheres along a predefined path. The laser was operated at 3% of its maximum power, with a scanning speed of 1 step s − 1 . The RTP-SF solution doped with CrO 2 (CrO 2 : glycerol : RTP-SF = 3 : 4 : 10) was poured into the patterned templates to fill all the air voids, followed by drying for 24 h (25 ℃, 30%-40% relative humidity) to form a free-standing CrO 2 @RTP-SF/polystyrene composite film. CrO 2 @RTP-SF film with patterned inverse opal structures was finally obtained by immersing the dried composite film in toluene for 24 h to remove the polystyrene spheres. The resulting master films were cut into rectangular labels (50 mm × 3.5 mm). Phosphorescent patterns were introduced using UV light. Black shadow masks with the desired designs were placed on the CrO 2 @RTP-SF label surfaces, and the films were irradiated with a UV germicidal lamp (G36T5VH, Serve Tool Inc., USA; 254 nm, 40 W) for 30 min at a distance of 2 cm. The UV exposure selectively quenched phosphorescence in the uncovered regions, generating high-resolution patterned RTP features. Audio information recording, reading, and processing. The A-PUF label was affixed to both ends of a magnetic strip detached from a commercial cassette tape using ultrathin adhesive tape, and audio signals generated by human speech or computer playback were recorded onto the strip using a standard cassette recorder. The recorded audio information was retrieved using a tape recorder and then transferred to a computer for digital acquisition. The acquired audio data were subsequently processed and analyzed using Adobe Audition 2024 software. Characterization The cross-sectional morphologies of the A-PUF labels were characterized using a field-emission scanning electron microscope (SEM; S-8100, Hitachi, Japan). Magnetic hysteresis loops of A-PUF labels with varying CrO 2 contents were measured at 300 K using a vibrating sample magnetometer (VSM; Physical Property Measurement System, PPMS-9, Quantum Design, Inc., USA) under an external magnetic field ranging from − 30 to 30 kOe. Photographs were acquired using a digital single-lens reflex camera (EOS 850D, Canon), and videos were recorded at a frame rate of 8 frames per second for phosphorescent information readout. The Young’s modulus of A-PUF labels with different CrO 2 loadings was determined using a universal testing machine (Yiheng, China) at a tensile rate of 4 mm min − 1 . Declarations Competing interests The authors declare no competing interests. Author contributions Y.-Q.L., Y.W., Y.-H.F., and Z.-T.W. conceived the idea and designed the research; Y.-H.F. synthesized and characterized magnetic composite; Z.-T.W. performed PUF performance analysis; T.W. and X.-Y.C. assisted in acoustic performance characterizations; Y.-H.F., Z.-T.W., and Y.W. contributed to the data analysis. Y.-H.F., Z.-T.W., Y.W., and Y.-Q.L. wrote and revised the manuscript. Y.W. and Y.-Q.L. supervised the research. All authors approved the final version of the manuscript. Acknowledgment This work was supported by the National Key R&D Program of China (No.2022YFA1203702, 2021YFA1202000, 2022YFA1405000), the National Natural Science Foundation of China (No. T2488302), and the Natural Science Foundation of Jiangsu Province (No. BK20243067). Data availability The data supporting the findings of this study are available within this article and its Supplementary Information. Additional data are available from the corresponding authors upon reasonable request. Source data are provided with this paper. References Lewicki MS (2002) Efficient coding of natural sounds. Nat Neurosci 5:356–363 Smith EC, Lewicki MS (2006) Efficient auditory coding. Nature 439:978–982 Dowling DR, Sabra KG (2015) Acoustic Remote Sensing. Annu Rev Fluid Mech 47:221–243 Park CI et al (2023) Ultrasonic barrier-through imaging by Fabry-Perot resonance-tailoring panel. Nat Commun 14:7818 Guo Y (2025) Directional sound propagation in acoustic artificial structures. npj Acoust 1:8 Lee K et al (2020) Mechano-acoustic sensing of physiological processes and body motions via a soft wireless device placed at the suprasternal notch. Nat Biomed Eng 4:148–158 Lin Z et al (2024) Insights into Materials, Physics, and Applications in Flexible and Wearable Acoustic Sensing Technology. Adv Mater 36:2306880 Kong Q et al (2020) PANNs: Large-Scale Pretrained Audio Neural Networks for Audio Pattern Recognition. IEEE/ACM Trans Audio Speech Lang Process 28:2880–2894 Wang W et al (2025) A review of speaker verification: Methods, network architectures, tasks and challenges. Eng Appl Artif Intell 162:112351 Bassia P et al (2001) Robust audio watermarking in the time domain. IEEE Trans Multimedia 3:232–241 Hua G et al (2016) Twenty years of digital audio watermarking—a comprehensive review. Sig Process 128:222–242 Zhang X et al (2021) Robust Reversible Audio Watermarking Scheme for Telemedicine and Privacy Protection. Comput Mater Continua 71:3035–3050 Wen S et al (2025) Robust Audio Watermarking Against Manipulation Attacks Based on Deep Learning. IEEE Signal Process Lett 32:126–130 Davis S, Mermelstein P (1980) Comparison of parametric representations for monosyllabic word recognition in continuously spoken sentences. IEEE Trans Acoust Speech Signal Process 28:357–366 Pal M et al (2018) Synthetic speech detection using fundamental frequency variation and spectral features. Comput Speech Lang 48:31–50 Yang J et al (2020) Significance of Subband Features for Synthetic Speech Detection. IEEE Trans Inf Forensics Secur 15:2160–2170 Borrelli C et al (2021) , . Synthetic speech detection through short-term and long-term prediction traces. EURASIP J. INF. SECUR. 2 (2021). Snyder D et al (2018), X-Vectors: Robust DNN Embeddings for Speaker Recognition. in. IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) 5329–5333 (2018). Ballesteros DM et al (2021) Deep4SNet: deep learning for fake speech classification. Expert Syst Appl 184:115465 Beguš G (2021) CiwGAN and fiwGAN: Encoding information in acoustic data to model lexical learning with Generative Adversarial Networks. Neural Netw 139:305–325 Liu T et al (2021) Identification of Fake Stereo Audio Using SVM and CNN. INFORMATION 12:263 Almutairi Z, Elgibreen HA (2022) Review of Modern Audio Deepfake Detection Methods: Challenges and Future Directions. Algorithms 15:155 Shaaban OA et al (2023) Audio Deepfake Approaches. IEEE Access 11:132652–132682 Xie Y et al (2024) Domain Generalization via Aggregation and Separation for Audio Deepfake Detection. IEEE Trans Inf Forensics Secur 19:344–358 Singh K, Yadav J (2025) Audio Splicing Forgery Detection via Discrepancy-Aware Meta-Learning. SIViP 19:918 Xu Y et al (2025), Association for Computing Machinery, Dublin, Ireland,. ALDEN: Dual-Level Disentanglement with Meta-learning for Generalizable Audio Deepfake Detection. in Proceedings of the 33rd ACM International Conference on Multimedia 7277–7286 Pappu R et al (2002) Physical One-Way Functions. Science 297:2026–2030 Hu Z et al (2016) Physically unclonable cryptographic primitives using self-assembled carbon nanotubes. Nat Nanotech 11:559–565 Arppe R, Sørensen TJ (2017) Physical unclonable functions generated through chemical methods for anti-counterfeiting. Nat Rev Chem 1:0031 Gao Y et al (2020) Physical unclonable functions. Nat Electron 3:81–91 Hoogendoorn A (1994) Digital compact cassette. Proceedings of the IEEE. 82, 1479–1489 Kim MS et al (2022) Revisiting silk: a lens-free optical physical unclonable function. Nat Commun 13:247 Wang K et al (2024) All-silicon multidimensionally-encoded optical physical unclonable functions for integrated circuit anti-counterfeiting. Nat Commun 15:3203 Katsnelson MI et al (2008) Half-metallic ferromagnets: From band structure to many-body effects. Rev Mod Phys 80:315–378 Wang R et al (2023) Printable Epsilon-Type Structure Transistor Arrays with Highly Reliable Physical Unclonable Functions. Adv Mater 35:2210621 Dodda A et al (2021) Graphene-based physically unclonable functions that are reconfigurable and resilient to machine learning attacks. Nat Electron 4:364–374 Rockwood DN et al (2011) Materials fabrication from Bombyx mori silk fibroin. Nat Protoc 6:1612–1631 Li M et al (2018), Flexible magnetic composites for light-controlled actuation and interfaces. Proc. Natl. Acad. Sci. U.S.A. 115, 8119–8124 Fu Y-H et al (2026) Modular Opto-Magnetic Oscillators: Harnessing Light to Drive Versatile Materials and Functionalities. Adv Mater 38:e20348 Wang T et al (2026) Versatile Room-Temperature Phosphorescence Silk Fibroin Platforms for Sustainable and Biocompatible Multifunctional Interfaces. Adv Mater 38:e12659 Wang Y et al (2017) Modulation of Multiscale 3D Lattices through Conformational Control: Painting Silk Inverse Opals with Water and Light. Adv Mater 29:1702769 Wang T et al (2024) Angle-Multiplexed 3D Photonic Superstructures with Multi-Directional Switchable Structural Color for Information Transformation, Storage, and Encryption. Adv Sci 11:2400442 Additional Declarations There is NO Competing Interest. Supplementary Files SupplementaryInformationFinal.docx Supplementary Information Cite Share Download PDF Status: Under Review Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-9353152","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":626279590,"identity":"b207362c-4e76-4a9b-af2d-a2d95cc56e36","order_by":0,"name":"Yu Wang","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA30lEQVRIiWNgGAWjYPACm/p+BoYEIIOZaC1pjDMbSNRymHHDATCDCC0GN3IMPxf8SmM2vt3wTIKhwjqxgf3sAUJajKVn9tmwmd05kCbBcCY9sYEnL4GAltwN0rw9aTxmNxLSJBjbDic2SPAYENKy+Tdvz2EJ4xkgLf+I07JNmufHYQMDCZCWBiK0SJ55/82atyEtQeJGQrJFwrF04zaeHPxa+I6nJd/m+WOTwD8jJ/HGhxpr2X72M/i1KBwAEoxtICZPAjgy2fCqBwL5BhD5B0SwHyCkeBSMglEwCkYoAADcBkikTk+aDAAAAABJRU5ErkJggg==","orcid":"https://orcid.org/0000-0003-0249-4414","institution":"Nanjing University","correspondingAuthor":true,"prefix":"","firstName":"Yu","middleName":"","lastName":"Wang","suffix":""},{"id":626279591,"identity":"ee55cfe3-98ab-4594-893d-3edbc3ad5698","order_by":1,"name":"Ying-Hao Fu","email":"","orcid":"","institution":"Nanjing University","correspondingAuthor":false,"prefix":"","firstName":"Ying-Hao","middleName":"","lastName":"Fu","suffix":""},{"id":626279592,"identity":"b7ba21c0-2793-4fde-83e6-63a4a0519086","order_by":2,"name":"Zi-Ting Wang","email":"","orcid":"","institution":"Nanjing University","correspondingAuthor":false,"prefix":"","firstName":"Zi-Ting","middleName":"","lastName":"Wang","suffix":""},{"id":626279593,"identity":"408bbe09-58c4-4432-af3e-7edfeb0d3946","order_by":3,"name":"Xin-Yu Cheng","email":"","orcid":"","institution":"Nanjing University","correspondingAuthor":false,"prefix":"","firstName":"Xin-Yu","middleName":"","lastName":"Cheng","suffix":""},{"id":626279594,"identity":"213f5968-921f-4e65-b823-bcceac40ebc9","order_by":4,"name":"Tao Wang","email":"","orcid":"","institution":"Nanjing University","correspondingAuthor":false,"prefix":"","firstName":"Tao","middleName":"","lastName":"Wang","suffix":""},{"id":626279595,"identity":"dd95113a-ee8e-4821-aa23-d771a36dfddb","order_by":5,"name":"Yanqing Lu","email":"","orcid":"https://orcid.org/0000-0001-6151-8557","institution":"Nanjing University","correspondingAuthor":false,"prefix":"","firstName":"Yanqing","middleName":"","lastName":"Lu","suffix":""}],"badges":[],"createdAt":"2026-04-08 07:27:04","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-9353152/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-9353152/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":109240947,"identity":"2244470b-b31b-4f46-a02e-1026f635c5e0","added_by":"auto","created_at":"2026-05-14 06:52:32","extension":"png","order_by":1,"title":"Figure 1","display":"","copyAsset":false,"role":"figure","size":6904728,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cstrong\u003eConcept, fabrication, and working principle of A-PUFs. a\u003c/strong\u003e, Schematic illustration of the A-PUF concept, in which human-perceivable audio signalling and hardware-rooted physical unclonability are integrated into a single magnetic label. \u003cstrong\u003eb\u003c/strong\u003e, Fabrication process of SF/CrO\u003csub\u003e2\u003c/sub\u003e composite film and the A-PUF strip, highlighting gravity-driven CrO\u003csub\u003e2\u003c/sub\u003e sedimentation that produces a macroscopically flat yet microscopically undulating bilayer structure and thus randomly fluctuating magnetic field strength after magnetization. \u003cstrong\u003ec\u003c/strong\u003e, Recording, reading, and authentication workflow of the A-PUF. \u003cstrong\u003ed\u003c/strong\u003e, The advantageous characteristics of the developed A-PUFs.\u003c/p\u003e","description":"","filename":"Figure1.png","url":"https://assets-eu.researchsquare.com/files/rs-9353152/v1/c52f281205e03f39affdb44d.png"},{"id":109296508,"identity":"37c97abc-4aec-4d0a-b5da-b4cb7871528e","added_by":"auto","created_at":"2026-05-15 08:47:40","extension":"png","order_by":2,"title":"Figure 2","display":"","copyAsset":false,"role":"figure","size":4777244,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cstrong\u003eAcoustic performance characterization of A-PUF labels. a\u003c/strong\u003e, Hysteretic magnetization of A-PUF labels as a function of CrO\u003csub\u003e2\u003c/sub\u003e-to-silk mass ratio. \u003cstrong\u003eb\u003c/strong\u003e, The time-domain waveforms at different CrO\u003csub\u003e2\u003c/sub\u003e-to-SF mass ratios, showing enhanced intensity with increasing CrO\u003csub\u003e2 \u003c/sub\u003econtent. \u003cstrong\u003ec\u003c/strong\u003e, Average amplitude, magnetization, and fracture strain of A-PUF labels with varying CrO\u003csub\u003e2\u003c/sub\u003e content, identifying 30% CrO\u003csub\u003e2\u003c/sub\u003e as the optimal composition for practical use. \u003cstrong\u003ed\u003c/strong\u003e, Cross-sectional SEM image of an A-PUF strip, revealing a bilayer structure with CrO\u003csub\u003e2\u003c/sub\u003e-rich and SF-rich regions forming an irregular interface. An enlarged image shows the random distribution of CrO\u003csub\u003e2\u003c/sub\u003e particles. Scale bars: 5 μm (left), 2 μm (right). \u003cstrong\u003ee\u003c/strong\u003e, Input and output signals of a 600 Hz mono-frequency tone encoded on the A-PUF label. \u003cstrong\u003ef\u003c/strong\u003e, Intensity distribution of the output signal with the lines indicating the Gaussian fits. \u003cstrong\u003eg\u003c/strong\u003e, Audio waveforms at different input powers. The number in the lower right corner represents the normalized average amplitude. \u003cstrong\u003eh\u003c/strong\u003e-\u003cstrong\u003ek\u003c/strong\u003e, Frequency-dependent encoding of monophonic sounds with carrier frequencies of 400 Hz (\u003cstrong\u003eh\u003c/strong\u003e), 1300 Hz (\u003cstrong\u003ei\u003c/strong\u003e), and 2800 Hz (\u003cstrong\u003ej\u003c/strong\u003e), and their mixed signal (\u003cstrong\u003ek\u003c/strong\u003e). Top: Mel-spectrograms; Bottom: Audio waveforms.\u003c/p\u003e","description":"","filename":"Figure2.png","url":"https://assets-eu.researchsquare.com/files/rs-9353152/v1/34f766cf011815e9c045be04.png"},{"id":109240949,"identity":"dfb3c179-c2a7-44d3-8cf8-331888e4bcb9","added_by":"auto","created_at":"2026-05-14 06:52:32","extension":"png","order_by":3,"title":"Figure 3","display":"","copyAsset":false,"role":"figure","size":3202605,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cstrong\u003eDigital encoding and performance characterization of A-PUFs.\u003c/strong\u003e \u003cstrong\u003ea\u003c/strong\u003e, MFCC processing flowchart for adaptive binarization. b, Sound waveforms of the recorded “silkoptics” audio at sampling rates of 48 kHz. \u003cstrong\u003ec\u003c/strong\u003e, The 98 frames, 40-dimensional log Mel spectrum matrix, obtained during the MFCC processing. \u003cstrong\u003ed\u003c/strong\u003e, The 98 frames, 123-dimensional Mel spectrum coefficient matrix processed by MFCC. \u003cstrong\u003ee\u003c/strong\u003e, The binarized map based on the adaptive thresholds for each dimension. \u003cstrong\u003ef\u003c/strong\u003e, Bit uniformity values converging to the ideal value of 0.5. \u003cstrong\u003eg\u003c/strong\u003e, Inter-HD and intra-HD distributions among 30 samples. The inter-HD and intra-HD average 0.4953 ± 0.0112 and 0.0717 ± 0.0194, respectively. \u003cstrong\u003eh\u003c/strong\u003e, Pairwise comparisons of PUF for the first and second measurements. \u003cstrong\u003ei\u003c/strong\u003e, Gaussian fitting of inter- and intra-HD used to determine the authentication threshold (dotted line), yielding a FNR of 9.8787 × 10⁻\u003csup\u003e45\u003c/sup\u003e and a FPR of 2.5122 × 10⁻\u003csup\u003e43\u003c/sup\u003e. \u003cstrong\u003ej\u003c/strong\u003e,\u003cstrong\u003ek\u003c/strong\u003e, Inter-HD values under different input powers (\u003cstrong\u003ej\u003c/strong\u003e) and frequencies (\u003cstrong\u003ek\u003c/strong\u003e), confirming robustness against tone and timbre variations. \u003cstrong\u003el\u003c/strong\u003e, Intra-HD of A-PUFs at different storage temperatures, indicating stable authentication performance below 50 °C.\u003c/p\u003e","description":"","filename":"Figure3.png","url":"https://assets-eu.researchsquare.com/files/rs-9353152/v1/879b088b8863088070d28ba7.png"},{"id":109240951,"identity":"9a17e9e3-baf1-4be1-8758-4cb255d8193f","added_by":"auto","created_at":"2026-05-14 06:52:32","extension":"png","order_by":4,"title":"Figure 4","display":"","copyAsset":false,"role":"figure","size":3163041,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cstrong\u003eReconfiguration of A-PUFs\u003c/strong\u003e.\u003cstrong\u003e a\u003c/strong\u003e, Schematic illustration of the erasure and rewriting processes for recorded acoustic information.\u003cstrong\u003e b\u003c/strong\u003e, Demonstration of repeated erasing and rewriting of the same or different acoustic information. \u003cstrong\u003ec\u003c/strong\u003e, The variation of amplitude of the written information during 100 successive erase/write cycles using the same acoustic input. \u003cstrong\u003ed\u003c/strong\u003e, Representative binarized map from 1 original CRP and 5 reconfigured CRPs extracted from a single A-PUF label over 100 reconfiguration cycles using an identical audio source. \u003cstrong\u003ee\u003c/strong\u003e-\u003cstrong\u003eg\u003c/strong\u003e, Calculated entropy (\u003cstrong\u003ee\u003c/strong\u003e), inter-HD (\u003cstrong\u003ef\u003c/strong\u003e), and correlation matrix (\u003cstrong\u003eg\u003c/strong\u003e) for 1 original CRP and 10 reconfigured CRPs.\u003c/p\u003e","description":"","filename":"Figure4.png","url":"https://assets-eu.researchsquare.com/files/rs-9353152/v1/6c146dc5bc60c50ffd1ef025.png"},{"id":109249530,"identity":"9cea59eb-465d-406f-a2b8-e5561f9919e2","added_by":"auto","created_at":"2026-05-14 08:55:26","extension":"png","order_by":5,"title":"Figure 5","display":"","copyAsset":false,"role":"figure","size":2911942,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cstrong\u003eResistance of A-PUFs to machine learning attacks. a\u003c/strong\u003e-\u003cstrong\u003ec\u003c/strong\u003e, Color maps of HD (i), CC (ii), and prediction accuracy (iii) between predicted and measured CRPs obtained using MLP models with 3 (\u003cstrong\u003ea\u003c/strong\u003e), 4 (\u003cstrong\u003eb\u003c/strong\u003e), and 5 (\u003cstrong\u003ec\u003c/strong\u003e) hidden layers.\u003cstrong\u003ed\u003c/strong\u003e-\u003cstrong\u003ef\u003c/strong\u003e, Statistical distributions of HD (\u003cstrong\u003ed\u003c/strong\u003e), CC (\u003cstrong\u003ee\u003c/strong\u003e), and prediction accuracy (\u003cstrong\u003ef\u003c/strong\u003e) for an expanded dataset of 100 CRPs obtained using MLP models. \u003cstrong\u003eg\u003c/strong\u003e-\u003cstrong\u003ei\u003c/strong\u003e, Statistical distributions of HD (\u003cstrong\u003eg\u003c/strong\u003e), CC (\u003cstrong\u003eh\u003c/strong\u003e), and prediction accuracy (\u003cstrong\u003ei\u003c/strong\u003e) for dataset of 100 CRPs obtained using Fourier regression models with 50, 100, and 200 Fourier orders. \u003cstrong\u003ej\u003c/strong\u003e, Statistical distributions of HD, |CC|, and prediction accuracy for dataset of 100 CRPs obtained using GAN models.\u003c/p\u003e","description":"","filename":"Figure5.png","url":"https://assets-eu.researchsquare.com/files/rs-9353152/v1/2f6e7a1f80aea78c1da6b023.png"},{"id":109252448,"identity":"5fc87a6d-e2c4-4b8e-9eb8-3c482f9b0cb1","added_by":"auto","created_at":"2026-05-14 09:26:31","extension":"png","order_by":6,"title":"Figure 6","display":"","copyAsset":false,"role":"figure","size":10455255,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cstrong\u003eThe use of A-PUF for Multichannel and multidimensional counterfeiting. a\u003c/strong\u003e, Schematic illustration of the encoding and decoding process of the triple-frequency-channel A-PUF label. The inset shows representative flexible A-PUF labels. \u003cstrong\u003eb\u003c/strong\u003e, Demonstration of the triple-frequency-channel A-PUF label containing the messages “Physical” (2800 Hz), “Unclonable” (1300 Hz), and “Functions” (400 Hz). \u003cstrong\u003ec\u003c/strong\u003e, Schematic of the multidimensional acoustic-optical PUF label. \u003cstrong\u003ed\u003c/strong\u003e, Photographs of a roll of multidimensional PUF labels exhibiting vivid structural coloration and bright phosphorescence. Scale bar: 1 cm. \u003cstrong\u003ee\u003c/strong\u003e, Demonstration of a multi-level anti-counterfeiting label for pharmaceuticals: (i) fabrication of the multi-level label, (ii) written structural-color information, (iii) hidden phosphorescent information, and (iv) acoustic information extraction and verification. Scale bars: 1 cm (i), 5 mm (ii, iii). \u003cstrong\u003ef\u003c/strong\u003e, Demonstration of a multi-level, high-security label for information transmission: (i) recording of authentic and counterfeit information, and (ii) information readout and discrimination. Scale bars: 5 mm.\u003c/p\u003e","description":"","filename":"Figure6.png","url":"https://assets-eu.researchsquare.com/files/rs-9353152/v1/25b9520223dcca09cfce5d9d.png"},{"id":109296048,"identity":"35e994e4-7662-4b0e-b2ea-30b7546184b1","added_by":"auto","created_at":"2026-05-15 08:44:52","extension":"pdf","order_by":0,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":26731733,"visible":true,"origin":"","legend":"","description":"","filename":"manuscript.pdf","url":"https://assets-eu.researchsquare.com/files/rs-9353152/v1/4627aaea-5b15-456d-82d1-975b78b315b7.pdf"},{"id":109249619,"identity":"c84e794b-3ea7-4582-9175-e81a59759a9a","added_by":"auto","created_at":"2026-05-14 08:57:58","extension":"docx","order_by":1,"title":"","display":"","copyAsset":false,"role":"supplement","size":4019251,"visible":true,"origin":"","legend":"Supplementary Information","description":"","filename":"SupplementaryInformationFinal.docx","url":"https://assets-eu.researchsquare.com/files/rs-9353152/v1/fa2a6aedde129a229e986dfb.docx"}],"financialInterests":"There is \u003cb\u003eNO\u003c/b\u003e Competing Interest.","formattedTitle":"Listening to disorder: acoustic physical unclonable functions for audio-enabled secure authentication","fulltext":[{"header":"Introduction","content":"\u003cp\u003eSound, as a ubiquitous and information-rich physical signal, offers a versatile medium for information encoding and storage. Acoustic signals encode data across frequency, amplitude, phase, and temporal domain\u003csup\u003e\u003cspan citationid=\"CR1\" class=\"CitationRef\"\u003e1\u003c/span\u003e,\u003cspan citationid=\"CR2\" class=\"CitationRef\"\u003e2\u003c/span\u003e\u003c/sup\u003e, and uniquely travel through opaque environments without requiring line-of-sight conditions\u003csup\u003e\u003cspan additionalcitationids=\"CR4\" citationid=\"CR3\" class=\"CitationRef\"\u003e3\u003c/span\u003e\u0026ndash;\u003cspan citationid=\"CR5\" class=\"CitationRef\"\u003e5\u003c/span\u003e\u003c/sup\u003e. Beyond their communicative function, they intrinsically embed system-dependent physical fingerprints arising from generation, propagation, and recording processes. Such multimodal encoding and environmental sensitivity have recently attracted interest in acoustic sensing\u003csup\u003e\u003cspan citationid=\"CR6\" class=\"CitationRef\"\u003e6\u003c/span\u003e,\u003cspan citationid=\"CR7\" class=\"CitationRef\"\u003e7\u003c/span\u003e\u003c/sup\u003e and recognition systems\u003csup\u003e\u003cspan citationid=\"CR8\" class=\"CitationRef\"\u003e8\u003c/span\u003e,\u003cspan citationid=\"CR9\" class=\"CitationRef\"\u003e9\u003c/span\u003e\u003c/sup\u003e, yet their potential for physically rooted security remains largely unexplored. In particular, the absence of a materialized acoustic labeling framework has limited the translation of recorded sound from a signal-level descriptor to a hardware-level security element.\u003c/p\u003e \u003cp\u003eExisting audio authentication strategies predominantly operate in the digital domain by assessing the integrity of the signal itself. Conventional approaches include the active embedding of imperceptible feature signals, such as acoustic watermarking\u003csup\u003e\u003cspan additionalcitationids=\"CR11 CR12\" citationid=\"CR10\" class=\"CitationRef\"\u003e10\u003c/span\u003e\u0026ndash;\u003cspan citationid=\"CR13\" class=\"CitationRef\"\u003e13\u003c/span\u003e\u003c/sup\u003e, and passive identification based on descriptors such as frequency spectra, temporal envelopes, energy distributions, and noise patterns to establish identity\u003csup\u003e\u003cspan additionalcitationids=\"CR15 CR16\" citationid=\"CR14\" class=\"CitationRef\"\u003e14\u003c/span\u003e\u0026ndash;\u003cspan citationid=\"CR17\" class=\"CitationRef\"\u003e17\u003c/span\u003e\u003c/sup\u003e. While these methods are cost-effective and readily deployable, their security is increasingly undermined by the rapid advancement of high-fidelity audio synthesis and deepfake technologies, which can convincingly replicate or manipulate acoustic signatures. Deep learning approaches have further improved authentication performance by enabling high-dimensional feature extraction\u003csup\u003e\u003cspan additionalcitationids=\"CR19 CR20 CR21 CR22 CR23\" citationid=\"CR18\" class=\"CitationRef\"\u003e18\u003c/span\u003e\u0026ndash;\u003cspan citationid=\"CR24\" class=\"CitationRef\"\u003e24\u003c/span\u003e\u003c/sup\u003e; however, they typically rely on large-scale datasets and substantial computational resources, and remain susceptible to adversarial attacks. Emerging meta-learning strategies\u003csup\u003e\u003cspan citationid=\"CR25\" class=\"CitationRef\"\u003e25\u003c/span\u003e,\u003cspan citationid=\"CR26\" class=\"CitationRef\"\u003e26\u003c/span\u003e\u003c/sup\u003e partially mitigate data dependence, yet they do not fundamentally resolve the vulnerability of algorithmic systems to model-targeted attacks.\u003c/p\u003e \u003cp\u003eThese challenges call for a foundation shift from algorithmic verification to physically grounded security. Physical unclonable functions (PUFs), which exploit the inherent randomness of physical systems to generate unique and irreproducible response\u003csup\u003e\u003cspan additionalcitationids=\"CR28 CR29\" citationid=\"CR27\" class=\"CitationRef\"\u003e27\u003c/span\u003e\u0026ndash;\u003cspan citationid=\"CR30\" class=\"CitationRef\"\u003e30\u003c/span\u003e\u003c/sup\u003e, offer such a paradigm. By translating microscopic physical disorder into a measurable and distinctive output, PUFs provide a hardware-rooted mechanism for authentication that is virtually impossible to replicate or predict. Within this context, acoustics represents an unconventional yet powerful modality for PUF implementation. The formation of a recorded acoustic signal is governed by coupled stochastic processes spanning sound generation, environmental propagation and material transduction. As a result, even nominally identical recording conditions can produce distinct waveform signatures. Critically, when acoustic signals are recorded onto a physical medium, intrinsic material inhomogeneities impose random, spatially varying modulations on the stored signal. For example, in magnetic recording media, microscopic disorder in magnetic domains introduces stochastic encoding variations that couple with the acoustic waveform fluctuations, producing a medium-specific, irreproducible fingerprint. This coupling of signal-level variability and material-level disorder offers a fundamentally new pathway for constructing high-security PUFs.\u003c/p\u003e \u003cp\u003eHere, we introduce an acoustic physical unclonable function (A-PUF) that exploits recorded sound within a magnetic strip composed of chromium dioxide (CrO\u003csub\u003e2\u003c/sub\u003e) microparticles embedded in a silk fibroin (SF) matrix as a robust source of physical entropy. Distinct from prior PUF implementations based solely on structural randomness, our approach integrates stochastic acoustic excitation with intrinsic material disorder to generate unique, irreproducible responses. We show that each recording event produces characteristic temporal and spectral signatures governed by this coupled variability, enabling robust authentication and cryptographic key generation. Importantly, the encoded signals remain human-perceptible, allowing simultaneous information storage and verification within a single platform. The resulting A-PUF labels are reconfigurable, and exhibit strong resilience against machine learning (ML) evaluated using multiple models. Furthermore, we demonstrate multi-channel anti-counterfeiting through frequency-division encoding, and multidimensional acoustic-optical hybrid labels that integrate structural color, phosphorescence, and audio functionalities.\u003c/p\u003e"},{"header":"Results","content":"\u003cdiv id=\"Sec3\" class=\"Section2\"\u003e \u003ch2\u003eA-PUF labels with coupled audio and security channels\u003c/h2\u003e \u003cp\u003eConventional PUF systems generate device-specific physical fingerprints, but their functionality is typically confined to an authentication task. They do not intrinsically carry meaningful user-level information, nor do they provide an intuitive human-machine interface. In contrast, the A-PUF platform developed here uniquely merges concealed, retrievable audio information with hardware-embedded physical unclonability within a single material system (Fig.\u0026nbsp;\u003cspan refid=\"Fig1\" class=\"InternalRef\"\u003e1\u003c/span\u003ea). This dual functionality transforms the A-PUF from a passive security element into an active information medium\u0026mdash;one that is simultaneously machine-verifiable and human-interpretable.\u003c/p\u003e \u003cp\u003eThe A-PUF is constructed by embedding CrO\u003csub\u003e2\u003c/sub\u003e microparticles within a SF matrix to form a flexible magnetic composite strip capable of storing and transducing acoustic information. Owing to the broad size distribution of CrO\u003csub\u003e2\u003c/sub\u003e microparticles, the resulting composite exhibits a stratified microstructure characterized by a macroscopically continuous yet microscopically stochastic, undulating bilayer interface between the CrO\u003csub\u003e2\u003c/sub\u003e domain and the overlying SF matrix. Upon magnetization, these microstructural irregularities translate directly into spatially random fluctuations in local magnetic field strength (Fig.\u0026nbsp;\u003cspan refid=\"Fig1\" class=\"InternalRef\"\u003e1\u003c/span\u003eb). When a magnetic read head scans the strip, this chaotic field distribution modulates the induced voltage, resulting in position-dependent variations that encode a unique acoustic response.\u003c/p\u003e \u003cp\u003eFigure\u0026nbsp;\u003cspan refid=\"Fig1\" class=\"InternalRef\"\u003e1\u003c/span\u003ec illustrates the working principle of the A-PUF. Audio recording in the A-PUF is achieved via electromagnetic induction. During the writing process, acoustic waves are first transduced into a time-varying electrical signal, which is subsequently converted by the magnetic head into a spatial arrangement of magnetized CrO\u003csub\u003e2\u003c/sub\u003e microparticles embedded within the A-PUF strip. During playback, the magnetic signal stored in the A-PUF is reconverted through a \u0026ldquo;magnetic-electrical-acoustic\u0026rdquo; transformation\u003csup\u003e\u003cspan citationid=\"CR31\" class=\"CitationRef\"\u003e31\u003c/span\u003e\u003c/sup\u003e, recovering the original audio content (i.e., the information channel). Simultaneously, the raw electrical signal acquired during playback can be sampled and visualized to generate a time-domain waveform diagram that exhibits pronounced stochastic variations in amplitude, frequency components, and temporal profiles, thereby constituting a parallel security channel. Notably, the final randomness of the waveform after Mel-frequency cepstral coefficient (MFCC) processing stems from the convolution of two independent entropy sources: the intrinsic stochasticity of the acoustic signal and the irreversible physical disorder of the magnetic medium. This coupling produces a robust set of challenge-response pairs (CRPs). By applying threshold segmentation and binarization to the Mel spectrum coefficient matrix, a high-entropy binary bitstream is generated, serving as a unique and irreproducible \u0026ldquo;identity marker\u0026rdquo; for the A-PUF. Ultimately, authentication is achieved by verifying this bitstream, thereby discriminating genuine from forged audio signals.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eThe A-PUF labels demonstrate exceptionally high encoding capacity because the rich acoustic features enable a dense accumulation of data per area. Unlike traditional PUFs with fixed CRPs, the A-PUF design allows stored audio content to be dynamically updated or rewritten without affecting the underlying physical randomness, supporting reconfigurable anti-counterfeiting strategies. Additionally, A-PUFs are naturally resistant to ML attacks. The stochastic magnetic landscape randomly modulates the stored acoustic features, generating highly random bitstreams without learnable patterns, while the high frame rate and feature dimensionality together introduce sufficient entropy to hinder model-based prediction or simulation. Beyond acoustic data, the SF matrix offers a flexible platform for adding extra optical channels into the same label, enabling multi-dimensional authentication. Importantly, these labels can be read using simple, widely available audio readout devices, providing a scalable and low-cost solution for data collection and verification. The favorable features of the A-PUFs are summarized in Fig.\u0026nbsp;\u003cspan refid=\"Fig1\" class=\"InternalRef\"\u003e1\u003c/span\u003ed. Compared with conventional electrical and optical PUFs, A-PUFs offer distinct advantages in entropy generation, overall PUF performance, and functional integration (Supplementary Table \u003cspan refid=\"MOESM1\" class=\"InternalRef\"\u003eS1\u003c/span\u003e).\u003c/p\u003e \u003c/div\u003e\n\u003ch3\u003eAcoustic performance characterization\u003c/h3\u003e\n\u003cp\u003eThe audio information in A-PUF labels is encoded through the magnetization of embedded CrO\u003csub\u003e2\u003c/sub\u003e microparticles; consequently, the CrO\u003csub\u003e2\u003c/sub\u003e loading governs both the magnetic response of the label and the fidelity of audio recording. A series of composites with varying CrO\u003csub\u003e2\u003c/sub\u003e-to-SF fibroin mass ratios was therefore prepared. As shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig2\" class=\"InternalRef\"\u003e2\u003c/span\u003ea, c, the remanent magnetization of the A-PUF labels increases markedly with increasing CrO\u003csub\u003e2\u003c/sub\u003e content. When the same audio waveform is written onto these samples, the reconstructed signals exhibit a monotonic increase in average loudness with CrO\u003csub\u003e2\u003c/sub\u003e loading (Fig.\u0026nbsp;\u003cspan refid=\"Fig2\" class=\"InternalRef\"\u003e2\u003c/span\u003eb, c). However, higher CrO\u003csub\u003e2\u003c/sub\u003e loadings markedly degrade mechanical integrity, as evidenced by a sharp reduction in fracture strain that increases susceptibility to mechanical failure during handling and readout (Fig.\u0026nbsp;\u003cspan refid=\"Fig2\" class=\"InternalRef\"\u003e2\u003c/span\u003ec, Supplementary Fig. \u003cspan refid=\"MOESM1\" class=\"InternalRef\"\u003eS1\u003c/span\u003e). Balancing magnetic readability against mechanical robustness, we identify a CrO\u003csub\u003e2\u003c/sub\u003e-to-SF mass ratio of 3:10 as the optimal formulation, which delivers sufficient audio fidelity while maintaining mechanical resilience suitable for practical deployment.\u003c/p\u003e \u003cp\u003eBuilding on the optimized composition, we examined the structural morphology and acoustic response of the A-PUF labels. Cross-sectional scanning electron microscopy (SEM) imaging of the A-PUF strip (Fig.\u0026nbsp;\u003cspan refid=\"Fig2\" class=\"InternalRef\"\u003e2\u003c/span\u003ed) reveals a heterogeneous bilayer architecture, with CrO\u003csub\u003e2\u003c/sub\u003e particles of varying sizes predominantly enriched on one side of the SF film. These magnetic particles form a randomly undulating interface with the SF-rich layer, resulting in a non-uniform magnetic layer thickness across the structure. Upon magnetization, this spatially irregular configuration induces region-dependent magnetic responses, which in turn translate into intrinsically stochastic modulation of the acoustic readout. Consistent with this mechanism, when a 600 Hz single-frequency tone is written and subsequently read out from an A-PUF label (Fig.\u0026nbsp;\u003cspan refid=\"Fig2\" class=\"InternalRef\"\u003e2\u003c/span\u003ee), the reconstructed signal exhibits pronounced, irregular amplitude fluctuations with non-periodic peaks and troughs, despite the simplicity of the input (Fig.\u0026nbsp;\u003cspan refid=\"Fig2\" class=\"InternalRef\"\u003e2\u003c/span\u003ef).\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eBeyond the intrinsic microstructure of the A-PUF labels, the properties of the input sound source (including intensity, frequency, and waveform) critically govern the encoding process. Reducing the input loudness from 100% to 30% leads to a proportional decrease in output signal amplitude (Fig.\u0026nbsp;\u003cspan refid=\"Fig2\" class=\"InternalRef\"\u003e2\u003c/span\u003eg, Supplementary Fig. S2), reflecting weaker magnetization induced in the CrO\u003csub\u003e2\u003c/sub\u003e-based recording layer at lower acoustic intensities. The input frequency further determines the spectral distribution of the readout signal, with higher frequencies producing correspondingly high-frequency-dominated outputs and lower frequencies shifting the spectral content downward (Fig.\u0026nbsp;\u003cspan refid=\"Fig2\" class=\"InternalRef\"\u003e2\u003c/span\u003eh-j). Leveraging this frequency selectivity, multiple sound sources with distinct carrier frequencies can be integrated on a single platform (Fig.\u0026nbsp;\u003cspan refid=\"Fig2\" class=\"InternalRef\"\u003e2\u003c/span\u003ek), thus enhancing the information capacity of the system. In addition, under identical frequency and amplitude conditions, different input waveforms generate distinct and reproducible output signatures (Supplementary Fig. S3), demonstrating the capacity of A-PUF labels to encode complex acoustic information beyond simple intensity or frequency modulation.\u003c/p\u003e\n\u003ch3\u003eDigital Encoding and Performance Evaluation of A-PUFs\u003c/h3\u003e\n\u003cp\u003eTo quantitatively evaluate A-PUF performance, their acoustic responses were converted into stable, information-dense digital signatures suitable for statistical analysis. Under controlled measurement conditions, the acoustic output of each label was recorded and digitally sampled, followed by feature extraction using MFCC analysis (Fig.\u0026nbsp;\u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003ea, and Supplementary Fig. S4 and Note S1). To preserve fine spectral-temporal details and maximize information entropy, a one-second segment of the spoken phrase \u0026ldquo;silkoptics\u0026rdquo; was acquired at a sampling rate of 48 kHz (Fig.\u0026nbsp;\u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003eb). The recorded signals were subsequently transformed into a log-Mel spectrogram matrix (Fig.\u0026nbsp;\u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003ec) and the corresponding MFCC feature set (Fig.\u0026nbsp;\u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003ed). The MFCC dataset were binarized using the adaptive thresholds for each dimension, assigning \u0026ldquo;1\u0026rdquo; to values above the median and \u0026ldquo;0\u0026rdquo; to those below. The resulting binarized maps (Fig.\u0026nbsp;\u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003ee) exhibit highly irregular distributions, highlighting the inherent randomness and uniqueness required for reliable PUF operation.\u003c/p\u003e \u003cp\u003eTo quantitatively evaluate the performance of the A-PUF, we analyzed three key statistical parameters\u0026mdash;bit uniformity, uniqueness, and repeatability (Supplementary Note S2)\u0026mdash;based on characteristic matrix extracted from 30 individual PUF labels. Bit uniformity quantifies the balance between \u0026ldquo;0\u0026rdquo; and \u0026ldquo;1\u0026rdquo; bits within a PUF response, ideally approaching 0.5 for a truly random binary distribution. As shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003ef, the average bit uniformity values for acoustic samples are 0.5, indicating the emergence of high randomness. Uniqueness, expressed as the average inter-Hamming distance (inter-HD), measures the dissimilarity between responses from different PUFs under the same challenge. The ideal inter-HD value is 0.5, ensuring that each device generates a distinct, unclonable signature. In our A-PUF system, the average inter-HD values are 0.4953 (Fig.\u0026nbsp;\u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003eg), confirming excellent distinctiveness among different PUF instances. Repeatability, expressed as the intra-Hamming distance (intra-HD), evaluates the stability of a PUF\u0026rsquo;s response to repeated identical challenges. The ideal intra-HD value is 0, indicating perfect consistency. In our devices, the intra-HDs from the first and second measurements of the same PUF labels give an average value of 0.0717 (Fig.\u0026nbsp;\u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003eg). The intra-HDs, which are close to the ideal value, ensure the stability of the data stream read from the same PUF during twice measurements (Fig.\u0026nbsp;\u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003eh), guaranteeing the practical feasibility of A-PUF for real-world authentication. Based on the calculated inter-HD and intra-HD values, we further estimated the verification threshold using Gaussian fitting of each HD distribution (Fig.\u0026nbsp;\u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003ei). The intersection of the two Gaussian curves defines the optimal decision boundary at an HD threshold of 0.3385, corresponding to a false negative rate (FNR) of 9.8787 \u0026times; 10⁻\u003csup\u003e45\u003c/sup\u003e and a false positive rate (FPR) of 2.5122 \u0026times; 10⁻\u003csup\u003e43\u003c/sup\u003e. These minimal values demonstrate the robustness and reliability of the authentication performance.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eWe calculated the theoretical encoding capacity of the A-PUF, given by \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{C}^{t\\times\\:n}\\)\u003c/span\u003e\u003c/span\u003e, which represents the maximum number of CRPs that can be generated\u003csup\u003e\u003cspan citationid=\"CR32\" class=\"CitationRef\"\u003e32\u003c/span\u003e,\u003cspan citationid=\"CR33\" class=\"CitationRef\"\u003e33\u003c/span\u003e\u003c/sup\u003e. In our work, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:C\\)\u003c/span\u003e\u003c/span\u003e is 2, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:t\\)\u003c/span\u003e\u003c/span\u003e corresponds to the number of frames for the samples after frame segmentation during MFCC processing, and \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:n\\)\u003c/span\u003e\u003c/span\u003e corresponds to the MFCC feature dimension. By enabling audio input on both sides of the label, the theoretical coding capacity for a one-second A-PUF reaches 1.7\u0026times;10\u003csup\u003e7257\u003c/sup\u003e. Increasing the audio duration, the frame number, or the feature dimensionality would further expand the encoding capacity exponentially.\u003c/p\u003e \u003cp\u003eFor practical deployment, PUF labels must combine reliable authentication with operational robustness against environmental and input perturbations. We therefore systematically evaluated the stability of the A-PUF responses by monitoring the evolution of the HD under variations in acoustic excitation, temperature, humidity, and UV irradiation. To specifically assess tolerance to changes in sound characteristics, the input power and frequency were deliberately modulated to emulate different loudness levels and tonal conditions. Despite these perturbations, the average inter-HD values remain high (\u0026gt;\u0026thinsp;0.45 for power and \u0026gt;\u0026thinsp;0.42 for frequency; Fig.\u0026nbsp;\u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003ej, k), demonstrating that the A-PUF responses are largely insensitive to excitation fluctuations and enabling reliable authentication under diverse real-world audio inputs. Thermal stability was further assessed by comparing responses before and after heat treatment (Fig.\u0026nbsp;\u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003el, Supplementary Fig. S5). Samples maintain low intra-HD values below the verification threshold up to 50\u0026deg;C, indicating reproducible signatures and temperature-independent operation. At 60\u0026deg;C, however, intra-HD exceeded the threshold, leading to authentication failure, which is attributed to thermally induced weakening of magnetic domains that destabilizes the acoustic response and degrades signal fidelity. In addition, the A-PUF labels demonstrate adaptability to high-humidity environments and resistance to deep UV light (254 nm, 10 W) exposure. Their performance remains essentially unchanged after 30 days under 70\u0026ndash;80% relative humidity or following 24 hours of deep UV exposure. These results demonstrate that the A-PUFs exhibit excellent stability and authentication reliability under normal environmental conditions. Furthermore, the A-PUF costs as little as US\u003cspan\u003e$\u003c/span\u003e0.000073 per square millimeter, benefiting from the use of low-cost materials (Supplementary Note S3), rendering it an economically viable solution for practical anticounterfeiting applications.\u003c/p\u003e\n\u003ch3\u003eReconfigurability of A-PUFs\u003c/h3\u003e\n\u003cp\u003eThe intrinsic ability of CrO\u003csub\u003e2\u003c/sub\u003e to reversibly redefine its magnetic domain structure under modest external fields (e.g., 150 mT)\u003csup\u003e\u003cspan citationid=\"CR34\" class=\"CitationRef\"\u003e34\u003c/span\u003e\u003c/sup\u003e enables precise modulation of the A-PUF magnetization, allowing reversible erasure and rewriting of recorded audio information (Fig.\u0026nbsp;\u003cspan refid=\"Fig4\" class=\"InternalRef\"\u003e4\u003c/span\u003ea). As shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig4\" class=\"InternalRef\"\u003e4\u003c/span\u003eb, cyclic recording and erasing of the audio signals \u0026ldquo;silkoptics\u0026rdquo;, \u0026ldquo;丝蛋白光学\u0026rdquo;, and \u0026ldquo;melody\u0026rdquo; yield highly reliable and clearly distinguishable magnetic responses. Furthermore, the label demonstrates remarkable endurance, with the average loudness decreasing by only 3.8% after 100 erase/write cycles using the same acoustic input (Fig.\u0026nbsp;\u003cspan refid=\"Fig4\" class=\"InternalRef\"\u003e4\u003c/span\u003ec). This rewritable magnetic behavior underscores the feasibility of developing reconfigurable PUF systems capable of secure data reprogramming and long-term operational stability.\u003c/p\u003e \u003cp\u003eReconfigurable PUFs enable the ability to adapt their challenge-response mapping dynamically while maintaining the device\u0026rsquo;s core identity and security features. This flexibility directly tackles one of the main vulnerabilities in traditional PUF technology\u0026mdash;modeling attacks\u0026mdash;while also supporting advanced cryptographic functions like proactive key renewal, revocation, and adaptive authentication. To assess the performance of the A-PUF during reconfiguration, a representative label underwent 100 successive erase/write cycles using the same audio source. Audio data were extracted every tenth cycle for PUF verification. Supplementary Fig. S6 and Fig.\u0026nbsp;\u003cspan refid=\"Fig4\" class=\"InternalRef\"\u003e4\u003c/span\u003ed show significant differences in audio waveforms and the related bitstreams across these cycles. The security of these rewritten CRPs was measured using entropy analysis. Reconfigured samples reach an ideal entropy score of 1 (Fig.\u0026nbsp;\u003cspan refid=\"Fig4\" class=\"InternalRef\"\u003e4\u003c/span\u003ee), indicating truly random CRPs. The average inter-HD between the original CRP and the 10 rewritten CRPs is 0.4901 (Fig.\u0026nbsp;\u003cspan refid=\"Fig4\" class=\"InternalRef\"\u003e4\u003c/span\u003ef), very close to the ideal of 0.5. Additionally, CC analysis among the 11 CRPs shows that identical CRPs have a CC of 1, while different CRPs display much lower CC values (Fig.\u0026nbsp;\u003cspan refid=\"Fig4\" class=\"InternalRef\"\u003e4\u003c/span\u003eg), confirming that the rewritten CRPs are non-repetitive and can be considered entirely new, independent identifiers. Overall, these results demonstrate that A-PUFs can deliver reliable, rewritable functionality while preserving high security and reproducibility, representing a major step forward in reconfigurable PUF technology.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e\n\u003ch3\u003eThe resilience of A-PUFs to machine learning-assisted attacks\u003c/h3\u003e\n\u003cp\u003eAs with other cryptographic technologies, PUFs exist within a continual arms race between attack and defense. Among the various attack strategies, ML has emerged as one of the most powerful and concerning tools for modeling PUF behavior. By training parameterized models on a limited set of known CRPs, attackers can potentially predict unknown CRPs with high accuracy, thereby compromising system security. To evaluate the robustness of the A-PUFs against ML-based modeling attacks, we employed a multi-layer perceptron (MLP) model\u0026mdash;an efficient and widely adopted neural network architecture\u0026mdash;following methodologies commonly used in PUF security assessments (Supplementary Note S4)\u003csup\u003e\u003cspan citationid=\"CR35\" class=\"CitationRef\"\u003e35\u003c/span\u003e\u003c/sup\u003e. To systematically examine the susceptibility of the A-PUFs, MLP models with different hidden layers (3, 4, 5 layers) were constructed to predict CRPs under varying network complexities (Supplementary Fig. S7). The dataset comprises 25 A-PUFs recorded at a sampling rate of 9 kHz with 100% input power and standard input frequency. Of these, 18 CRPs were used for training, and the remaining for testing. The model employs an adaptive learning algorithm to ensure efficient prediction.\u003c/p\u003e \u003cp\u003eAs shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig4\" class=\"InternalRef\"\u003e4\u003c/span\u003ea-c, the HD, CC, and prediction accuracy were calculated by comparing 5 predicted CRPs with 5 known CRPs for models with 3, 4, and 5 hidden layers, respectively. The results indicate that the HD and CC values remain close to the ideal values of 0.5 and 0, respectively, indicating that the predicted CRPs are statistically uncorrelated with the authentic responses. The prediction accuracy fluctuates near 50%, and shows minimal dependence on network depth. To further evaluate resilience, the dataset was expanded to 100 CRPs, partitioned into training (80%), testing (10%), and validation (10%) subsets. The validation results (Fig.\u0026nbsp;\u003cspan refid=\"Fig4\" class=\"InternalRef\"\u003e4\u003c/span\u003ed-f) confirm that the HD and CC values remain near the ideal values of 0.5 and 0, respectively, while the prediction accuracy persists near 50%. Importantly, no improvement in prediction accuracy is observed even as the number of tests increases, confirming that the A-PUF exhibits strong inherent resistance to ML-based modeling attacks.\u003c/p\u003e \u003cp\u003eTo further evaluate the resistance of the A-PUF against ML attacks, we conducted additional attacks using Fourier regression and generative adversarial network (GAN) models (Supplementary Note S4)\u003csup\u003e\u003cspan citationid=\"CR36\" class=\"CitationRef\"\u003e36\u003c/span\u003e\u003c/sup\u003e. As shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig4\" class=\"InternalRef\"\u003e4\u003c/span\u003eg-i, Fourier regression models with different Fourier orders (50, 100, and 200) were constructed to predict CRPs. The validation results across these orders are consistent with those obtained using the MLP model, with the inter-HD and CC values remaining close to the ideal values of 0.5 and 0, respectively, while the prediction accuracy stays near 50%. For the GAN-based attack, two deep neural networks (a generator and a discriminator) were trained in a contrarious framework to minimize the maximum loss. When both networks approached convergence, the attack performance was evaluated. As shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig4\" class=\"InternalRef\"\u003e4\u003c/span\u003ej, the resulting HD and CC values again remain close to the ideal values of 0.5 and 0, respectively, with prediction accuracy around 0.5, indicating that the generated responses fail to reproduce the genuine CRPs. These results demonstrate that the A-PUF exhibits strong resistance to ML-based modeling attacks. Moreover, increasing the sampling rate or extending the audio duration would further enhance attack resistance by increasing the complexity and entropy of the underlying data stream.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cdiv id=\"Sec8\" class=\"Section2\"\u003e \u003ch2\u003eMultichannel and multidimensional counterfeiting applications\u003c/h2\u003e \u003cp\u003eBy embedding rewritable, user-defined audio signals into physical randomness, the A-PUF introduces a new class of multimodal anticounterfeiting labels capable of providing both content-level security and material-level authenticity. More importantly, the encoded audio signal allows for multi-channel information storage and transmission across different frequency domains, significantly boosting information capacity and encryption complexity. To demonstrate this capability, we constructed a triple-frequency-channel anti-counterfeiting label, in which Morse codes representing \u0026ldquo;physical\u0026rdquo; (2800 Hz), \u0026ldquo;unclonable\u0026rdquo; (1300 Hz), and \u0026ldquo;functions\u0026rdquo; (400 Hz) are mixed and recorded onto an A-PUF magnetic strip (Fig.\u0026nbsp;\u003cspan refid=\"Fig6\" class=\"InternalRef\"\u003e6\u003c/span\u003ea). Because audio signals at different frequencies interfere when played simultaneously, the written information becomes indistinguishable to conventional playback, providing a primary layer of anti-counterfeiting. Accurate recovery of the message requires frequency-selective separation and ordering of the individual channels using their respective frequencies as decoding \u0026ldquo;keys\u0026rdquo;, thereby reconstructing the correct information \u0026ldquo;physical unclonable functions\u0026rdquo; (Fig.\u0026nbsp;\u003cspan refid=\"Fig6\" class=\"InternalRef\"\u003e6\u003c/span\u003eb, and Supplementary Fig. S8). The extracted information is finally verified through the PUF authentication, establishing an integrated anti-counterfeiting system that spans from information concealment to physical fingerprint validation.\u003c/p\u003e \u003cp\u003eMoreover, the inherently functionalizable SF matrix allows the seamless incorporation of additional optical channels into the A-PUF label, enabling the construction of hybrid acoustic-optical systems for multidimensional information encryption and high-security anti-counterfeiting. This capacity is demonstrated by integrating the structural color, phosphorescence, and the audio channels into a single label (Fig.\u0026nbsp;\u003cspan refid=\"Fig6\" class=\"InternalRef\"\u003e6\u003c/span\u003ec,d, Supplementary Fig. S9). Based on this integrated label system, we demonstrate its applicability in scenarios involving multi-level anti-counterfeiting and high-security information transmission.\u003c/p\u003e \u003cp\u003eWe first developed a multi-level anti-counterfeiting label for pharmaceuticals (Fig.\u0026nbsp;\u003cspan refid=\"Fig6\" class=\"InternalRef\"\u003e6\u003c/span\u003ee-i), comprising four hierarchically organized layers that collectively form a comprehensive security framework. The first layer leverages the angle-dependent structural color of embedded photonic crystals to display the product name \u0026ldquo;Aspirin\u0026rdquo;, providing primary optical authentication under ambient light (Fig.\u0026nbsp;\u003cspan refid=\"Fig6\" class=\"InternalRef\"\u003e6\u003c/span\u003ee-ii). The second layer conceals the serial number \u0026ldquo;2024\u0026rdquo; in a phosphorescent channel (Fig.\u0026nbsp;\u003cspan refid=\"Fig6\" class=\"InternalRef\"\u003e6\u003c/span\u003ee-iii), visible only after 254 nm UV light cessation. The third layer directly encodes an audible \u0026ldquo;Medicine\u0026rdquo; message (Fig.\u0026nbsp;\u003cspan refid=\"Fig6\" class=\"InternalRef\"\u003e6\u003c/span\u003ee-iv), providing an additional acoustic authentication channel. The fourth A-PUF layer acts as the highest security tier, requiring manufacturers to preregister audio fingerprints in a secure database. End-users can then use portable readers to extract the embedded audio and transmit it to a cloud server for real-time authentication. By combining structural color, phosphorescence, and audio in a multi-channel architecture, this design dramatically enhances the security of pharmaceutical authentication.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eThe rapid proliferation of artificial intelligence (AI)-generated voices has lowered barriers to producing convincing synthetic audio, increasing the risk of fraud. A-PUFs provide a technological solution to this threat by integrating authentication directly into the information carrier. As an illustrative scenario, consider Mr. Red transmitting a confidential message, \u0026ldquo;Vote for Mr. Green\u0026rdquo;, to Mr. Blue (Fig.\u0026nbsp;\u003cspan refid=\"Fig6\" class=\"InternalRef\"\u003e6\u003c/span\u003ef). To prevent tampering or substitution during transmission, an acoustic-optical coupled PUF label encodes the recipient identifier (\u0026ldquo;To Mr. Blue\u0026rdquo;) within the structural color channel, the message is split across acoustic (\u0026ldquo;Vote for\u0026rdquo;) and phosphorescence (\u0026ldquo;Mr. Green\u0026rdquo;) channels (Fig.\u0026nbsp;\u003cspan refid=\"Fig6\" class=\"InternalRef\"\u003e6\u003c/span\u003ef-i, top), minimizing the risk of full-message interception. Attackers, however, can leverage similar fabrication methods and AI-based voice synthesis to produce counterfeit labels carrying falsified information (Fig.\u0026nbsp;\u003cspan refid=\"Fig6\" class=\"InternalRef\"\u003e6\u003c/span\u003ef-i, bottom). The high perceptual quality of the visual outputs and forged audio makes routine inspection insufficient to verify authenticity. By activating PUF authentication, Mr. Blue reads the embedded acoustic information and transmits it to a secure backend, enabling reliable verification of the genuine label (Fig.\u0026nbsp;\u003cspan refid=\"Fig6\" class=\"InternalRef\"\u003e6\u003c/span\u003ef-ii). The stored message can then be erased via a permanent magnet to prevent secondary leakage. This workflow establishes a comprehensive security protocol, including transmission, content concealment, authenticity verification, and post-read destruction, demonstrating the capacity of A-PUFs to safeguard information integrity against AI-enabled forgeries.\u003c/p\u003e \u003c/div\u003e"},{"header":"Conclusion","content":"\u003cp\u003eWe have demonstrated the potential of acoustic signatures in developing robust PUF systems with high encoding capacity, reconfigurable architectures, strong ML resistance, and convenient verification methods. By harnessing the inherent stochasticity and non-reproducibility of acoustic wave\u0026ndash;medium interactions, A-PUFs expand the concept of hardware security beyond traditional optical or electronic systems. Importantly, the seamless integration of audio information with security authentication within a single system further broadens the functional scope of PUF technologies, moving beyond device-specific physical fingerprints to enable multi-layered, information-rich security solutions. Multi-channel and broadband acoustic encoding strategies, incorporating frequency, phase, temporal, and spatial dimensions, significantly increase the complexity and entropy of acoustic challenge\u0026ndash;response pairs. Beyond their strong security performance, A-PUFs benefit from the natural compatibility of sound with human perception and common audio hardware, enabling accessible, low-cost solutions for identity verification, anti-counterfeiting traceability, communication encryption, and secure information transfer. Hybrid authentication schemes integrating A-PUFs with complementary optical, magnetic, or electronic modalities can further strengthen robustness while preserving user-friendly verification. This work establishes a conceptual framework linking the fields of information security and physical acoustics, positioning sound as a universal, human-accessible medium for secure authentication across digital and physical domains.\u003c/p\u003e"},{"header":"Methods","content":"\u003cp\u003e \u003cem\u003ePreparation of SF solution.\u003c/em\u003e The SF solution was prepared following established protocols\u003csup\u003e\u003cspan citationid=\"CR37\" class=\"CitationRef\"\u003e37\u003c/span\u003e\u003c/sup\u003e. Briefly, \u003cem\u003eBombyx mori\u003c/em\u003e cocoons were cut into small pieces and boiled in an aqueous Na\u003csub\u003e2\u003c/sub\u003eCO\u003csub\u003e3\u003c/sub\u003e solution (0.02 M) for 30 min to remove sericin. The resulting degummed silk was thoroughly rinsed with deionized water and air-dried at room temperature for 48 h. The dried fibers were subsequently dissolved in LiBr solution (9.3 M) at 60\u0026deg;C to obtain a 20 wt/vol% SF solution. This solution was dialyzed against deionized water for 3 days to remove residual salts, followed by centrifugation at 11,000 rpm for 20 min to eliminate insoluble particulates, yielding a clear and homogeneous SF solution for subsequent use.\u003c/p\u003e \u003cp\u003e \u003cem\u003ePretreatment of CrO\u003c/em\u003e \u003csub\u003e \u003cem\u003e2\u003c/em\u003e \u003c/sub\u003e. CrO\u003csub\u003e2\u003c/sub\u003e particles were surface-modified with a silica (SiO\u003csub\u003e2\u003c/sub\u003e) shell to improve their dispersibility within the SF solution. The coating procedure followed a previously reported sol-gel method\u003csup\u003e\u003cspan citationid=\"CR38\" class=\"CitationRef\"\u003e38\u003c/span\u003e,\u003cspan citationid=\"CR39\" class=\"CitationRef\"\u003e39\u003c/span\u003e\u003c/sup\u003e. Briefly, pristine CrO\u003csub\u003e2\u003c/sub\u003e powder was first ball-milled at 1,500 rpm for 2 h to reduce particle size and narrow the size distribution. Subsequently, 0.4 g of the milled CrO\u003csub\u003e2\u003c/sub\u003e particles was dispersed in 80 mL of ethanol and ultrasonicated for 5 min to achieve a homogeneous suspension. Aqueous ammonia solution (28 wt%, 6 mL) was then added as a catalyst. Under vigorous stirring (300 rpm), 20 mL of tetraethyl orthosilicate solution in ethanol (2 vol%) was slowly introduced dropwise, and the reaction was allowed to proceed for 3 h at room temperature. The resulting SiO\u003csub\u003e2\u003c/sub\u003e-coated CrO\u003csub\u003e2\u003c/sub\u003e particles were collected by filtration, washed three times with ethanol, and dried at 60\u0026deg;C to obtain the final powder.\u003c/p\u003e \u003cp\u003e \u003cem\u003ePreparation of A-PUF label.\u003c/em\u003e The silica-coated CrO\u003csub\u003e2\u003c/sub\u003e powder was dispersed in deionized water at a concentration of 0.2 g mL\u003csup\u003e\u0026minus;\u0026thinsp;1\u003c/sup\u003e and ultrasonicated for 10 min to form a homogeneous suspension. This suspension was subsequently mixed with SF solution and glycerol at a mass ratio of CrO\u003csub\u003e2\u003c/sub\u003e : glycerol : SF\u0026thinsp;=\u0026thinsp;3 : 4 : 10, followed by thorough mechanical stirring to ensure uniform dispersion. The resulting CrO\u003csub\u003e2\u003c/sub\u003e/SF precursor was rapidly cast onto a silicon wafer pretreated with trichloro(\u003csup\u003e1\u003c/sup\u003eH,\u003csup\u003e1\u003c/sup\u003eH,\u003csup\u003e2\u003c/sup\u003eH,\u003csup\u003e2\u003c/sup\u003eH-perfluorooctyl)silane to facilitate film peel-off. The cast film was dried in a sealed chamber under controlled conditions (25\u0026deg;C, 50% relative humidity) for 24 h, yielding freestanding CrO\u003csub\u003e2\u003c/sub\u003e@SF composite film. The dried film was then cut into rectangular strips with dimensions of 50 mm \u0026times; 3.5 mm to form A-PUF labels.\u003c/p\u003e \u003cp\u003e \u003cem\u003ePreparation of room-temperature phosphorescent silk fibroin (RTP-SF) solution.\u003c/em\u003e The RTP-SF solution was prepared by mixing an aqueous SF solution (12 wt%, 3 mL) with 3-biphenylboronic acid (5 mg dissolved in 4 mL of deionized water) and ammonium hydroxide (1 mL)\u003csup\u003e\u003cspan citationid=\"CR40\" class=\"CitationRef\"\u003e40\u003c/span\u003e\u003c/sup\u003e. The mixture was stirred at 80\u0026deg;C for 20 min to allow the reaction to proceed. The resulting solution was subsequently dialyzed against deionized water for 48 h to remove unreacted species and low-molecular-weight by-products, yielding the RTP-SF solution.\u003c/p\u003e \u003cp\u003e \u003cem\u003eFabrication of hybrid acoustic-optical labels.\u003c/em\u003e Acoustic\u0026ndash;optical labels were fabricated by integrating structural color and phosphorescent patterns into the CrO\u003csub\u003e2\u003c/sub\u003e@RTP-SF matrix. Structural color patterns were generated using inverse opal photonic crystals, prepared following previously reported methods\u003csup\u003e\u003cspan citationid=\"CR41\" class=\"CitationRef\"\u003e41\u003c/span\u003e,\u003cspan citationid=\"CR42\" class=\"CitationRef\"\u003e42\u003c/span\u003e\u003c/sup\u003e. Briefly, 30 \u0026micro;L of a monodisperse polystyrene microsphere suspension (600 nm diameter, carboxyl-functionalized, 6 wt%, dispersed in a 1:1 water/ethanol mixture; Huge biotechnology) was drop-cast onto the surface of water to form a floating monolayer. Microspheres that sank into the aqueous phase were removed, and a few drops of sodium dodecyl sulfate were added to facilitate the formation of a large-area, hexagonally close-packed PS monolayer at the air-water interface. The self-assembled monolayer was then transferred onto a hydrophobic substrate (silicon wafer treated with trichloro(\u003csup\u003e1\u003c/sup\u003eH,\u003csup\u003e1\u003c/sup\u003eH,\u003csup\u003e2\u003c/sup\u003eH,\u003csup\u003e2\u003c/sup\u003eH-perfluorooctyl)silane). To create patterned opal templates, a commercial CO\u003csub\u003e2\u003c/sub\u003e laser cutter (Speedy100R, Trotec Laser, Austria) was used to selectively remove polystyrene spheres along a predefined path. The laser was operated at 3% of its maximum power, with a scanning speed of 1 step s\u003csup\u003e\u0026minus;\u0026thinsp;1\u003c/sup\u003e. The RTP-SF solution doped with CrO\u003csub\u003e2\u003c/sub\u003e (CrO\u003csub\u003e2\u003c/sub\u003e : glycerol : RTP-SF\u0026thinsp;=\u0026thinsp;3 : 4 : 10) was poured into the patterned templates to fill all the air voids, followed by drying for 24 h (25 ℃, 30%-40% relative humidity) to form a free-standing CrO\u003csub\u003e2\u003c/sub\u003e@RTP-SF/polystyrene composite film. CrO\u003csub\u003e2\u003c/sub\u003e@RTP-SF film with patterned inverse opal structures was finally obtained by immersing the dried composite film in toluene for 24 h to remove the polystyrene spheres. The resulting master films were cut into rectangular labels (50 mm \u0026times; 3.5 mm). Phosphorescent patterns were introduced using UV light. Black shadow masks with the desired designs were placed on the CrO\u003csub\u003e2\u003c/sub\u003e@RTP-SF label surfaces, and the films were irradiated with a UV germicidal lamp (G36T5VH, Serve Tool Inc., USA; 254 nm, 40 W) for 30 min at a distance of 2 cm. The UV exposure selectively quenched phosphorescence in the uncovered regions, generating high-resolution patterned RTP features.\u003c/p\u003e \u003cp\u003e \u003cem\u003eAudio information recording, reading, and processing.\u003c/em\u003e The A-PUF label was affixed to both ends of a magnetic strip detached from a commercial cassette tape using ultrathin adhesive tape, and audio signals generated by human speech or computer playback were recorded onto the strip using a standard cassette recorder. The recorded audio information was retrieved using a tape recorder and then transferred to a computer for digital acquisition. The acquired audio data were subsequently processed and analyzed using Adobe Audition 2024 software.\u003c/p\u003e \u003cp\u003e \u003cstrong\u003eCharacterization\u003c/strong\u003e \u003cp\u003eThe cross-sectional morphologies of the A-PUF labels were characterized using a field-emission scanning electron microscope (SEM; S-8100, Hitachi, Japan). Magnetic hysteresis loops of A-PUF labels with varying CrO\u003csub\u003e2\u003c/sub\u003e contents were measured at 300 K using a vibrating sample magnetometer (VSM; Physical Property Measurement System, PPMS-9, Quantum Design, Inc., USA) under an external magnetic field ranging from \u0026minus;\u0026thinsp;30 to 30 kOe. Photographs were acquired using a digital single-lens reflex camera (EOS 850D, Canon), and videos were recorded at a frame rate of 8 frames per second for phosphorescent information readout. The Young\u0026rsquo;s modulus of A-PUF labels with different CrO\u003csub\u003e2\u003c/sub\u003e loadings was determined using a universal testing machine (Yiheng, China) at a tensile rate of 4 mm min\u003csup\u003e\u0026minus;\u0026thinsp;1\u003c/sup\u003e.\u003c/p\u003e \u003c/p\u003e "},{"header":"Declarations","content":"\u003cp\u003e \u003ch2\u003eCompeting interests\u003c/h2\u003e \u003cp\u003eThe authors declare no competing interests.\u003c/p\u003e \u003c/p\u003e\u003ch2\u003eAuthor contributions\u003c/h2\u003e \u003cp\u003eY.-Q.L., Y.W., Y.-H.F., and Z.-T.W. conceived the idea and designed the research; Y.-H.F. synthesized and characterized magnetic composite; Z.-T.W. performed PUF performance analysis; T.W. and X.-Y.C. assisted in acoustic performance characterizations; Y.-H.F., Z.-T.W., and Y.W. contributed to the data analysis. Y.-H.F., Z.-T.W., Y.W., and Y.-Q.L. wrote and revised the manuscript. Y.W. and Y.-Q.L. supervised the research. All authors approved the final version of the manuscript.\u003c/p\u003e\u003ch2\u003eAcknowledgment\u003c/h2\u003e \u003cp\u003eThis work was supported by the National Key R\u0026amp;D Program of China (No.2022YFA1203702, 2021YFA1202000, 2022YFA1405000), the National Natural Science Foundation of China (No. T2488302), and the Natural Science Foundation of Jiangsu Province (No. BK20243067).\u003c/p\u003e\u003cdiv id=\"Sec11\" class=\"Section2\"\u003e \u003ch2\u003eData availability\u003c/h2\u003e \u003cp\u003eThe data supporting the findings of this study are available within this article and its Supplementary Information. Additional data are available from the corresponding authors upon reasonable request. Source data are provided with this paper.\u003c/p\u003e \u003c/div\u003e"},{"header":"References","content":"\u003col\u003e\u003cli\u003e\u003cspan\u003eLewicki MS (2002) Efficient coding of natural sounds. Nat Neurosci 5:356\u0026ndash;363\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eSmith EC, Lewicki MS (2006) Efficient auditory coding. Nature 439:978\u0026ndash;982\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eDowling DR, Sabra KG (2015) Acoustic Remote Sensing. Annu Rev Fluid Mech 47:221\u0026ndash;243\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003ePark CI et al (2023) Ultrasonic barrier-through imaging by Fabry-Perot resonance-tailoring panel. Nat Commun 14:7818\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eGuo Y (2025) Directional sound propagation in acoustic artificial structures. npj Acoust 1:8\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eLee K et al (2020) Mechano-acoustic sensing of physiological processes and body motions via a soft wireless device placed at the suprasternal notch. Nat Biomed Eng 4:148\u0026ndash;158\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eLin Z et al (2024) Insights into Materials, Physics, and Applications in Flexible and Wearable Acoustic Sensing Technology. Adv Mater 36:2306880\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eKong Q et al (2020) PANNs: Large-Scale Pretrained Audio Neural Networks for Audio Pattern Recognition. IEEE/ACM Trans Audio Speech Lang Process 28:2880\u0026ndash;2894\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eWang W et al (2025) A review of speaker verification: Methods, network architectures, tasks and challenges. Eng Appl Artif Intell 162:112351\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eBassia P et al (2001) Robust audio watermarking in the time domain. IEEE Trans Multimedia 3:232\u0026ndash;241\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eHua G et al (2016) Twenty years of digital audio watermarking\u0026mdash;a comprehensive review. Sig Process 128:222\u0026ndash;242\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eZhang X et al (2021) Robust Reversible Audio Watermarking Scheme for Telemedicine and Privacy Protection. Comput Mater Continua 71:3035\u0026ndash;3050\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eWen S et al (2025) Robust Audio Watermarking Against Manipulation Attacks Based on Deep Learning. IEEE Signal Process Lett 32:126\u0026ndash;130\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eDavis S, Mermelstein P (1980) Comparison of parametric representations for monosyllabic word recognition in continuously spoken sentences. IEEE Trans Acoust Speech Signal Process 28:357\u0026ndash;366\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003ePal M et al (2018) Synthetic speech detection using fundamental frequency variation and spectral features. Comput Speech Lang 48:31\u0026ndash;50\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eYang J et al (2020) Significance of Subband Features for Synthetic Speech Detection. IEEE Trans Inf Forensics Secur 15:2160\u0026ndash;2170\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eBorrelli C et al (2021) ,\u003cem\u003e. Synthetic speech detection through short-term and long-term prediction traces. EURASIP J. INF. SECUR. 2 (2021).\u003c/em\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eSnyder D et al (2018), \u003cem\u003eX-Vectors: Robust DNN Embeddings for Speaker Recognition. in. IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) 5329\u0026ndash;5333 (2018).\u003c/em\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eBallesteros DM et al (2021) Deep4SNet: deep learning for fake speech classification. Expert Syst Appl 184:115465\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eBeguš G (2021) CiwGAN and fiwGAN: Encoding information in acoustic data to model lexical learning with Generative Adversarial Networks. Neural Netw 139:305\u0026ndash;325\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eLiu T et al (2021) Identification of Fake Stereo Audio Using SVM and CNN. INFORMATION 12:263\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAlmutairi Z, Elgibreen HA (2022) Review of Modern Audio Deepfake Detection Methods: Challenges and Future Directions. Algorithms 15:155\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eShaaban OA et al (2023) Audio Deepfake Approaches. IEEE Access 11:132652\u0026ndash;132682\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eXie Y et al (2024) Domain Generalization via Aggregation and Separation for Audio Deepfake Detection. IEEE Trans Inf Forensics Secur 19:344\u0026ndash;358\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eSingh K, Yadav J (2025) Audio Splicing Forgery Detection via Discrepancy-Aware Meta-Learning. SIViP 19:918\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eXu Y et al (2025), \u003cem\u003eAssociation for Computing Machinery, Dublin, Ireland,. ALDEN: Dual-Level Disentanglement with Meta-learning for Generalizable Audio Deepfake Detection. in Proceedings of the 33rd ACM International Conference on Multimedia 7277\u0026ndash;7286\u003c/em\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003ePappu R et al (2002) Physical One-Way Functions. Science 297:2026\u0026ndash;2030\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eHu Z et al (2016) Physically unclonable cryptographic primitives using self-assembled carbon nanotubes. Nat Nanotech 11:559\u0026ndash;565\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eArppe R, S\u0026oslash;rensen TJ (2017) Physical unclonable functions generated through chemical methods for anti-counterfeiting. Nat Rev Chem 1:0031\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eGao Y et al (2020) Physical unclonable functions. Nat Electron 3:81\u0026ndash;91\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eHoogendoorn A (1994) Digital compact cassette. \u003cem\u003eProceedings of the IEEE.\u003c/em\u003e 82, 1479\u0026ndash;1489\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eKim MS et al (2022) Revisiting silk: a lens-free optical physical unclonable function. Nat Commun 13:247\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eWang K et al (2024) All-silicon multidimensionally-encoded optical physical unclonable functions for integrated circuit anti-counterfeiting. Nat Commun 15:3203\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eKatsnelson MI et al (2008) Half-metallic ferromagnets: From band structure to many-body effects. Rev Mod Phys 80:315\u0026ndash;378\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eWang R et al (2023) Printable Epsilon-Type Structure Transistor Arrays with Highly Reliable Physical Unclonable Functions. Adv Mater 35:2210621\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eDodda A et al (2021) Graphene-based physically unclonable functions that are reconfigurable and resilient to machine learning attacks. Nat Electron 4:364\u0026ndash;374\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eRockwood DN et al (2011) Materials fabrication from Bombyx mori silk fibroin. Nat Protoc 6:1612\u0026ndash;1631\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eLi M et al (2018), \u003cem\u003eFlexible magnetic composites for light-controlled actuation and interfaces. Proc. Natl. Acad. Sci. U.S.A. 115, 8119\u0026ndash;8124\u003c/em\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eFu Y-H et al (2026) Modular Opto-Magnetic Oscillators: Harnessing Light to Drive Versatile Materials and Functionalities. Adv Mater 38:e20348\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eWang T et al (2026) Versatile Room-Temperature Phosphorescence Silk Fibroin Platforms for Sustainable and Biocompatible Multifunctional Interfaces. Adv Mater 38:e12659\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eWang Y et al (2017) Modulation of Multiscale 3D Lattices through Conformational Control: Painting Silk Inverse Opals with Water and Light. Adv Mater 29:1702769\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eWang T et al (2024) Angle-Multiplexed 3D Photonic Superstructures with Multi-Directional Switchable Structural Color for Information Transformation, Storage, and Encryption. Adv Sci 11:2400442\u003c/span\u003e\u003c/li\u003e\u003c/ol\u003e"}],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":true,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":true,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":false,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":false,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"nature-portfolio","isNatureJournal":true,"hasQc":false,"allowDirectSubmit":false,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"","title":"Nature Portfolio","twitterHandle":"","acdcEnabled":false,"dfaEnabled":false,"editorialSystem":"ejp","reportingPortfolio":"","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"","lastPublishedDoi":"10.21203/rs.3.rs-9353152/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-9353152/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eAcoustic signals offer a rich yet largely untapped physical medium for secure information encoding, anti-counterfeiting, and authentication. Here, we introduce an acoustic physical unclonable function (A-PUF) that leverage ubiquitous sound as an unpredictable excitation to generate high-entropy physical signatures. The A-PUFs are based on a composite magnetic medium comprising chromium dioxide microparticles embedded within a silk fibroin matrix, in which stochastic acoustic fluctuations interact with microscale magnetic-domain disorder to produce responses that are intrinsically unclonable and irreproducible. The resulting A-PUFs uniquely integrate human-accessible audio outputs with hardware-based security, achieving a unique convergence of usability and protection. Meanwhile, the A-PUFs demonstrate excellent reconfigurability and strong resistance to machine-learning attacks, while remaining fully compatible with standard playback technologies. We demonstrate multi-channel anti-counterfeiting via frequency-domain encoding and implement multi-dimensional security by constructing hybrid acoustic-optical labels. This work establishes A-PUFs as a scalable and practical paradigm for advanced anti-counterfeiting and information protection technologies.\u003c/p\u003e","manuscriptTitle":"Listening to disorder: acoustic physical unclonable functions for audio-enabled secure authentication","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-05-14 06:52:27","doi":"10.21203/rs.3.rs-9353152/v1","editorialEvents":[],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"nature-communications","isNatureJournal":true,"hasQc":false,"allowDirectSubmit":false,"externalIdentity":"NCOMMS","sideBox":"Learn more about [Nature Communications](http://www.nature.com/ncomms/)","snPcode":"","submissionUrl":"https://mts-ncomms.nature.com/","title":"Nature Communications","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"ejp","reportingPortfolio":"Nature Communications","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"a32d94e4-396e-4d6e-858b-e78e506c6b6e","owner":[],"postedDate":"May 14th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[{"id":66653074,"name":"Physical sciences/Materials science/Condensed-matter physics/Magnetic properties and materials"},{"id":66653075,"name":"Physical sciences/Physics/Applied physics/Acoustics"}],"tags":[],"updatedAt":"2026-05-14T06:52:27+00:00","versionOfRecord":[],"versionCreatedAt":"2026-05-14 06:52:27","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-9353152","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-9353152","identity":"rs-9353152","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}