No Malware or Network Access Required: How Deep-TEMPEST Reads Your PC Monitor Through HDMI Cable Radio Waves
No Trojan horse, no zero-day exploit, and no physical access to your local network are required to intercept what is currently displayed on your desktop screen. In a peer-reviewed academic study led at the Facultad de Ingeniería of the Universidad de la República in Montevideo, Uruguay, researchers Santiago Fernández, Emilio Martínez, Gabriel Varela, Pablo Musé, and Federico Larroca developed Deep-TEMPEST, a deep learning pipeline capable of reconstructing readable text from a PC monitor solely by capturing unintended electromagnetic waves leaking from an HDMI cable. Published openly under arXiv:2407.09717 alongside its full open-source codebase and training dataset on GitHub (emidan19/deep-tempest), the research brings classic side-channel eavesdropping firmly into the digital display era.
From 10-Bit TMDS Encoding to RF Leaks: Why Digital HDMI Signals Betray Your Monitor
Eavesdropping on video displays through unintentional radio emissions, historically classified under the military codename TEMPEST (or Van Eck Phreaking following Win van Eck's 1985 CRT demonstrations and Markus Kuhn's early 2000s work), used to rely on straightforward analog proportionality. On legacy VGA cables, voltage levels mapped linearly to pixel brightness. Digital HDMI (and single-link DVI), however, transmits video across three separate TMDS (Transition-Minimized Differential Signaling) channels corresponding to Red, Green, and Blue components.
Before traveling down the wire, each 8-bit color value (256 intensity levels) is transformed into a non-linear 10-bit word: the first eight bits undergo a differential XOR or XNOR operation (flagged by the ninth bit) to minimize bit transitions, followed by an optional inversion stage (flagged by the tenth bit) to balance DC voltage levels. At a standard 1920 × 1080 resolution at 60 Hz, once horizontal and vertical blanking intervals are factored in (where audio and control packets are transmitted, bringing the actual frame grid to 2,200 × 1,125 pixels), the pixel clock reaches 148.5 MHz, pushing a raw serial bit rate of 1.485 Gbps per channel.
In an ideal circuit, each TMDS channel uses a differential twisted pair (carrying positive and negative voltages) whose opposing electromagnetic fields cancel each other out. In real-world cables, tiny timing mismatches between the two conductors (known as skew) or slight impedance imbalances turn the HDMI cord into an unintentional radio antenna radiating energy around harmonics of the pixel frequency. Targeting a monitor running at 1600 × 900 at 60 Hz, the Uruguayan team tuned an Ettus Research USRP B200mini Software Defined Radio (SDR) to the third harmonic of the pixel clock (324 MHz), paired with a telescopic antenna, a Mini-Circuits ZJL-6G+ RF amplifier, and two band-limiting filters (SLP-450+ low-pass and SHP-250+ high-pass) feeding a modified GNU Radio flowgraph.
Inside the DRUNet Architecture and Chayane's Deep Learning Breakdown: Slashing Text Error Rates by Over 60 Points
The core hardware hurdle lies in the receiver's bandwidth bottleneck: an accessible mid-range SDR like the USRP B200mini tops out at a 50 MHz sampling rate (whereas a lab-grade Ettus USRP X440 capable of 3.2 GHz instantaneous bandwidth costs over $25,000). Because 50 MHz represents only a fraction of the HDMI bit rate, each captured RF sample blends several tens of encoded bits together. Legacy open-source tools such as TempestSDR or baseline gr-tempest simply plotted the magnitude of those samples in grayscale, yielding blurry ghost frames with an unreadable 92.2% Character Error Rate (CER) when evaluated by the Tesseract optical character recognition engine (alongside an 8.57 dB PSNR and 0.345 SSIM).
As our colleague Chaya "Chayane" highlights when examining the neural network pipeline, Deep-TEMPEST's breakthrough comes from recasting the interception as a Bayesian inverse problem and feeding the raw complex baseband samples (preserving both real and imaginary components, meaning both amplitude and phase information) into an end-to-end DRUNet (Deep Residual U-Net) convolutional neural network. Combining U-Net's multi-scale encoder-decoder topology with ResNet residual skip connections, Total Variation regularization, and automatic Hough Line Transform blanking alignment, the model learns the non-linear inverse mapping directly from the degraded RF spectrum.
To avoid capturing tens of thousands of physical screens for every monitor configuration, the researchers built an analytical Python simulator of the TMDS encoder and SDR low-pass filter, assembling a dataset of 3,491 clean-degraded image pairs (2,189 synthetic simulations and 1,302 real-world captures). Trained on a workstation powered by an Intel Core i7-10700F CPU, 64 GB of RAM, and an Nvidia GeForce RTX 3090 (24 GB VRAM), the network reconstructs a 1600 × 900 frame in 0.5 seconds on GPU (or 15 seconds on CPU). On real-world captures, the Character Error Rate drops from 92.2% down to 35.3% with the pure complex-valued model (compared to 43.6% when phase data is discarded), and reaches 29.8% CER (15.7 dB PSNR and 0.806 SSIM) when the simulation-trained base model is fine-tuned on real captures , an improvement of over 62 percentage points. Even more remarkably, fine-tuning the synthetic base model with just 10% of the real-world captures already achieves a 35.0% CER.
Should PC Gamers Worry? Physical Limits Against 240 Hz Monitors, HDMI 2.1 FRL, and Triple Shielding
While the academic leap is undeniable, does a PC or console gamer need to worry about someone reading their screen from across the street? Looking closely at the physical constraints documented in the paper reveals why modern gaming setups are far harder targets:
- High Sensitivity to Resolution Shifts and High Refresh Rates (144 Hz to 240 Hz): The DRUNet weights are tightly coupled to a specific resolution and pixel clock (in this case, static 60 Hz desktop output). When the researchers switched the target monitor to 1280 × 720 at 60 Hz on the fourth harmonic without retraining, the error rate immediately jumped back to 50%. On modern high-refresh gaming panels running at 144 Hz, 240 Hz, or higher , such as the displays we examined in our 18,000-hour WOLED longevity analysis and our HDMI 2.1 4K VRR capture hardware guide , pixel clocks skyrocket and the HDMI 2.1 specification replaces legacy 10-bit TMDS encoding with FRL (Fixed Rate Link) signaling, distributing up to 48 Gbps across four 16b/18b scrambled lanes. Similarly, DisplayPort transmits video in packetized, scrambled micro-packets rather than a continuous raster line scan.
- Physical Cable Shielding Stops Leaks at the Source: Differential leakage thrives on cheap, unshielded HDMI cords where twisted pairs suffer from crosstalk and timing skew. Upgrading to an Ultra High Speed Certified HDMI 2.1 Cable (48 Gbps) equipped with triple EMI shielding (individual aluminum Mylar foil per pair, high-density braided copper mesh, and shielded metal connector housings) or an active optical HDMI fiber cable drastically attenuates stray radio emissions.
- Built-In Software Countermeasures: Federico Larroca's team also demonstrated two software defenses that weaponize TMDS non-linearity against the neural network. Injecting an eye-imperceptible Gaussian noise overlay ($sigma = 3$) into the video output, or applying a subtle horizontal grayscale gradient (0 to 127 ramp) to document backgrounds, scrambles the 10-bit transition patterns into vertical interference bands and causes DRUNet inference to fail completely.
Certified Ultra High Speed HDMI 2.1 Cable 48 Gbps (Triple EMI Shielded)
- Triple-layer EMI/RFI shielding (aluminum Mylar foil + braided metal mesh) to suppress unintended electromagnetic leakage
- Certified 48 Gbps HDMI 2.1 FRL bandwidth supporting 4K 240Hz, 8K 60Hz, VRR, and ALLM
- Gold-plated connectors with reinforced metal housing for gaming PCs, PS5 Pro, and Xbox Series X
My Field Notes
Looking at the Universidad de la República test bench, I have genuine respect for the signal-processing ingenuity on display: turning a 50 MHz USRP B200mini into a readable HDMI screen receiver by feeding both amplitude and phase into a DRUNet model, just as Chayane pointed out on the deep learning side, is a textbook inverse-problem breakthrough. From a practical hardware perspective, however, I would not lose any sleep over my gaming rig: between the 0.5-second-per-frame GPU inference time on an RTX 3090, the short-range antenna requirement on a fixed 60 Hz desktop resolution, and the shift toward 48 Gbps FRL packet encoding on HDMI 2.1 and DisplayPort monitors, nobody is casually streaming your 240 Hz gameplay through a wall. Still, it serves as a great physical reminder to retire those thin, unshielded bargain-bin HDMI cords sitting behind your desk and stick to properly shielded Ultra High Speed HDMI 2.1 cables. We have not yet had a physical unit on our desk,if the manufacturer's team would like to send over a review sample so we can put it through our full real-world testing protocol, our lab doors are wide open.
Originally from Lyon, France, gaming journalist Bastien "Orion" relocated nearly a decade ago to Quebec City's Saint-Roch district, right in the heart of eastern Canada's development studio hub. Before crossing the Atlantic, he honed his versatile reporting style across classic French gaming web portals and specialist television outlets in the 2000s and 2010s, notably with JeuxVideo.fr and JeuxNews. Equally passionate about AAA blockbusters, North American studio culture, retro preservation, and community modding projects, he anchors Pro-Gamer's transatlantic desk and real-time coverage of US and Japanese industry announcements.
