Wireless eavesdropping on phone conversations has become a major security and safety concern, especially with advancements toward 5G and beyond featuring higher frequencies and higher sensing resolution. As demonstrated recently, attackers can remotely detect even micron-scale acoustic vibrations emanating from a smartphone's earpiece via off-the-shelf millimeter-wave radar for audio information eavesdropping, all without the victim ever noticing. Here, we present a new architecture, MiSINFO, that not only thwarts such attacks but also enables the victim to counter-attack by spoofing of eavesdroppers with audio misinformation. With emerging attacks targeting the physical medium, i.e., acoustic signals, which cannot be protected by digital encryption and are the weakest segment of the communication chain, MiSINFO aims to systematically modify the eavesdroppers' fundamental sensing observations, concealing native signals while encoding alternate synthetic data. MiSINFO incorporates a low-profile, reconfigurable metasurface and double-inference principles to dynamically generate artificial audio-vibration signatures, injecting deceptive misinformation. We design, implement, and experimentally evaluate MiSINFO. Our results reveal that eavesdroppers detect none of the original words emitted by the speaker, while the injected misinformation is reconstructed with a low average word error rate of 2.29%. Our work represents the first such eavesdropping countermeasure which not only prevents attackers from accurately decoding the true signal but also uses a false signal to fool them into believing that they have succeeded. This approach transforms defensive measures from merely reactive to proactively deceptive, giving the defender an advantage and the capability to delude attackers into trusting false information.

Wireless eavesdropping on phone conversations has become a major security concern as attackers repurpose advanced wireless capabilities in 5G and beyond featuring higher frequencies and higher sensing resolution. Recent studies have demonstrated that attackers can exploit off-the-shelf millimeter-wave radars to covertly detect even micron-scale vibrations of smartphones caused by the earpiece during the phone conversation, eavesdropping on audio information without the victim ever noticing. In our IEEE S&P'25 paper, we present a new architecture that not only thwarts such attacks but also injects false signatures to fool eavesdroppers into believing they have succeeded. Here, we demonstrate the eavesdropping countermeasure technique that enables the user to hide his private acoustic signals and simultaneously inject an alternative signal via a low-profile, reconfigurable metasurface. We present a metasurface-based audio encoding method that generates artificial audio-vibration signatures to send deceptive audio information to eavesdroppers. We showcase experimental audio samples from both the attack and the proposed countermeasure, which transforms defensive strategies from merely reactive to proactively deceptive.

The next generation of wireless networks will utilize highly directional beams to overcome the path loss at high frequencies, requiring angle inference during link establishment. Furthermore, the integration of location-based services into the wireless infrastructure is rapidly increasing, bringing in a significant demand for an integrated fast localization scheme. In this work, we present a first-of-its-kind one-shot angular localization method that is carried out with a re-configurable architecture that unlocks ISAC functionality. Specifically, we use an electrically tunable metasurface with broadband response to generate wavefronts that are randomized across the angular space with diverse wideband amplitude and phase observations, corresponding to a collection of angle-unique one-shot beacons. Our results show down to 0.26° mean absolute error at 20 dB SNR, an order of magnitude improvement over the recently proposed one-shot solutions based on leaky-wave antennas (LWAs), in addition to having wider area coverage and less stringent bandwidth requirements.