To promote the practicality of deep learning-based localization, existing studies aim to address the issue of scenario dependence through meta-learning. However, these studies primarily focus on variations in environmental layouts while overlooking the impact of changes in device configurations, such as bandwidth, the number of access points (APs), and the number of antennas used. Unlike environmental changes, variations in device configurations affect the dimensionality of channel state information (CSI), thereby compromising neural network usability. To address this issue, we propose Meta-SimGNN, a novelWiFi localization system that integrates graph neural networks with meta-learning to improve localization generalization and robustness. First, we introduce a fine-grained CSI graph construction scheme, where each AP is treated as a graph node, allowing for adaptability to changes in the number of APs. To structure the features of each node, we propose an amplitude-phase fusion method and a feature extraction method. The former utilizes both amplitude and phase to construct CSI images, enhancing data reliability, while the latter extracts dimension-consistent features to address variations in bandwidth and the number of antennas. Second, a similarity-guided meta-learning strategy is developed to enhance adaptability in diverse scenarios. The initial model parameters for the fine-tuning stage are determined by comparing the similarity between the new scenario and historical scenarios, facilitating rapid adaptation of the model to the new localization scenario. Extensive experimental results over commodity WiFi devices in different scenarios show that Meta-SimGNN outperforms the baseline methods in terms of localization generalization and accuracy.

Face authentication (FA) schemes are universally adopted. However, current FA systems are mainly camera-based and susceptible to masks and vulnerable to spoofing attacks. This paper exploits the penetrability, material sensitivity, and fine-grained sensing capability of millimeter wave (mmWave) to build an anti-spoofing FA system, named mmFace. It scans faces by moving a commodity mmWave radar along a specific trajectory. The signals bounced off the face carry facial biometric and structure features, which allows mmFace to achieve reliable liveness detection and FA. Due to the penetrability of mmWave, mmFace can still work well when users wear masks. To en- hance security, we develop a liveness detection method and an amplitude modulation-based method to defend against spoofing attacks and replay attacks. We enhance the basic version of mmFace [1] by improving its performance under mask occlusion and replay attack resilience. Besides, we explore a distance-resistant structure feature to suppress the impact of unstable face- to-device distance. To avoid on-site registration, we propose a novel virtual registration approach based on the cross-modal transformation from photos to mmWave. We implement mmFace with various antenna configurations and prototype two typical modes of mmFace. Extensive experiments demonstrate mmFace's accuracy in FA and effectiveness in attack detection.

WiFi-based indoor localization, supported by comprehensive infrastructure, is considered a highly promising solution. However, practical applications of existing WiFi-based methods often struggle due to dynamic antenna configurations and potential influence from obstacles, which can undermine the reliability of channel state information and frustrate localization. Even worse, environmental changes may lead to a domain shift, further degrading localization accuracy and system robustness. To address these problems, this paper introduces GraphFi, a novel system that leverages graph neural networks (GNNs) to deliver accurate and robust localization using nearby access points (APs). GraphFi designs two types of graph structures: intra-AP graph and inter-AP graph, to maximize the use of information from all available APs. They aggregate the local features among antennas within each AP and global features across APs, effectively addressing the problem of dynamic antenna configurations. Two specialized GNNs are utilized to derive accurate user locations from these graphs. Additionally, we introduce an anomaly detection method to identify and exclude obstacle-affected APs. This method also employs a tailored GNN to mitigate influence from unpredictable obstacles. Furthermore, we integrate an unsupervised domain adaptation mechanism based on a gradient reversal layer into GNNs. This helps maintain localization performance in a cost-efficient manner and ensures sustained effectiveness in a cross-domain setting. We prototype GraphFi using commodity WiFi devices and conduct extensive experiments in various scenarios. The results demonstrate that GraphFi achieves average localization errors of 0.17 m in a single-domain setting and 0.2851 m in a cross-domain setting, surpassing existing solutions in both precision and robustness.

Recent deep learning-based localization methods leverage meta-learning to enhance adaptability across diverse environments. However, most existing approaches focus on variations in environmental layouts while overlooking the changes in device configurations—such as the number of access points, antennas, or bandwidth. Unlike environmental variations, changes in device configurations fundamentally alter the dimensionality of channel state information (CSI), which can significantly hinder the usability and generalizability of neural networks. To address this problem, we propose Meta-GLoc, an adaptive and robust WiFi localization system that combines meta-learning with graph neural networks to effectively handle variations in CSI dimensionality. Specifically, we introduce an amplitude-phase fusion method and a feature extraction method to construct fine-grained CSI graphs. The former fuses the cleaned amplitude and phase in a carefully determined ratio to construct robust CSI images, while the latter extracts dimension-consistent features to mitigate the impact of varying bandwidth and antenna configurations. Moreover, meta-learning is employed to realize adaptive localization in different environments. Experiment results on commodity WiFi devices across different configurations demonstrate that Meta-GLoc effectively improves localization accuracy and robustness.

Speech carries a wealth of sensitive information, and many studies have investigated various methods of speech eavesdropping. Recent research has shown that even in soundproof indoor environments, speech systems can still be compromised by outdoor RF sensing technologies. However, existing approaches either rely heavily on prior knowledge of the target environment, fail when the primary sound source is occluded, or are limited to word-level classification. Consequently, they have not fully exposed the severe threats that RF sensing poses to speech privacy. To bridge these gaps, this paper presents Argus-ear, a mmWave-based speech eavesdropping system. By localizing and identifying sound sources throughout the target room, Argus-ear captures subtle vibrations from the most eavesdropping-worthy reflectors and reconstructs speech using deep neural networks. A series of techniques are proposed to enhance weak vibration sensing, suppress noise interference, and improve the fidelity of speech reconstruction. Extensive experiments demonstrate that Argus-ear can identify various types of sound sources and accurately reconstruct unconstrained vocabulary-level speech across different languages, speakers, and sound sources.

WiFi-based gesture recognition (WGR) has emerged as a promising technology due to its potential for integration with communication systems under the concept of integrated sensing and communication (ISAC). However, current WGR systems face two primary challenges: limited scalability for recognizing new gestures and poor compatibility with ISAC. These systems typically require extensive data collection and retraining for each new gesture and struggle to handle the dimensional variability of channel state information (CSI) caused by fluctuating data traffic in communication networks. To overcome these limitations, we introduce OneSense, a one-shot WGR system designed for seamless integration with communication systems. OneSense designs a data enrichment technique based on the law of signal propagation to generate virtual gestures. Based on enriched dataset, OneSense leverages an aug-meta learning (AML) framework to facilitate efficient and scalable FSL. OneSense also incorporates a data cropping strategy to enhance gesture feature prominence and a dynamic size-adaptive backbone model that ensures compatibility with CSI samples exhibiting dimensional inconsistencies. Experimental results show that OneSense achieves over 94% accuracy in one-shot gesture recognition. A case study further illustrates its effectiveness in ISAC contexts. Furthermore, our proposed AML framework reduces pre-training latency by more than 86% compared to conventional meta-learning approaches.

External disks (henceforth referred to as disks) are commonly used data storage peripherals for hosts. Verifying the legitimacy of these disks is essential to mitigate security risks, such as privacy breaches and virus propagation, before initiating interactions with a host. To address this challenge, we proposeDiskPrint, a novel replay-resistant, few-shot disk authentication system that relies on unintentional electromagnetic (EM) emanations from the internal components of disks. The core idea ofDiskPrintis that EM signals emitted during data writing operations can reveal unique hardware discrepancies among different disks. Building on electromagnetic theory, we develop a theoretical model that links EM signals to the underlying electronic components of the disk, demonstrating the feasibility of extracting distinctive disk fingerprints from these emanations. We also propose a set of signal enhancement techniques aimed at mitigating EM interface noise and improving the signal-to-noise ratio (SNR) of the EM measurements. To further strengthen the security ofDiskPrint, we introduce a device-agnostic, replay-resistant approach by incorporating randomness into the leaked EM signals. Real-world experiments with 60 disks, spanning both hard disk drives (HDDs) and solid-state drives (SSDs) from seven brands and 14 different models, indicate thatDiskPrintachieves an authentication success rate exceeding 99.6% with only three registration samples. A robustness analysis confirms its stability over time, while a security evaluation shows its resilience against various attack scenarios.

For safety guard and crime prevention, video surveillance systems have been pervasively deployed in many security-critical scenarios, such as the residence, retail stores, and banks. However, these systems could be infiltrated by the adversary and the video streams would be modified or replaced, i.e., under the video forgery attack. The prevalence of Internet of Things (IoT) devices and the emergence of Deepfake-like techniques severely emphasize the vulnerability of video surveillance systems under such attacks. To secure existing surveillance systems, in this paper we propose a vision-WiFi cross-modal video forgery detection system, namelyWiSil. Leveraging a theoretical model based on the principle of signal propagation,WiSilconstructs wave front information of the object in the monitoring area from WiFi signals. With a well-designed deep learning network,WiSilfurther recovers silhouettes from the wave front information. Based on a Siamese network-based semantic feature extractor,WiSilcan eventually determine whether a frame is manipulated by comparing the semantic feature vectors extracted from the video’s silhouette with those extracted from the WiFi’s silhouette. We enhance the basic version ofWiSilFang et al. 2023 by developing a model compression method and a forgery trace localization method. Extensive experiments show thatWiSilachieves 95%$+$accuracy in detecting tampered frames.

Federated Learning (FL) collaboratively trains a shared global model without exposing clients' private data. In practical FL systems, clients (e.g., smartphones and wearables) typically have disparate system resources. Traditional FL, however, adopts a one-size-fits-all solution, where a homogeneous large model is sent to and trained on each client. This method results in an overwhelming workload for less capable clients and starvation for others. To tackle this, we proposeFedConv, a client-friendly FL framework, minimizing the system overhead on resource-constrained clients by providing heterogeneous customized sub-models.FedConvfeatures a novellearning-on-modelparadigm that learns the parameters of heterogeneous sub-models viaconvolutional compression. To aggregate heterogeneous sub-models, we proposetransposed convolutional dilationto convert them back to large models with a unified size while retaining personalized information. The compression and dilation processes, transparent to clients, are tuned on the server using a small public dataset. We further propose ahierarchical and clustering-based local trainingstrategy for enhanced performance. Extensive experiments on six datasets show thatFedConvoutperforms state-of-the-art FL systems in terms of model accuracy (by more than 35% on average), computation and communication overhead (with 33% and 25% reduction, respectively).

With a wide range of common and privacy-sensitive applications, smartphones are frequently accessed for substantial personal information. Therefore, user-friendliness and security are crucial for user authentication on smartphones. Recently, convenient and secure biometric-based authentication is widely employed for smartphones, where the facial authentication stands out due to its potential for advancements in both user-friendliness and security. However, existing facial authentication methods possess some defects. For example, camera-based methods require good illumination conditions and are susceptible to 2D spoofing attacks. Moreover, previous acoustic-based methods either require camera assistance, or still suffer from 3D spoofing attacks. Even worse, some acoustic-based methods use audible sound waves, causing discomfort to users. To solve these questions, in this paper we propose UltraFace, an anti-spoofing and user-friendly facial authentication system on smartphones. It extracts facial geometry features and acoustic impedance features from imperceptible ultrasound. Leveraging the principle of ultrasound propagation, UltraFace correlates spectrograms of reflected signals with facial biometrics. Utilizing a deep learning model as a feature extractor, UltraFace mines fine-grained facial geometry features and acoustic impedance features from the spectrograms for accurate user authentication. Extensive experiments show that UltraFace achieves $97.2 \%$ accuracy in user authentication and can effectively defend against spoofing attacks. Furthermore, UltraFace exhibits robustness for long-term usage.

In recent years, WiFi-based gesture recognition (WGR) has gained popularity due to its privacy-preserving nature and the wide availability of WiFi infrastructure. However, existing WGR systems suffer from scalability issues, i.e., requiring extensive data collection and re-training for each new gesture class. To address these limitations, we propose OneSense, a one-shot WiFi-based gesture recognition system that can efficiently and easily adapt to new gesture classes. Specifically, we first propose a data enrichment approach based on the law of signal propagation in physical world to generate virtual gestures, enhancing the diversity of the training set without extra overhead of real sample collection. Then, we devise an aug-meta learning (AML) framework to enable efficient and scalable few-short learning. This framework leverages two pre-training stages (i.e., aug-training and meta-training) to improve the model’s feature extraction and generalization abilities, and ultimately achieves accurate one-shot gesture recognition through fine-tuning. Experimental results demonstrate that OneSense achieves 93% one-shot gesture recognition accuracy, which outperforms the state-of-the-art approaches. Moreover, it maintains high recognition accuracy when facing new environments, user locations, and user orientations. Furthermore, the proposed AML framework reduces 86%+ pre-training latency compared to conventional meta-learning method.

Smartwatches have become increasingly prevalent in people’s daily lives, offering support for a wide range of privacy and security-sensitive applications, such as SMS messaging and mobile payment. Consequently, there is an imperative need for independent user authentication on smartwatches to safeguard against property loss and personal privacy breaches. However, current authentication methods rely on passwords, leaving users vulnerable to shoulder surfing attacks. Moreover, existing biometric-based authentication methods either require dedicated sensors or cannot support continuous authentication. In this paper, we propose a replay-resistant continuous authentication system on smartwatches, namely WristPass. It extracts acoustic impedance biometrics from ultrasonic signals. Leveraging a theoretical model based on the principle of ultrasound propagation, WristPass correlates spectrograms of reflected signals with impedance features of wrist skin. Utilizing a deep learning model as a feature extractor, WristPass mines fine-grained impedance features from the spectrograms for accurate user authentication. Additionally, to prevent WristPass from replay attacks, we design a device fingerprinting method to detect replayed signals. Extensive experiments show that WristPass can achieve 96.7% accuracy in user authentication. Furthermore, WristPass exhibits robustness for long-term usage.

To break through the transmission rate bottleneck of traditional communication, semantic communication is proposed to support emerging applications with extremely low latency requirements such as remote surgery and autonomous vehicle. Unlike the transmission of verbose symbols in traditional communication, mainstream semantic communications use deep learning technology to extract compact semantic information from data and convey it. However, the application of deep neural networks also poses security concerns, i.e., vulnerabilities to adversarial attacks. In this paper, we perform the first study on the security of semantic communication against both whitebox and black-box attacks by compromising the wireless channel between the transmitter and receiver. To launch practical and effective attacks, a systematic and universal attack framework is designed to craft content-agnostic, undetectable, robust whitebox perturbation signals as well as highly-transferable blackbox ones. Extensive experiments on two open-source datasets demonstrate that our attack framework can achieve over 87%, 99%, and 89% success rates in untargeted white-box, targeted white-box, and untargeted black-box attacks. This means that the proposed attack methods could severely threaten the quality of service of current semantic communications. We also propose two mitigation methods to resist such attacks.

Federated Learning (FL) facilitates collaborative training of a shared global model without exposing clients' private data. In practical FL systems, clients (e.g., edge servers, smartphones, and wearables) typically have disparate system resources. Conventional FL, however, adopts a one-size-fits-all solution, where a homogeneous large global model is transmitted to and trained on each client, resulting in an overwhelming workload for less capable clients and starvation for other clients. To address this issue, we propose FedConv, a client-friendly FL framework, which minimizes the computation and memory burden on resource-constrained clients by providing heterogeneous customized sub-models. FedConv features a novel learning-on-model paradigm that learns the parameters of the heterogeneous sub-models via convolutional compression. Unlike traditional compression methods, the compressed models in FedConv can be directly trained on clients without decompression. To aggregate the heterogeneous sub-models, we propose transposed convolutional dilation to convert them back to large models with a unified size while retaining personalized information from clients. The compression and dilation processes, transparent to clients, are optimized on the server leveraging a small public dataset. Extensive experiments on six datasets demonstrate that FedConv outperforms state-of-the-art FL systems in terms of model accuracy (by more than 35% on average), computation and communication overhead (with 33% and 25% reduction, respectively).

External disks (abbr., disks) are common data storage peripherals for hosts. Verifying the disk’s legitimacy is crucial to prevent security issues on a host like privacy leakage and virus propagation before interaction setup. To address this issue, we propose DiskPrint, a novel non-intrusive and replay-resistant disk authentication system that relies on unintentional electromagnetic (EM) emanations from disks’ internal components. The core idea of DiskPrint is that EM signals emitted during data writing can reflect hardware discrepancies among different disks. Based on electromagnetic principles, we establish a theoretical model associating EM signals with built-in electronic components to demonstrate the feasibility of extracting disk fingerprints from such EM emanations. We also propose a series of signal enhancement methods to remove the EM interface and improve the signal-to-noise ratio (SNR) of the EM measurements. To boost the security of DiskPrint, we propose a device-agnostic replay-resistant method by introducing randomness into leaked EM signals. Real-world experiments with 60 disks including hard disk drives (HDDs) and solid state drives (SSDs) from seven brands and 14 models indicate that DiskPrint achieves a 99%+ authentication success rate. Robustness analysis demonstrates DiskPrint’s stability over time. Security study shows its ability to defend against various attacks.

Given the fact that WiFi-based sensing can be realized through the reuse of WiFi communication facilities and frequency bands, integrated sensing and communication (ISAC) emerges as a pivotal direction for future WiFi standards, such as IEEE 802.11bf. Traditional WiFi sensing systems extract channel state information (CSI) from exclusive WiFi packets to quantify the characteristics of the sensing target. This poses challenges for existing WiFi systems originally designed for communication purposes, as it demands high-quality and sufficient CSI measurements. In this paper, we propose SenCom as a step towards forward-compatible ISAC solution. SenCom extracts CSI from general WiFi packets, enabling CSI calibration across different WiFi communication modes and delivering quality CSI measurements for upper-layer sensing applications. A fitting-resampling scheme and an incentive strategy are also developed. The former one is to obtain evenly sampled CSI with consistent dimensionality and the latter one is to guarantee sufficient CSI measurements over time. We build a prototype of SenCom and conduct extensive experiments involving 15 participants. The results show that SenCom’s competence for a variety of sensing tasks while making minimal compromises to WiFi communication performance.

Behavior recognition plays an essential role in numerous behavior-driven applications (e.g., virtual reality and smart home) and even in the security-critical applications (e.g., security surveillance and elder healthcare). Recently, WiFi-based behavior recognition (WBR) technique stands out among many behavior recognition techniques due to its advantages of being non-intrusive, device-free, and ubiquitous. However, existing WBR research mainly focuses on improving the recognition precision, while rarely studying the security aspects. In this article, we reveal that WBR systems are vulnerable to manipulating physical signals. For instance, our observation shows that WiFi signals can be changed by jamming signals. By exploiting the vulnerability, we propose two approaches to generate physically online adversarial samples to perform untargeted attack and targeted attack, respectively. The effectiveness of these attacks are extensively evaluated over four real-world WBR systems. The experiment results show that our attack approaches can achieve 80% and 60% success rates for untargeted attack and targeted attack in physical world, respectively. We also show that our attack approaches can be generalized to other WiFi-based sensing applications, such as user authentication.

Wireless charging is becoming an essential power supply pattern for electronic devices. Currently, mainstream smartphones are almost compatible with wireless charging. However, when the charging efficiency is continuously improved, its security challenge still remains open yet overlooked. In this paper, we reveal that severe security flaws exist in the wireless charging procedure of off-the-shelf commodity smartphones. Specifically, we find that an attacker can utilize the electromagnetic induction effect between the wireless charger and the smartphone to detect the activities and operations performed on the smartphone. We term such attack asEM-Surfingside-channel attack and build a theoretical model to show its feasibility. To explore the hazard ofEM-Surfing, we propose a three-module attack method, with which we conduct real-world experiments over three mainstream models of smartphones. The results show that the attacker can achieve over 99%, 96%, 94%, and 97% accuracy when inferring the passcode, keystroke, App information, and speech content, respectively. We also design an App namedSecChargingto prevent smartphones fromEM-Surfingattacks. The defense experiment results demonstrate thatSecChargingcan mitigate the threats posed byEM-Surfingeffectively.

Covert eavesdropping via microphones has always been a major threat to user privacy. Benefiting from the acoustic non-linearity property, the ultrasonic microphone jammer (UMJ) is effective in resisting this long-standing attack. However, prior UMJ researches underestimate adversary's attacking capability in reality and miss critical metrics for a thorough evaluation. The strong assumptions of adversary unable to retrieve information under low word recognition rate, and adversary's weak denoising abilities in the threat model make these works overlook the vulnerability of existing UMJs. As a result, their UMJs' resilience is overestimated. In this paper, we refine the adversary model and completely investigate potential eavesdropping threats. Correspondingly, we define a total of 12 metrics that are necessary for evaluating UMJs' resilience. Using these metrics, we propose a comprehensive framework to quantify UMJs' practical resilience. It fully covers three perspectives that prior works ignored to some degree, i.e., ambient information, semantic comprehension, and collaborative recognition. Guided by this framework, we can thoroughly and quantitatively evaluate the resilience of existing UMJs towards eavesdroppers. Our extensive assessment results reveal that most existing UMJs are vulnerable to sophisticated adverse approaches. We further outline the key factors influencing jammers' performance and present constructive suggestions for UMJs' future designs.

Current facial authentication (FA) systems are mostly based on the images of human faces, thus suffering from privacy leakage and spoofing attacks. Mainstream systems utilize facial geometry features for spoofing mitigation, but they are still vulnerable to feature manipulation, e.g., 3D-printed human faces. In this article, we propose a novel privacy-preserving anti-spoofing FA system, named RFace, which extracts both the 3D geometry and inner biomaterial features of faces using a COTS RFID tag array. These features are difficult to obtain and forge, hence are resistant to spoofing attacks. Unlike images, RF signals are not perceptible to human eyes, so RFace protects user's privacy. We build a theoretical model to rigorously prove the feasibility of feature acquisition and the correlation between facial features and RF signals. To enhance the security of RFace, we specify the tag reading order for each authentication to defend against the signal replay attack. For practicality, we design an effective algorithm to mitigate the impact of unstable distance and angle deflection from the face to the array. Extensive experiments with 30 participants and three types of spoofing attacks show that RFace achieves an average authentication success rate of over 95.7$\%$and an EER of 4.4$\%$. More importantly, no replay attack or spoofing attack succeeds in deceiving RFace in the experiments.

With the popularity of LED infrastructure and the camera on smartphone, LED-Camera visible light communication (VLC) has become a realistic and promising technology. However, the existing LED-Camera VLC has limited throughput due to the sampling manner of camera. In this paper, by introducing a polarization dimension, we propose a hybrid modulation scheme with LED and polarization signals to boost throughput. Nevertheless, directly mixing LED and polarized signals may suffer from channel conflict. We exploit well-designed packet structure and Symmetric Return-to-Zero Inverted (SRZI) coding to overcome the conflict. In addition, in the demodulation of hybrid signal, we alleviate the noise of polarization on the LED signals by the polarization background subtraction. We further propose a pixel-free approach to correct the perspective distortion caused by the shift of view angle by adding polarizers around the liquid crystal array. We build a prototype of this hybrid modulation scheme using off-the-shelf optical components. We enhance the basic version (Zou et al. 2023) of preliminary work by analyzing the performance with FSK modulation. Extensive experimental results demonstrate that the hybrid modulation scheme can achieve reliable communication, achieving 13.4 kbps throughput, which is 400$\%$of the existing state-of-the-art LED-Camera VLC.

Rodent infestation has always been one of the most severe threats to humans, which to solve consumes massive manpower and resources. People usually use traps or poisons to treat rat infestation. Such passive countermeasures are inefficient. Damage often occurs when the rats are finally trapped or killed, not to mention the potential risk to injure humans or cause pollution. In this article, we propose a WiFi-based active small object tracking system named TomFi . The core components of TomFi include several deep learning techniques that bridge rat locations/motions and WiFi signal variations (represented by the channel state information). TomFi first employs a detection model to detect the appearance of the rat and then localize it based on a two-branch localization model. Through the design of the two-branch localization model, to our best knowledge, we are the first to solve the information loss and distortion problem. We conducted extensive experiments in both the laboratory environment and real-world kitchen scenarios. The results show that TomFi can achieve a detection success rate of 99%+ and a centimeter-level localization accuracy in real time.

With the popularity of LED infrastructure and the camera on smartphone, LED-Camera visible light communication (VLC) has become a realistic and promising technology. However, the existing LED-Camera VLC has limited throughput due to the sampling manner of camera. In this paper, by introducing a polarization dimension, we propose a hybrid modulation scheme with LED and polarization signals to boost throughput. Nevertheless, directly mixing LED and polarized signals may suffer from channel conflict. We exploit well-designed packet structure and Symmetric Return-to-Zero Inverted (SRZI) coding to overcome the conflict. In addition, in the demodulation of hybrid signal, we alleviate the noise caused by polarization on the LED signals by polarization background subtraction. We further propose a pixel-free approach to correct the perspective distortion caused by the shift of view angle by adding polarizers around the liquid crystal array. We build a prototype of this hybrid modulation scheme using off-the-shelf optical components. Extensive experimental results demonstrate that the hybrid modulation scheme can achieve reliable communication, achieving 13.4 kbps throughput, which is 400 % of the existing state-of-the-art LED-Camera VLC.

Rodent infestation is a great danger to human society, continuously threatening food safety and inducing disease spread. Existing methods to deal with rodent infestation are mainly based on passive bait traps and poisoning. These methods lack timeliness and effectiveness due to the missing of real-time detection. In this paper, we develop WiHunter, a new wireless sensing system to discover small objects (e.g., rat). Our idea is to exploit reflection signal effect of wireless channels induced by the movement of small objects around the receiver antenna. However, existing wireless sensing works usually employ customized or costly device-dependency Network Interface Cards(NIC), which are impractical to be densely deployed in reality. We implement WiHunter with several CSI-enabled standalone IoT nodes. We show how such devices enable moving small object detection via WiFi signal. The rationale behind this is 1) thanks to the widespread deployments of WiFi infrastructures and IoT devices, the WiFi signal covers almost every location of the corner, 2) the signal amplitude of each device is related to the small object near the receiver antenna. This ability gives us the opportunity to sense object as small as a rat. We implement WiHunter with ESP32 microcontroller on Espressif IoT Development Framework (both of them are cheap commodity off-the-shelf (COTS) devices) and design a practical small object intrusion detection system. Comprehensive and real-world experiments demonstrate that our system is effective in detecting the presence of small objects with an average accuracy of 92.1%.

Given the fact that WiFi-based sensing can be realized by reusing WiFi communication facilities and communication frequency bands, integrated sensing and communication (ISAC) is considered a crucial development direction for future WiFi standards, such as IEEE 802.11bf. Traditional WiFi sensing systems extract channel state information (CSI) from customized WiFi packets to quantify the characteristics of the sensing target. This poses challenges for existing WiFi systems originally designed for communication purposes, as it requires high-quality and sufficient CSI measurements. In this paper, we propose SenCom, which extracts CSI from general WiFi packets. SenCom enables CSI calibration across different WiFi communication modes and provides unified CSI measurements for upper-layer sensing applications. We also devise a fitting-resampling scheme to derive evenly sampled CSI with consistent dimensionality, and an incentive strategy to ensure sufficient CSI measurements over time. We build a prototype of SenCom and perform extensive experiments with 15 participants. The results show that SenCom is competent for a variety of sensing tasks, while incurring little compromise to the WiFi communication performance.

Recent years have witnessed the booming development of RF sensing, which supports both identity authentication and behavior recognition by analysing the signal distortion caused by human body. In particular, RF-based identity authentication is more attractive to researchers, because it can capture the unique biological characteristics of users. However, the openness of wireless transmission raises privacy concerns since human behaviors could expose massive private information of users, which impedes the real-world implementation of RF-based user authentication applications. It is difficult to filter out the behavior information from the collected RF signals. In this article, we propose a privacy-preserving deep neural network namedBPCloakto erase the behavior information in RF signals while retaining the ability of user authentication. We conduct extensive experiments over mainstream RF signals collected from three real wireless systems, including the WiFi, radio frequency identification (RFID), and millimeter-wave (mmWave) systems. The experimental results show thatBPCloaksignificantly reduces the behavior recognition accuracy, i.e., 85%+, 75%+, and 65%+ reduction for WiFi, RFID, and mmWave systems respectively, merely with a slight penalty of accuracy decrease when using these three systems for user authentication, i.e., 1%-, 3%-, and 5%-, respectively.

Biometric plays an important role in user authentication. However, the most widely used biometrics, such as facial feature and fingerprint, are easy to capture or record, and thus vulnerable to spoofing attacks. On the contrary, intracorporal biometrics, such as electrocardiography and electroencephalography, are hard to collect, and hence more secure for authentication. Unfortunately, adopting them is not user-friendly due to their complicated collection methods or inconvenient constraints on users. In this paper, we propose a novel biometric-based authentication system, namelyMandiPass.MandiPassleverages inertial measurement units, which have been widely deployed in portable devices, to collect intracorporal biometric from the vibration of user's mandible. It provides not only one-time verification function but also continuous authentication function. Both the two functions are secure and user-friendly. We theoretically validate the feasibility ofMandiPassand develop a series of deep learning techniques for effective biometric extraction. We also utilize a Gaussian matrix to defend against replay attacks. Extensive experiment results with 34 volunteers show thatMandiPasscan achieve low equal error rate, even under various harsh environments.

Multi-factor user authentication becomes increasingly popular due to its superior security comparing with single-factor user authentication. However, existing multi-factor user authentication methods usually require multiple interactions between users and different authentication components when inputting the multiple factors, leading to extra overhead and bad user experience. In this paper, we propose a secure and user-friendly multi-factor user authentication system named BioDraw. It utilizes four categories of biometrics (impedance, geometry, behavior, and composition) of human hand plus the pattern-based password to identify and authenticate users. User only needs to draw a pattern on a radio frequency identification tag array, while four biometrics can be collected simultaneously. Specifically, we first design a gradient-based pattern recognition algorithm to precisely extract user’s secret pattern. Then, a convolutional neural network- and long short-term memory-based classifier is utilized for user recognition. Furthermore, to guarantee the systemic security, an anti-replay method called Binary ALOHA is proposed to detect replayed signals. We conduct extensive experiments with 30 volunteers. The experiment results show that BioDraw can achieve high authentication accuracy (with a 2%– false reject rate) and is effective in defending against various attacks.

Behavior recognition plays an essential role in numerous behavior-driven applications (e.g., virtual reality and smart home) and even in the security-critical applications (e.g., security surveillance and elder healthcare). Recently, WiFi-based behavior recognition (WBR) technique stands out among many behavior recognition techniques due to its advantages of being non-intrusive, device-free, and ubiquitous. However, existing WBR research mainly focuses on improving the recognition precision, while neglecting the security aspects. In this paper, we reveal that WBR systems are vulnerable to manipulating physical signals. For instance, our observation shows that WiFi signals can be changed by jamming signals. By exploiting the vulnerability, we propose two approaches to generate physically online adversarial samples to perform untargeted attack and targeted attack, respectively. The effectiveness of these attacks are extensively evaluated over four real-world WBR systems. The experiment results show that our attack approaches can achieve 80% and 60% success rates for untargeted attack and targeted attack in physical world, respectively. We also propose three methods to mitigate the hazard of such attacks.

Face authentication (FA) schemes are universally adopted. However, current FA systems are mainly camera-based and hence susceptible to face occlusion (e.g., facial masks) and vulnerable to spoofing attacks (e.g., 3D-printed masks). This paper exploits the penetrability, material sensitivity, and fine-grained sensing capability of millimeter wave (mmWave) to build an anti-spoofing FA system, named mmFace. It scans the human face by moving a commodity off-the-shelf (COTS) mmWave radar along a specific trajectory. The mmWave signals bounced off the human face carry the facial biometric features and structure features, which allows mmFace to achieve reliable liveness detection and FA. Due to the penetrability of mmWave, mmFace can still work well even if users wear masks. We explore a distance-resistant facial structure feature to suppress the impact of unstable face-to-device distance. To avoid inconvenient on-site registration, we also propose a novel virtual registration approach based on the core idea of cross-modal transformation from photos to mmWave signals. We implement mmFace with various antenna configurations and prototype two typical modes of mmFace. Extensive experiments show that mmFace can realize accurate FA as well as reliable liveness detection.

Biometric plays an important role in user authentication. However, the most widely used biometrics, such as facial feature and fingerprint, are easy to capture or record, and thus vulnerable to spoofing attacks. On the contrary, intracorporal biometrics, such as electrocardiography and electroencephalography, are hard to collect, and hence more secure for authentication. Unfortunately, adopting them is not user-friendly due to their complicated collection methods and inconvenient constraints on users. In this paper, we propose a novel biometric-based authentication system, namely MandiPass. MandiPass leverages inertial measurement units (IMU), which have been widely deployed in portable devices, to collect intracorporal biometric from the vibration of user's mandible. The authentication merely requires user to voice a short ‘EMM’ for generating the vibration. In this way, MandiPass enables a secure and user-friendly biometric-based authentication. We theoretically validate the feasibility of MandiPass and develop a two-branch deep neural network for effective biometric extraction. We also utilize a Gaussian matrix to defend against replay attacks. Extensive experiment results with 34 volunteers show that MandiPass can achieve an equal error rate of 1.28%, even under various harsh environments.

Biometrics have been widely used in user authentications. However, existing outer-body biometrics (e.g., fingerprint), collecting from body surface, are vulnerable to spoofing attacks. Although inner-body biometrics, such as the electrocardiogram, are hard to be forged, their complex acquisition methods and instability lead to unsatisfactory user experience. Therefore, achieving good user-friendliness and high security simultaneously in biometric-based authentication is challenging. In this paper, we propose Hand-Key, an attack-resilient and user-friendly user authentication system to address the above challenge. Hand-Key utilizes a low-cost radio frequency identification (RFID) tag array to simultaneously collect the inner-body composition and outer-body geometric features of human hand to identify users. Users are merely required to hold their hands in a ‘handshaking’ pose between a reader's antenna and a tag array during authentication. To further enhance the security, we tactfully leverage the inherent randomness of the anti-collision scheme in RFID systems to make Hand-Key immune against replay attacks. We built a prototype of Hand-Key and conducted extensive experiments with 30 volunteers. The results show that Hand-Key achieves an authentication success rate of 99%+.

Current facial authentication (FA) systems are mostly based on the images of human faces, thus suffering from privacy leakage and spoofing attacks. Mainstream systems utilize facial geometry features for spoofing mitigation, which are still easy to deceive with the feature manipulation, e.g., 3D-printed human faces. In this paper, we propose a novel privacy-preserving anti-spoofing FA system, named RFace, which extracts both the 3D geometry and inner biomaterial features of faces using a COTS RFID tag array. These features are difficult to obtain and forge, hence are resistant to spoofing attacks. RFace only requires users to pose their faces in front of a tag array for a few seconds, without leaking their visual facial information. We build a theoretical model to rigorously prove the feasibility of feature acquisition and the correlation between the facial features and RF signals. For practicality, we design an effective algorithm to mitigate the impact of unstable distance and angle deflection from the face to the array. Extensive experiments with 30 participants and three types of spoofing attacks show that RFace achieves an average authentication success rate of over 95.7% and an EER of 4.4%. More importantly, no spoofing attack succeeds in deceiving RFace in the experiments.

Recent years have witnessed the booming development of RF sensing, which supports both identity authentication and behavior recognition by analysing the signal distortion caused by human body. In particular, RF-based identity authentication is more attractive to researchers, because it can capture the unique biological characteristics of users. However, the openness of wireless transmission raises privacy concerns since human behaviors can expose the massive private information of users, which impedes the real-world implementation of RF-based user authentication applications. Unfortunately, it is difficult to filter out the behavior information from the collected RF signals.In this paper, we propose a privacy-preserving deep neural network named BPCloak to erase the behavior information in RF signals while retaining the ability of user authentication. We conduct extensive experiments over mainstream RF signals collected from three real wireless systems, including the WiFi, Radio Frequency IDentification (RFID), and millimeter-wave (mmWave) systems. The experimental results show that BPCloak significantly reduces the behavior recognition accuracy, i.e., 85%+, 75%+, and 65%+ reduction for WiFi, RFID, and mmWave systems respectively, merely with a slight penalty of accuracy decrease when using these three systems for user authentication, i.e., 1%-, 3%-, and 5%-, respectively.

WiFi-based Human Gesture Recognition (HGR) becomes increasingly promising for device-free human-computer interaction. However, existing WiFi-based approaches have not been ready for real-world deployment due to the limited scalability, especially for unseen gestures. The reason behind is that when introducing unseen gestures, prior works have to collect a large number of samples and re-train the model. While the recent advance of few-shot learning has brought new opportunities to solve this problem, the overhead has not been effectively reduced. This is because these methods still require enormous data to learn adequate prior knowledge, and their complicated training process intensifies the regular training cost. In this paper, we propose a WiFi-based HGR system, namely OneFi, which can recognize unseen gestures with only one (or few) labeled samples. OneFi fundamentally addresses the challenge of high overhead. On the one hand, OneFi utilizes a virtual gesture generation mechanism such that the massive efforts in prior works can be significantly alleviated in the data collection process. On the other hand, OneFi employs a lightweight one-shot learning framework based on transductive fine-tuning to eliminate model re-training. We additionally design a self-attention based backbone, termed as WiFi Transformer, to minimize the training cost of the proposed framework. We establish a real-world testbed using commodity WiFi devices and perform extensive experiments over it. The evaluation results show that OneFi can recognize unseen gestures with the accuracy of 84.2, 94.2, 95.8, and 98.8% when 1, 3, 5, 7 labeled samples are available, respectively, while the overall training process takes less than two minutes.

Multi-factor user authentication (MFUA) becomes increasingly popular due to its superior security comparing with single-factor user authentication. However, existing MFUAs require multiple interactions between users and different authentication components when sensing the multiple factors, leading to extra overhead and bad use experiences. In this paper, we propose a secure and user-friendly MFUA system, namely BioDraw, which utilizes four categories of biometrics (impedance, geometry, composition, and behavior) of human hand plus the pattern-based password to identify and authenticate users. A user only needs to draw a pattern on a RFID tag array, while four biometrics can be simultaneously collected. Particularly, we design a gradient-based pattern recognition algorithm for pattern recognition and then a CNN-LSTM-based classifier for user recognition. Furthermore, to guarantee the systemic security, we propose a novel anti-spoofing scheme, called Binary ALOHA, which utilizes the inhabit randomness of RFID systems. We perform extensive experiments over 21 volunteers. The experiment result demonstrates that BioDraw can achieve a high authentication accuracy (with a false reject rate less than 2%) and is effective in defending against various attacks.