Privacy implications of ubiquitous RF sensing

"A camera has a lens you can cover and a red light you can watch for. The router in your hallway has neither, sees through the wall, and was already in the house. I am told this is a feature."

A Reluctant AI Agent

What actually leaks, and how sensitive it is

What an RF sensing adversary recovers is not one thing but a ladder of increasingly personal inferences, each built from the same CSI stream. At the bottom sits occupancy: is anyone home, and roughly how many people. One rung up is activity and gait, which is quasi-biometric because walking style identifies individuals across sessions with useful accuracy. Higher still are vital signs, the sub-millimeter chest displacement of breathing and heartbeat that Section 47.3 extracted, which are health data in every regulatory sense. Near the top are fine motor signals: several published attacks recover typed keystrokes and even PINs from the multipath perturbations of finger motion. Why this ordering matters is that mitigation cost and legal exposure both climb the ladder, and a system provisioned only to detect a fall may leak vital signs it never intended to collect.

How to reason about the leak quantitatively is to treat each inference as a channel with a bit rate. A useful lens is mutual information between the private attribute \(A\) (identity, health state, keystroke) and the observable feature \(X\) (a window of CSI),

where a privacy defense succeeds insofar as it drives \(I(A; X)\) toward zero while preserving \(I(T; X)\) for the intended task \(T\). This framing, developed with the estimation vocabulary of Chapter 4, is what separates a real defense from cosmetic obfuscation: adding noise that any classifier learns to ignore lowers neither term and buys nothing. When the distinction bites hardest is under function creep, where a link deployed for a benign task is later repurposed. Because the raw CSI already contains the whole ladder, the constraint has to live in the pipeline, not in the operator's good intentions.

The adversary and attack surface

What a threat model needs is a clear picture of who can do the sensing. There are three distinct adversaries, and they call for different defenses. The first-party adversary owns the access point: a landlord, an employer, or a smart-home vendor who legitimately controls the radio and can quietly enable sensing. The second-party adversary is a co-tenant or houseguest who runs sensing on the shared network against another occupant. The third-party adversary owns nothing on the link and instead eavesdrops, placing a passive receiver nearby to read the CSI perturbations of a victim's traffic, or in the through-wall case sensing a target who is not even using the attacker's network. Why the third-party case is the most alarming is that it needs no account, no credential, and no cooperation; the victim's own devices radiate the signal, and physics does the rest, which connects this to the spoofing-and-adversary mindset of Chapter 68.

Defenses that actually reduce the leak

What works is a layered stack, because no single control covers all three adversaries. At the physical layer, geofencing the sensing region and reducing transmit power or nulling energy toward exterior walls shrinks the through-wall surface, and the 802.11bf design includes signaling so a station can decline to participate in sensing measurements. At the signal layer, deliberate obfuscation injects structured perturbations, randomized artificial motion or crafted interference, that raise \(H(A \mid X)\) for sensitive attributes while a whitelisted task model, trained on the same perturbation, still reads \(I(T; X)\). At the learning layer, the private attribute is scrubbed by adversarial representation learning: train an encoder whose features predict the intended task but on which an adversary head cannot recover identity or vitals, a min-max objective in the spirit of the fair-representation and federated methods of Chapter 64. At the governance layer, process the CSI on-device and emit only the minimal task label, so no reconstructable stream ever leaves the room; this data-minimization posture is the same one the regulation survey of Chapter 70 recommends across sensing modalities.

How to check whether a defense is real, rather than security theater, is to run the adversary yourself and measure the residual leak. The snippet below sketches the audit: fit a simple attribute classifier on protected features and report how far above chance it lands. Why this belongs in every RF sensing project is that leakage is empirical; a defense that looks principled can still leave a linearly decodable identity signal, and the only way to know is to try to decode it. The result also feeds the leakage-safe evaluation thread, because splitting by person and environment (never by random window) is what keeps the audit honest.

import numpy as np
from sklearn.linear_model import LogisticRegression
from sklearn.model_selection import GroupKFold
from sklearn.metrics import accuracy_score

def privacy_leakage(features, secret_labels, person_ids):
    """Estimate how recoverable a 'secret' attribute is from protected features.
    Leakage = adversary accuracy minus a majority-class baseline. ~0 is good."""
    gkf = GroupKFold(n_splits=5)
    accs, base = [], []
    for tr, te in gkf.split(features, secret_labels, groups=person_ids):
        clf = LogisticRegression(max_iter=1000).fit(features[tr], secret_labels[tr])
        accs.append(accuracy_score(secret_labels[te], clf.predict(features[te])))
        vals, counts = np.unique(secret_labels[tr], return_counts=True)
        base.append(np.mean(secret_labels[te] == vals[counts.argmax()]))
    return float(np.mean(accs) - np.mean(base))   # residual leakage above chance

# leak near 0  -> attribute is well protected; leak >> 0 -> the defense failed

What's Next

In Chapter 48, we leave single-modality sensing behind and open Part X on sensor fusion, where RF, radar, lidar, and vision stop being rivals and start being complementary evidence about one world. The privacy tension does not vanish there; it compounds, because fusing weak modalities can reconstruct what each alone would have hidden. Carry the leakage-audit reflex forward.