Adversarial Robustness of WiFi-Based Human Sensing

Motivation

WiFi sensing is moving from the lab toward real deployments: presence detection, fall detection, occupancy [1]. Every one of those is a security decision waiting to happen. A fall detector that can be silenced, or an occupancy sensor that can be spoofed into seeing an empty room, is not a safe product.

Deep learning models are famously fragile: a tiny, carefully chosen perturbation flips their prediction [2], [3]. WiFi sensing inherits that fragility, and adds a twist, the attacker does not touch the model, they touch the radio channel. Almost all published WiFi sensing assumes benign data and never asks what a motivated adversary could do.

This thesis asks it, and measures the answer.

Problem statement

The robustness of WiFi human-sensing models is largely unmeasured. Standard adversarial attacks [2], [3] assume the attacker can edit the input directly, but a WiFi attacker can only shape what happens over the air, under real physical constraints. We do not know which attacks survive those constraints, how much they degrade real sensing models, or which defences (adversarial training, multi-sensor consistency) actually hold up.

That is the gap. This thesis builds an honest map of the attack surface of WiFi sensing: which attacks work, under what physical realism, and what defending them costs.

Research questions

Which adversarial attacks [2], [3] transfer from the digital setting to physically realistic WiFi perturbations, and how much do they degrade CNN, LSTM, and autoencoder sensing models?
How much robustness do defences (adversarial training [3], multi-sensor consistency across our nine-node testbed) actually buy, and at what accuracy cost?
Does redundancy across many sensing nodes make an attack meaningfully harder than fooling one?

Suggested methodology

Train baseline sensing models (CNN, LSTM, autoencoder) on public WiFi CSI datasets and on our in-house nine-node ESP32 testbed.
Attack them with standard methods (FGSM [2], PGD [3], C&W [4]), first digitally, then under physically realistic constraints on the channel.
Implement defences: adversarial training [3], input denoising, and multi-node consistency checks (our OpenCSI self-calibration layer gives a clean multi-node substrate).
Measure the trade-off: attack success rate vs clean accuracy vs defence cost.
Deliver a threat-model report: what a realistic adversary can and cannot do to WiFi sensing, and what it costs to stop them.

What you need: machine-learning basics and Python. A security interest helps, we bring the WiFi testbed and the sensing pipeline.

Previous theses in this line

Feeling the Room: A Practical Study on WiFi-based Occupancy Detection, Simon Sigg, the group’s WiFi sensing testbed this work attacks and defends.
The paper OpenCSI: Self-Calibration Layer for Heterogeneous Mesh Wireless Sensor Networks (Khamaisi, Sigg, and Rodrigues, LCN 2026), the multi-node substrate for consistency-based defence.

References

[1] Y. Ma, G. Zhou, and S. Wang. “WiFi Sensing with Channel State Information: A Survey.” ACM Computing Surveys, 52(3):46, 2019.

[2] I. J. Goodfellow, J. Shlens, and C. Szegedy. “Explaining and Harnessing Adversarial Examples.” International Conference on Learning Representations (ICLR), 2015.

[3] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. “Towards Deep Learning Models Resistant to Adversarial Attacks.” International Conference on Learning Representations (ICLR), 2018.

[4] N. Carlini and D. Wagner. “Towards Evaluating the Robustness of Neural Networks.” IEEE Symposium on Security and Privacy (S&P), 2017.