WiFi Can See You

2 hours ago 1

Every WiFi router in your home is secretly watching. Not in the creepy camera-hiding-in-the-smoke-detector way, but through something potentially more unsettling: the invisible radio waves bouncing around your living room can reveal where you're standing, how you're moving, even the rhythm of your breathing. And thanks to recent breakthroughs in artificial intelligence, these signals can now generate surprisingly detailed images of what's happening inside your home—no camera required.

A groundbreaking paper published in June 2025 on arXiv demonstrates just how far this technology has advanced. Researchers Eshan Ramesh and Takayuki Nishio developed a system called LatentCSI that transforms WiFi signals into high-resolution photographs. Their AI doesn't just detect that someone is in a room—it can generate 512×512 pixel images showing a person's position, orientation, and even specific poses like raising or waving hands. The researchers position this as a privacy-preserving alternative to cameras, noting that their system "strikes a balance between interpretability and privacy" by intentionally blurring fine details like faces. But this framing raises an uncomfortable question: when did we agree that being monitored without cameras somehow meant we weren't being monitored at all?

The invisible eye

Here's how it works. When WiFi signals travel between your router and devices, they don't move in straight lines—they bounce off walls, furniture, and yes, human bodies. These reflections create what's called Channel State Information, or CSI, a detailed fingerprint of how radio waves navigate your space. When you walk across a room, your body disrupts this pattern in unique ways. Modern machine learning systems have become remarkably good at reading these disruptions.

The LatentCSI approach represents a leap forward in efficiency and capability. Rather than using complex generative adversarial networks (GANs) like earlier systems, the researchers mapped WiFi signals directly into the latent space of Stable Diffusion, the same AI model behind popular text-to-image generators. This clever shortcut achieved better image quality while training three times faster than previous methods. Perhaps most intriguingly, the system can modify generated images with text prompts—transforming a "photograph of a man in a small office" into "a drawing of a man in a laboratory, anime, 4k" while maintaining the actual position and pose detected through WiFi.

The researchers emphasize practical applications: elderly care monitoring for people who don't want cameras, security systems using existing WiFi infrastructure, monitoring in low-light conditions where cameras struggle. The technology is "robust to low-light or non-line-of-sight conditions," they note, and "enables device-free human sensing without the prerequisite of dedicated devices." In other words, the router you already own could be repurposed into a sensor that works through walls, in the dark, and without anyone wearing tracking devices.

Beyond imaging: a sensor in every signal

WiFi-to-image generation is just one application of an increasingly sophisticated field. WiFi sensing can now accomplish an unsettling array of surveillance tasks, most with accuracy rates above 95% in controlled environments:

Human activity recognition systems can distinguish between walking, sitting, falling, and dozens of other activities by analyzing how movements disturb WiFi signals. State-of-the-art models achieve 99.9% accuracy in controlled settings. Gesture recognition interprets hand movements through micro-Doppler effects—Stanford researchers developed systems that recognize sign language through WiFi with 98% accuracy. Vital signs monitoring detects breathing patterns and even heartbeats from chest movements as small as 4-12 millimeters, enabling sleep apnea detection and baby monitors that work through walls.

More concerningly, WiFi signals can enable keystroke inference—a 2023 system called WiKI-Eve achieved 88.9% accuracy identifying individual keystrokes and 65.8% accuracy guessing passwords from the top 10 possibilities. The attack works by detecting the subtle hand position changes as you type. Through-wall detection can locate people in adjacent rooms or even behind concrete barriers. Gait recognition identifies individuals by their unique walking patterns with over 90% accuracy. Device fingerprinting tracks specific smartphones and laptops by detecting tiny hardware imperfections in their radio transmitters, even when MAC addresses are randomized.

These aren't science fiction concepts—they're established capabilities being refined and commercialized. Origin Wireless, holder of over 220 patents in this space, has integrated its technology into Verizon Fios routers. Cognitive Systems claims its WiFi Motion technology is deployed through 160+ internet service providers globally. ABI Research projects that WiFi sensing-compatible devices in North American homes will reach 112 million units by 2030, growing at 51.6% annually.

The privacy paradox

Daniel Kahn Gillmor, a staff technologist at the ACLU, cuts through the industry's privacy-preserving rhetoric: "In another sense, Wi-Fi sensing is more concerning than cameras, because it can be completely invisible. You can spot a nanny cam if you know what to look for. But if you are not the person in charge of the router, there is no way to know if someone's smart lightbulbs are monitoring you—unless the owner chooses to tell you."

The fundamental problem is that radio waves cannot be encrypted. Professor Neal Patwari of Washington University in St. Louis, who pioneered WiFi-based breathing detection back in 2009, explains: "Even if your data is encrypted, somebody sitting outside of your house could get information about where people are walking inside of the house—maybe even who is doing the walking." This creates what University of Chicago researchers call "silent surveillance attacks"—monitoring that requires no signal transmission and leaves no trace.

The technology's invisibility enables surveillance of particularly vulnerable groups. Gillmor flags concerns about law enforcement overreach: "We have lots of examples of law enforcement overreach. If law enforcement gains access to this data and uses it to harass people, it's another chunk of metadata that can be abused." Palak Shah of the National Domestic Workers Alliance worries about domestic workers: "It's usually the case that things end up being used against the worker even if there's a potential for it to be used for them, and that inherent power dynamic is really hard to disrupt." The tools could create additional hurdles for people experiencing domestic abuse, enabling stalkers to monitor when homes are occupied without physical access.

Professor Heather Zheng, whose University of Chicago team demonstrated through-wall surveillance using $20 WiFi receivers, describes the capability as "not just about privacy, it's more about physical security protection." Her group developed a "cover signal" defense—essentially a privacy button on routers that introduces noise to confuse monitoring systems. But such protections remain research projects, not commercial reality.

The regulatory void

Despite these capabilities, no jurisdiction has enacted laws specifically addressing WiFi sensing. The IEEE 802.11bf standard for WiFi sensing, approved in May 2025, explicitly excludes privacy considerations from its scope. Oscar Au, an IEEE task group member and vice president at Origin Wireless, acknowledges privacy concerns were raised but explains they were deemed "not within the committee's mandate." The focus remains on technical functionality and interoperability.

Existing privacy laws provide minimal protection. GDPR can technically apply to WiFi tracking of MAC addresses, requiring notices and opt-out mechanisms. But ambient sensing that doesn't identify devices falls into a regulatory gray zone. California's CCPA classifies precise geolocation as sensitive personal information requiring consent, but WiFi sensing of movement within buildings doesn't clearly fit existing categories. Twenty-seven U.S. states have comprehensive privacy laws taking effect by October 2025, but none address ambient sensing technologies.

The Federal Communications Commission regulates WiFi spectrum allocation but not sensing applications. The Federal Trade Commission has authority to pursue "unfair" practices causing privacy harms, but no enforcement actions have targeted WiFi sensing. Academic researchers face Institutional Review Board oversight requiring informed consent for human subjects research, but commercial deployments face no comparable ethics review.

Ray Liu, founder of Origin Wireless and former IEEE president, acknowledges the tension: "This is a technology that can help change the world and make lives better... Nevertheless, we as a society need to draw a red line. Whatever the red line is—it's not my job to decide—here is the red line we do not cross." The statement encapsulates the industry position: enthusiastic about capabilities, deferential about responsibility.

The cutting edge

Recent research continues advancing both capabilities and concerns. A November 2024 paper introduced WiFlexFormer, a model with just 50,000 parameters achieving 98.4% accuracy while running inference in 10 milliseconds on edge devices—enabling real-time monitoring on hardware already in your home. Imperial College London released WiMANS, the first public dataset for multi-user WiFi sensing, with 9.4 hours of synchronized WiFi signals and video. The dataset exposes how existing models struggle with multiple people but establishes baselines for improvement.

Perhaps most notably, January 2025 saw the first integration of Large Language Models with WiFi sensing in a system called Wi-Chat. The paper introduces "Penetrative AI" that bridges language models with physical world sensing—imagine asking your router in natural language what's happening in a room and receiving interpretable answers derived from radio waves. The convergence of conversational AI with ambient sensing represents a new paradigm in how we might interact with monitoring systems.

Meanwhile, self-supervised learning frameworks like CAPC (Context-Aware Predictive Coding) are dramatically reducing the labeled data needed to train WiFi sensing systems, making deployment across diverse environments more practical. CrossFi uses Siamese networks to enable few-shot and zero-shot learning—systems that work in new environments with minimal or no additional training data. These advances remove key barriers to widespread deployment.

Living with invisible sensors

The paradox of WiFi sensing is that it genuinely offers benefits—elderly fall detection saves lives, energy optimization reduces carbon footprints, touchless interfaces serve genuine accessibility needs. But benefits don't negate the need for consent, transparency, and control. The industry's framing of WiFi sensing as "privacy-preserving" because it doesn't capture faces conflates different surveillance with no surveillance. Movement patterns, presence detection, and activity monitoring reveal sensitive information even without facial recognition.

IEEE Computer Society researcher Amod K. Agrawal argues for design principles that could thread this needle: minimize data collection to what's strictly necessary, maintain transparency about what's being sensed, ensure informed consent, and enable user controls. "Just because we are now able to detect and infer more than ever before does not mean we should," he writes. "Ethical sensing is not only a technical concern, it is also a design philosophy."

The question is whether market incentives and voluntary best practices can deliver these principles, or whether we need what Gillmor calls "both legal and technical guardrails." Right now, 30+ million homes have WiFi sensing capabilities, most owners unaware their routers possess these functions. Visitors to these homes have no way to know they're being monitored. ISPs and manufacturers can activate sensing features remotely.

The uncomfortable truth is that every WiFi-enabled space—your home, your workplace, cafes and airports and hotels—now contains infrastructure that can be repurposed for surveillance you cannot see, cannot disable without disconnecting entirely, and likely don't know is happening. The technology already exists. The standards are being finalized. The products are shipping. The only thing missing is the conversation about whether we actually want this future, and what constraints should govern it if we do.

As Professor Jie Yang of Florida State University notes about state actors and sophisticated monitoring: "It's likely that this is already happening. That is: I don't know that people are actually doing that. But I'm sure that we are capable of doing that." Capability, it turns out, has a way of becoming reality. The question is what kind of reality we're building, and whether we'll have any say in the matter.