## 1 Introduction  
Smartphones and tablets are usually used in public places (such as cafes, hotels, shopping malls, airports) and connected to public WiFi. However, it is not safe to use mobile devices in such an environment, because by analyzing the influence of user's finger movements on channel state information (CSI) when the user enters the password, the attackers can steal user's sensitive information, such as passwords, PINs, security codes, etc. We call this kind of attack a \"CSI-based attack\" [1]. Unlike traditional attacks, such as shoulder surfing attack [2], fingerprint attack [3] and video-based attack [4], which need to obtain the users' devices or additional support of video-based techniques, the CSI-based attack can recognize the users' sensitive input information from only one public WiFi access point (AP) [5] and does not need any other vision-enhancing devices for a long-distance attack. Moreover, using commercial off-the-shelf (COTS) devices, such as Network Interface Controller (NIC) 5300, the attackers can conduct a successful CSI-based attack to obtain the user's passwords [6; 7] even without obtaining any information displayed on the screen. Additionally, with professional techniques such as MIMO beamforming [8], the users' private information, such as lip-reading, can be leaked by analyzing CSI. As shown in Figure 1, to launch the new attack, there is only one thing needed, and that is the attacker's toolkits and the target devices access the same online public WiFi simultaneously. Unfortunately, it seems that this happens all the time at KFC, Modoload, Starbucks coffee bars, etc. Therefore, what makes the CSI-based attack easy to conduct for attackers? The key insight is that CSI characterizes the channel frequency response, and the signal at the receiver end is a superposition of multipath propagation, which is scattered from the wall and the surrounding objects. When a user inputs sensitive information, the movements of the finger motions will generate a unique pattern in time series CSI values, and different finger motions correspond to different patterns. However, it is not enough to simply obtain CSI values, fine-grained CSI is required to conduct a CSI-based attack. In order to capture the subtle differences between finger motions, CSI must be measured at a fine-grained level. This is often done by sending high-frequency ICMP packets to the target AP (the public AP the attacker leverages) to obtain a high sample rate of CSI. For instance, [PERSON] et al. [5] recognized keystrokes using CSI at a rate of 2500 ICMP packets per second. Therefore, obtaining high-frequency, fine-grained CSI measurements is key to the success of CSI-based attacks. As analyzed above, the more fine-grained CSI is, the more easily the attacker will obtain the input sensitive information. Inspired by [9], in order to protect the input sensitive information, the user can reduce the rate of ICMP ping packets or make the attacker's receiver lose ICMP ping packets. A low rate of ICMP ping packets cannot capture the difference between different finger motions, and this will lead to the failure of the CSI-based attack. While there are a number of methods available to decrease ICMP responses [10], the communication quality of the target device cannot be ignored. Our solution is based on the fact that the target AP will lose ICMP packets if there exists another AP works on a channel next to the target AP's working channel. This paper introduces WiGuard. As opposed to the prior work [11], which proposed a black sensor obfuscation technique and required additional hardware, WiGuard explores the potential of adjacent channel interference to defeat the CSI-based attack and prevent the public WiFi from leaking users' input sensitive information. To protect user's privacy, first knowing which public WiFi is being leveraged to obtain CSI values by an attacker is an important step.