# A Survey on Secure WiFi Sensing Technology: Attacks and Defenses
## 3 Attacks Against WiFi Sensing
### Active Attack  
Active attacks mainly focus on direct interaction with the WiFi sensing system to alter, disrupt, or damage the wireless channel. The attacker aims to interfere with the normal operation of the sensing system by manipulating signal transmissions or the communication environment [51; 54; 60; 61; 62; 63; 64; 65]. This interference can degrade the sensing performance or compromise data integrity to intentionally introduce anomalies or distortions in the wireless signals, affecting the system's ability to accurately interpret environmental information. By directly targeting the signal propagation or transmission processes, these attacks pose significant challenges to the reliability and security of WiFi sensing applications. The mainstream of active attack techniques is attacking WiFi recognition systems, e.g., gesture recognition and activity recognition. The WiFi signal is emitted by Tx, is then propagated through the wireless channel, and is finally received by Rx. Therefore, there are works that attack these three different objects, as illustrated in Figure 2.  
[PERSON] et al. [51] demonstrated how adversaries can attack Tx to subtly manipulate WiFi packet preambles to affect CSI and thereby influence underlying deep learning models (shown in Figure 2a). With the analysis of the relationship between the pilot symbol and CSI, a delicate mechanism is proposed to facilitate quantitative control of receiver-side CSI through minimal modifications to the pilot symbols of WiFi packets at the Tx. Moreover, by using a perturbation optimization method based on the Carlini and Wagner (CW) attack and a penalty-based training process, this attack method can be universally effective across various CSI responses and noise. The attacks on Rx mainly try to manipulate the samples of training datasets or inject adversarial samples into the benign datasets, which is illustrated in Figure 2c. WiCAM [64] uses an adversarial perturbation added to the CSI of the received WiFi signal, which minimizes the influence on communication while retaining the attack effect. WiCAM \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Method** & **Category** & **Attack Aim** & **Sensing Scenario** & **Potential Defense** \\ \hline \multirow{3}{*}{ActListener [67]} & \multirow{3}{*}{Passive attack} & \multicolumn{2}{c}{Eavesdropping on user activities} & \multirow{3}{*}{Activity recognition} & Physical isolation \\  & & imperceptibly in any location of user & & Channel disturbance \\ \cline{1-1}  & & sensing area & & \\ \hline \multirow{2}{*}{WiPeep [52]} & \multirow{2}{*}{Passive attack} & \multicolumn{2}{c}{Eavesdropping locations of indoor WiFi devices} & \multirow{2}{*}{Location estimation} & Randomizing ToF \\  & & & & \\ \cline{1-1}  & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._  
Figure 2: Illustration of attacks on different objects in WiFi recognition systems (e.g., Tx, channel, and Rx): (a) Tx [51]; (b) channel [60]; (c) Rx [64]. utilizes an attention-based framework to identify the CSI subcarriers important to sensing, only adding limited perturbations to these critical parts. Then, the added perturbations have the strongest adversarial effect but incur the minimum influence on bit error rate (BER). [PERSON] et al. [62] investigated the effectiveness of attacking WiFi sensing systems via false data injection (FDI). They perform different types of FDI in seven datasets to reveal the decline in sensing accuracy. Besides attacking Tx or Rx, most of the works try to attack the wireless channel because this open medium is the easiest to invade and manipulate. [PERSON] et al. [61] exploited the phenomenon of CSI absence in WiFi communication to affect the received WiFi signals. Therefore, by carefully designing the pattern of CSI absence, the sensing results can be modified purposefully. However, this attack may degrade the communication quality (e.g., packet loss and signal-to-noise ratio), thus making the attacks noticeable to users.