How WiFi Learned to See
Your router has been quietly capable of sensing through walls for years. This module reframes RF from communication medium to sensing modality — from CSI fundamentals through deployed products, cutting-edge research, and the privacy implications.
Multipath as Signal
Every other Hertzian module treats multipath as the enemy — fading, ISI, the reason WiFi drops behind the fridge. Here, multipath is the signal. The environment is talking back to the radio.
OFDM already computes per-subcarrier amplitude and phase for equalization. Instead of discarding this rich fingerprint, WiFi sensing reads it as an evolving picture of the physical environment — the same data the radio uses to decode packets becomes a spatial sensor reading. The label for this measurement is shown in the comparison below.
Spectrum Primer
WiFi sensing happens in unlicensed spectrum — the same bands shared with kitchen appliances and Bluetooth devices. Understanding the frequency bands is essential to understanding why sensing works and where it struggles.
WiFi Frequency Bands
The Crowded Pioneer
The 2.4 GHz band has a wavelength of about 12.5 cm — long enough to bend around furniture and punch through drywall. That penetration makes it ideal for whole-home coverage, but it also makes the band a traffic jam. Bluetooth, Zigbee, baby monitors, cordless phones, and every neighbor's router all share these same 80 MHz of spectrum. For sensing, this band is a double-edged sword: it reaches more of the environment (good for coverage), but the interference floor is higher (bad for sensitivity).
Why does your WiFi drop when someone heats lunch?
Your microwave oven operates at around 2450 MHz — chosen because water molecules absorb energy efficiently at that frequency. A microwave oven is essentially a 1000-watt transmitter on your WiFi channel. Even with shielding, enough energy leaks to drown out the milliwatt signals your router sends.
The Fast Lane
The 5 GHz band offers dramatically more spectrum — over 500 MHz across multiple UNII sub-bands — with wider channels (up to 160 MHz) and far less interference. The tradeoff: shorter wavelengths (~6 cm) mean worse wall penetration and faster signal decay with distance. For sensing, this band provides finer spatial resolution but covers less area per access point.
The New Frontier
Wi-Fi 6E and Wi-Fi 7 open up 1200 MHz of new spectrum in the 6 GHz band. It's the least congested WiFi band today, with support for ultra-wide 320 MHz channels. For sensing, this band is still early — but its clean spectrum and wide channels could enable higher-resolution CSI measurements as hardware adoption grows.
Licensed vs Unlicensed
Cellular networks use licensed spectrum — operators pay billions at auction for exclusive access, and base stations schedule every transmission. WiFi uses unlicensed spectrum — anyone can transmit as long as they follow power limits and use listen-before-talk protocols. This means WiFi sensing must be robust to interference from devices it can't control — your neighbor's router, a baby monitor, or that kitchen appliance. Licensed-band sensing (like 5G positioning) has a cleaner environment but requires carrier cooperation.
Already in Your House
This isn't a research prototype. Major ISPs ship motion sensing to every customer with a newer gateway — free, no extra hardware, enabled by default. Your router is already capable of detecting whether someone is home.
What the Industry Calls It
The technical term is presence detection — the ability to determine whether a person is in a room using WiFi signal perturbations. But you won't find that term on any product page. Instead, vendors choose names designed to feel helpful rather than invasive.
Xfinity
Free presence sensing with XB7/XB8 gateways. Detects activity in rooms covered by pods — no extra hardware required.
Linksys
"Linksys Aware" — monthly subscription. Uses Velop mesh nodes as motion sensors.
TP-Link
"HomeShield" — bundles motion detection with parental controls and security scanning.
The naming is the teaching moment
A consumer-friendly name sounds like a feature. The technical term sounds like surveillance. They're the same capability. When you see a technology renamed for consumers, ask what the rename is softening — and whether the soft name matches the full capability of the underlying system.
The Scale
Comcast alone has over 30 million broadband subscribers. Every XB7 and XB8 gateway shipped since 2020 is sensing-capable. This isn't a future deployment — it's an installed base measured in tens of millions of homes, running firmware that can detect human presence today.
The Capability Ladder
The same CSI data, the same hardware, progressively smarter models. Three rungs — presence, pose, and recognition. Each step up reveals more about the people in the sensing environment — and the gap between "motion alert" and "recognizing who is present" is a software update on hardware that's already installed.
3. Identify — "Who is it?"
A Transformer encoder over CSI sequences extracts person-specific biometric signatures. 95.5% rank-1 accuracy with commodity TP-Link routers.
2. Reconstruct — "What are they doing?"
Recent research maps CSI to UV body surface coordinates across 24 regions — through walls, multiple people, no camera.
1. Detect — "Is someone there?"
Commodity, deployed in millions of homes today. The simplest approach: threshold on CSI variance over time.
Watch the Ladder in Action
Scroll through to see how the same physical event gets progressively more legible to smarter models.
Physical World
What the Model Sees
Raw CSI
Unprocessed channel state information — amplitude and phase across 52 subcarriers, updating with every WiFi packet.
Output
A matrix of numbers. Meaningless to the eye.
Stage 1: Raw CSI
Unprocessed channel state information — amplitude and phase across 52 subcarriers, updating with every WiFi packet.
Stage 2: Detect
Compute variance across a sliding window. If subcarrier amplitudes fluctuate beyond a threshold — something moved.
Stage 3: Reconstruct
Feed CSI phase and amplitude through a trained neural network. Out comes a skeleton — limb positions, body pose, mapped to 24 UV regions.
Stage 4: Identify
A Transformer encoder reads the CSI sequence as a biometric signature. Gait, body shape, movement patterns — unique to each person.
This is the same escalation pattern facial recognition followed: faces → expressions → individuals. The difference is that WiFi sensing hardware is already deployed at scale for the first rung. Moving up the ladder doesn't require new hardware — just new firmware.
The Anchor Papers
802.11bf — When Sensing Becomes Spec
Everything we've seen so far — CSI extraction, motion detection, pose estimation — has been built on top of WiFi, not into it. Researchers extract CSI using firmware hacks and driver modifications. IEEE 802.11bf changes that: it's an amendment to the WiFi standard that makes sensing a first-class capability of the protocol itself.
What 802.11bf Standardizes
Measurement
Standardized procedures for CSI measurement exchange between sensing initiators and responders.
Signaling
New management frames for setting up, maintaining, and tearing down sensing sessions between devices.
Coordination
How sensing devices negotiate roles, timing, and resources without disrupting regular data traffic.
Timeline
2020
IEEE 802.11bf Task Group (TGbf) formed
2022–2024
Draft iterations, letter ballots, comment resolution
2025–2026
Expected ratification and inclusion in Wi-Fi 8 certification
Why this matters
When something moves from "interesting research hack" to "in the IEEE standard," it means the industry has decided it's real and shippable. Qualcomm, Intel, Broadcom, and MediaTek — the companies that make the WiFi chips in your devices — are active participants in TGbf. Sensing will be a checkbox feature on your next router, not a research curiosity.
CSI Playback
Scrub through a pre-recorded CSI capture. The room scene on the left shows what's physically happening — a person walking through a room with a WiFi router. The heatmap on the right shows the CSI response — watch how the abstract numbers react to physical movement.
Physical Scene
CSI Response
Privacy & Dual Use
"Your router can see through walls" is a sentence that deserves scrutiny. The same physics that powers genuinely useful applications — fall detection for elderly care, occupancy-based HVAC, hands-free smart home control — also enables surveillance capabilities that most privacy frameworks haven't caught up to.
The GPS Lesson
We learned this once before with GPS. Individual location pings feel innocuous — "I'm at the coffee shop." Aggregated over weeks, they reveal where you work, who you visit, where you worship, and when you see a doctor. The data wasn't the problem. The aggregation was.
WiFi sensing follows the same pattern. A single CSI snapshot tells you almost nothing. Continuous capture, combined with increasingly capable models, tells you who is in a building, what they're doing, and eventually who they are — all without a camera, and through walls a camera can't see through.
The Detect → Localize → Identify Escalation
This is the same escalation pattern facial recognition followed. First: detect presence (is anyone there?). Then: localize activity (which room, doing what?). Finally: identify individuals (who specifically?). Each step was presented as a useful feature. The aggregate became a surveillance system.
A Concrete Scenario
A retail store deploys WiFi access points for customer internet access. Using CSI from those same access points, the store could build biometric signatures of walking patterns — re-identifying returning customers without ever asking permission, without cameras, and potentially without triggering any existing privacy law written with faces and fingerprints in mind.
Radio-based identifiers may bypass laws written for visible biometrics. The regulatory gap is real and mostly unaddressed.
The Dual-Use Tension
Genuinely Useful
- • Fall detection for elderly living alone
- • Occupancy-based energy savings
- • Gesture control without wearables
- • Intruder detection without cameras
Genuinely Concerning
- • Through-wall surveillance without consent
- • Biometric tracking via RF signatures
- • Activity profiling in private spaces
- • No visible indicator that sensing is active
The honest answer is that WiFi sensing is genuinely useful and genuinely concerning, and the gap between "consumer feature" and "surveillance system" is a software update on hardware that's already installed in your home.
Zoom Out
Step back from the details and see the bigger picture. Radio frequency is joining camera, lidar, and IMU as a first-class spatial sensor modality for physical AI. This isn't a future prediction — it's happening now, across consumer products, academic research, and defense systems.
RF Among the Spatial Senses
Camera & Lidar
High resolution, line-of-sight only, affected by lighting and weather, raises immediate privacy alarms.
RF Sensing
Works through walls, in the dark, in rain and smoke. Uses hardware already deployed in billions of homes. Lower resolution but ubiquitous.
From Living Room to Orbit
The same physics spans an enormous range of applications. Consumer: Xfinity WiFi Motion detects presence in millions of homes. Research: DensePose-from-WiFi reconstructs human poses through walls. Defense: Companies like HawkEye 360 and Spire Global use satellite constellations to geolocate RF emitters from orbit — passive RF intelligence at planetary scale.
Radio waves were always painting a spatial picture of the physical world. We just treated them as dumb pipes until we had the compute and algorithms to read the picture. Multipath isn't noise — it's the environment talking back. We finally learned to listen.
Key Takeaways
- 1.CSI turns every WiFi packet into an environmental probe
- 2.The detect → reconstruct → identify ladder is already climbing
- 3.802.11bf makes sensing a standard protocol feature
- 4.Privacy implications deserve the same scrutiny as facial recognition
- 5.RF is a spatial sensor — we just didn't know it yet