Wi-Fi identification can recognise a person who is not carrying a phone, smartwatch or any other connected device. In a controlled study, researchers trained a machine-learning system to distinguish people from the way their bodies altered ordinary wireless signals and reported 99.5% accuracy on its main test. The target did not have to join the network. Other devices communicating nearby created the radio evidence.

That result does not mean any router can instantly attach a name to anyone who walks past. The system first needed labelled recordings of the people it was expected to recognise, and its strongest number came from training and testing under closely matched conditions. When the viewing position changed between training and testing, accuracy collapsed. Those limits matter, but they do not remove the underlying privacy problem.

The unsettling part is not that Wi-Fi behaves like a perfect hidden camera. It does not. It is that wireless hardware already installed in homes, offices and public spaces produces unencrypted technical feedback that can double as a biometric signal. A network designed to deliver data can reveal who moved through its radio field, even when that person made no decision to connect.

Wi-Fi Identification Does Not Need Your Device

Researchers at Karlsruhe Institute of Technology developed the system, called BFId, to test an identity-inference attack based on beamforming feedback information. Their peer-reviewed ACM conference paper describes a study that recruited 197 people and recorded them walking through a Wi-Fi field using five walking styles and four receiving perspectives.

There is an important denominator hidden beneath the headline. Technical collection problems meant the final dataset contained channel-state information for 170 people and beamforming-feedback data for 161. The 99.5% result came from normal-walking BFI sequences, split 80:20 between training and testing and repeated across independent splits. It was not a universal test of all 197 recruits under every condition.

The official BFId dataset page still accurately describes the broader collection as recordings from 197 individuals because that was the recruited study population. For readers evaluating an accuracy claim, however, the usable sample for the specific model matters more than the recruitment total. The paper provides that detail, allowing the stronger and narrower conclusion to be separated from the simpler publicity figure.

What the 99.5% Result Actually Proves

For the main experiment, each participant completed 40 normal walking sequences. The model learned from most of those recordings and classified the remainder. Training and testing used data captured from the same perspective. Under that controlled arrangement, the reported mean accuracy was 99.5%, with variation of plus or minus 0.38 percentage points across five runs.

The system was therefore solving a closed recognition task. It chose among identities already represented in its training data. The paper explicitly says its softmax classifier could not test how the model would respond to a previously unseen person. It might reject them, mislabel them as someone enrolled or require an entirely different design. That question remains unanswered.

Viewpoint was another boundary. When the researchers trained on recordings from one position and tested on another, accuracy was generally very low. Tests trained from the first perspective fell below 5% on the others. The system worked well when trained and tested separately from each available position, but it did not learn a portable radio signature that followed someone reliably across differently arranged networks.

This makes the result less like a global facial-recognition engine and more like a local re-identification system. An operator could record someone at a known time, attach a label through another clue and later ask whether a new recording from a comparable setup matches that person. That is still powerful in a workplace, entrance, café or monitored public route where the geometry remains stable.

How Beamforming Became a Biometric Side Channel

Modern Wi-Fi does more than broadcast data equally in every direction. Beamforming helps a router direct energy towards connected devices. To do that efficiently, compatible clients report information about the channel back to the access point. Wi-Fi 5 introduced this process, and the returned beamforming feedback information is a compressed description of how the radio path currently behaves.

A person changes that path. Radio waves reflect, scatter, bend and lose energy as they interact with walls, furniture and the human body. Movement turns those changes into a time series. BFId fed the raw sequences into a recurrent neural network designed to learn patterns over time, allowing it to distinguish the disturbances associated with different participants.

The security issue is that the feedback is broadcast without encryption. The researchers’ official KIT explanation says the attack can use standard Wi-Fi devices and does not require the target to carry a phone. The paper goes further: the passive observer does not need the network password or control of the access point, only a suitable device within broadcast range.

Earlier Wi-Fi sensing often depended on channel-state information that required particular hardware or modified firmware. Beamforming feedback lowers that barrier because a listening device can capture reports sent by legitimate clients. One observer may also receive reports representing several paths between an access point and connected devices, creating multiple potential views of the same physical space.

The Model Reads Disturbance, Not a Name

BFId does not extract a hidden identity field from a wireless packet. It learns how a known person’s movement changes a particular radio environment. The name arrives from labelled training data, not from the signal itself. Without that earlier association, the model can link similar recordings but cannot independently discover who the person is.

The researchers describe a plausible attack in which an observer first obtains a label through another side channel. A phone identifier, entry record or visible event could establish that a particular person was present during one recording. Later, the model could link an otherwise anonymous passage through the same wireless field to that earlier pattern.

This resembles the privacy problem LiveAIWire examined in AI inference from anonymous writing. Removing a direct identifier does not necessarily remove the structure that makes information linkable. In one case, word choices expose personal attributes. In the other, changes in radio propagation expose a repeatable physical pattern.

Changing How You Walk Did Not Reliably Defeat It

The study did more than record ordinary walking. Participants repeated the route while wearing a backpack, carrying a bottle crate, moving faster and passing through a turnstile. Models trained on normal walking still identified people reliably from BFI across those altered styles, although performance was lower for fast walking and the turnstile condition.

That suggests the classifier was not relying on speed alone. Human movement contains a combination of body dimensions, timing and gait mechanics, while the surrounding environment shapes how those features appear in radio data. The empty-room control produced top-two accuracy of 2.34% rather than consistently matching the person recorded immediately before or afterwards, supporting the researchers’ conclusion that the model had learned information associated with participants rather than a simple session artefact.

Gait has already become a surveillance identifier in visually monitored settings. LiveAIWire’s reporting on AI border surveillance examined systems that combine faces, movement and behavioural signals. Wireless identification extends the same concern to places where there may be no visible camera and where covering a face does nothing to alter the radio field.

Turning Off Your Phone May Not Protect You

The target’s device is not the essential component. BFId needs compatible Wi-Fi clients to exchange beamforming reports with an access point, but those clients can belong to the café, office or home. A laptop, television or other connected device can provide the signal path that a passing body disturbs. Turning off one personal handset therefore does not remove the surrounding radio environment.

A strong network password is not a complete defence either. The attack described in the paper is passive and relies on unencrypted portions of legitimate wireless traffic. An observer does not transmit a request that would appear as a failed login and does not need to decrypt the network’s ordinary data payload.

This does not make every router an active identification service today. Someone still needs capture hardware, training data, a machine-learning pipeline and a sufficiently stable environment. The practical concern is that each component is less exotic than the phrase “radio biometrics” suggests, while the person being observed may have no visible sign that sensing is taking place.

Can Wi-Fi Identification Work Through a Wall?

The BFId experiment included a non-line-of-sight receiving perspective in a neighbouring room. Identification remained strong when the model was trained and tested from that same position, though it was slightly weaker than the clearer perspectives. That supports through-obstruction sensing under a controlled arrangement, not unrestricted identification from anywhere outside a building.

A separate peer-reviewed security project provides stronger evidence for wall-crossing occupancy detection. The LeakyBeam study presented at NDSS captured unencrypted beamforming feedback through walls at distances up to 20 metres. It reported an 82.7% true-positive rate for occupied spaces and a 96.7% true-negative rate for empty ones.

LeakyBeam did not identify the occupant. It inferred whether somebody was present. BFId identified enrolled participants but did not establish a general 20-metre identity attack through an exterior wall. Combining the headlines would create a capability neither paper demonstrated. The evidence supports two adjacent risks: remote occupancy sensing and local radio-based re-identification.

The Same Capability Has Legitimate Uses

Radio sensing can work in darkness, does not require a person to wear a device and can preserve more visual privacy than a conventional camera. Those properties make it attractive for detecting movement, falls or breathing in homes and care settings. LiveAIWire’s analysis of AI elderly-care technology found a genuine need for unobtrusive safety monitoring, alongside unresolved questions about consent and intimate behavioural data.

The issue is therefore not whether Wi-Fi sensing should exist. It is whether a system designed to detect presence can be quietly repurposed to infer identity, activity or routine. A fall detector may need to know that someone has stopped moving. It does not automatically need to build a persistent biometric profile of everyone who crosses the room.

This tension is becoming part of the network itself. The IEEE 802.11 working group records that the 802.11bf WLAN sensing standard was published in September 2025. Standardisation can make useful sensing more interoperable, but research such as BFId shows why privacy testing has to examine secondary inferences, not only the application a manufacturer chooses to advertise.

The Privacy Problem Begins Before Data Is Stored

Camera debates often focus on recordings: who owns the footage, how long it is retained and whether facial recognition is applied. That concern appears in LiveAIWire’s examination of always-on AI monitoring in swimming pools. Wireless sensing shifts the problem earlier. A person may be classified from the physical effect of their body on signals they neither transmitted nor agreed to receive.

That makes notice difficult. A camera can be marked with a sign. A Wi-Fi logo normally communicates internet access, not environmental sensing. People may reasonably understand that connecting to a network reveals technical information about their device, yet have no reason to expect that someone else’s connection could help recognise their gait.

It also complicates resistance. Clothing designed to confuse a camera may not affect radio sensing in the same way. Switching off location services does not alter another device’s beamforming exchange. LiveAIWire’s coverage of tools for resisting AI surveillance shows how most personal defences are designed around visible sensors and data trails, not passive measurement of the surrounding wireless field.

What the Researchers Could Not Prove

The 99.5% figure came from a deliberately favourable data-collection setup. The team adjusted network traffic to trigger frequent beamforming reports. The paper warns that ordinary traffic may produce fewer reports and reduce attack effectiveness. It also used two TP-Link Archer BE800 access points and a controlled 6 GHz environment chosen partly to minimise interference from nearby networks.

The researchers did not establish long-term robustness. Furniture moves, doors open, people enter together and networks change equipment. The paper lists transient objects, interference from other Wi-Fi networks and stability over time as open questions. A classifier trained during one week may not remain equally reliable months later.

Scale is also unresolved. A dataset of 161 usable BFI participants is far larger than much previous Wi-Fi identification work, but far smaller than the thousands or millions needed to assess a city-scale system. The study could not evaluate unknown people, and its sharp cross-perspective failure shows that deployment across different locations would require additional labelled data or better generalisation.

These are not minor footnotes. They define the difference between a serious privacy warning and a claim that global invisible tracking already exists. The research demonstrates a strong local identification signal under controlled conditions. It does not demonstrate a universal wireless identity database.

What You Can Do Today

There is no single privacy switch that neutralises this class of sensing. Disabling unused wireless devices and beamforming features can reduce available signals, but many routers do not expose those controls and changing them may reduce performance. A password protects access to network data; it does not necessarily encrypt beamforming feedback that nearby equipment can observe.

For households and organisations, the more useful questions are procurement questions. Does a router or monitoring product perform environmental sensing, are its beamforming reports protected, can sensing be disabled and does the vendor retain derived activity or identity data? Care homes, offices and public venues should also treat radio-based monitoring as surveillance requiring clear purpose and notice, not as harmless network telemetry.

Individual caution can only go so far because the signal may come from infrastructure someone else controls. The durable fixes belong in standards, firmware and product design. The BFId authors found that reducing report frequency had limited protective effect, while encrypting feedback would require changes that could create compatibility problems. That is difficult engineering, but it is preferable to pretending consent can be solved through a router manual nobody reads.

A Router Is No Longer Only a Router

The most important lesson from BFId is not the 99.5% figure in isolation. It is the discovery that routine network feedback contains enough physical information to become an identity signal. Hardware purchased for connectivity can acquire a second function through software, without the people inside its radio field noticing that the purpose has changed.

Used carefully, that second function could support safer homes without installing cameras in bedrooms or care spaces. Used without consent, it could turn ordinary wireless coverage into an identification layer. The technology is not yet the universal invisible camera suggested by its most dramatic headlines. It is something more plausible and therefore more urgent: a strong surveillance primitive already present in common infrastructure, waiting for standards and safeguards to catch up.

About the Author

Stuart Kerr is Technology Correspondent at LiveAIWire, covering artificial intelligence, cybersecurity, and the social impact of emerging technology. He publishes daily at LiveAIWire.com.