pith. sign in

arxiv: 2606.10148 · v1 · pith:7LZMO3VInew · submitted 2026-06-08 · 💻 cs.CR

RadKey: An LLM-Guided RF Backscatter System for Through-Wall Keystroke Inference

Qijun Wang , Chunqi Qian , Huacheng Zeng This is my paper

Pith reviewed 2026-06-27 16:04 UTC · model grok-4.3

classification 💻 cs.CR
keywords keystroke inferenceRF backscatterthrough-wall eavesdroppingside-channel attackLLM adaptationbatteryless tagvibration sensing
0
0 comments X

The pith

RadKey uses a batteryless RF backscatter tag to modulate keystroke vibrations onto radio signals for through-wall inference, with LLM outputs adapting the classifier at runtime without victim-specific training.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper presents RadKey as an RF backscatter system that places a compact passive tag near a keyboard to capture vibrations and acoustic signals from typing. These signals shift the frequency of the tag's reflected RF waveform through two magnetically coupled LC resonators, which also separates the backscatter from the excitation carrier to reduce self-interference at the reader. The reader extracts time- and frequency-domain features that the authors claim remain consistent across users and keyboards, then feeds LLM-generated pseudo-labels back into the classifier for ongoing refinement. If the approach holds, keystroke eavesdropping moves from short-range conspicuous sensors that need per-victim data to a longer-range, stealthier method that works on new users and keyboards out of the box. This matters because it shows how passive hardware plus language-model assistance can lower the barrier for side-channel attacks on everyday input devices.

Core claim

RadKey achieves accurate and robust keystroke inference across diverse users in real-world settings by capturing keystroke-induced vibrations and acoustic signals with a batteryless backscatter tag that modulates them onto the frequency shift of its RF signal using two magnetically-coupled LC resonators, then demodulating at the reader with a signal processing pipeline that extracts user- and keyboard-independent features and an LLM that supplies pseudo ground-truth labels for online classifier adaptation.

What carries the argument

A batteryless backscatter tag with two magnetically-coupled LC resonators that converts keystroke vibrations and acoustics into frequency shifts on the backscattered RF signal, paired with a dedicated signal processing pipeline for generalizable feature extraction and LLM-driven online adaptation.

If this is right

  • Keystroke inference extends to longer ranges and through walls because spectral separation mitigates self-interference at the reader.
  • No per-user or per-keyboard training data collection is required because the extracted features are claimed to be independent of those variables.
  • LLM outputs function as pseudo-labels that allow the classifier to refine itself during live operation.
  • The full prototype demonstrates accurate inference across diverse users in real-world over-the-air experiments.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The resonator-based modulation could be tested on other mechanical events such as mouse clicks or switch actuations to see whether the same feature pipeline generalizes.
  • The spectral separation property might allow multiple tags to operate simultaneously in the same environment without mutual interference, an extension not evaluated in the paper.
  • If the LLM adaptation step succeeds, similar pseudo-labeling could reduce training overhead in other side-channel sensing systems that currently rely on labeled victim data.
  • The approach leaves open whether performance holds when the tag and reader are separated by multiple walls or in the presence of strong external RF sources.

Load-bearing premise

The signal processing pipeline extracts keystroke features in time and frequency domains that stay consistent enough across users and keyboards to support accurate inference without any victim-specific training data.

What would settle it

A controlled test showing that classification accuracy falls below usable levels on a previously unseen keyboard model or typing style even after the LLM adaptation step runs for several minutes.

Figures

Figures reproduced from arXiv: 2606.10148 by Chunqi Qian, Huacheng Zeng, Qijun Wang.

Figure 1
Figure 1. Figure 1: Threat model and system configuration. Consequently, keystroke privacy has emerged as a critical aspect of cybersecurity, with eavesdropping attacks present￾ing a persistent and evolving threat. Traditionally, adver￾saries exploit various side-channel emanations (e.g., acous￾tic signals [1], [2], [3], [4], [5], [6], [7], electromagnetic radiation [8], [9], [10], [11], radar-based sensing [12], [13], and me… view at source ↗
Figure 2
Figure 2. Figure 2: Three common keyboard switch types. and the RF eavesdropping activity can also be detected by spectrum monitoring. 3. Understanding Keystrokes This section introduces the fundamental principles un￾derlying our proposed keystroke eavesdropping attack. Specifically, we examine how mechanical vibrations are generated by keystrokes, how these vibrations propagate through various media, and how they are detecte… view at source ↗
Figure 3
Figure 3. Figure 3: Keystroke-induced signal propagation model. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 6
Figure 6. Figure 6: The diagram of our proposed backscatter tag. [PITH_FULL_IMAGE:figures/full_fig_p005_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Illustrating spectral separation of the RF tag’s [PITH_FULL_IMAGE:figures/full_fig_p006_7.png] view at source ↗
Figure 9
Figure 9. Figure 9: Overview of RF reader’s signal processing and [PITH_FULL_IMAGE:figures/full_fig_p007_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: A sample of coarse-grained and fine-grained [PITH_FULL_IMAGE:figures/full_fig_p008_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: (a) LLM is used only for post hoc correction; [PITH_FULL_IMAGE:figures/full_fig_p009_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Experimental settings. spaced 1.8 mm apart. The coil consists of five counterclock￾wise turns on the first rod, followed by a single clockwise turn on the second. The two wire ends are connected to a pair of head-to-head varactor diodes with a capacitance of 3 pF. The piezoelectric transducer connects one sensing electrode to the common cathode and the other to the common anode. RF Reader [PITH_FULL_IMAG… view at source ↗
Figure 14
Figure 14. Figure 14: Keystroke detection performance under different conditions. [ [PITH_FULL_IMAGE:figures/full_fig_p011_14.png] view at source ↗
Figure 15
Figure 15. Figure 15: Impact of the RF tag’s placement. [OU: LLM￾guided Online Updating.] Impact of Tag-to-Reader Distance. Another critical factor for the key-typing eavesdropping attack is the tag￾to-reader distance, which determines the effective reading range of the RF system. We evaluate this by placing the RF reader at distances ranging from 1 m to 8 m. Beyond 6 m, line-of-sight (LoS) is obstructed by furniture, rep￾rese… view at source ↗
Figure 17
Figure 17. Figure 17: Through-wall keystroke detection accuracy. [PITH_FULL_IMAGE:figures/full_fig_p013_17.png] view at source ↗
Figure 18
Figure 18. Figure 18: The PER operates in the circular resonance mode [PITH_FULL_IMAGE:figures/full_fig_p015_18.png] view at source ↗
read the original abstract

In today's digitally connected world, keyboards remain the primary interface for inputting sensitive information, making them a persistent target for eavesdropping attacks. While prior keystroke inference techniques have exploited side-channel signals such as acoustics and vibrations, they typically rely on conspicuous, short-range sensors and require victim-specific data for model training, limiting their practicality, scalability, and stealth. In this paper, we present RadKey, an RF backscatter system for covert, long-range, through-wall keystroke eavesdropping. RadKey comprises two components: a compact batteryless backscatter tag and an RF reader. The tag captures keystroke-induced vibrations and acoustic signals, modulating them onto the frequency shift of its backscattered RF signal using two magnetically-coupled LC resonators. This design also enables spectral separation between the excitation and backscatter signals, mitigating self-interference for the RF reader and thus extending eavesdropping range. The RF reader demodulates the backscattered RF signal to infer typed content. It employs a dedicated signal processing pipeline that extracts user- and keyboard-independent keystroke features across time and frequency domains, enabling strong generalizability. To further enhance adaptability, RadKey integrates an LLM for online adaptation, leveraging LLM outputs as pseudo ground-truth labels to refine the classifier during runtime. We have built a prototype of the full RadKey system and evaluated it through extensive over-the-air experiments. Results show that RadKey achieves accurate and robust keystroke inference across diverse users in real-world settings. A demo video is available at: https://radkey-submission.github.io/RadKey/

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 0 minor

Summary. The paper presents RadKey, an RF backscatter system consisting of a batteryless tag with two magnetically-coupled LC resonators that modulates keystroke-induced vibrations and acoustics onto the backscattered RF signal, and an RF reader that demodulates the signal. A dedicated signal-processing pipeline extracts user- and keyboard-independent features in time and frequency domains, and an LLM supplies pseudo ground-truth labels for online classifier adaptation. A prototype is evaluated in over-the-air experiments, with the abstract claiming accurate and robust keystroke inference across diverse users in real-world settings.

Significance. If the claimed generalizability and LLM-driven adaptation hold with supporting quantitative evidence, the work would be significant for demonstrating a practical, long-range, through-wall side-channel attack that avoids victim-specific training data, combining custom RF hardware design with LLM-guided runtime refinement.

major comments (2)
  1. [Abstract] Abstract: the central claim of 'accurate and robust keystroke inference across diverse users' is asserted without any quantitative metrics (accuracy, error rates, dataset sizes, number of users/keyboards, or controls), making it impossible to assess whether the signal-processing pipeline or LLM adaptation actually delivers the stated performance.
  2. [Abstract] Abstract: the LLM component is described as 'leveraging LLM outputs as pseudo ground-truth labels to refine the classifier during runtime,' yet supplies no information on prompt construction, how time/frequency features are encoded for the LLM, or measured agreement between LLM labels and held-out ground truth; without this validation the adaptation step risks error propagation and cannot be trusted to support the generalizability claim.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback focused on the abstract. We will revise the abstract to include quantitative metrics and brief validation details on the LLM component, drawing from the experimental results already reported in the manuscript body.

read point-by-point responses

  1. Referee: [Abstract] Abstract: the central claim of 'accurate and robust keystroke inference across diverse users' is asserted without any quantitative metrics (accuracy, error rates, dataset sizes, number of users/keyboards, or controls), making it impossible to assess whether the signal-processing pipeline or LLM adaptation actually delivers the stated performance.

    Authors: We agree that the abstract should provide quantitative support for the performance claims. In the revised version we will incorporate specific metrics from the over-the-air evaluation section, including accuracy and error rates, the number of users and keyboards tested, and controls for user/keyboard independence. This will enable readers to assess the generalizability of the signal-processing pipeline and LLM adaptation directly from the abstract. revision: yes

  2. Referee: [Abstract] Abstract: the LLM component is described as 'leveraging LLM outputs as pseudo ground-truth labels to refine the classifier during runtime,' yet supplies no information on prompt construction, how time/frequency features are encoded for the LLM, or measured agreement between LLM labels and held-out ground truth; without this validation the adaptation step risks error propagation and cannot be trusted to support the generalizability claim.

    Authors: Detailed information on prompt construction, time/frequency feature encoding for the LLM, and measured agreement between LLM pseudo-labels and held-out ground truth is already present in the manuscript sections describing the LLM-guided adaptation pipeline and its experimental validation. To address the abstract-level concern, we will add a concise statement referencing the validation approach and agreement rates, thereby demonstrating that error propagation is mitigated and supporting the generalizability claim. revision: yes

Circularity Check

0 steps flagged

No circularity in claimed derivation chain

full rationale

The provided abstract and description contain no equations, derivations, fitted parameters presented as predictions, or self-citations that reduce the claimed generalizability or performance to inputs by construction. The signal-processing pipeline and LLM pseudo-labeling are described as external components enabling the result, with no self-definitional loops, ansatz smuggling, or renaming of known results evident. This is the normal case of a self-contained empirical system description.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract-only review; no explicit free parameters, axioms, or invented entities are stated.

pith-pipeline@v0.9.1-grok · 5819 in / 1023 out tokens · 22466 ms · 2026-06-27T16:04:23.401063+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

67 extracted references · 10 canonical work pages

  1. [1]

    A practical deep learning-based acoustic side channel attack on keyboards,

    J. Harrison, E. Toreini, and M. Mehrnezhad, “A practical deep learning-based acoustic side channel attack on keyboards,” in2023 IEEE European Symposium on Security and Privacy Workshops (Eu- roS&PW). IEEE, 2023, pp. 270–280

    2023

  2. [2]

    Keyprint: Practical black-box keystroke inference attacks to mobile devices,

    Y . Feng, D. Liu, W. Jin, and L. Gong, “Keyprint: Practical black-box keystroke inference attacks to mobile devices,”Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, vol. 9, no. 2, pp. 1–30, 2025

    2025

  3. [3]

    Eavesdropping on controller acoustic emanation for keystroke inference attack in virtual reality,

    S. Luo, A. Nguyen, H. Farooq, K. Sun, and Z. Yan, “Eavesdropping on controller acoustic emanation for keystroke inference attack in virtual reality,” inThe Network and Distributed System Security Symposium (NDSS), vol. 1, no. 2, 2024, p. 3

    2024

  4. [4]

    Reflexnoop: Passwords snoop- ing on nlos laptops leveraging screen-induced sound reflection,

    P. Wang, J. Hu, C. Liu, and J. Luo, “Reflexnoop: Passwords snoop- ing on nlos laptops leveraging screen-induced sound reflection,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 3361–3375

    2024

  5. [5]

    A survey on acous- tic side channel attacks on keyboards,

    A. Taheritajar, Z. M. Harris, and R. Rahaeimehr, “A survey on acous- tic side channel attacks on keyboards,” inInternational Conference on Information and Communications Security. Springer, 2024, pp. 99–121

    2024

  6. [6]

    A batteryless wireless microphone using rf backscatter,

    Q. Wang, C. Qian, P. Yan, S. Zhang, and H. Zeng, “A batteryless wireless microphone using rf backscatter,”Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, vol. 9, no. 4, pp. 1–18, 2025

    2025

  7. [7]

    Radear: A self-supervised rf backscatter system for voice eavesdropping and separation,

    Q. Wang, P. Yan, C. Qian, and H. Zeng, “Radear: A self-supervised rf backscatter system for voice eavesdropping and separation,”arXiv preprint arXiv:2603.12446, 2026

    work page arXiv 2026

  8. [8]

    Compromising electromagnetic emana- tions of wired and wireless keyboards

    M. Vuagnoux and S. Pasini, “Compromising electromagnetic emana- tions of wired and wireless keyboards.” inUSENIX security sympo- sium, vol. 8, 2009, pp. 1–16

    2009

  9. [9]

    Ghosttype: The limits of using contactless electromagnetic interference to inject phantom keys into analog circuits of keyboards,

    Q. Jiang, Y . Ren, Y . Long, C. Yan, Y . Sun, X. Ji, K. Fu, and W. Xu, “Ghosttype: The limits of using contactless electromagnetic interference to inject phantom keys into analog circuits of keyboards,” inNetwork and Distributed Systems Security (NDSS) Symposium, 2024

    2024

  10. [10]

    Periscope: A keystroke inference attack using human coupled electromagnetic emanations,

    W. Jin, S. Murali, H. Zhu, and M. Li, “Periscope: A keystroke inference attack using human coupled electromagnetic emanations,” inProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 700–714

    2021

  11. [11]

    Graphics peeping unit: Exploiting em side-channel information of gpus to eavesdrop on your neighbors,

    Z. Zhan, Z. Zhang, S. Liang, F. Yao, and X. Koutsoukos, “Graphics peeping unit: Exploiting em side-channel information of gpus to eavesdrop on your neighbors,” in2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022, pp. 1440–1457

    2022

  12. [12]

    Radsee: See your handwriting through walls using fmcw radar,

    S. Zhang, Q. Wang, M. Gan, Z. Cao, and H. Zeng, “Radsee: See your handwriting through walls using fmcw radar,” inProceedings of Network and Distributed System Security Symposium (NDSS), 2025

    2025

  13. [13]

    Radeye: Tracking eye motion using fmcw radar,

    S. Zhang, Q. Wang, K. Song, Q. Yan, and H. Zeng, “Radeye: Tracking eye motion using fmcw radar,” inProceedings of the 2025 CHI Conference on Human Factors in Computing Systems, 2025, pp. 1– 13

    2025

  14. [14]

    Accessory: pass- word inference using accelerometers on smartphones,

    E. Owusu, J. Han, S. Das, A. Perrig, and J. Zhang, “Accessory: pass- word inference using accelerometers on smartphones,” inproceedings of the twelfth workshop on mobile computing systems & applications, 2012, pp. 1–6

    2012

  15. [15]

    {TouchLogger}: Inferring keystrokes on touch screen from smartphone motion,

    L. Cai and H. Chen, “{TouchLogger}: Inferring keystrokes on touch screen from smartphone motion,” in6th USENIX Workshop on Hot Topics in Security (HotSec 11), 2011

    2011

  16. [16]

    When good becomes evil: Keystroke inference with smartwatch,

    X. Liu, Z. Zhou, W. Diao, Z. Li, and K. Zhang, “When good becomes evil: Keystroke inference with smartwatch,” inProceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, 2015, pp. 1273–1285

    2015

  17. [17]

    Vibsense: Sensing touches on ubiquitous surfaces through vibration,

    J. Liu, Y . Chen, M. Gruteser, and Y . Wang, “Vibsense: Sensing touches on ubiquitous surfaces through vibration,” in2017 14th Annual IEEE International Conference on Sensing, Communication, and Networking (SECON). IEEE, 2017, pp. 1–9

    2017

  18. [18]

    Keystrokesniffer: An off-the-shelf smartphone can eavesdrop on your privacy from anywhere,

    J. Huang, J.-X. Bai, X. Zhang, Z. Liu, Y . Feng, J. Liu, X. Sun, M. Dong, and M. Li, “Keystrokesniffer: An off-the-shelf smartphone can eavesdrop on your privacy from anywhere,”IEEE Transactions on Information Forensics and Security, 2024

    2024

  19. [19]

    Snooping keystrokes with mm-level audio ranging on a single phone,

    J. Liu, Y . Wang, G. Kar, Y . Chen, J. Yang, and M. Gruteser, “Snooping keystrokes with mm-level audio ranging on a single phone,” in Proceedings of the 21st Annual International Conference on Mobile Computing and Networking, 2015, pp. 142–154

    2015

  20. [20]

    I know your keyboard input: a robust keystroke eavesdropper based-on acoustic signals,

    J.-X. Bai, B. Liu, and L. Song, “I know your keyboard input: a robust keystroke eavesdropper based-on acoustic signals,” inProceedings of the 29th ACM International Conference on Multimedia, 2021, pp. 1239–1247

    2021

  21. [21]

    Keylistener: Inferring keystrokes on qwerty keyboard of touch screen through acoustic signals,

    L. Lu, J. Yu, Y . Chen, Y . Zhu, X. Xu, G. Xue, and M. Li, “Keylistener: Inferring keystrokes on qwerty keyboard of touch screen through acoustic signals,” inIEEE INFOCOM 2019-IEEE Conference on Computer Communications. IEEE, 2019, pp. 775–783

    2019

  22. [22]

    Behavicker: Eavesdrop- ping computer-usage activities through acoustic side channel,

    M. Chen, J. Lin, W. Liu, and K. Wu, “Behavicker: Eavesdrop- ping computer-usage activities through acoustic side channel,”Wire- less Communications and Mobile Computing, vol. 2022, no. 1, p. 8090652, 2022

    2022

  23. [23]

    Overhear: headphone based multi-sensor keystroke inference,

    R. Wijewickrama, M. Abbasihafshejani, A. Maiti, and M. Jadliwala, “Overhear: headphone based multi-sensor keystroke inference,”arXiv preprint arXiv:2311.02288, 2023

    work page arXiv 2023

  24. [24]

    Ultrasnoop: Placement- agnostic keystroke snooping via smartphone-based ultrasonic sonar,

    Y . Zhao, Y . Zhao, S. Li, H. Han, and L. Xie, “Ultrasnoop: Placement- agnostic keystroke snooping via smartphone-based ultrasonic sonar,” ACM Transactions on Internet of Things, vol. 4, no. 4, pp. 1–24, 2023

    2023

  25. [25]

    Context-free attacks using keyboard acoustic emanations,

    T. Zhu, Q. Ma, S. Zhang, and Y . Liu, “Context-free attacks using keyboard acoustic emanations,” inProceedings of the 2014 ACM SIGSAC conference on computer and communications security, 2014, pp. 453–464

    2014

  26. [26]

    Ubiquitous keyboard for small mobile devices: harnessing multipath fading for fine-grained keystroke localization,

    J. Wang, K. Zhao, X. Zhang, and C. Peng, “Ubiquitous keyboard for small mobile devices: harnessing multipath fading for fine-grained keystroke localization,” inProceedings of the 12th annual interna- tional conference on Mobile systems, applications, and services, 2014, pp. 14–27

    2014

  27. [27]

    Keystroke recognition using wifi signals,

    K. Ali, A. X. Liu, W. Wang, and M. Shahzad, “Keystroke recognition using wifi signals,” inProceedings of the 21st annual international conference on mobile computing and networking, 2015, pp. 90–102

    2015

  28. [28]

    Revealing your mobile password via wifi signals: Attacks and countermeasures,

    Y . Meng, J. Li, H. Zhu, X. Liang, Y . Liu, and N. Ruan, “Revealing your mobile password via wifi signals: Attacks and countermeasures,” IEEE Transactions on Mobile Computing, vol. 19, no. 2, pp. 432–449, 2019

    2019

  29. [29]

    Towards a general video-based keystroke inference attack,

    Z. Yang, Y . Chen, Z. Sarwar, H. Schwartz, B. Y . Zhao, and H. Zheng, “Towards a general video-based keystroke inference attack,” in32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 141– 158

    2023

  30. [30]

    Side-channel inference attacks on mobile keypads using smartwatches,

    A. Maiti, M. Jadliwala, J. He, and I. Bilogrevic, “Side-channel inference attacks on mobile keypads using smartwatches,”IEEE Transactions on Mobile Computing, vol. 17, no. 9, pp. 2180–2194, 2018

    2018

  31. [31]

    Zoom on the keystrokes: Exploiting video calls for keystroke inference attacks,

    M. Sabra, A. Maiti, and M. Jadliwala, “Zoom on the keystrokes: Exploiting video calls for keystroke inference attacks,”arXiv preprint arXiv:2010.12078, 2020

    work page arXiv 2010

  32. [32]

    Acoustic side channel at- tack on keyboards based on typing patterns,

    A. Taheritajar and R. Rahaeimehr, “Acoustic side channel at- tack on keyboards based on typing patterns,”arXiv preprint arXiv:2403.08740, 2024

    work page arXiv 2024

  33. [33]

    (sp) iphone: Decoding vibrations from nearby keyboards using mobile phone accelerometers,

    P. Marquardt, A. Verma, H. Carter, and P. Traynor, “(sp) iphone: Decoding vibrations from nearby keyboards using mobile phone accelerometers,” inProceedings of the 18th ACM conference on Computer and communications security, 2011, pp. 551–562

    2011

  34. [34]

    Tracking keystrokes us- ing wireless signals,

    B. Chen, V . Yenamandra, and K. Srinivasan, “Tracking keystrokes us- ing wireless signals,” inProceedings of the 13th Annual International Conference on Mobile Systems, Applications, and Services, 2015, pp. 31–44

    2015

  35. [35]

    Sok: Keylogging side channels,

    J. V . Monaco, “Sok: Keylogging side channels,” in2018 IEEE Sym- posium on Security and Privacy (SP). IEEE, 2018, pp. 211–228

    2018

  36. [36]

    Wireless identification and sensing platform version 6.0,

    R. Menon, R. Gujarathi, A. Saffari, and J. R. Smith, “Wireless identification and sensing platform version 6.0,” inProceedings of the 20th ACM Conference on Embedded Networked Sensor Systems, 2022, pp. 899–905

    2022

  37. [37]

    Battery-free cellphone,

    V . Talla, B. Kellogg, S. Gollakota, and J. R. Smith, “Battery-free cellphone,”Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, vol. 1, no. 2, pp. 1–20, 2017

    2017

  38. [38]

    Mars: Nano-power battery- free wireless interfaces for touch, swipe and speech input,

    N. Arora, A. Mirzazadeh, I. Moon, C. Ramey, Y . Zhao, D. C. Rodriguez, G. D. Abowd, and T. Starner, “Mars: Nano-power battery- free wireless interfaces for touch, swipe and speech input,” inThe 34th Annual ACM Symposium on User Interface Software and Tech- nology, 2021, pp. 1305–1325

    2021

  39. [39]

    Making acous- tic{Side-Channel}attacks on noisy keyboards viable with{LLM- Assisted}spectrograms’

    S. A. Ayati, J. H. Park, Y . Cai, and M. Botacin, “Making acous- tic{Side-Channel}attacks on noisy keyboards viable with{LLM- Assisted}spectrograms’” typo” correction,” in19th USENIX WOOT Conference on Offensive Technologies (WOOT 25), 2025, pp. 87–101

    2025

  40. [40]

    Non-intrusive and uncon- strained keystroke inference in vr platforms via infrared side channel,

    T. Ni, Y . Du, Q. Zhao, and C. Wang, “Non-intrusive and uncon- strained keystroke inference in vr platforms via infrared side channel,” arXiv preprint arXiv:2412.14815, 2024

    work page arXiv 2024

  41. [41]

    Improving acoustic side-channel attacks on keyboards using transformers and large language models,

    J. H. Park, S. A. Ayati, and Y . Cai, “Improving acoustic side-channel attacks on keyboards using transformers and large language models,” arXiv preprint arXiv:2502.09782, 2025

    work page arXiv 2025

  42. [42]

    Llm-assisted cheating detection in korean language via keystrokes,

    D. H. Roh, R. Kumar, and A. Ngo, “Llm-assisted cheating detection in korean language via keystrokes,”arXiv preprint arXiv:2507.22956, 2025

    work page arXiv 2025

  43. [43]

    K. F. Graff,Wave motion in elastic solids. Courier Corporation, 2012

    2012

  44. [44]

    Thomson,Theory of vibration with applications

    W. Thomson,Theory of vibration with applications. CrC Press, 2018

    2018

  45. [45]

    L. D. Landau, L. Pitaevskii, A. M. Kosevich, and E. M. Lifshitz, Theory of elasticity: volume 7. Elsevier, 2012, vol. 7

    2012

  46. [46]

    S. P. Timoshenko and J. M. Gere,Theory of elastic stability. Courier Corporation, 2012

    2012

  47. [47]

    L. E. Kinsler, A. R. Frey, A. B. Coppens, and J. V . Sanders,Funda- mentals of acoustics. John wiley & sons, 2000

    2000

  48. [48]

    Uchino,Piezoelectric actuators and ultrasonic motors

    K. Uchino,Piezoelectric actuators and ultrasonic motors. Springer Science & Business Media, 1996, vol. 1

    1996

  49. [49]

    Coatnet: Marrying convolution and attention for all data sizes,

    Z. Dai, H. Liu, Q. V . Le, and M. Tan, “Coatnet: Marrying convolution and attention for all data sizes,”Advances in neural information processing systems, vol. 34, pp. 3965–3977, 2021

    2021

  50. [50]

    Integrating health sensing into cellular networks: Human sleep monitoring using 5g signals,

    R. Lin, P. Yan, J. Lu, Q. Wang, and H. Zeng, “Integrating health sensing into cellular networks: Human sleep monitoring using 5g signals,”arXiv preprint arXiv:2603.02558, 2026

    work page arXiv 2026

  51. [51]

    Eexapp: Gnn-based reinforcement learn- ing for radio unit energy optimization in 5g o-ran,

    J. Lu, P. Yan, and H. Zeng, “Eexapp: Gnn-based reinforcement learn- ing for radio unit energy optimization in 5g o-ran,”arXiv preprint arXiv:2602.09206, 2026

    work page arXiv 2026

  52. [52]

    Near-real-time resource slicing for qos optimization in 5g o-ran using deep reinforcement learning,

    P. Yan, J. Lu, H. Zeng, and Y . T. Hou, “Near-real-time resource slicing for qos optimization in 5g o-ran using deep reinforcement learning,” IEEE Transactions on Networking, vol. 34, pp. 1596–1611, 2025

    2025

  53. [53]

    xdiff: Online diffusion model for collaborative inter-cell interference management in 5g o-ran,

    P. Yan, H. Zeng, and Y . T. Hou, “xdiff: Online diffusion model for collaborative inter-cell interference management in 5g o-ran,”IEEE Transactions on Networking, 2025

    2025

  54. [54]

    The llama 3 herd of models,

    A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Yang, A. Fanet al., “The llama 3 herd of models,”arXiv e-prints, pp. arXiv–2407, 2024

    2024

  55. [55]

    Keyboard acoustic emanations revisited,

    L. Zhuang, F. Zhou, and J. D. Tygar, “Keyboard acoustic emanations revisited,”ACM Transactions on Information and System Security (TISSEC), vol. 13, no. 1, pp. 1–26, 2009

    2009

  56. [56]

    Rf sensing security and malicious exploitation: A comprehensive survey,

    M. Han, H. Yang, W. Li, W. Xu, X. Cheng, P. Mohapatra, and P. Hu, “Rf sensing security and malicious exploitation: A comprehensive survey,”arXiv preprint arXiv:2504.10969, 2025

    work page arXiv 2025

  57. [57]

    Security and privacy in the emerging cyber-physical world: A survey,

    Z. Yu, Z. Kaplan, Q. Yan, and N. Zhang, “Security and privacy in the emerging cyber-physical world: A survey,”IEEE Communications Surveys & Tutorials, vol. 23, no. 3, pp. 1879–1919, 2021

    1919

  58. [58]

    Auditory eyesight: Demystifying{µs-Precision}keystroke tracking attacks on unconstrained keyboard inputs,

    Y . Tu, L. Shan, M. I. Hossen, S. Rampazzi, K. Butler, and X. Hei, “Auditory eyesight: Demystifying{µs-Precision}keystroke tracking attacks on unconstrained keyboard inputs,” in32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 175–192

    2023

  59. [59]

    Keyboard snooping from mobile phone arrays with mixed convolutional and recurrent neural networks,

    T. Giallanza, T. Siems, E. Smith, E. Gabrielsen, I. Johnson, M. A. Thornton, and E. C. Larson, “Keyboard snooping from mobile phone arrays with mixed convolutional and recurrent neural networks,”Pro- ceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, vol. 3, no. 2, pp. 1–22, 2019

    2019

  60. [60]

    Sia: Smartwatch-enabled inference attacks on physical keyboards using acoustic signals,

    ¨U. Meteriz-Yıldıran, N. F. Yildiran, and D. Mohaisen, “Sia: Smartwatch-enabled inference attacks on physical keyboards using acoustic signals,” inProceedings of the 20th Workshop on Workshop on Privacy in the Electronic Society, 2021, pp. 209–221

    2021

  61. [61]

    Robust keystroke transcription from the acoustic side-channel,

    D. Slater, S. Novotney, J. Moore, S. Morgan, and S. Tenaglia, “Robust keystroke transcription from the acoustic side-channel,” inProceed- ings of the 35th Annual Computer Security Applications Conference, 2019, pp. 776–787

    2019

  62. [62]

    Skype & type: Keyboard eavesdropping in voice-over-ip,

    S. Cecconello, A. Compagno, M. Conti, D. Lain, and G. Tsudik, “Skype & type: Keyboard eavesdropping in voice-over-ip,”ACM Transactions on Privacy and Security (TOPS), vol. 22, no. 4, pp. 1–34, 2019

    2019

  63. [63]

    Don’t skype & type! acoustic eavesdropping in voice-over-ip,

    A. Compagno, M. Conti, D. Lain, and G. Tsudik, “Don’t skype & type! acoustic eavesdropping in voice-over-ip,” inProceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, 2017, pp. 703–715

    2017

  64. [64]

    Dictionary attacks using keyboard acoustic emanations,

    Y . Berger, A. Wool, and A. Yeredor, “Dictionary attacks using keyboard acoustic emanations,” inProceedings of the 13th ACM conference on Computer and communications security, 2006, pp. 245–254

    2006

  65. [65]

    Keyboard acoustic emanations,

    D. Asonov and R. Agrawal, “Keyboard acoustic emanations,” inIEEE Symposium on Security and Privacy, 2004. Proceedings. 2004. IEEE, 2004, pp. 3–11

    2004

  66. [66]

    No training hurdles: Fast training-agnostic attacks to infer your typing,

    S. Fang, I. Markwood, Y . Liu, S. Zhao, Z. Lu, and H. Zhu, “No training hurdles: Fast training-agnostic attacks to infer your typing,” inProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 2018, pp. 1747–1760

    2018

  67. [67]

    A survey on sensor-based threats and attacks to smart devices and applications,

    A. K. Sikder, G. Petracca, H. Aksu, T. Jaeger, and A. S. Uluagac, “A survey on sensor-based threats and attacks to smart devices and applications,”IEEE Communications Surveys & Tutorials, vol. 23, no. 2, pp. 1125–1159, 2021

    2021