How WiFi Learned to See
Your router has been quietly capable of sensing motion for years. This module reframes RF from communication medium to sensing modality — from CSI fundamentals through deployed products, cutting-edge research, and the privacy implications.
Multipath as Signal
Every other Hertzian module treats multipath as the enemy — fading, ISI, the reason WiFi drops behind the fridge. Here, multipath is the signal. The environment is talking back to the radio.
OFDM already computes per-subcarrier amplitude and phase for equalization. Instead of discarding this rich fingerprint, WiFi sensing reads it as an evolving picture of the physical environment — the same data the radio uses to decode packets becomes a spatial sensor reading. The label for this measurement is shown in the comparison below.
Spectrum Primer
WiFi sensing happens in unlicensed spectrum — the same bands shared with kitchen appliances and Bluetooth devices. Understanding the frequency bands is essential to understanding why sensing works and where it struggles.
WiFi Frequency Bands
The Crowded Pioneer
The 2.4 GHz band has a wavelength of about 12.5 cm — long enough to bend around furniture and punch through drywall. That penetration makes it ideal for whole-home coverage, but it also makes the band a traffic jam. Bluetooth, Zigbee, baby monitors, cordless phones, and every neighbor's router all share these same 83.5 MHz of spectrum. For sensing, this band is a double-edged sword: it reaches more of the environment (good for coverage), but the interference floor is higher (bad for sensitivity).
Why does your WiFi drop when someone heats lunch?
Your microwave oven operates at around 2450 MHz, in the same unlicensed band as WiFi. Water absorbs energy at that frequency well enough to heat food. A microwave oven is essentially a 1000-watt-class transmitter on your WiFi channel. Even with shielding, enough energy leaks to drown out the milliwatt signals your router sends.
The Fast Lane
The 5 GHz band offers dramatically more spectrum — over 500 MHz across multiple UNII sub-bands — with wider channels (up to 160 MHz) and far less interference. The tradeoff: shorter wavelengths (~6 cm) mean worse wall penetration and faster signal decay with distance. For sensing, this band provides finer spatial resolution but covers less area per access point.
The New Frontier
Wi-Fi 6E and Wi-Fi 7 open up 1200 MHz of new spectrum in the 6 GHz band. It's the least congested WiFi band today, with support for ultra-wide 320 MHz channels. For sensing, this band is still early — but its clean spectrum and wide channels could enable higher-resolution CSI measurements as hardware adoption grows.
Licensed vs Unlicensed
Cellular networks use licensed spectrum — operators pay billions at auction for exclusive access, and base stations schedule every transmission. WiFi uses unlicensed spectrum — anyone can transmit as long as they follow power limits and use listen-before-talk protocols. This means WiFi sensing must be robust to interference from devices it can't control — your neighbor's router, a baby monitor, or that kitchen appliance. Licensed-band sensing (like 5G positioning) has a cleaner environment but requires carrier cooperation.
Already in Your House
This isn't a research prototype. Major ISPs now sell or give away motion sensing built on the Wi-Fi gear they already put in customers' homes. Xfinity's version is free, needs no extra sensors, and is switched on by the customer in the app. Your router may already be capable of detecting whether someone is home.
What the Industry Calls It
The technical term is presence detection — the ability to determine whether a person is in a room using WiFi signal perturbations. But you won't find that term on any product page. Instead, vendors choose names designed to feel helpful rather than invasive.
Xfinity
"WiFi Motion" — free on supported gateways (XB7 and newer). Off by default; you opt in through the Xfinity app.
Linksys
"Linksys Aware" — monthly subscription. Uses Velop mesh nodes as motion sensors.
The naming is the teaching moment
A consumer-friendly name sounds like a feature. The technical term sounds like surveillance. They're the same capability. When you see a technology renamed for consumers, ask what the rename is softening — and whether the soft name matches the full capability of the underlying system.
The Scale
Comcast alone has over 30 million broadband subscribers, and its newer gateways (XB7 and later) support WiFi Motion. This isn't a future deployment — it's an installed base of gateways whose firmware can detect human presence today, for every customer who turns the feature on.
The Capability Ladder
The same CSI data, the same hardware, progressively smarter models. Three rungs — presence, pose, and recognition. Each step up reveals more about the people in the sensing environment — and the gap between "motion alert" and "recognizing who is present" may be little more than a software update on hardware that's already installed.
3. Identify — "Who is it?"
A Transformer encoder over CSI sequences extracts person-specific biometric signatures. 95.5% rank-1 accuracy in a lab study of 14 people (NTU-Fi dataset) with commodity TP-Link routers.
2. Reconstruct — "What are they doing?"
Research prototypes map CSI to UV body surface coordinates across 24 regions, for multiple people, with no camera at inference time.
1. Detect — "Is someone there?"
Commodity, deployed in millions of homes today. The simplest approach: threshold on CSI variance over time.
Watch the Ladder in Action
Scroll through to see how the same physical event gets progressively more legible to smarter models.
Physical World
What the Model Sees
Raw CSI
Unprocessed channel state information — amplitude and phase across 52 subcarriers, updating with every WiFi packet.
Output
A matrix of numbers. Meaningless to the eye.
Stage 1: Raw CSI
Unprocessed channel state information — amplitude and phase across 52 subcarriers, updating with every WiFi packet.
Stage 2: Detect
Compute variance across a sliding window. If subcarrier amplitudes fluctuate beyond a threshold — something moved.
Stage 3: Reconstruct
Feed CSI phase and amplitude through a trained neural network. Out comes a body map — pose and surface positions across 24 UV regions.
Stage 4: Identify
A Transformer encoder reads the CSI sequence as a biometric signature. Gait, body shape, movement patterns — unique to each person.
This is the same escalation pattern facial recognition followed: faces → expressions → individuals. The difference is that WiFi sensing hardware is already deployed at scale for the first rung. The upper rungs have so far been shown with research setups that expose raw CSI, but they use the same kind of radio signal, so the step up may need little more than new firmware and models.
The Anchor Papers
802.11bf — When Sensing Becomes Spec
Everything we've seen so far — CSI extraction, motion detection, pose estimation — has been built on top of WiFi, not into it. Researchers extract CSI using firmware hacks and driver modifications. IEEE 802.11bf changes that: it's an amendment to the WiFi standard that makes sensing a first-class capability of the protocol itself.
What 802.11bf Standardizes
Measurement
Standardized procedures for CSI measurement exchange between sensing initiators and responders.
Signaling
New management frames for setting up, maintaining, and tearing down sensing sessions between devices.
Coordination
How sensing devices negotiate roles, timing, and resources without disrupting regular data traffic.
Timeline
2020
IEEE 802.11bf Task Group (TGbf) formed
2022–2024
Draft iterations, letter ballots, comment resolution
2025
IEEE 802.11bf-2025 approved (May) and published (September)
Why this matters
When something moves from "interesting research hack" to "in the IEEE standard," it means the industry has decided it's real and shippable. Qualcomm, Intel, Broadcom, and MediaTek — the companies that make the WiFi chips in your devices — are active participants in TGbf. Sensing is likely to become a checkbox feature on future routers, not a research curiosity.
CSI Playback
Scrub through a pre-recorded CSI capture. The room scene shows what's physically happening — a person walking through a room with a WiFi router. The heatmap shows the CSI response (time runs left to right, one row per subcarrier) — watch how the abstract numbers react to physical movement.
Physical Scene
CSI Response
Privacy & Dual Use
"Your router can see through walls" is a sentence that deserves scrutiny. The same physics that powers genuinely useful applications — fall detection for elderly care, occupancy-based HVAC, hands-free smart home control — also enables surveillance capabilities that most privacy frameworks haven't caught up to.
The GPS Lesson
We learned this once before with GPS. Individual location pings feel innocuous — "I'm at the coffee shop." Aggregated over weeks, they reveal where you work, who you visit, where you worship, and when you see a doctor. The data wasn't the problem. The aggregation was.
WiFi sensing follows the same pattern. A single CSI snapshot tells you almost nothing. Continuous capture, combined with increasingly capable models, tells you who is in a building, what they're doing, and eventually who they are — all without a camera, and through walls a camera can't see through.
The Detect → Reconstruct → Identify Escalation
This is the same escalation pattern facial recognition followed. First: detect presence (is anyone there?). Then: reconstruct activity (where, doing what?). Finally: identify individuals (who specifically?). Each step was presented as a useful feature. The aggregate became a surveillance system.
A Concrete Scenario
A retail store deploys WiFi access points for customer internet access. Using CSI from those same access points, the store could in principle build biometric signatures of walking patterns — re-identifying returning customers without ever asking permission, without cameras, and potentially without triggering any existing privacy law written with faces and fingerprints in mind.
Radio-based identifiers may bypass laws written for visible biometrics. The regulatory gap is real and mostly unaddressed.
The Dual-Use Tension
Genuinely Useful
- • Fall detection for elderly living alone
- • Occupancy-based energy savings
- • Gesture control without wearables
- • Intruder detection without cameras
Genuinely Concerning
- • Through-wall surveillance without consent
- • Biometric tracking via RF signatures
- • Activity profiling in private spaces
- • No visible indicator that sensing is active
The honest answer is that WiFi sensing is genuinely useful and genuinely concerning, and the gap between "consumer feature" and "surveillance system" may be little more than a software update on hardware that's already installed in your home.
Zoom Out
Step back from the details and see the bigger picture. Radio frequency is joining camera, lidar, and IMU as a first-class spatial sensor modality for physical AI. This isn't a future prediction — it's happening now, across consumer products, academic research, and defense systems.
RF Among the Spatial Senses
Camera & Lidar
High resolution, line-of-sight only, affected by lighting and weather, raises immediate privacy alarms.
RF Sensing
Works in the dark, in rain and smoke, and radio waves pass through many walls. Builds on WiFi hardware already deployed in billions of Wi-Fi devices. Lower resolution but ubiquitous.
From Living Room to Orbit
The same physics spans an enormous range of applications. Consumer: Xfinity WiFi Motion detects presence in homes whose owners turn it on. Research: DensePose-from-WiFi reconstructs human poses from CSI alone. Defense: Companies like HawkEye 360 and Spire Global use satellite constellations to geolocate RF emitters from orbit — passive RF intelligence at planetary scale.
Radio waves were always painting a spatial picture of the physical world. We just treated them as dumb pipes until we had the compute and algorithms to read the picture. Multipath isn't noise — it's the environment talking back. We finally learned to listen.
Key Takeaways
- 1.CSI turns every WiFi packet into an environmental probe
- 2.The detect → reconstruct → identify ladder is already climbing
- 3.802.11bf makes sensing a standard protocol feature
- 4.Privacy implications deserve the same scrutiny as facial recognition
- 5.RF is a spatial sensor — we just didn't know it yet