{"id":"3a7c10fd-6deb-4b90-8cde-424d4a2f56ac","arxiv_id":"2505.10864","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A wearable oscillator that mimics cardiac motion disrupts UWB radar heart-rate estimation, raising real-device MAE from about 2-3 bpm to 7-18 bpm.","lead":"This paper tests a wearable motor-and-reflector device that jams unauthorized radar heart-rate monitors by adding a fake heartbeat-like motion signal. It reports that the device raises radar heart-rate estimation errors by several beats per minute, a possible privacy defense for people near radar-equipped robots or through-wall sensors.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"White-box requirement undermines the unauthorized-sensing claim: Algorithm 1 needs the adversary's exact HR model, and no transferability or random-frequency control shows protection against unseen models.","rationale":"Good-faith reading: the paper aims to provide a practical, physically realizable defense against unauthorized UWB radar HR sensing, and supports it with simulations on a sleep dataset, real radargrams, and a servo-motor device. The numerical results are in the right direction and the device is real. However, the method as described is a white-box targeted attack (Algorithm 1, Section IV). The paper itself labels it this way, and the real experiments optimize against known models. In an unauthorized-sensing scenario, the adversary's model is precisely the thing the wearer does not know. Without evidence that an oscillation optimized for one model transfers to other models, or that any random physiological-range oscillation is sufficient, the claimed privacy protection for the realistic threat model is unsupported. This is not an internal inconsistency; it is a mismatch between the stated use case and the experimental protocol. The reader's weakest assumption identified the same issue, so I agree. Keeping the verdict CONDITIONAL is appropriate: the white-box results are promising, but the unauthorized-sensing claim needs a transferability test, per-subject statistics, and a control condition before it can be accepted.","tokens_in":10000,"tokens_out":7197,"duration_ms":76862,"concrete_test":"Run a transferability experiment: train a second HR estimator with a different architecture and initialization on the same sleep dataset, and for each of the five participants optimize the motor frequency and amplitude with Algorithm 1 against a first model (e.g., ResNet-50). Then physically collect radar data with the motor at those settings and measure the second model's MAE and the FFT MAE. If the unseen model's MAE stays near its no-motor baseline instead of rising to the Table II range, the white-box requirement is load-bearing and the unauthorized-sensing claim fails. If the unseen model is also degraded to a similar degree, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing assumption is the white-box condition stated in Section IV: Algorithm 1 takes h_theta and y as inputs and is described as 'a white-box targeted attack requiring knowledge of the vital sign model.' In the stated unauthorized-sensing scenario, the radar operator's model, training data, and preprocessing are unknown, so the wearer cannot compute the optimized f_opt and A_opt for the actual adversary. The real-device evaluation in Section VI-B does not close this gap: it optimizes per participant against known models, and Table II reports aggregate MAE without specifying whether each model row was optimized with that same model or with a single common setting. There is no evaluation against an unseen architecture or retrained model, and no random-frequency control. Consequently, the observed MAE increases (2.42 to 8.17 bpm for FFT, 2.93 to 7.23 bpm for ResNet-50, 9.24 to 17.56 bpm for CNN 1D+2D) could be artifacts of optimizing against the exact evaluated models, not evidence that an arbitrary unauthorized radar model is deceived. The central privacy claim therefore rests on an untested transferability assumption.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes Anti-Sensing, a defense against unauthorized UWB radar heart-rate estimation. It models a wearable oscillating reflector as a structured, localized sinusoidal perturbation on radargrams, and uses a gradient-based white-box targeted attack (Algorithm 1) to optimize oscillation frequency and amplitude under physiological constraints. The authors evaluate the approach in simulation on a two-participant sleep dataset with ResNet-18/50, CNN 1D+2D, and ViT, and in hardware with a servo motor on five participants with FFT, ResNet-50, and CNN 1D+2D. Both evaluations report increases in mean absolute error (MAE) when anti-sensing is active, with the largest real-device effect being CNN 1D+2D from 9.24 to 17.56 bpm.","tokens_in":10179,"tokens_out":4567,"duration_ms":45089,"significance":"The idea of using physically realizable oscillatory motion to create structured radar perturbations is novel and relevant to privacy in radar sensing. The synthetic radargram model paired with a real pendulum comparison (Figure 2) is a useful validation step, and the wearable prototype demonstrates that the perturbation is physically implementable. If transferability to unseen models and statistical robustness are established, the method would be a meaningful contribution to physical-layer defenses for contactless sensing.","major_comments":[{"comment":"The defense as formulated requires white-box access to the adversary's exact heart-rate model h_theta, because Algorithm 1 computes gradients through h_theta and takes y as input, and the text explicitly describes it as 'a white-box targeted attack requiring knowledge of the vital sign model' (Section IV). The unauthorized-sensing scenario implies the wearer does not know the radar operator's model, preprocessing, or training data. The real experiments in Section VI-B do not close this gap: for each participant the authors optimize against the same model that is later evaluated (Table II), so the reported MAE increases could be an artifact of same-model overfitting. The paper should include transferability experiments across architectures, retrained models, or at least a random-frequency control and a universal perturbation, to support the claim that arbitrary unauthorized radar models are deceived.","section":"Section IV, Algorithm 1, and Section VI-B"},{"comment":"The real-device evaluation reports aggregate MAE from five participants with no per-participant results, no error bars or confidence intervals, and no statistical tests; the ground-truth smartwatch is not validated and no control conditions (e.g., motor off, static reflector, different wrist positions) are described. With n=5, the degradation could be dominated by a single participant. The conclusion that anti-sensing is a 'practical solution' requires participant-level data, measures of variability, and paired significance tests.","section":"Section VI-B, Table II"},{"comment":"The simulation evaluation uses a sleep dataset from two participants (Section VI-A1) but reports only aggregate MAE for four models without describing the train/test split, the number of segments, or per-subject variability. Given the small sample, the reported increases in MAE (e.g., ResNet-18 from 2.67 to 5.35 bpm) need confidence intervals or per-subject breakdowns before they can be interpreted as robust evidence.","section":"Section VI-A, Table I"}],"minor_comments":[{"comment":"Equation (5) and Algorithm 1 use inconsistent indices: δ_{i,j,k}(A_opt,f_opt) in Equation (5) versus δ_{i,j}(A_opt,f_opt) in step 5; please make the index conventions consistent and define i, j, and k.","section":"Section IV, Algorithm 1"},{"comment":"Algorithm 1 initializes f_opt randomly in [f_min,f_max] and runs a single gradient-descent trajectory; the paper should specify the number of restarts or seeds and report sensitivity to initialization.","section":"Section IV, Algorithm 1"},{"comment":"The statement that 'the rest of the models perform very poorly, even without anti-sensing; hence, the results are not included' is selective reporting; please report results for all evaluated models or provide a pre-registered exclusion criterion.","section":"Section VI-B"},{"comment":"Figure 2 compares synthetic and real radargrams only qualitatively; please report the simulation parameters (amplitude, distance, SNR) and include a quantitative similarity measure.","section":"Section III, Figure 2"},{"comment":"The term offsets[k] in Equation (3) is not defined; clarify how multiple targets and the target's range bin are represented.","section":"Section III, Equation (3)"},{"comment":"The sentence reporting mean differences as -5.30, 4.91, 12.55, and 8.40 mixes negative and positive biases; please interpret as absolute deviations or report signed bias consistently.","section":"Section VI-A"}],"recommendation":"major_revision","confidential_remarks":"The paper is a promising proof-of-concept, but the white-box/transferability gap is central to the unauthorized-sensing claim. I recommend a major revision requesting cross-model transferability experiments, a random-frequency control, and participant-level statistics. The 'unauthorized sensing' framing should either be softened or supported with black-box evidence."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe thing to know about this paper: it's a physically realizable wearable oscillator that jams UWB radar heart-rate estimation, and the authors show with both simulated and real-motor experiments that known models' MAE goes up. That combination is new. IR-Shield and RF-Protect work on FMCW/mmWave; this targets UWB vital signs, and the device is a cheap servo with a copper-wrapped reflector. The gradient-based optimization of frequency and amplitude under physiological constraints is sensible, and the simulation-to-hardware transition is more than most adversarial-physical papers do.\n\nThe paper earns credit for being explicit about the white-box assumption: Algorithm 1 takes the exact model h_theta and a target HR as inputs. That is also the soft spot. The stated scenario is unauthorized sensing by an unknown radar operator, but the defense requires knowing the adversary's model, training, and preprocessing. The real-device evaluation optimizes per participant against the same models being tested; there is no transferability test to an unseen architecture, no retrained model, and no random-frequency control. Without that, the MAE rises in Table II may be partly an artifact of tuning to the exact evaluator. That is a load-bearing gap for the privacy claim.\n\nSmaller issues: five participants, no error bars or statistical tests, no per-subject breakdown. The CNN 1D+2D baseline at 9.24 bpm on real data is already poor; the paper says \"rest of models perform very poorly\" and omits them, which is honest but thin.\n\nThe math and signal generation are physically motivated, and the citation pattern is honest — they cite the prior countermeasures and distinguish UWB's ToF behavior. No circular derivation; this is standard white-box attack evaluation.\n\nWho is this for: radar-privacy researchers and adversarial-machine-learning people who care about physical perturbations. It deserves a serious referee, but the authors should add transferability/black-box experiments, a random control, and statistics before the privacy claim can stand. I'd accept it for review with the expectation of major revision.\n\nRecommendation: send it to peer review, but the white-box requirement and missing controls are the main things to push on.","headline":"A wearable oscillator that physically jams UWB radar heart-rate estimation is a genuinely new combination, but the privacy claim outruns the white-box threat model the paper actually tests.","tokens_in":10751,"tokens_out":2082,"would_cite":false,"duration_ms":21072,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Wearing an optimized oscillating reflector degrades UWB radar heart-rate estimates enough to conceal the true rate.","keywords":["UWB radar","vital sign privacy","adversarial perturbation","physical-world attack","heart rate estimation","wearable oscillator","gradient-based optimization","anti-sensing"],"falsifier":"Take the physical wrist-worn device tuned by Algorithm 1 against one heart-rate model, then point a UWB radar running a different, independently trained heart-rate estimator at the wearer: if the unseen model's mean absolute error stays near its no-device baseline (roughly 2-3 bpm), the defense fails in the realistic threat model.","tokens_in":9739,"feed_emoji":"🛡️","tokens_out":5146,"duration_ms":46911,"temperature":0.7,"pith_summary":"The paper tries to show that a person can defend their heart rate against unauthorized Ultra-Wideband (UWB) radar sensing by wearing a small motorized reflector that vibrates at a carefully chosen frequency and amplitude. The oscillation is designed to mimic genuine cardiac motion, so the radar's heart-rate estimator locks onto a false rate instead of the wearer's real one. In simulations on sleep-clinic radar data the approach roughly doubles to triples the mean absolute error of several neural-network heart-rate models, and a physical servo-motor prototype produces comparable degradation: on real data, FFT-based estimation error rises from 2.42 to 8.17 bpm, ResNet-50 from 2.93 to 7.23 bpm, and a CNN from 9.24 to 17.56 bpm. If the method holds, it offers a practical, wearable privacy defense in settings where radar can otherwise read vital signs without consent.","feed_headline":"Wrist-worn motor hides heart rate from ultra-wideband radar","feed_subtitle":"Optimized oscillation triples heart-rate estimation error in real device tests, from about 2.4 to 8.2 bpm.","key_machinery":"The load-bearing machinery is the Sinusoidal Defense Algorithm (Algorithm 1), which parameterizes the perturbation as a synthetic radargram $\\delta_{i,j,k}(A_{\\mathrm{opt}}, f_{\\mathrm{opt}})$: a Gaussian-modulated sinusoidal pulse whose range-bin position $d_j$ moves sinusoidally at frequency $f_{\\mathrm{osc}}$ with spatial amplitude $A$. Because $d_j$ is a differentiable function of $f$ and $A$, gradient descent through the heart-rate model $h_\\theta$ can tune both parameters to maximize the loss toward a target heart rate $y$ while clipping keeps the motion inside physiological and spatial bounds. The perturbation is localized to the target's range bins and structured as a periodic waveform, so it acts like a second cardiac source that dominates the estimator's spectral readout.","core_discovery":"The central discovery is that a physically realizable oscillatory perturbation, generated by an off-the-shelf servo motor with a reflective load, can mislead UWB radar heart-rate estimators by inserting a structured sinusoidal signature into the range bins occupied by the target. The paper frames this as a targeted white-box adversarial attack on a regression model: Algorithm 1 backpropagates the model's loss against a chosen false heart rate to optimize the perturbation's frequency and spatial amplitude, subject to the constraint that the frequency stays in the physiologically plausible 50-100 bpm range and the amplitude stays within the target's spatial footprint. The optimized motion mimics natural cardiac motion so the estimator reports a plausible but wrong heart rate rather than rejecting the signal as noise. Real-device experiments with the motor worn on the wrist show the dominant FFT peak moves from the true heart rate to the motor's frequency, and all three evaluated models degrade in accuracy.","pith_inferences":["The paper's real-device tests optimize each participant's motor settings against the exact model being attacked; in a genuine unauthorized-sensing encounter the adversary's model is unknown, so the most direct test of practical value is whether perturbations optimized on one model transfer to another. The paper does not report such a transfer experiment.","A black-box variant, for example a small set of fixed oscillation frequencies near the wearer's estimated heart rate, could provide protection without gradient access, at the cost of targeting precision; this is a natural testable extension.","The same masking principle might generalize to protect breathing rate and other periodic physiological signals, since the paper's own spectrograms show respiratory harmonics competing with the injected tone."],"forward_implications":["Unauthorized radar systems that estimate heart rate from FFT peaks can be defeated: the dominant spectral peak shifts from the true heart rate to the motor frequency.","Deep-learning heart-rate estimators are also vulnerable: mean absolute error rises to 5-13 bpm on sleep-clinic data and to 7-18 bpm with the physical device, well beyond the 2-3 bpm baseline error.","Because the optimized frequency is confined to 50-100 bpm, the false signal stays inside the normal physiological range, so a naive noise filter will not remove it.","The same physical perturbation pipeline could be extended beyond heart rate, as the paper suggests, to other radar-based sensing tasks such as breathing-rate or gesture recognition."],"supporting_citations":[{"why":"Supplies the sleep-clinic dataset with simultaneous UWB radar and electrocardiography ground truth used for simulated perturbations.","marker":"[3]"},{"why":"Defines the P440 UWB radar hardware and the 9 mm per range-bin scale used in both the simulation and real-device experiments.","marker":"[29]"},{"why":"Provides the ResNet-18 and ResNet-50 architectures fine-tuned as heart-rate regression models and attacked in the evaluation.","marker":"[30]"},{"why":"Provides the CNN 1D+2D model used for heart-rate estimation in both simulation and real-device tests.","marker":"[31]"},{"why":"Provides the Vision Transformer architecture evaluated as a third heart-rate estimation model in the simulated perturbation study.","marker":"[32]"}],"fun_headline_variants":["Wearable motor jams radar heart rate sensing","Oscillating wristband fools radar vital sign monitors","Anti-sensing: wearable oscillator disrupts radar HR estimation","Servo-driven wristwear thwarts unauthorized radar vital sign tracking","Physically realizable oscillator blinds radar heart rate estimators"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense assumes the wearer has white-box access to the exact heart-rate model the radar operator uses, can compute gradients through it, and knows a target false heart rate; Algorithm 1 takes the model and target as inputs, and the real experiments tune the motor per participant against known models.","fun_headline_variants_meta":{"raw":{"variants":["Wearable motor jams radar heart rate sensing","Oscillating wristband fools radar vital sign monitors","Anti-sensing: wearable oscillator disrupts radar HR estimation","Servo-driven wristwear thwarts unauthorized radar vital sign tracking","Physically realizable oscillator blinds radar heart rate estimators"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00021,"raw_usage":{"total_tokens":1397,"prompt_tokens":919,"completion_tokens":478,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":535,"completion_tokens_details":{"reasoning_tokens":398}},"tokens_in":535,"tokens_out":478,"duration_ms":4516,"temperature":1.0,"reasoning_tokens":398,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T21:02:11.123542+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the physical wrist-worn device tuned by Algorithm 1 against one heart-rate model, then point a UWB radar running a different, independently trained heart-rate estimator at the wearer: if the unseen model's mean absolute error stays near its no-device baseline (roughly 2-3 bpm), the defense fails in the realistic threat model.","supporting_citations":[{"cited_title":"Eulerian phase-based motion magnification for high-fidelity vital sign estimation with radar in clinical settings,","cited_arxiv_id":null,"evidence_quote":"Supplies the sleep-clinic dataset with simultaneous UWB radar and electrocardiography ground truth used for simulated perturbations."},{"cited_title":"Pulson 440 uwb radar,","cited_arxiv_id":null,"evidence_quote":"Defines the P440 UWB radar hardware and the 9 mm per range-bin scale used in both the simulation and real-device experiments."},{"cited_title":"Portable uwb radar sensing system for transforming subtle chest movement into actionable micro-doppler signatures to extract respiratory rate exploiting resnet algorithm,","cited_arxiv_id":null,"evidence_quote":"Provides the ResNet-18 and ResNet-50 architectures fine-tuned as heart-rate regression models and attacked in the evaluation."},{"cited_title":"Convolutional neural networks for the real-time monitoring of vital signs based on impulse radio ultrawide-band radar during sleep,","cited_arxiv_id":null,"evidence_quote":"Provides the CNN 1D+2D model used for heart-rate estimation in both simulation and real-device tests."}],"review_version":1}