{"id":"5421cb9f-7b04-44fe-8c32-1345a878a138","arxiv_id":"2507.12211","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A dual-antenna passive LTE sensing system detects moving targets and estimates their speed by extracting the differential Doppler shift between two receivers.","lead":"Passive traffic sensing built from two antennas listening to ambient LTE phone signals reports detecting fast-moving targets and estimating rough speeds for pedestrians and cars. The approach uses the difference in Doppler shifts seen by the two antennas to cancel hardware noise, an idea borrowed from Wi-Fi sensing.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section 3.2's four-term expansion never justifies that the differential dynamic cross-term dominates after background subtraction; if static-dynamic cross-terms dominate, the phase derivative is not the differential Doppler and the speed estimates are unsupported.","rationale":"The reader's weakest assumption is the hardware-impairment identity C0(t,f) ≈ C1(t,f). That assumption is physically plausible here because both receiver chains share the same LimeSDR oscillator, and even a static per-antenna gain/phase mismatch would only contribute a constant phase that background subtraction can remove. The more load-bearing and less supported assumption is dominance of the differential dynamic cross-term over the static-dynamic cross-terms. The paper's own expansion in §3.2 makes this visible: only the static-static term is constant, and the static-dynamic terms oscillate at the individual Doppler frequencies ν0 and ν1. Nothing in §4.3 or §5 establishes that these terms are small relative to the desired ν1−ν0 term, and the outdoor measurements were taken in exactly the high-static, low-SNR regime where the assumption is weakest. I therefore disagree with the reader's choice of weakest assumption, though I share the CONDITIONAL verdict: the qualitative feasibility result is credible and the indoor dataset is substantial, but the outdoor quantitative speed estimates should not be accepted until the cross-term dominance is demonstrated. The proposed test does that directly without requiring code or data release.","tokens_in":20863,"tokens_out":9570,"duration_ms":126392,"concrete_test":"Take one controlled indoor constant-speed run with ground truth. Estimate the four-term model of §3.2 from the complex composite CSI (fit Hs,0, Hs,1, a0, a1, ν0, ν1, τ0, τ1 at the crossing instant), then compute the power ratio of the Δν=ν1−ν0 component to the ν0 and ν1 static-dynamic components. If the static-dynamic components are within 10 dB of the Δν component, run the full §4.3 pipeline and compare its phase-derivative output to the known speed: if the pipeline output tracks ν0/ν1 rather than the input Δν, the outdoor speed estimates in §6.2 are not supported by the stated model. This single test settles whether the dominance assumption is the reason the outdoor numbers appear plausible.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 3.2 expands H~ = H1 H0* into four terms, but background subtraction removes only the constant static-static term. The static-dynamic cross-terms Hs,1 a0* e^{-j2πν0 t} and Hs,0* a1 e^{j2πν1 t} still carry time-varying phase at ν0 and ν1, not at the claimed differential Doppler ν1−ν0. The desired dynamic-dynamic term scales as |a1||a0|, while these cross-terms scale as |Hs||a|; in roadside and parking scenarios the static/direct path is typically much stronger than the vehicle or pedestrian reflection. The paper lists 'vehicle echo strong enough to be discerned' as a condition, and the conclusion says predominance relies on background subtraction and relative dynamic strength, but no measurement, ablation, or synthetic check quantifies |Hs|/|a| or shows that the Δν component survives subcarrier averaging and normalization. If the static-dynamic terms dominate, the unwrapped phase derivative computed in §4.3 step 6 evolves at ν0 or ν1 instead of ν1−ν0, so the speed formula vx ≈ −Δν λ Rm / (2(xc−x0)) is applied to the wrong quantity. The indoor setup, with a reflector only 5–15 cm from the antennas, may satisfy the dominance condition, but the outdoor speed estimates in §6.2 — the core of the 'reliable speed estimation' claim — are exactly where the static path is strongest and the condition is least verified.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents a passive traffic-sensing system that uses a dual-receiver software-defined radio to acquire LTE downlink CSI, multiplies the CSI of the two receivers to cancel common hardware impairments, and extracts a differential Doppler signal that is related to target velocity. The theoretical framework is based on Bello's time-variant channel model, and the processing pipeline includes normalization, subcarrier averaging, phase unwrapping, background subtraction, Savitzky-Golay filtering, and differentiation. The system is evaluated in a controlled indoor room with a moving reflector (239 trajectories for detection, 751 for speed classification) and in two outdoor scenarios (a parking area with pedestrians and a roadside with vehicles). The paper reports detection rates above 90% for speeds above 6000 mm/min in the controlled indoor tests and provides a few qualitative outdoor speed estimates.","tokens_in":21153,"tokens_out":5897,"duration_ms":63939,"significance":"If the central claims hold, the paper demonstrates a low-cost, passive approach to vehicle and pedestrian detection using ambient LTE signals, with clear relevance to ISAC and smart-infrastructure applications. The strengths of the manuscript include a concrete dual-receiver channel model, a transparent step-by-step signal-processing pipeline, and a quantitative indoor evaluation with detection rate and false-positive rate reported for 239 trajectories. The use of open-source srsRAN software and commodity SDR hardware supports reproducibility. However, the outdoor evidence is limited to six qualitative speed estimates without ground truth, the speed-estimation formula contains a factor-of-2π inconsistency, and the assumed dominance of the differential dynamic cross-term over static-dynamic cross-terms is not demonstrated. The indoor results are the only statistically solid part of the paper.","major_comments":[{"comment":"Equation (5) is inconsistent with the speed formula derived in Section 3.2 and with the definition of vΔ in Section 4.3. Section 3.2 gives vx ≈ -Δν λ Rm / (2(xc-x0)), and Section 4.3 defines vΔ(t) = λ/(2π) Δν(t). Substituting these definitions into Eq. (5) shows that a factor of 2π is missing. For example, the reported pedestrian speed of 3.095 m/s would become about 19.45 m/s if the factor 2π were included, which is implausible; conversely, if vΔ is meant to be a phase derivative in units of mm/s, the notation and derivation are not explained. Please correct the formula and re-derive all outdoor speed estimates, or explicitly state the units and the physical meaning of vΔ.","section":"6.2, Eq. (5)"},{"comment":"The claim that the differential dynamic cross-term a1 a0* e^{j2π(ν1-ν0)t} dominates after background subtraction is asserted but not demonstrated. The static-dynamic cross-terms Hs,1 a0* e^{-j2πν0 t} and Hs,0* a1 e^{j2πν1 t} carry time-varying phases at ν0 and ν1, respectively, and they are not removed by the background-subtraction step described in Section 4.3, which subtracts a constant or slowly varying phase offset. The paper states that suppression is 'achieved via background subtraction techniques' and lists the condition 'the vehicle echo is strong enough to be discerned,' but no measurement, ablation, or synthetic check quantifies |Hs|/|a| or demonstrates that the Δν component survives subcarrier averaging and normalization. In the outdoor scenarios the static or direct path is typically much stronger than the target echo, so the phase derivative computed in Section 4.3 step 6 may track ν0 or ν1 rather than Δν, which would invalidate Eq. (5). Please provide a quantitative analysis of the relative magnitudes of the four terms in at least one indoor and one outdoor measurement, for example via spectrograms or by comparing the phase derivative against the expected differential Doppler.","section":"3.2, expansion of H~"},{"comment":"The abstract's statement that 'the system demonstrated over 90% detection accuracy' is not supported by the reported metrics. Section 5.2 defines Detection Rate as sensitivity (TP/(TP+FN)), not accuracy, and Figure 12 reports DR of 96.8% at 6000 mm/min and 91.9% at 10000 mm/min, with corresponding FPR of 3.2% and 8.1%. The overall DR across all speeds is 82.0%. Reporting sensitivity as 'accuracy' overstates performance, especially because FPR is non-negligible and the paper itself notes that some false positives may be correct detections that are slightly offset from the ground-truth timestamps. Please report accuracy, precision, F1, and ROC curves, or explicitly state that the metric is sensitivity and give the accompanying FPR in the abstract.","section":"Abstract and Section 6.1, Fig. 12"},{"comment":"The dual-receiver calibration relies on the assumption C0(t,f) ≈ C1(t,f) ≈ C(t,f), but the paper provides no validation of this assumption for the two RF chains of the LimeSDR. If the two chains have different phase noise, carrier frequency offset, sampling frequency offset, or I/Q imbalance, the conjugate multiplication does not reduce C to |C|² but leaves a residual complex exponential that corrupts the extracted differential phase. This is load-bearing because the speed estimate depends directly on a clean differential Doppler. Please include a calibration measurement under static conditions that quantifies the residual phase error after conjugate multiplication, or justify the assumption with hardware specifications and a sensitivity analysis.","section":"3.2, assumption C0≈C1"}],"minor_comments":[{"comment":"The caption and the text disagree on which panel is intra-measurement and which is inter-measurement: the caption labels (a) intra and (b) inter, while the text refers to Figure 13b as intra and Figure 13a as inter. Please clarify.","section":"Figure 13"},{"comment":"There is a typo in 'where environmental and processing conditions conditions remain constant'; remove the duplicated word.","section":"5.2"},{"comment":"'extense' should be 'extensive' in the opening sentence of the conclusion.","section":"Section 9"},{"comment":"The units of vΔ are unclear: the text gives values such as vΔ = 201 mm/s, but Section 4.3 defines vΔ with units of velocity (m/s if Δν is in Hz and λ in meters), and the subsequent computation mixes mm/s and meters. Please state the units explicitly and define how vΔ is obtained from the unwrapped phase in each experiment.","section":"6.2"},{"comment":"Figure 3 appears to be identical to Figure 1 (both are described as 'Passive vehicle detection scenario illustration'); please renumber or remove the duplicate.","section":"Figure 3"}],"recommendation":"major_revision","confidential_remarks":"The manuscript reads as a student project report rather than a fully polished journal article, but the topic is timely and the core processing pipeline is described in detail. The most serious technical issues are the missing factor of 2π in the outdoor speed formula and the unverified dominance of the differential dynamic cross-term; both directly affect the main claims of 'reliable speed estimation.' The outdoor evaluation is far too small (six speed estimates, no ground truth) to support the abstract's claim of reliable outdoor estimates, but this could be addressed by reporting the indoor results as the primary validation and treating the outdoor results as anecdotal. I would advise the editor to require a corrected derivation, a quantitative cross-term analysis, and a proper reporting of detection metrics before considering the paper further."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Saúl Fenollosa's report is a genuine feasibility study: a dual-receiver LTE CSI pipeline built with srsRAN and a LimeSDR, with indoor experiments showing the differential Doppler idea works in a controlled room. The novelty is modest — the CSI-ratio trick is borrowed from Wi-Fi sensing — but applying it to ambient LTE for traffic detection, with the crossing-peak estimator, is a legitimate new application. The paper is transparent about its limitations.\n\nThe problems are in the quantitative claims. First, the abstract says 'detection accuracy' but the metrics are detection rate (sensitivity) and false positive rate; over 90% DR is not over 90% accuracy. Second, there is a factor-2π inconsistency between the Section 3.2 derivation and Eq. (5) in Section 6.2. The pipeline defines vΔ = λ/(2π)Δν, and plugging that into Eq. (5) makes the outdoor speeds 2π smaller than the derivation gives. The pedestrian and vehicle speeds look plausible only because of that missing factor. That is a load-bearing error.\n\nThe stress-test note is also on target. Background subtraction removes only the static-static product; the static-dynamic cross-terms still oscillate at ν0 or ν1, not at Δν. The paper lists conditions for the dynamic-dynamic term to dominate but gives no measurement or synthetic check of |Hs|/|a|. Indoors, with the reflector 5–15 cm away, the condition may hold. Outdoors, where the static path is strongest and the speed estimates are claimed, it is the least verified. The 'reliable speed estimation' claim is unsupported as written.\n\nThe outdoor evaluation has tiny samples and no ground truth, and no code or data is shipped. Per-session thresholds further limit reproducibility.\n\nThe paper earns credit for a reasonably large indoor dataset (239 detection runs, 751 classification runs), a step-by-step processing pipeline, and honest discussion of failure modes at low speed and under multipath.\n\nWho is this for? Someone wanting a hands-on feasibility reference for LTE CSI sensing, not someone needing trustworthy speed numbers. I would not cite the speed estimates. But I would send the work to a serious referee rather than desk reject it, because a reviewer can push the authors to correct the formula, release data, and verify the dominance condition. The abstract's numbers should not be quoted until that happens.","headline":"A transparent LTE dual-receiver CSI feasibility study with a solid indoor demo, but the outdoor speed estimates hinge on a factor-2π slip and an unverified cross-term dominance assumption.","tokens_in":21707,"tokens_out":7526,"would_cite":false,"duration_ms":75325,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A passive dual-receiver LTE setup can detect moving pedestrians and vehicles and estimate their speeds from differential Doppler shifts in ambient cellular signals, with over 90% detection accuracy above 6000 mm/min in controlled tests.","keywords":["passive sensing","LTE CSI","dual-receiver differential Doppler","traffic detection","Doppler speed estimation","software-defined radio","integrated sensing and communication"],"falsifier":"Feed the same RF signal into both receiver inputs through a power splitter so no true differential Doppler exists; any phase trajectory remaining after the pipeline is pure hardware mismatch. If that residual is comparable to the phase signature of a 6000 mm/min crossing, the cancellation assumption fails. Alternatively, repeat the indoor low-speed test at 2000 mm/min across sessions and check whether the reported 62.2% detection rate is stable, since the paper identifies low speeds as the regime where the dynamic echo drowns in static clutter.","tokens_in":20616,"feed_emoji":"📡","tokens_out":10130,"duration_ms":104136,"temperature":0.7,"pith_summary":"The paper tries to establish that ambient LTE signals, already broadcast by cellular base stations, can be turned into a passive traffic sensor: two receiver antennas capture Channel State Information (CSI), and multiplying one receiver's CSI by the conjugate of the other cancels common hardware phase errors, leaving a clean differential Doppler signature from moving targets. If this works, traffic monitoring would not need cameras, radar, or embedded road sensors, only a low-cost software-defined radio listening to the existing cellular downlink. The reported evidence is a complete processing pipeline plus measurements: over 90% detection rate for reflector speeds above 6000 mm/min in a controlled indoor setup, and physically plausible speed estimates for pedestrians and vehicles outdoors, with known weaknesses at low speeds, directional ambiguity, and multipath.","feed_headline":"LTE Doppler sensing tops 90% detection for speeds above 6000 mm/min","feed_subtitle":"Two passive receivers cancel hardware noise and estimate vehicle speed from ambient cellular signals.","key_machinery":"The load-bearing object is the composite channel $\\tilde{H}(t,f)=\\hat{H}_1(t,f)\\,\\hat{H}_0^*(t,f)$, the product of the two receivers' estimated channels with one conjugated. Under the assumption $C_0 \\approx C_1 \\approx C$, this multiplication turns common hardware impairments into the real factor $|C(t,f)|^2$ and exposes a differential dynamic cross-term whose phase, after normalization, subcarrier averaging, unwrapping, background subtraction, and smoothing, differentiates into the instantaneous differential Doppler $\\Delta\\nu(t)=\\nu_1(t)-\\nu_0(t)$. At the moment a reflector crosses the midpoint of the antenna baseline, this differential Doppler reaches a peak whose value feeds the speed estimate $v_x \\approx -\\Delta\\nu(x_c)\\,\\lambda R_m / (2(x_c-x_0))$.","core_discovery":"The central discovery is that the differential Doppler shift between two closely spaced receivers, extracted by conjugate-multiplying their CSI, is a usable proxy for a target crossing the antenna baseline, and its time-derivative yields speed. In the model, the hardware impairment term $C(t,f)$, which corrupts single-receiver phase, becomes $|C(t,f)|^2$ after multiplication, a real scaling factor; the surviving signal carries the term $a_1 a_0^* e^{j2\\pi(\\nu_1-\\nu_0)t} e^{-j2\\pi f(\\tau_1-\\tau_0)}$. The differential Doppler peaks when the reflector crosses the midpoint of the two antennas, and the peak value gives $v_x \\approx -\\Delta\\nu(x_c)\\,\\lambda R_m / (2(x_c-x_0))$. The paper reports that this peak is detectable in practice and that the estimated speeds fall in physically reasonable ranges for pedestrians and vehicles.","pith_inferences":["A testable extension would be to sweep the antenna separation and measure residual phase noise after conjugate multiplication, which would map how far the common-impairment assumption holds.","The speed formula assumes a known reflector distance $R_m$ from the baseline midpoint, so in multilane roads the same differential Doppler could correspond to very different true speeds; fusing angle-of-arrival or range information is a natural next step the paper leaves implicit.","If the method is correct, low-cost roadside receivers could act as traffic-counting nodes for smart-city applications, but the 62.2% detection rate at 2000 mm/min suggests that pedestrian and bicycle speeds will need denser antenna arrays or learning-based separation of static and dynamic components."],"forward_implications":["At 6000 mm/min the controlled indoor detection rate is 96.8%, and at 10000 mm/min it is 91.9%, while at 2000 mm/min it drops to 62.2%.","The same pipeline yields speed estimates without knowing the target's identity: outdoor estimates for pedestrians were about 6.8-11.1 km/h and for vehicles about 32.5-43.7 km/h.","Direction of motion is encoded in the sign of the differential Doppler, but the paper's outdoor data show that the sign is not always consistent, so direction cannot yet be trusted in real conditions.","Because the sensing is passive and uses the existing LTE downlink, each additional monitoring point needs only a receiver; the practical limits are synchronization, multipath, and per-site calibration rather than transmitter cost."],"supporting_citations":[{"why":"Establishes the delay-Doppler representation of time-variant channels that the single-receiver CSI model builds on.","marker":"[21]"},{"why":"Demonstrates the differential CSI/ratio technique that the conjugate-multiplication step extends to passive LTE sensing.","marker":"[12]"},{"why":"Supplies the passive-LTE detection baseline and the background-subtraction step used to remove static clutter.","marker":"[15]"},{"why":"Provides the CSI-to-speed relationship and a detection benchmark for motion-speed estimation.","marker":"[13]"},{"why":"Shows a comparable dual-antenna differential strategy for weak vital-sign signals, supporting its use for stronger vehicle echoes.","marker":"[22]"}],"fun_headline_variants":["Passive LTE radar catches traffic with 90% accuracy","Two receivers, one Doppler trick: speed from ambient LTE","LTE Doppler sensing: 90% detection for moving targets","Cellular signals reveal traffic speeds via differential Doppler","90% accuracy: LTE passive sensing for traffic monitoring"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the two receivers' hardware impairments are effectively identical, $C_0(t,f) \\approx C_1(t,f) \\approx C(t,f)$, so that conjugate multiplication cancels phase errors and leaves only $|C(t,f)|^2$ as a real scaling factor.","fun_headline_variants_meta":{"raw":{"variants":["Passive LTE radar catches traffic with 90% accuracy","Two receivers, one Doppler trick: speed from ambient LTE","LTE Doppler sensing: 90% detection for moving targets","Cellular signals reveal traffic speeds via differential Doppler","90% accuracy: LTE passive sensing for traffic monitoring"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000229,"raw_usage":{"total_tokens":1444,"prompt_tokens":879,"completion_tokens":565,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":495,"completion_tokens_details":{"reasoning_tokens":486}},"tokens_in":495,"tokens_out":565,"duration_ms":7276,"temperature":1.0,"reasoning_tokens":486,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T16:51:26.393759+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Feed the same RF signal into both receiver inputs through a power splitter so no true differential Doppler exists; any phase trajectory remaining after the pipeline is pure hardware mismatch. If that residual is comparable to the phase signature of a 6000 mm/min crossing, the cancellation assumption fails. Alternatively, repeat the indoor low-speed test at 2000 mm/min across sessions and check whether the reported 62.2% detection rate is stable, since the paper identifies low speeds as the regime where the dynamic echo drowns in static clutter.","supporting_citations":[{"cited_title":"Vehicle detection and classification using lte-commsense,","cited_arxiv_id":null,"evidence_quote":"Supplies the passive-LTE detection baseline and the background-subtraction step used to remove static clutter."},{"cited_title":"Understandingandmodeling of wifi signal based human activity recognition,","cited_arxiv_id":null,"evidence_quote":"Provides the CSI-to-speed relationship and a detection benchmark for motion-speed estimation."}],"review_version":1}