Pith. sign in

REVIEW 3 major objections 6 minor 32 references

Anti-Sensing: Defense against Unauthorized Radar-based Human Vital Sign Sensing with Physically Realizable Wearable Oscillators

T0 review · 3 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Wearing an optimized oscillating reflector degrades UWB radar heart-rate estimates enough to conceal the true rate.

desk verdict A wearable oscillator that physically jams UWB radar heart-rate estimation is a genuinely new combination, but the privacy claim outruns the white-box threat model the paper actually tests. read the letter →

arxiv 2505.10864 v1 pith:D5IKH4WQ submitted 2025-05-16 cs.HC cs.CR

Md Farhan Tasnim Oshim , Nigel Doering , Bashima Islam , Tsui-Wei Weng , Tauhidur Rahman This is my paper · ORCID
classification cs.HCcs.CR
keywords UWBradarvitalsignprivacyadversarialperturbationphysical-worldattackheartrateestimationwearableoscillatorgradient-basedoptimizationanti-sensing
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to show that a person can defend their heart rate against unauthorized Ultra-Wideband (UWB) radar sensing by wearing a small motorized reflector that vibrates at a carefully chosen frequency and amplitude. The oscillation is designed to mimic genuine cardiac motion, so the radar's heart-rate estimator locks onto a false rate instead of the wearer's real one. In simulations on sleep-clinic radar data the approach roughly doubles to triples the mean absolute error of several neural-network heart-rate models, and a physical servo-motor prototype produces comparable degradation: on real data, FFT-based estimation error rises from 2.42 to 8.17 bpm, ResNet-50 from 2.93 to 7.23 bpm, and a CNN from 9.24 to 17.56 bpm. If the method holds, it offers a practical, wearable privacy defense in settings where radar can otherwise read vital signs without consent.

What carries the argument

The load-bearing machinery is the Sinusoidal Defense Algorithm (Algorithm 1), which parameterizes the perturbation as a synthetic radargram $\delta_{i,j,k}(A_{\mathrm{opt}}, f_{\mathrm{opt}})$: a Gaussian-modulated sinusoidal pulse whose range-bin position $d_j$ moves sinusoidally at frequency $f_{\mathrm{osc}}$ with spatial amplitude $A$. Because $d_j$ is a differentiable function of $f$ and $A$, gradient descent through the heart-rate model $h_\theta$ can tune both parameters to maximize the loss toward a target heart rate $y$ while clipping keeps the motion inside physiological and spatial bounds. The perturbation is localized to the target's range bins and structured as a periodic waveform, so it acts like a second cardiac source that dominates the estimator's spectral readout.

What would settle it

Take the physical wrist-worn device tuned by Algorithm 1 against one heart-rate model, then point a UWB radar running a different, independently trained heart-rate estimator at the wearer: if the unseen model's mean absolute error stays near its no-device baseline (roughly 2-3 bpm), the defense fails in the realistic threat model.

Watch

Extended reading notes

Core claim

The central discovery is that a physically realizable oscillatory perturbation, generated by an off-the-shelf servo motor with a reflective load, can mislead UWB radar heart-rate estimators by inserting a structured sinusoidal signature into the range bins occupied by the target. The paper frames this as a targeted white-box adversarial attack on a regression model: Algorithm 1 backpropagates the model's loss against a chosen false heart rate to optimize the perturbation's frequency and spatial amplitude, subject to the constraint that the frequency stays in the physiologically plausible 50-100 bpm range and the amplitude stays within the target's spatial footprint. The optimized motion mimics natural cardiac motion so the estimator reports a plausible but wrong heart rate rather than rejecting the signal as noise. Real-device experiments with the motor worn on the wrist show the dominant FFT peak moves from the true heart rate to the motor's frequency, and all three evaluated models degrade in accuracy.

Load-bearing premise

The defense assumes the wearer has white-box access to the exact heart-rate model the radar operator uses, can compute gradients through it, and knows a target false heart rate; Algorithm 1 takes the model and target as inputs, and the real experiments tune the motor per participant against known models.

Editorial extensions

If this is right

  • Unauthorized radar systems that estimate heart rate from FFT peaks can be defeated: the dominant spectral peak shifts from the true heart rate to the motor frequency.
  • Deep-learning heart-rate estimators are also vulnerable: mean absolute error rises to 5-13 bpm on sleep-clinic data and to 7-18 bpm with the physical device, well beyond the 2-3 bpm baseline error.
  • Because the optimized frequency is confined to 50-100 bpm, the false signal stays inside the normal physiological range, so a naive noise filter will not remove it.
  • The same physical perturbation pipeline could be extended beyond heart rate, as the paper suggests, to other radar-based sensing tasks such as breathing-rate or gesture recognition.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's real-device tests optimize each participant's motor settings against the exact model being attacked; in a genuine unauthorized-sensing encounter the adversary's model is unknown, so the most direct test of practical value is whether perturbations optimized on one model transfer to another. The paper does not report such a transfer experiment.
  • A black-box variant, for example a small set of fixed oscillation frequencies near the wearer's estimated heart rate, could provide protection without gradient access, at the cost of targeting precision; this is a natural testable extension.
  • The same masking principle might generalize to protect breathing rate and other periodic physiological signals, since the paper's own spectrograms show respiratory harmonics competing with the injected tone.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The manuscript proposes Anti-Sensing, a defense against unauthorized UWB radar heart-rate estimation. It models a wearable oscillating reflector as a structured, localized sinusoidal perturbation on radargrams, and uses a gradient-based white-box targeted attack (Algorithm 1) to optimize oscillation frequency and amplitude under physiological constraints. The authors evaluate the approach in simulation on a two-participant sleep dataset with ResNet-18/50, CNN 1D+2D, and ViT, and in hardware with a servo motor on five participants with FFT, ResNet-50, and CNN 1D+2D. Both evaluations report increases in mean absolute error (MAE) when anti-sensing is active, with the largest real-device effect being CNN 1D+2D from 9.24 to 17.56 bpm.

Significance. The idea of using physically realizable oscillatory motion to create structured radar perturbations is novel and relevant to privacy in radar sensing. The synthetic radargram model paired with a real pendulum comparison (Figure 2) is a useful validation step, and the wearable prototype demonstrates that the perturbation is physically implementable. If transferability to unseen models and statistical robustness are established, the method would be a meaningful contribution to physical-layer defenses for contactless sensing.

major comments (3)
  1. [Section IV, Algorithm 1, and Section VI-B] The defense as formulated requires white-box access to the adversary's exact heart-rate model h_theta, because Algorithm 1 computes gradients through h_theta and takes y as input, and the text explicitly describes it as 'a white-box targeted attack requiring knowledge of the vital sign model' (Section IV). The unauthorized-sensing scenario implies the wearer does not know the radar operator's model, preprocessing, or training data. The real experiments in Section VI-B do not close this gap: for each participant the authors optimize against the same model that is later evaluated (Table II), so the reported MAE increases could be an artifact of same-model overfitting. The paper should include transferability experiments across architectures, retrained models, or at least a random-frequency control and a universal perturbation, to support the claim that arbitrary unauthorized radar models are deceived.
  2. [Section VI-B, Table II] The real-device evaluation reports aggregate MAE from five participants with no per-participant results, no error bars or confidence intervals, and no statistical tests; the ground-truth smartwatch is not validated and no control conditions (e.g., motor off, static reflector, different wrist positions) are described. With n=5, the degradation could be dominated by a single participant. The conclusion that anti-sensing is a 'practical solution' requires participant-level data, measures of variability, and paired significance tests.
  3. [Section VI-A, Table I] The simulation evaluation uses a sleep dataset from two participants (Section VI-A1) but reports only aggregate MAE for four models without describing the train/test split, the number of segments, or per-subject variability. Given the small sample, the reported increases in MAE (e.g., ResNet-18 from 2.67 to 5.35 bpm) need confidence intervals or per-subject breakdowns before they can be interpreted as robust evidence.
minor comments (6)
  1. [Section IV, Algorithm 1] Equation (5) and Algorithm 1 use inconsistent indices: δ_{i,j,k}(A_opt,f_opt) in Equation (5) versus δ_{i,j}(A_opt,f_opt) in step 5; please make the index conventions consistent and define i, j, and k.
  2. [Section IV, Algorithm 1] Algorithm 1 initializes f_opt randomly in [f_min,f_max] and runs a single gradient-descent trajectory; the paper should specify the number of restarts or seeds and report sensitivity to initialization.
  3. [Section VI-B] The statement that 'the rest of the models perform very poorly, even without anti-sensing; hence, the results are not included' is selective reporting; please report results for all evaluated models or provide a pre-registered exclusion criterion.
  4. [Section III, Figure 2] Figure 2 compares synthetic and real radargrams only qualitatively; please report the simulation parameters (amplitude, distance, SNR) and include a quantitative similarity measure.
  5. [Section III, Equation (3)] The term offsets[k] in Equation (3) is not defined; clarify how multiple targets and the target's range bin are represented.
  6. [Section VI-A] The sentence reporting mean differences as -5.30, 4.91, 12.55, and 8.40 mixes negative and positive biases; please interpret as absolute deviations or report signed bias consistently.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the optimized oscillation is a white-box attack parameter, not a derived prediction, and the reported MAE comes from external radar recordings.

full rationale

The paper's derivation chain is a forward radar model (Eqs. 2-3) and a gradient-based optimizer (Algorithm 1, Eq. 6) that fits free parameters f_opt and A_opt to maximize loss on a specified model h_theta. The reported degradation in Tables I and II is measured on real radar data and physical motor oscillations, not computed from the optimization objective, so the MAE increase is an empirical outcome rather than an algebraic consequence of the inputs. The white-box condition is disclosed in Section IV ('a white-box targeted attack requiring knowledge of the vital sign model'), which limits the unauthorized-sensing claim but is not circular: the paper never asserts black-box protection. The self-citations [2] and [3] supply an independently collected sleep-clinic dataset and prior radar processing; they are not an unverified theorem or a premise containing the conclusion, so they do not make the derivation circular. No load-bearing self-citation chain, ansatz-smuggling, or renaming of a known result was found.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on a synthetic radar model used for both simulation and perturbation generation, on linear additivity of the physical reflector's signal, and on white-box access to the target sensing model. No new theoretical entities are postulated; the octahedral reflector and servo are physical artifacts. The optimized frequency and amplitude are the main fitted parameters.

free parameters (4)
  • f_opt (optimized servo oscillation frequency) = Not reported per participant; example shown at ~98 rpm in Fig. 6
    Chosen by gradient descent in Algorithm 1 to maximize the target model's loss; central to the claimed disruption and varies per model and subject.
  • A_opt (spatial oscillation amplitude) = Not reported; set by mounting arm length
    Optimized jointly with f_opt and constrained to 25 range bins; physically adjusted by changing the reflector arm length.
  • epsilon_A spatial amplitude budget = 25 range bins (~22.5 cm)
    Hand-chosen constraint based on an assumed 46 cm human torso width and 9 mm range-bin scale; bounds the attack but is arbitrary and not derived.
  • epsilon_hr physiological frequency range = 50 to 100 bpm
    Chosen so that the fake heart rate appears physiologically plausible; not based on data presented in this paper.
assumptions (5)
  • domain assumption UWB radar scan of a point target is modeled as a Gaussian-modulated sinusoid with sinusoidal range motion (Eqs. 2-3).
    The synthetic radargram and the perturbation generator both rely on this model; if the actual radar reflection physics differs substantially (e.g., saturation, multipath), simulated perturbation fidelity is affected.
  • domain assumption The perturbation adds linearly to the received radargram (x' = x + delta).
    Algorithm 1 step 5 assumes a metal reflector's reflection can be injected by addition to raw radar scans; linear superposition is plausible but unverified in the hardware experiments.
  • ad hoc to paper The defended user has white-box access to the adversary's heart-rate model h_theta and can compute gradients through it, plus knows a target label y.
    Algorithm 1 requires h_theta and y as inputs; the paper frames the device as a privacy defense for users facing unauthorized sensing, yet in realistic scenarios the user may not know the adversary's model.
  • domain assumption Normal heart-rate range is 50 to 100 bpm, and estimates outside this range would be discarded as noise.
    Used to clip f_opt and to justify the physiological plausibility constraint; unsupported by this paper's data.
  • domain assumption Human torso width is about 46 cm, translating to roughly 50 range bins at 9 mm per bin.
    Used to set the spatial amplitude budget epsilon_A to 25 bins; cited to the P440 radar specification [29].

how reviews work

0 comments
Cite this review

Pith. "Pith review of Anti-Sensing: Defense against Unauthorized Radar-based Human Vital Sign Sensing with Physically Realizable Wearable Oscillators." pith.science (2026). https://pith.science/paper/D5IKH4WQ

@misc{pith2026250510864,
  author       = {Pith},
  title        = {Pith review of: Anti-Sensing: Defense against Unauthorized Radar-based Human Vital Sign Sensing with Physically Realizable Wearable Oscillators},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/D5IKH4WQ}},
  note         = {Machine review of arXiv:2505.10864}
}
read the original abstract

Recent advancements in Ultra-Wideband (UWB) radar technology have enabled contactless, non-line-of-sight vital sign monitoring, making it a valuable tool for healthcare. However, UWB radar's ability to capture sensitive physiological data, even through walls, raises significant privacy concerns, particularly in human-robot interactions and autonomous systems that rely on radar for sensing human presence and physiological functions. In this paper, we present Anti-Sensing, a novel defense mechanism designed to prevent unauthorized radar-based sensing. Our approach introduces physically realizable perturbations, such as oscillatory motion from wearable devices, to disrupt radar sensing by mimicking natural cardiac motion, thereby misleading heart rate (HR) estimations. We develop a gradient-based algorithm to optimize the frequency and spatial amplitude of these oscillations for maximal disruption while ensuring physiological plausibility. Through both simulations and real-world experiments with radar data and neural network-based HR sensing models, we demonstrate the effectiveness of Anti-Sensing in significantly degrading model accuracy, offering a practical solution for privacy preservation.

Figures

Figures reproduced from arXiv: 2505.10864 by the authors.

Figure 1
Figure 1. Anti-Sensing Scenario: The left panel shows a radar system detecting an individual’s heart rate (85 bpm) without [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Comparison of synthetic radargram (left) and real [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. A programmable servo motor paired with a ESP 32 [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Comparison of Bland Altman Plots from Resnet [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 6
Figure 6. Figure 6: Sample comparison of HR measurement with (right [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 5
Figure 5. Figure 5: Comparison of Resnet-18, Resnet-50, CNN 1D+2D, [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 24 canonical work pages

  1. [1]

    Analysis of vital signs monitoring using an ir-uwb radar,

    A. Lazaro, D. Girbau, and R. Villarino, “Analysis of vital signs monitoring using an ir-uwb radar,” Progress In Electromagnetics Research, vol. 100, pp. 265–284, 2010

    work page 2010

  2. [2]

    Respiratory rate monitor- ing in clinical environments with a contactless ultra-wideband im- pulse radar-based sensor system,

    C. E. Goldfine, M. F. T. Oshim, S. P. Carreiro, B. P. Chap- man, D. Ganesan, and T. Rahman, “Respiratory rate monitor- ing in clinical environments with a contactless ultra-wideband im- pulse radar-based sensor system,” in Proceedings of the... Annual Hawaii International Conference on System Sciences. Annual Hawaii International Conference on System Scie...

    work page 2020

  3. [3]

    Eulerian phase-based motion magnification for high-fidelity vital sign estimation with radar in clinical settings,

    M. F. T. Oshim, T. Surti, C. Goldfine, S. Carreiro, D. Ganesan, S. Jaya- suriya, and T. Rahman, “Eulerian phase-based motion magnification for high-fidelity vital sign estimation with radar in clinical settings,” in 2022 IEEE Sensors. IEEE, 2022, pp. 1–4

    work page 2022

  4. [4]

    Deepvs: A deep learning approach for rf-based vital signs sensing,

    Z. Xie, H. Wang, S. Han, E. Schoenfeld, and F. Ye, “Deepvs: A deep learning approach for rf-based vital signs sensing,” in Proceedings of the 13th ACM international conference on bioinformatics, computational biology and health informatics, 2022, pp. 1–5

    work page 2022

  5. [5]

    Heart rate sensing with a robot mounted mmwave radar,

    P. Zhao, C. X. Lu, B. Wang, C. Chen, L. Xie, M. Wang, N. Trigoni, and A. Markham, “Heart rate sensing with a robot mounted mmwave radar,” in 2020 IEEE International Conference on Robotics and Automation (ICRA). IEEE, 2020, pp. 2812–2818

    work page 2020

  6. [6]

    Adaptable action-aware vital models for personalized intelligent patient monitoring,

    K. Wu, E. H. Chen, X. Hao, F. Wirth, K. Vitanova, R. Lange, and D. Burschka, “Adaptable action-aware vital models for personalized intelligent patient monitoring,” in 2022 International Conference on Robotics and Automation (ICRA). IEEE, 2022, pp. 826–832

    work page 2022

  7. [7]

    Uwb-gestures, a public dataset of dynamic hand gestures acquired using impulse radar sensors,

    S. Ahmed, D. Wang, J. Park, and S. H. Cho, “Uwb-gestures, a public dataset of dynamic hand gestures acquired using impulse radar sensors,” Scientific Data, vol. 8, no. 1, p. 102, 2021

    work page 2021

  8. [8]

    Deep-learning methods for hand-gesture recognition using ultra-wideband radar,

    S. Skaria, A. Al-Hourani, and R. J. Evans, “Deep-learning methods for hand-gesture recognition using ultra-wideband radar,” IEEE Access, vol. 8, pp. 203 580–203 590, 2020

    work page 2020

Show all 32 references
  1. [9]

    Ir-uwb radar sensor for human ges- ture recognition by using machine learning,

    J. Park and S. H. Cho, “Ir-uwb radar sensor for human ges- ture recognition by using machine learning,” in 2016 IEEE 18th International Conference on High Performance Computing and Communications; IEEE 14th International Conference on Smart City; IEEE 2nd International Confere...

    2016

  2. [10]

    Explaining and harness- ing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harness- ing adversarial examples,” arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  3. [11]

    Adversarial examples in the physical world,

    K. Alexey, “Adversarial examples in the physical world,” arXiv preprint arXiv: 1607.02533, 2016

    2016 arXiv

  4. [12]

    Towards deep learning models resistant to adversarial attacks,

    A. M ˛ adry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” stat, vol. 1050, no. 9, 2017

    2017

  5. [13]

    The limitations of deep learning in adversarial settings,

    N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in adversarial settings,” in 2016 IEEE European symposium on security and privacy (EuroS&P). IEEE, 2016, pp. 372–387

    2016

  6. [14]

    Deepfool: a sim- ple and accurate method to fool deep neural networks,

    S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “Deepfool: a sim- ple and accurate method to fool deep neural networks,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 2574–2582

    2016

  7. [15]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in 2017 ieee symposium on security and privacy (sp). Ieee, 2017, pp. 39–57

    2017

  8. [16]

    Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,

    P.-Y . Chen, H. Zhang, Y . Sharma, J. Yi, and C.-J. Hsieh, “Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,” in Proceedings of the 10th ACM workshop on artificial intelligence and security, 2017, pp. 15–26

    2017

  9. [17]

    Genattack: Practical black-box attacks with gradient-free optimization,

    M. Alzantot, Y . Sharma, S. Chakraborty, H. Zhang, C.-J. Hsieh, and M. B. Srivastava, “Genattack: Practical black-box attacks with gradient-free optimization,” in Proceedings of the genetic and evolutionary computation conference, 2019, pp. 1111–1119

    2019

  10. [18]

    Decision-based adversarial attacks: Reliable attacks against black-box machine learning models,

    W. Brendel, J. Rauber, and M. Bethge, “Decision-based adversarial attacks: Reliable attacks against black-box machine learning models,” arXiv preprint arXiv:1712.04248, 2017

    2017 arXiv

  11. [19]

    Square attack: a query-efficient black-box adversarial attack via random search,

    M. Andriushchenko, F. Croce, N. Flammarion, and M. Hein, “Square attack: a query-efficient black-box adversarial attack via random search,” in European conference on computer vision. Springer, 2020, pp. 484–501

    2020

  12. [20]

    Simple black-box adversarial attacks,

    C. Guo, J. Gardner, Y . You, A. G. Wilson, and K. Weinberger, “Simple black-box adversarial attacks,” in International conference on machine learning. PMLR, 2019, pp. 2484–2493

    2019

  13. [21]

    Robust physical-world attacks on deep learning visual classification,

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning visual classification,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 1625–1634

    2018

  14. [22]

    Adversarial laser beam: Effective physical-world attack to dnns in a blink,

    R. Duan, X. Mao, A. K. Qin, Y . Chen, S. Ye, Y . He, and Y . Yang, “Adversarial laser beam: Effective physical-world attack to dnns in a blink,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021, pp. 16 062–16 071

    2021

  15. [23]

    Physical-world optical adversarial attacks on 3d face recognition,

    Y . Li, Y . Li, X. Dai, S. Guo, and B. Xiao, “Physical-world optical adversarial attacks on 3d face recognition,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2023, pp. 24 699–24 708

    2023

  16. [24]

    T-sea: Transfer- based self-ensemble attack on object detection,

    H. Huang, Z. Chen, H. Chen, Y . Wang, and K. Zhang, “T-sea: Transfer- based self-ensemble attack on object detection,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2023, pp. 20 514–20 523

    2023

  17. [25]

    Universal targeted adversarial attacks against mmwave-based human activity recogni- tion,

    Y . Xie, X. Guo, Y . Wang, J. Cheng, and Y . Chen, “Universal targeted adversarial attacks against mmwave-based human activity recogni- tion,” in Network Security Empowered by Artificial Intelligence. Springer, 2024, pp. 177–211

    2024

  18. [26]

    Investigating the significance of adversarial attacks and their relation to interpretability for radar-based human activity recognition systems,

    U. Ozbulak, B. Vandersmissen, A. Jalalvand, I. Couckuyt, A. Van Messem, and W. De Neve, “Investigating the significance of adversarial attacks and their relation to interpretability for radar-based human activity recognition systems,” Computer Vision and Image Understanding, v...

    2021

  19. [27]

    Irshield: A countermeasure against adversarial physical-layer wireless sensing,

    P. Staat, S. Mulzer, S. Roth, V . Moonsamy, M. Heinrichs, R. Kron- berger, A. Sezgin, and C. Paar, “Irshield: A countermeasure against adversarial physical-layer wireless sensing,” in 2022 IEEE Symposium on Security and Privacy (SP), 2022, pp. 1705–1721

    2022

  20. [28]

    Rf-protect: privacy against device-free human tracking,

    J. Shenoy, Z. Liu, B. Tao, Z. Kabelac, and D. Vasisht, “Rf-protect: privacy against device-free human tracking,” in Proceedings of the ACM SIGCOMM 2022 Conference, 2022, pp. 588–600

    2022

  21. [29]

    Pulson 440 uwb radar,

    “Pulson 440 uwb radar,” 2015, https://fccid.io/NUF-P440-A/ User-Manual/User-Manual-287844

    2015

  22. [30]

    Portable uwb radar sensing system for transforming subtle chest movement into actionable micro-doppler signatures to extract respiratory rate exploiting resnet algorithm,

    U. Saeed, S. Y . Shah, A. A. Alotaibi, T. Althobaiti, N. Ramzan, Q. H. Abbasi, and S. A. Shah, “Portable uwb radar sensing system for transforming subtle chest movement into actionable micro-doppler signatures to extract respiratory rate exploiting resnet algorithm,”IEEE Senso...

    2021

  23. [31]

    Convolutional neural networks for the real-time monitoring of vital signs based on impulse radio ultrawide-band radar during sleep,

    S. H. Choi and H. Yoon, “Convolutional neural networks for the real-time monitoring of vital signs based on impulse radio ultrawide-band radar during sleep,” Sensors, vol. 23, no. 6, 2023. [Online]. Available: https://www.mdpi.com/1424-8220/23/6/3116

    2023

  24. [32]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, “An image is worth 16x16 words: Transformers for image recognition at scale,” arXiv preprint arXiv:2010.11929, 2020

    2010 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.