Anti-Sensing: Defense against Unauthorized Radar-based Human Vital Sign Sensing with Physically Realizable Wearable Oscillators

TL;DR

The paper tackles the privacy risks of unauthorized radar-based vital-sign sensing by proposing Anti-Sensing, a defense that uses wearable oscillators to inject physically realizable perturbations into radar signals. A gradient-based Sinusoidal Defense Algorithm optimizes a perturbation's frequency and spatial amplitude under physiological and spatial constraints to mislead heart-rate estimations. The approach is validated with synthetic radar data and real-world measurements, showing significant degradation in multiple HR-estimation models (including ResNet variants and ViT) and across both simulated and wrist-worn demonstrations. This work demonstrates a practical privacy-preserving hardware-and-algorithm stack for UWB radar sensing, with potential extensions to more complex tasks and multi-modal defenses in future robotics and human–robot interaction systems.

Abstract

Recent advancements in Ultra-Wideband (UWB) radar technology have enabled contactless, non-line-of-sight vital sign monitoring, making it a valuable tool for healthcare. However, UWB radar's ability to capture sensitive physiological data, even through walls, raises significant privacy concerns, particularly in human-robot interactions and autonomous systems that rely on radar for sensing human presence and physiological functions. In this paper, we present Anti-Sensing, a novel defense mechanism designed to prevent unauthorized radar-based sensing. Our approach introduces physically realizable perturbations, such as oscillatory motion from wearable devices, to disrupt radar sensing by mimicking natural cardiac motion, thereby misleading heart rate (HR) estimations. We develop a gradient-based algorithm to optimize the frequency and spatial amplitude of these oscillations for maximal disruption while ensuring physiological plausibility. Through both simulations and real-world experiments with radar data and neural network-based HR sensing models, we demonstrate the effectiveness of Anti-Sensing in significantly degrading model accuracy, offering a practical solution for privacy preservation.

Figures (6)

• Figure 1: Anti-Sensing Scenario: The left panel shows a radar system detecting an individual's heart rate (85 bpm) without permission. In contrast, the right panel illustrates our anti-sensing solution, where a motor generates a false heart rate signal (98 bpm), effectively blocking the radar from sensing the person's true heart rate (85 bpm) and ensuring privacy.
• Figure 2: Comparison of synthetic radargram (left) and real radargram (right) of a point target (a pendulum with a metal bob) oscillating at a frequency of $90$ rpm ($1.5$ Hz).
• Figure 3: A programmable servo motor paired with a ESP 32 Mini. A 3D-printed octahedral reflector wrapped with copper tape is attached as a load to the motor to enhance reflectivity and increase the signal-to-noise ratio (SNR).
• Figure 4: Comparison of Bland Altman Plots from Resnet-18, Resnet-50, CNN 1D+2D, and Vision Transformer (ViT) models for HR estimation without (left column) and with (right column) anti-sensing perturbation applied on sleep dataset.
• Figure 5: Comparison of Resnet-18, Resnet-50, CNN 1D+2D, and Vision Transformer (ViT) model performance on HR prediction without (left column) and with (right column) anti-sensing perturbation applied on sleep dataset.