BFI Privacy Risk
Three published attacks. One root cause. Every Wi-Fi 5, 6, 6E, and 7 client continuously broadcasts a spatial fingerprint of its physical environment -- in plaintext -- as part of the standard beamforming procedure. This page maps the attack surface, assesses enterprise exposure, and documents what mitigations currently exist.
— Shankar K. · Last reviewed: May 2026 · See also: /beamforming-sounding for the protocol mechanics
IEEE 802.11 requires beamformee clients to transmit Compressed Beamforming Reports (CBR) to the AP as plaintext Action No Ack frames -- there is no provision in the standard to encrypt them -- and these frames contain quantized channel measurements that encode the geometry and movement of everything in the RF path, including people.
The key advantage over CSI-based methods: one passive monitor captures BFI from all associated clients simultaneously, providing multiple spatial perspectives of the same scene. At 197 subjects, BFId outperforms per-client CSI approaches precisely because of this multi-perspective aggregation. Training time is under one minute per subject on a standard GPU; inference takes seconds per identification.
Wi-Fi cannot reconstruct a 3D skeleton. A 5 GHz antenna array (~10 cm aperture) has ~35° angular resolution -- insufficient to resolve body joints separated by 10-30 cm. BFId does not attempt 3D reconstruction. It trains an RNN directly on the φ/ψ angle time series. Gait identity does not require knowing where the knee is -- it requires recognising the person-specific perturbation pattern that the knee movement produces in the SVD decomposition, repeated at 0.8-1.2 Hz. That pattern is stable, compressible, and person-unique.
wlan.fc.type == 0 && wlan.fc.subtype == 14 LeakyBeam also proposes a defence: AP-based spatial-temporal obfuscation of BFI packets with minimal overhead. This is currently the only published hardware-light mitigation with a working implementation and measured performance data.
WiKI-Eve uses an adversarial learning scheme to generalise across unseen typing styles and devices. The attack targets the same unencrypted BFI stream as BFId and LeakyBeam -- no new access mechanism required.
| Attack | What is inferred | Requires target device? | Attacker hardware | Year |
|---|---|---|---|---|
| BFId | Person identity (gait-based) | No -- person need not carry device | Any Wi-Fi adapter, monitor mode | 2025 |
| LeakyBeam | Room occupancy (presence/absence) | No -- any associated client generates signal | Any Wi-Fi adapter, 20m range | 2025 |
| WiKI-Eve | Keystrokes, passwords | Yes -- target must be typing on associated device | Any Wi-Fi adapter, same channel | 2023 |
Whether your environment is exposed depends on three factors: whether beamforming is enabled, whether an adversary could position a passive monitor within range, and whether the information inferrable from your BFI stream has value to an adversary.
- ▸ Open office with Wi-Fi 5/6/7 APs and no physical perimeter control
- ▸ Shared-building deployments (retail, co-working, hospitality)
- ▸ Conference rooms with regular sensitive meetings and Wi-Fi-connected laptops
- ▸ Facilities where personnel identity or schedule is sensitive (government, finance, healthcare)
- ▸ Any environment where an adversary can park a vehicle or linger within 20-50m
- ▸ 3 or more clients simultaneously sounding the same AP -- multi-perspective BFI aggregation outperforms single-client CSI (BFId §IV: independent spatial measurements of the same moving body)
- ▸ Beamforming disabled on AP (trades throughput for privacy)
- ▸ Wired-only network segments for sensitive workstations
- ▸ Physically secure perimeter preventing passive monitoring within range
- ▸ Wi-Fi 4 (802.11n) -- does not use explicit compressed beamforming
- ▸ Fewer than 3 simultaneously sounding clients -- multi-perspective aggregation requires ≥3 concurrent CBR reporters to exceed single-client CSI accuracy
wlan.action.category == 30
wlan.action.category == 21
Disabling explicit beamforming on the AP stops CBR frames entirely. Cost: reduced throughput (typically 10-30% at range) and potential MU-MIMO degradation. Supported in most enterprise AP management consoles under MIMO / beamforming settings.
Wired Ethernet generates no BFI. High-sensitivity workstations in secure areas should use wired connections. This eliminates the attack surface entirely for those devices.
arXiv 2512.18529 (Dec 2025) proposes adding calibrated noise to Givens angles at quantization time. Standards-compatible output (same bit-width), epsilon-DP guarantee, less than 1 dB beamforming gain loss in simulation. No firmware implementation as of May 2026.
AP-based spatial-temporal obfuscation of BFI packet timing and content. Proposed in LeakyBeam (NDSS 2025) with working implementation and measured performance. Requires AP firmware support; not shipped in any commercial AP as of May 2026.
CBR frames are Action No Ack management frames (type=0, subtype=14). PMF (802.11w) management frame encryption covers Deauthentication, Disassociation, and specific Action frame categories -- but not Action No Ack frames carrying CBR. Encrypting BFI requires a standards amendment explicitly adding CCMP protection to this frame type. No such amendment exists in 802.11be-2024 or 802.11bf-2025.
No major AP vendor (Cisco, Aruba, Juniper Mist, Ruckus, Ubiquiti) had shipped a BFI privacy mitigation as of May 2026. The BFId authors called for IEEE 802.11bf to include privacy safeguards; no standard amendment has been published.
No BFI privacy provisions. CBR frames remain plaintext Action No Ack frames by design. The standard was ratified before BFId was published.
Ratified September 2025. The BFId authors explicitly called for 802.11bf to include BFI privacy safeguards. The ratified standard does not include mandatory BFI obfuscation. 802.11bf defines Sensing Measurement Report frames as a separate mechanism; the beamforming BFI attack surface predates and is independent of 802.11bf sensing.
Wi-Fi CERTIFIED 7 requires beamforming support. No privacy test case for BFI content in the certification program as of May 2026.
- ▸ AP vendor firmware updates mentioning BFI privacy, sounding rate limiting, or beamforming obfuscation
- ▸ IEEE 802.11 TGbi (Enhanced Privacy Protection) -- final SA ballot as of May 2026; scope broader than BFI but could address CBR frame protection
- ▸ GDPR / ePrivacy enforcement actions in EU citing Wi-Fi sensing as personal data processing
- ▸ Extension of BFId to EHT 320 MHz captures -- larger BFI payload = richer identity signal
- ▸ BeamCraft (ACM MobiCom 2024) -- separate but related: BFI forgery to manipulate AP steering decisions (integrity attack, not just passive eavesdropping)
Building WiFi Analyser V2 · CWNA-109 in progress · one post every two weeks