Claude
16b2a629d1
VEIL (Verifiable Emission-shaping for Identity-Leakage prevention) is the countermeasure counterpart to BFLD (ADR-118/121): where BFLD detects when beamforming feedback becomes identifying, VEIL shapes a node's own outgoing feedback so an unauthorized passive sniffer cannot re-identify people, while a legitimate receiver that shares the per-session key sees an unchanged link. Mechanism: identity leaks through the fine cross-subcarrier phase structure of a compressed beamforming report; throughput rides the dominant beam direction. These are (mostly) separable subspaces. VEIL composes extra keyed Givens rotations (the report's native primitive) over the fine subspace only. The rotation is orthogonal (energy-preserving -> not jamming), keyed per session (the AP inverts it -> throughput preserved), and fresh each session (a sniffer cannot average it back -> re-identification collapses to chance). Contents: - v2/crates/wifi-densepose-privshield: deterministic, dependency-free, WASM-ready pure-compute leaf implementing the attacker-vs-protector experiment, the four compliant controls, a throughput model, a machine-checkable "not jamming" compliance audit, and a pinned witness. 29 tests + doctest pass; clippy -D warnings clean; builds for wasm32-unknown-unknown. - docs/research/privacy-shield: 8-file research bundle (SOTA, threat model, design, compliance/regulatory, experiment protocol, market, roadmap). - docs/adr/ADR-288: formal decision record. Reference results (SYNTHETIC / L0, N=16 identities): passive re-ID accuracy 100% shield-off -> 7.8% shield-on (chance 6.25%); modeled throughput ratio 98.0%; emission energy ratio 1.000000 (compliant). All defense numbers are SYNTHETIC until a two-node hardware capture with a witness exists. Compliant waveform controls only; never jamming (47 U.S.C. 333/302a analysis in the bundle). Co-Authored-By: claude-flow <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_01WEXNqzs7UsfNFBcP5yW21p
5.6 KiB
Privacy Shield Research Bundle — VEIL
VEIL (Verifiable Emission-shaping for Identity-Leakage prevention) is a privacy firewall for WiFi sensing: it prevents unauthorized identity and activity inference from a room's WiFi while preserving normal communications. It is the countermeasure counterpart to BFLD — where BFLD detects when beamforming feedback becomes identifying, VEIL acts by shaping the node's own compliant waveform (channel sounding, precoder phase, beam/feedback schedules) so identity and activity inference fail, while a legitimate receiver sees an essentially unchanged link.
This must use compliant waveform controls, never jamming. Every technique here operates on the defender's own legitimately transmitted, standards- conformant frames. Nothing adds energy to interfere with another station's transmission (the statutory definition of jamming, 47 U.S.C. §333/§302a).
Table of contents
| File | Purpose |
|---|---|
| 01-sota-survey.md | State of the art: identity/activity inference attacks (BFI + CSI), the IEEE 802.11bf-2025 standard, and privacy-preserving countermeasures |
| 02-threat-model.md | Adversary classes, what VEIL defends and what it explicitly does not, trust boundary |
| 03-countermeasure-design.md | The compliant waveform controls, the separable-subspace principle, keyed Givens-rotation shield, and how it maps to the crate |
| 04-compliance-and-regulatory.md | The legal line between compliant waveform control and jamming, with statutory citations |
| 05-experiment-protocol.md | The attacker-vs-protector experiment: metrics, acceptance bar, reproducer, and results |
| 06-market-and-buyers.md | First buyers, procurement drivers, competitive landscape, and the standards-body gap |
| 07-implementation-and-roadmap.md | Crate layout, reuse map, hardware path, phased rollout, and open problems |
Formal decision: ADR-288.
Reference implementation: v2/crates/wifi-densepose-privshield.
Executive summary
-
The threat is real and now standardized. IEEE 802.11ac/ax beamforming feedback (BFI) — the compressed Givens-rotation angle matrices (φ/ψ) a client sends the AP — travels unencrypted on the management plane. Any device in monitor mode can capture it for every client at once, no network access, and the target need carry no device. BFId (KIT, ACM CCS 2025) re-identifies individuals from BFI alone; LeakyBeam (NDSS 2025) detects occupancy through walls at ~20 m from BFI; BeamSense recognizes activities at up to 99.28% from BFI. IEEE Std 802.11bf-2025 (published 26 Sep 2025) standardizes the sensing measurement/feedback surface these attacks abuse.
-
The standards body declined to fix it. A 2023 proposal for a BFI "secure transmission mechanism" (IEEE 802.11-23/0782) was withdrawn — the working group did not align on characterizing sensing privacy as a distinct problem. 802.11bf shipped without privacy protections. This is the single strongest demand signal: the gap is structural and acknowledged.
-
No targeted anti-sensing product ships (as of 2026). Every countermeasure in the literature — IRShield, PhyCloak, MIMOCrypt, DP-Givens dithering, ScatterShield — is research-stage. The only shipping substitute is broadband RF shielding (SCIF/TEMPEST film/paint), which is blunt: it kills all RF and cannot coexist with wanted WiFi. The whitespace is a selective, coexisting, software/PHY shield.
-
The VEIL mechanism. Identity leaks through the fine cross-subcarrier phase structure of a beamforming report; throughput rides the dominant beam direction. These are (mostly) separable subspaces. VEIL composes extra keyed Givens rotations over the fine subspace only. The rotation is orthogonal (energy-preserving ⇒ not jamming), keyed per session (the legitimate receiver inverts it ⇒ throughput preserved), and fresh each session (a sniffer cannot average it back ⇒ re-ID collapses to chance).
-
Measured on the reference model (SYNTHETIC). On the default synthetic scene (16 candidate identities), a passive nearest-centroid re-identifier scores 100% with the shield off and 7.8% with it on (chance = 6.25%), while modeled link throughput stays at 98.0% of baseline and the emission energy ratio is 1.000000 (compliant). Reproduce:
cargo test -p wifi-densepose-privshield. -
Scope, honestly. VEIL defends against a third-party passive sniffer. It does not hide identity from the associated AP (that party holds the key) — that is BFLD's detection/policy problem. VEIL is a reference model, not hardware: real-silicon validation (per CLAUDE.md) is future work with a captured-log witness.
Evidence discipline
Per repository policy, every quantitative claim is tagged:
- MEASURED — from a cited primary source with its metric and conditions.
- CLAIMED — asserted by a source (vendor PR, press, standards minutes) without an independent measurement.
- SYNTHETIC — produced by VEIL's own deterministic model; reproduced by
cargo test, describing the model and not real hardware.
WiFi sensing is never presented here as camera-grade, and no VEIL result implies a defense guarantee on real silicon until a hardware witness exists.