ruvnet/wifi-densepose: turning WiFi signals into a motion capture system
I have been following ruvnet‘s work for a few years. He publishes a lot of code, most of it under the MIT license, and a meaningful fraction of it is the kind of thing that makes you stop and read the README twice. The wifi-densepose repository is one of those.
The short version: it takes the signal-strength data that a normal WiFi router already broadcasts, runs it through a machine learning model, and produces a body pose estimation (a 3D map of where the joints of a person’s body are in space) in real time. No cameras. No wearable sensors. No special hardware. The same WiFi signal that is already bouncing around your living room.
The reason I am writing about this is not the technology. The reason is what the technology implies about the privacy model of the WiFi signals your router is already broadcasting. That part is more interesting than the model itself.
What the project actually does
The repository has three components.
- A signal-processing library. Takes raw CSI (Channel State Information, the low-level signal-strength and phase data that WiFi chips report per-antenna, much richer than the “three bars” icon on your phone) data from a compatible WiFi chip and turns it into a normalized feature stream.
- A pre-trained model. A neural network (specifically, a
DensePose-style architecture, which is the same family of models Meta built for estimating body pose from 2D images, but adapted to consume CSI features instead of pixels) that maps the feature stream to body pose keypoints. - A real-time demo app. A Python application that connects to a compatible WiFi chip, runs the signal processing and the model, and renders the body pose on a 2D plot.
The compatible WiFi chips are a specific list. The most common is the Intel AX200, which is in most modern laptops and is available as a $20 USB (Universal Serial Bus, the standard connector for peripherals on computers) adapter for desktops. The list of supported chips is in the README.
Accuracy, from the demo videos the maintainer has published, is about 80% of what a camera-based system would produce for the same scene. The advantage is that it works in the dark, through walls, and without anyone knowing they are being captured. The disadvantage is that it requires the receiver to be in the same room as the transmitter, the body has to be in motion (the model degrades on stationary subjects), and the data rate is lower than a camera.
Why this is a privacy story, not a tech story
Here is the part I want to be specific about. Your WiFi router, right now, is broadcasting a signal that carries more information than you think. The signal-strength bars on your phone are a coarse summary. The underlying CSI data is much richer: it captures the multipath propagation (the way the signal bounces off walls, furniture, and people) at a fine time scale, and the multipath changes as the people in the room move.
wifi-densepose is a working demonstration that this information is enough to recover body pose. The maintainer is not the first person to publish this kind of result. Researchers have been writing papers about WiFi-based pose estimation for a decade. The difference is that the research code is now packaged as a Python library that runs on a $20 USB adapter, and the pre-trained model is downloadable with a single git clone.
This means: the privacy threat model of “anyone with a WiFi receiver in physical proximity can recover body pose” is no longer theoretical. It is a thing a moderately skilled developer can do this weekend. The threat is not new. The accessibility of the threat is new.
The mitigations, to be clear, are limited. You can encrypt the WiFi network, which prevents unauthorized devices from joining. Encryption does not prevent a passive receiver from listening to the signal. The CSI data is in the over-the-air signal regardless of whether the network is encrypted. The encryption protects the data payload, not the signal.
The mitigations that do work are physical: not putting WiFi access points in rooms where you expect privacy, or accepting that the rooms where you have WiFi are observable by anyone with the right hardware. Both mitigations are not great.
The use cases the project is good for
I want to balance the privacy framing with the actual use cases, because the project is genuinely useful for several things that are not surveillance.
- Elderly fall detection. A WiFi-based fall detector does not require the person being monitored to wear a pendant, charge a battery, or remember to put on a sensor. The CSI data is enough to detect a sudden fall with high accuracy. This is the use case the maintainer highlights in the README.
- Smart home automation that does not require cameras. A WiFi-based presence detector can tell whether a person is in a room, and which room, without any camera in the room. This is the use case the smart home community has been waiting for.
- Sleep tracking without wearable sensors. A WiFi access point on the bedside table can estimate breathing rate and sleep stages from the signal. This is the use case the consumer sleep-tracking market is interested in.
- HVAC and energy optimization. Knowing where people are in a building lets a smart HVAC (heating, ventilation, and air conditioning) system direct airflow to occupied rooms instead of empty ones. The accuracy does not need to be perfect for this to work, which is why the use case is realistic for the current state of the technology.
All three of these are use cases where the person being monitored has consented to the monitoring, and where the alternative is worse. The elderly fall detector is the clearest case. The smart home automation is the most common case. The sleep tracking is the case with the most commercial interest.
What I would tell past me
If I could send a message back to the version of me that thought “WiFi is just internet, it does not carry information about me,” I would say three things.
- The signal is information. The “three bars” on your phone is a one-byte summary of a continuous data stream. The data stream carries more than you think. Assume the stream is observable by anyone with a receiver in the building.
- Encryption protects the data, not the signal. A WPA2-encrypted network (WPA2 is the standard security protocol most home WiFi uses) prevents unauthorized devices from joining the network. It does not prevent a passive receiver from observing the multipath propagation. If you care about the latter, the mitigations are physical.
- The accessibility of WiFi sensing is increasing, not decreasing.
wifi-denseposeis one project. There are others. The trend is toward easier-to-use tools and cheaper receivers. The privacy conversation about WiFi is going to be a real conversation in the next five years, and the people who should be having it are the people designing WiFi chips and home routers right now.
Trade-offs
The project is research code, not a product. The README is honest about this. The model is not as accurate as a camera-based system. The hardware requirements are specific. The installation is a few hours, not a few minutes. If you are not a developer, this is not a tool you are going to use directly. You are going to use the products that get built on top of it, or you are going to be one of the people whose privacy is affected by it.
Legal status of WiFi-based surveillance is, in most jurisdictions, unclear. Recording a video of someone in their home without consent is illegal in many places. Recording the WiFi signal in their home without consent is not, as far as I know, addressed by any current law. The legal gap is real. The legal gap is going to be tested in court eventually.
Accuracy is good enough for “person is in the room and moving” and not good enough for “person is reading a book in a chair.” The 80% number is for body pose under motion. The accuracy degrades on stationary subjects. The use cases the project is good for are the use cases where this degradation is acceptable.
Bottom line
wifi-densepose is a real piece of engineering. The privacy implications are not theoretical. The use cases are real. The combination of those three things is the story, and the story is one that more people are going to be talking about over the next few years. If you are a developer, the project is worth a weekend of exploration. If you are not a developer, the project is worth knowing about, because the products built on top of it are coming to a home near you.