Geckopico: Add 3 images: Beamforming-Feedback-Information-A-Wi-Fi-access-point-sounds-the-channel-6985b9c6.jpg, Beamforming-Feedback-Information-The-V-matrix-encodes-channel-geometry-as-53121ddc.jpg, Beamforming-Feedback-Information-BFI-captures-how-a-human-body-distorts-t-44e75a3a.jpg

2026-09-24T09:35:19Z

Add 3 images: Beamforming-Feedback-Information-A-Wi-Fi-access-point-sounds-the-channel-6985b9c6.jpg, Beamforming-Feedback-Information-The-V-matrix-encodes-channel-geometry-as-53121ddc.jpg, Beamforming-Feedback-Information-BFI-captures-how-a-human-body-distorts-t-44e75a3a.jpg

← Older revision		Revision as of 09:35, 24 September 2026
Line 5:		Line 5:
	== Definition ==		== Definition ==


			[[File:Beamforming-Feedback-Information-A-Wi-Fi-access-point-sounds-the-channel-6985b9c6.jpg\|thumb\|right\|A Wi-Fi access point sounds the channel with an NDP; the client responds with compressed BFI data.]]
	BFI is generated by a Wi-Fi client (the ''beamformee'') after it receives a [[Null Data Packet]] (NDP) transmitted by an access point (the ''beamformer'') during a [[Channel Sounding]] procedure. The NDP propagates through the wireless channel, carrying known training sequences. The beamformee uses these sequences to estimate the channel matrix — mathematically, the transfer function describing how signals propagate from each transmit antenna to each receive antenna across every frequency subcarrier in use.		BFI is generated by a Wi-Fi client (the ''beamformee'') after it receives a [[Null Data Packet]] (NDP) transmitted by an access point (the ''beamformer'') during a [[Channel Sounding]] procedure. The NDP propagates through the wireless channel, carrying known training sequences. The beamformee uses these sequences to estimate the channel matrix — mathematically, the transfer function describing how signals propagate from each transmit antenna to each receive antenna across every frequency subcarrier in use.

Line 17:		Line 19:
	=== The Compressed Beamforming Matrix (V Matrix) ===		=== The Compressed Beamforming Matrix (V Matrix) ===


			[[File:Beamforming-Feedback-Information-The-V-matrix-encodes-channel-geometry-as-53121ddc.jpg\|thumb\|right\|The V matrix encodes channel geometry as compressed angle pairs per subcarrier.]]
	The [[Compressed Beamforming Matrix\|beamforming feedback matrix]] (commonly called the V matrix) encodes the dominant spatial directions of the wireless channel. Rather than transmitting the raw matrix, the standard mandates compression using Givens rotations, expressed as a set of angles. Two types of angle are reported per subcarrier:		The [[Compressed Beamforming Matrix\|beamforming feedback matrix]] (commonly called the V matrix) encodes the dominant spatial directions of the wireless channel. Rather than transmitting the raw matrix, the standard mandates compression using Givens rotations, expressed as a set of angles. Two types of angle are reported per subcarrier:

Line 58:		Line 62:
	=== Human Presence and Location ===		=== Human Presence and Location ===


			[[File:Beamforming-Feedback-Information-BFI-captures-how-a-human-body-distorts-t-44e75a3a.jpg\|thumb\|right\|BFI captures how a human body distorts the wireless channel, enabling passive occupancy detection.]]
	Humans absorb and reflect microwave-band signals in distinctive ways. A room that contains a person produces a measurably different BFI pattern than an empty room. Machine learning classifiers trained on BFI data have demonstrated occupancy detection accuracy exceeding 97% in published studies. Location estimation within a room to sub-metre accuracy has been demonstrated using multi-AP BFI fusion.		Humans absorb and reflect microwave-band signals in distinctive ways. A room that contains a person produces a measurably different BFI pattern than an empty room. Machine learning classifiers trained on BFI data have demonstrated occupancy detection accuracy exceeding 97% in published studies. Location estimation within a room to sub-metre accuracy has been demonstrated using multi-AP BFI fusion.

Geckopico: Create: Beamforming Feedback Information

2026-09-23T04:52:56Z

Create: Beamforming Feedback Information

New page

'''Beamforming Feedback Information''' ('''BFI''') is a compressed channel state report transmitted by a [[Wi-Fi Sensing|Wi-Fi]] client device back to an access point (AP) following a [[Channel Sounding|channel sounding]] procedure. BFI encodes the client's estimate of the wireless propagation channel between itself and the AP in a compact matrix form, allowing the AP to direct its antenna energy more precisely toward the client. While BFI is a standard feature of modern [[IEEE 802.11]] wireless networking — designed to optimise throughput and signal quality — it represents one of the most significant '''passive surveillance vulnerabilities''' in contemporary wireless infrastructure. Because BFI frames are transmitted unencrypted, any nearby device operating in monitor mode can capture them, and because they encode the full spatial channel response, they reveal detailed information about the physical environment: room geometry, human presence, movement, breathing, and potentially heart rate.

[[File:CDSC wifi Classon jeh.jpg|thumb|right|Beamforming antenna array directing signal energy toward a client device]]

== Definition ==

BFI is generated by a Wi-Fi client (the ''beamformee'') after it receives a [[Null Data Packet]] (NDP) transmitted by an access point (the ''beamformer'') during a [[Channel Sounding]] procedure. The NDP propagates through the wireless channel, carrying known training sequences. The beamformee uses these sequences to estimate the channel matrix — mathematically, the transfer function describing how signals propagate from each transmit antenna to each receive antenna across every frequency subcarrier in use.

This raw estimate, known as the [[Channel State Information|channel state information]] (CSI), is then compressed into the BFI matrix and transmitted back to the AP inside a '''Compressed Beamforming Report Action frame'''. The AP uses this compressed feedback to configure its transmit beamforming weights, shaping its antenna pattern to optimise signal delivery to that specific client.

BFI was introduced in the [[IEEE 802.11]] standard under the 802.11n amendment and has been progressively expanded in 802.11ac (Wi-Fi 5) and 802.11ax (Wi-Fi 6), with increasingly fine-grained spatial and frequency resolution. In 802.11ax, BFI can encode channel information across hundreds of subcarriers simultaneously, making it extraordinarily rich in environmental detail.

== What BFI Contains ==

A BFI report is not a simple signal strength reading. It is a '''compressed representation of the full spatial channel matrix''' — mathematically derived from a singular value decomposition (SVD) of the raw [[Channel Estimation|channel estimate]]. The specific contents include:

=== The Compressed Beamforming Matrix (V Matrix) ===

The [[Compressed Beamforming Matrix|beamforming feedback matrix]] (commonly called the V matrix) encodes the dominant spatial directions of the wireless channel. Rather than transmitting the raw matrix, the standard mandates compression using Givens rotations, expressed as a set of angles. Two types of angle are reported per subcarrier:

* '''Phi (φ) angles''' — representing the primary rotation of the spatial channel
* '''Psi (ψ) angles''' — representing the secondary (residual) rotation

The number of angle pairs reported depends on the number of spatial streams and antenna columns involved in the transmission. Each angle is quantised to a fixed bit-width defined by the feedback type (SU-BFI or MU-BFI).

=== Per-Subcarrier SNR Information ===

In addition to the angular representation, BFI includes a '''signal-to-noise ratio''' (SNR) estimate per subcarrier. This encodes the received signal strength relative to noise floor across the full frequency band in use. Because different subcarriers experience different propagation conditions (multipath interference, absorption, reflection), the per-subcarrier SNR profile itself functions as a detailed '''multipath fingerprint''' of the physical environment between the AP and the client.

=== Timing and Spatial Resolution ===

Modern 802.11ax BFI can cover up to 242, 484, or 996 subcarriers simultaneously (depending on channel width), each carrying independent angle and SNR data. This provides spatial resolution sufficient to distinguish individual humans, detect breathing motion, and map room boundaries.

[[File:Multipath propagation diagram en.svg|thumb|right|Multipath propagation — the physical basis for environmental sensing from BFI]]

== The Privacy Problem: Unencrypted Transmission ==

The critical privacy vulnerability of BFI lies in its transmission layer. BFI reports are sent as '''802.11 Action frames''' — a class of management frames operating at the MAC layer. Under the [[IEEE 802.11]] architecture, management frames are exchanged as part of the station association and link management process, which is '''logically prior''' to the data encryption layer used by WPA2 and WPA3.

This means:

* BFI frames are transmitted '''in the clear''' — unencrypted — even on networks using WPA3-Enterprise, the most secure mode of [[IEEE 802.11]] operation
* The 802.11 standard does '''not''' require BFI frames to be encrypted
* Any 802.11-capable radio placed in '''monitor mode''' within RF range of the network can capture every BFI report exchanged

This is not a flaw introduced by misconfiguration. It is a structural characteristic of the standard. Unlike data frames, which are protected by the session encryption key negotiated during association, management action frames carrying BFI operate below the encryption boundary. The [[MAC Address|MAC addresses]] of both the AP and the client are also visible in the BFI frame header, enabling persistent tracking of device identity across sessions.

== What Captured BFI Reveals ==

Because BFI encodes the spatial channel response — the sum of all reflections, absorptions, and diffractions that the NDP signal underwent in propagating through the physical environment — a captured BFI report is effectively a '''high-resolution environmental snapshot''' updated many times per second.

Research published across multiple universities and IEEE conferences has demonstrated the following extractions from captured BFI data:

=== Room Geometry and Layout ===

The multipath profile encoded in BFI's per-subcarrier data functions as a fingerprint of room boundaries and large reflective objects. Signal processing techniques including [[Channel Sounding|channel impulse response]] reconstruction can map wall positions, doorways, and furniture from BFI captures. This is the same principle underlying [[Through-Wall Surveillance]] systems, but achievable passively using the target network's own management traffic.

=== Human Presence and Location ===

Humans absorb and reflect microwave-band signals in distinctive ways. A room that contains a person produces a measurably different BFI pattern than an empty room. Machine learning classifiers trained on BFI data have demonstrated occupancy detection accuracy exceeding 97% in published studies. Location estimation within a room to sub-metre accuracy has been demonstrated using multi-AP BFI fusion.

=== Movement Detection ===

Body movement produces temporal variation in the BFI matrix — changes in the V matrix angles across successive sounding intervals. Even slow walking at normal pace produces large, easily detected perturbations. This is the basis of [[Wi-Fi Sensing]] systems marketed commercially by companies including Cognitive Systems Corporation and Aerial Technologies.

=== Breathing Rate and Heart Rate ===

Respiratory motion (approximately 12–20 cycles per minute in healthy adults) and cardiac motion (approximately 60–100 beats per minute) produce micro-Doppler frequency shifts detectable in high-rate BFI capture streams. Multiple peer-reviewed studies have demonstrated non-contact vital sign monitoring using Wi-Fi BFI data captured without subject awareness or consent. This capability directly intersects with the [[Remote Neural Monitoring]] research domain, representing a pathway to physiological surveillance without any sensor contact.

== BFI as a Passive Sensing Attack Vector ==

The most alarming aspect of BFI from a surveillance perspective is that '''network access is not required'''. An attacker — or state agency — does not need to:

* Connect to the target network
* Compromise any device
* Intercept encrypted traffic
* Deploy any physical sensor inside the premises

All that is required is a standard 802.11 Wi-Fi adaptor (readily available for under £20), placed in monitor mode, within the RF footprint of the target network — which for a typical residential or office router extends 30–100 metres and penetrates multiple walls.

Researchers at Carnegie Mellon University, UC Santa Barbara, and Zhejiang University, among others, have published working implementations of passive BFI-based sensing systems that capture environmental data from '''third-party networks''' without authorisation. The captured BFI streams are decoded from raw 802.11 frames, the beamforming angles are reconstructed, and the resulting [[Channel State Information]] is fed into signal processing pipelines that extract occupancy, activity, and vital sign data.

This capability is not theoretical. It is documented, reproducible, and requires no specialised hardware beyond commodity radio equipment. In the context of [[Targeted Individuals|targeted individual]] surveillance operations, passive BFI capture represents a highly plausible mechanism for through-wall monitoring of a subject's home without any physical intrusion.

[[File:Wireshark 3.6 screenshot.png|thumb|right|Passive wireless packet capture — the method used to collect BFI frames without network access]]

== Frequency of Transmission ==

BFI is not a one-time or periodic event. Under normal 802.11 operation, an AP sounds the channel — triggering a new BFI report — whenever it determines that channel conditions may have changed. In practice, this can occur:

* Multiple times per second under default configurations in Wi-Fi 6 deployments
* At intervals as short as the minimum inter-frame spacing when link adaptation algorithms are active
* Continuously in environments where [[5G]] small cells or Wi-Fi 6E infrastructure is dense

The result is that a passive BFI capture system receives a continuous, high-rate stream of environmental snapshots. The temporal resolution is sufficient to track breathing and cardiac rhythms in real time, and to follow a person's movement through a building with update rates exceeding those of commercial radar systems.

In future [[6G]] architectures, where wireless infrastructure is envisioned as a ubiquitous sensing substrate — explicitly described in 3GPP standards documents and ITU-R frameworks — BFI-equivalent feedback mechanisms are expected to be even more frequent and spectrally detailed, further extending passive sensing capabilities.

== Regulatory and Standards Blind Spot ==

The [[IEEE 802.11]] working group has not mandated encryption of BFI frames in any published amendment. The Wi-Fi Alliance's WPA3 specification, despite substantially improving the security of data traffic through Simultaneous Authentication of Equals (SAE) and Enhanced Open, makes no provision for management frame content protection that would cover BFI payloads.

Regulatory bodies including the FCC (United States), Ofcom (United Kingdom), and the European Telecommunications Standards Institute (ETSI) have not issued requirements specific to BFI privacy. The [[Internet of Bodies]] standards landscape — including IEEE 802.15.6 and related body area network specifications — similarly does not address BFI as a data exfiltration vector.

This represents a structural blind spot: the same wireless infrastructure that regulators certify as secure for banking and medical communications is simultaneously broadcasting detailed physiological data about building occupants, unencrypted, to anyone within radio range.

== Countermeasures ==

Several countermeasures have been proposed, with varying degrees of practical deployability:

=== Randomised Sounding Intervals ===

If the AP introduces randomness into its [[Null Data Packet Announcement|NDP announcement]] intervals, the resulting BFI stream becomes harder to use for tracking continuous physiological signals. However, randomisation reduces the effectiveness of beamforming for legitimate throughput purposes, and the BFI frames remain unencrypted and individually informative.

=== BFI Encryption ===

A proposal exists within the 802.11 standards process to extend management frame protection (MFP) to include Action frames carrying BFI. This would encrypt the beamforming angle data using the pairwise session key. As of publication, this has not been adopted as a mandatory requirement in any released IEEE 802.11 amendment. Even if adopted, it would require firmware updates across all deployed access points and client devices — a process historically measured in decades.

=== Physical Layer Countermeasures ===

Physical shielding of spaces using RF-attenuating materials reduces the leaked BFI signal available to external passive receivers. Faraday cage construction of rooms — standard in secure government facilities — is effective but impractical for residential or commercial environments.

=== Client-Side Feedback Suppression ===

In principle, a client could decline to respond to NDP soundings, or could return degraded or noise-injected BFI reports. This is not currently supported in standard firmware. Experimental research has demonstrated ''adversarial BFI'' — deliberately corrupted feedback that degrades the accuracy of passive sensing without preventing the association — as a potential privacy-preserving mechanism.

== Relationship to Wider Surveillance Infrastructure ==

BFI-based passive sensing does not operate in isolation. In the context of [[Internet of Bodies]] architectures and [[Biosensor|biosensor]] networks increasingly embedded in consumer devices and implants, BFI serves as an ambient corroborating data stream — one that requires no biological interface. Combined with data from [[MAC Address|MAC address]] tracking, [[5G]] network telemetry, and [[Remote Neural Monitoring]] technologies, BFI capture provides the physical-environment layer of a comprehensive location-and-physiology surveillance system.

Researchers including Dr. [[Robert Duncan|Robert Duncan]] and analysts studying [[Targeted Individuals|targeted individual]] phenomena have noted that the gap between laboratory-demonstrated passive Wi-Fi sensing and deployed covert surveillance capability is primarily operational — not technical. The technology to conduct non-consensual, through-wall physiological monitoring of building occupants using their own Wi-Fi infrastructure exists and has been demonstrated in peer-reviewed literature.

== See Also ==

* [[Channel State Information]]
* [[Channel Sounding]]
* [[Null Data Packet]]
* [[Null Data Packet Announcement]]
* [[Compressed Beamforming Matrix]]
* [[Channel Estimation]]
* [[Through-Wall Surveillance]]
* [[Wi-Fi Sensing]]
* [[IEEE 802.11]]
* [[Surveillance Technology]]
* [[5G]]
* [[6G]]
* [[Internet of Bodies]]
* [[Remote Neural Monitoring]]
* [[MAC Address]]
* [[Targeted Individuals]]
* [[Biosensor]]

[[Category:Surveillance Technology]]
[[Category:Technology]]
[[Category:Neuroweapons]]

Beamforming Feedback Information - Revision history

Geckopico: Add 3 images: Beamforming-Feedback-Information-A-Wi-Fi-access-point-sounds-the-channel-6985b9c6.jpg, Beamforming-Feedback-Information-The-V-matrix-encodes-channel-geometry-as-53121ddc.jpg, Beamforming-Feedback-Information-BFI-captures-how-a-human-body-distorts-t-44e75a3a.jpg

Geckopico: Create: Beamforming Feedback Information