Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces RadKey, an innovative RF backscatter system designed for covert, long-range keystroke inference through walls, addressing the limitations of previous eavesdropping techniques that relied on short-range sensors and victim-specific data. The system consists of a compact batteryless backscatter tag that captures keystroke-induced vibrations and acoustic signals, modulating them onto an RF signal, while a dedicated RF reader processes these signals to infer typed content. Extensive experiments demonstrate RadKey's ability to achieve accurate and robust keystroke inference across diverse users in real-world environments, showcasing its practical application in eavesdropping scenarios.
RadKey can accurately infer keystrokes from behind walls, overcoming the limitations of traditional eavesdropping methods with its innovative RF backscatter technology.
In today's digitally connected world, keyboards remain the primary interface for inputting sensitive information, making them a persistent target for eavesdropping attacks. While prior keystroke inference techniques have exploited side-channel signals such as acoustics and vibrations, they typically rely on conspicuous, short-range sensors and require victim-specific data for model training, limiting their practicality, scalability, and stealth. In this paper, we present RadKey, an RF backscatter system for covert, long-range, through-wall keystroke eavesdropping. RadKey comprises two components: a compact batteryless backscatter tag and an RF reader. The tag captures keystroke-induced vibrations and acoustic signals, modulating them onto the frequency shift of its backscattered RF signal using two magnetically-coupled LC resonators. This design also enables spectral separation between the excitation and backscatter signals, mitigating self-interference for the RF reader and thus extending eavesdropping range. The RF reader demodulates the backscattered RF signal to infer typed content. It employs a dedicated signal processing pipeline that extracts user- and keyboard-independent keystroke features across time and frequency domains, enabling strong generalizability. To further enhance adaptability, RadKey integrates an LLM for online adaptation, leveraging LLM outputs as pseudo ground-truth labels to refine the classifier during runtime. We have built a prototype of the full RadKey system and evaluated it through extensive over-the-air experiments. Results show that RadKey achieves accurate and robust keystroke inference across diverse users in real-world settings. A demo video is available at: https://radkey-submission.github.io/RadKey/