Adversarial CSI Obfuscation Against Device-Free Activity Recognition in RIS-Assisted Systems

Abstract

Reconfigurable Intelligent Surfaces (RISs) extend 5G New Radio (NR) coverage by redirecting signals toward Non-Line-of-Sight regions, but the same reflected footprint exposes Channel State Information (CSI) to passive eavesdroppers, who can train a Machine Learning classifier on it and perform unauthorized device-free Human Activity Recognition (HAR). Because the information leaks through the propagation environment rather than through transmitted content, encryption and access control are ineffective, and artificial-noise approaches either fail against trained neural networks or violate the strict Error Vector Magnitude (EVM) limits of 3GPP TS 38.104. This paper proposes a transmitter-side adversarial defense that obfuscates the CSI intercepted by a non-adaptive eavesdropper within the EVM budget of the active modulation. The defense reformulates the Carlini & Wagner attack for the radio-frequency domain, replacing additive norm-bounded perturbations with multiplicative amplitude scaling and phase rotation on the complex channel coefficients, and embeds the modulation-dependent EVM limits directly into the adversarial objective. An offline Universal Adversarial Perturbation (UAP) variant removes the per-packet optimization cost and meets the latency budget of Ultra-Reliable Low-Latency Communication services. The instance-specific attack achieves a feasible Attack Success Rate above 90% under QPSK and 16-QAM and above 83% under the 3.5% EVM budget of 256-QAM. The UAP retains 73% to 83% of this effectiveness with no online computation and transfers across receiver positions, reducing a target-position classifier from 83.6% to roughly 33% accuracy. End-to-end physical-layer simulations bound the cost to the legitimate link below 1 dB of Signal-to-Noise-Ratio penalty on Block Error Rate after Low-Density Parity-Check decoding.