/docs/research/BFLD/09-github-issue.md

# GitHub Issue Draft

**Title**: feat: BFLD — Beamforming Feedback Layer for Detection (privacy-gated WiFi sensing)

**Labels**: `enhancement`, `privacy`, `security`, `area/signal`, `area/firmware`

**Milestone**: (TBD — suggest: v0.8.0)

---

## Summary

Add a new crate `wifi-densepose-bfld` that turns raw 802.11 Beamforming Feedback
Information (BFI) into bounded, privacy-gated sensing outputs. BFLD detects when RF
data crosses from "ambient sensing" into "identity record" and structurally prevents
identity-correlated data from leaving the node.

This is the safety layer that was missing from the CSI pipeline. As passive BFI sniffing
tools (Wi-BFI, PicoScenes) become widely available and academic attacks (BFId at ACM CCS
2025, LeakyBeam at NDSS 2025) demonstrate >90% re-identification from commodity WiFi,
the wifi-densepose ecosystem needs an explicit privacy layer before scaling deployment.

## Motivation

1. **BFI is plaintext and passively sniffable.** IEEE 802.11ac/ax CBFR frames are
   transmitted before WPA2/WPA3 encryption is applied. Any nearby device in monitor mode
   can capture them (NDSS 2025: https://www.ndss-symposium.org/ndss-paper/lend-me-your-beam-privacy-implications-of-plaintext-beamforming-feedback-in-wifi/).

2. **BFI enables re-identification.** The KIT BFId paper (ACM CCS 2025:
   https://dl.acm.org/doi/10.1145/3719027.3765062) demonstrates >90% identity
   recognition from 5 seconds of BFI, from a dataset of 197 individuals, using only
   the Phi/Psi Givens rotation angles.

3. **The existing pipeline has no identity-leakage measurement.** The rvCSI pipeline
   produces presence/motion/pose events without any indication of whether those outputs
   were derived from identity-discriminative data. An operator deploying in a care
   facility or shared office has no way to verify the system is behaving anonymously.

4. **WiFi 7 will make this worse.** 802.11be (Wi-Fi 7) multi-link operation increases
   sounding frequency 3–5×. The attack surface is not static.

## Proposed Solution

New crate at `v2/crates/wifi-densepose-bfld/` with the following pipeline:

```
BFI capture (CBFR frames, Pi 5 / Nexmon monitor mode)
    → BFI extractor (Phi/Psi parser, 802.11ac/ax)
    → Normalization + temporal windowing
    → Feature extraction (9 named features)
    → Identity risk engine (in-RAM embeddings, coherence gate)
    → Privacy gate (privacy_class byte, field masking)
    → MQTT emitter (per-class topic routing)
```

Three structural invariants (not configurable, not policy):
1. Raw BFI never leaves the node.
2. Identity embedding is in-RAM-only (VecDeque, never persisted).
3. Cross-site identity matching is cryptographically impossible via per-site BLAKE3
   keyed hash with daily rotation.

Output events published on `ruview/<node_id>/bfld/{presence,motion,person_count,...}/state`.

Matter and HA expose only: presence, motion, person_count. Identity fields are rejected
at both boundaries.

## Acceptance Criteria

- [ ] **AC1**: Parser handles 802.11ac VHT and 802.11ax HE CBFR frames at 20/40/80/160 MHz,
  2×2 through 4×4 MIMO.
- [ ] **AC2**: Presence detection latency ≤ 1s p95 from first non-empty BFI frame in
  a new occupancy event.
- [ ] **AC3**: Motion score published at ≥ 1 Hz on `ruview/<node_id>/bfld/motion/state`
  during sustained occupancy.
- [ ] **AC4**: Raw BFI bytes (Phi/Psi angle matrices) are never present in any
  serialized output at any `privacy_class` value.
- [ ] **AC5**: Privacy mode suppresses all identity-derived fields (`identity_risk_score`,
  `rf_signature_hash`, `identity_embedding`) from all outbound events.
- [ ] **AC6**: Identical `BfiCapture` input → bit-identical `BfldFrame` output
  (deterministic, cross-platform).
- [ ] **AC7**: Pipeline produces valid `BfldEvent` with `csi_matrix = None` (BFI-only
  mode), without panic or significant accuracy degradation.

## References

- BFId paper: https://dl.acm.org/doi/10.1145/3719027.3765062
- KIT BFId dataset: https://ps.tm.kit.edu/english/bfid-dataset/index.php
- LeakyBeam (NDSS 2025): https://www.ndss-symposium.org/ndss-paper/lend-me-your-beam-privacy-implications-of-plaintext-beamforming-feedback-in-wifi/
- Wi-BFI tool: https://arxiv.org/abs/2309.04408
- Protecting activity signatures in CSI feedback: https://arxiv.org/pdf/2512.18529
- Research bundle: `docs/research/BFLD/` (this repo)
- Draft ADR: `docs/research/BFLD/08-adr-draft.md` → ADR-118

## Out of Scope

- Preventing passive BFI capture by external attackers (hardware-level problem, not
  software).
- Differential privacy noise injection (noted as future extension in ADR-118).
- Federated identity learning (local-only is sufficient for the current use case).
- BFI capture directly from ESP32-S3 firmware (Espressif API does not expose CBFR;
  host-side Pi 5 / Nexmon capture is the implementation path).
- WiFi 7 / 802.11be multi-link BFI (frame format versioning accommodates it; not
  in scope for v1 implementation).

## Related Issues / PRs

- ADR-028 witness bundle (ref: this repo's `docs/WITNESS-LOG-028.md`)
- ADR-115 HA integration (21 entities — BFLD adds 6 more)
- ADR-116 Matter seed packaging (`cog-ha-matter` crate needs Matter boundary update)
- ADR-117 pip modernization (PyO3 pattern reused for BFLD Python bindings)
- rvCSI platform (ADR-095/096) — Nexmon adapter shared with BFLD BFI capture path