Active Injection vs Passive Sniffing
Current assessment (2026-09-15)
No completed matched-rate arrival-regularity result was identified. The impairment campaigns test receiver models rather than packet timing. The August 28 impairment fit now provides a measured-profile sensitivity comparison, but it does not resolve this card's hypothesis.
A comparison between an injected source and pooled ambient traffic changes more than timing: transmitter position, frame class and received power can change too. Timing should first be varied on a controlled link. Conventional FFT features assume regular sampling; timestamp-aware estimators provide a necessary comparison. The thesis now needs an acquisition-quality limit, rather than an assumption that all sensing must be passive.
Next evidence needed: Declare the delivered-rate matching rule, gap statistic and estimator before the comparison. Carry source identity and missing-data intervals into the result, and compare conventional resampling with a timestamp-aware method.
Basis: Thesis Narrative, the September 10 synthesis, and the September 15 register review. See the review record for evidence sources and outstanding checks.
Earlier protocol and dated results
The methods and observations below retain their original scope. Read their readiness statements and proposed next steps as historical. The current assessment above records what has changed; frozen thresholds have not been retrospectively revised.
The problem, in plain words
Think of a spectrogram as a set of evenly-spaced snapshots of a moving object. If someone walks past a Wi-Fi link, each snapshot catches the reflected signal at a slightly different phase, and stacking them reveals the walking speed as a Doppler shift. This only works if the snapshots are evenly spaced in time — like frames of a film shot at a steady 24 fps (yang2026_6c4f ↗).
Now imagine the camera fires at random: three frames in a burst, then a two-second gap, then one frame, then nothing. Even if you took the same total number of frames over the minute, the motion is smeared — you cannot tell a fast walk from a slow one, because the timing between frames is all over the place. That is exactly what passive sniffing does to CSI: you only get a sample when some device happens to send a packet, and real network traffic is bursty. Active injection avoids this — you send your own probe packets on a fixed clock — but it means transmitting, which costs energy and is less "invisible" (sharma2024_c8a2 ↗).
The tempting shortcut is to spec capture by mean packet rate alone: "as long as I average 200 packets per second, I'm above the Nyquist limit, so I'm fine." This experiment tests whether that shortcut is a trap. If a bursty 200-Hz-mean stream loses the motion feature that a smooth 200-Hz stream keeps, then mean rate is not the spec — arrival regularity is a separate thing the thesis must measure and engineer for.
What we are trying to prove
- Hypothesis (falsifiable). At a fixed mean rate R that comfortably clears the Nyquist bound, an active (uniform) capture yields a significantly higher motion-feature SNR than a passive (bursty) capture, because uneven sampling spreads the Doppler signature into spectral leakage. Concretely: the matched-mean active-vs-bursty difference is positive, grows with burstiness, and crosses a usability threshold at some idle-fraction / Fano factor.
- What a null means. If active and bursty captures are statistically indistinguishable at matched mean rate across scenes and seeds, then mean PRR is a sufficient spec and passive deployment is viable wherever ambient traffic is dense enough — a positive result for the deployable stance. The hypothesis is only interesting because it can fail this way; the experiment is designed so the null is a clean, publishable finding, not an absence of one.
- The mitigation fork. If burstiness does destroy the feature, a secondary question decides the engineering response: does a non-uniform-aware estimator (Lomb–Scargle / NUFFT) placed on the true sample times recover the active-capture feature SNR, or is light active-probe injection to fill the idle gaps the only fix? One answer says "redesign the feature"; the other says "you cannot be fully passive."
How the experiment works (plain method)
- One physically-consistent master run. Reuse the single high-rate ray-traced CSI run from EXP-007 (coupled walk → Sionna Doppler-CFR). Because every arrival process is a resampling of the same underlying channel, arrival regularity is the only thing that varies — scene, walk paths, carrier, and motion ground truth are held identical.
- Three arrival processes at each mean rate R ∈ {500, 200, 100} Hz: active (evenly spaced — the control), passive-Poisson (memoryless burstiness), and passive-onoff (dense bursts separated by idle gaps, sweeping burstiness from mild to severe). A fourth condition tests the W3 §4 gotcha of snapping bursty samples to a uniform grid instead of honouring their true times.
- Fixed, dumb feature pipeline. The same spectrogram window and the same motion detector are applied to every arrival process, so any difference is about the data's information content, not model tuning — the feature pipeline follows the CSI-ratio / Doppler construction of wu2022_75d3 ↗ and the DFS/BVP features of zheng2019_5389 ↗.
- Measure and sweep. Per (R, arrival process) record the Doppler feature SNR (motion-band energy vs leakage floor) and a fixed detection metric; sweep burstiness to find where it breaks; then, only if it breaks, probe the two mitigations against the active control.
What we've found so far (honest — the core axis is unrun)
The burstiness experiment itself has not executed. No vault campaign resamples a master run onto active vs passive arrival processes. The two campaigns attached to this umbrella live on the measurement- model axis (how a commodity NIC corrupts the sample values), not the sampling axis (how bursty timing corrupts the sample spacing). They are genuine, sealed, real-run sessions — reported here because they change the risk picture for EXP-008, not because they test it.
| Adjacent campaign | Runs | What it actually varied | Real finding | Figures |
|---|---|---|---|---|
| c-csi-impairment-sim-to-real | 13 (12 impaired + 1 clean control), sealed 01KTPNH0PV |
SNR {5,10,20,30} dB × CFO {0,2k,10k} Hz on a fixed scene | The impairment stage is correct + strictly additive, but the CSI occupancy signature is fragile: mean blockage attenuation halves (27.5 → 12.3 dB/person) and the Rician-K occupancy slope sign-flips (+10.12 → −2.40) even at SNR=30 dB. No defensible SNR capture budget is quotable (the brief's survival metric was non-monotone — an AWGN-shadow artifact). Verdict: transfer moves speculative → testable, but the result strengthens the case for real calibration. | none |
| c-ble-impairment-robustness | 14 of 15 (one raced the attach), sealed 01KVWSXM8Q |
n_agents {4,8,12} × SNR {5..40} dB, ble.enabled, fixed phase-impairment base |
The **BLE RSSI anchor's occupancy rank-correlation ( | ρ |
Why this matters for EXP-008: the feature this experiment wants to defend against bursty sampling is the Doppler/phase feature — and the adjacent evidence says that same phase feature is already the fragile one under commodity hardware, while amplitude/power reads are robust. So EXP-008's burstiness penalty stacks on top of an impairment penalty on the same signal. Both campaigns are self-authored impairment priors (IP-101 Q3=A) with zero rendered figures — per the 2026-07-15 integrity audit, a sealed verdict with no figure and a synthetic noise model is design-grade evidence only. The honest state of EXP-008 is: designed, motivated, and de-risked in premise — not executed.
The plan (what a run must deliver)
- Outputs.
dataset/exp008/arrival_traces/(active / Poisson / on-off timestamp sets per R),feature_snr.csv(Doppler SNR + detection metric per condition),doppler/spectra showing leakage under bursty arrivals vs clean active. Headline figure: feature SNR vs burstiness at matched mean rate. Mitigation figure: STFT-on-bursty vs NUFFT-on-bursty vs active control. - Primary analyses. (1) Matched-mean paired comparison (active vs on-off at equal R) with effect size and a paired test across scenes/seeds; (2) the burstiness threshold (idle fraction / Fano factor) at which passive feature SNR falls below usable; (3) the mitigation verdict.
- Guardrails (campaign-rigor audit). Keep the detector fixed and dumb; validate the known
doppler frame // n_subalignment gotcha before trusting any SNR number; state that the mechanism (leakage from non-uniform sampling) is geometry-agnostic while the magnitude needs the hardware check. - The standing real-hardware gate. AX210 active injection vs monitor-mode sniff of genuine ambient traffic in the FIIT room, anchored against a public real-CSI set (meneghello2023_0a93 ↗, huang2025_060d ↗). Required before any thesis claim leaves the simulator.
Key references
- sharma2024_c8a2 ↗ — the ambient-traffic passive stance whose burstiness this quantifies.
- li2022_4220 ↗, li2021_1875 ↗ — operational passive Wi-Fi radar riding opportunistic, uneven illumination.
- li2026_2b30 ↗ — ambient-traffic interference on CSI sensing.
- yang2026_6c4f ↗, wu2022_75d3 ↗, zheng2019_5389 ↗, wang2015_48cf ↗ — the Doppler/DFS feature pipeline that assumes regular sampling.
- ropitault2024_d49d ↗, du2025_5663 ↗ — the standardized scheduled-sounding escape hatch.
- longo2019_b72f ↗ — the deployment-side packet-capture occupancy baseline.
- peck2008_2ba0 — the design/replication reference for the matched-mean paired comparison.
- huang2025_060d ↗, meneghello2023_0a93 ↗ — public real-CSI anchors for the standing hardware gate.
- guarino2026_e72c ↗, zhang2026_ccac ↗ — the reproducibility bar the SWE voice invokes.