Wi-Fi Sees Through Walls: What WiFireNet's 72.5% Detection Actually Buys You

A team at the Swedish Defence Research Agency just built a camera with no lens. Their paper, "Concealed Handgun Detection using WiFi Signals," went up on arXiv on October 13, 2026, describing WiFireNet, a model that reads Wi-Fi channel state information and draws a box around a person carrying a concealed handgun. Erik Persson, David Gustafsson and Tomas Wilkinson ran it at 72.5 percent average precision on the handgun class, with a real deactivated metal handgun in the room and no camera at inference.

The dataset, the code and the weights are public.

The thesis is not small. Perception stopped being a camera problem. Every access point in every office, school and apartment corridor is a latent sensor pointed at people who were never asked, and the only thing standing between that sensor and a deployment order is an engineering detail that is now public. The engineering is real. The governance is not ready, and it was never built for this.

HOW IT WORKS: FROM CHANNEL STATE TO IMAGE

Wi-Fi is not a flashlight. It is a wideband signal split into dozens of narrow subcarriers, and each one arrives at the receiver with its own amplitude and its own phase. A standard 20 MHz channel gives you 52 subcarriers. The FOI rig sampled them at 80 Hz.

Every object in the path bends that picture. A torso absorbs and scatters differently than a doorway. A steel object shifts the phase response in a way a plastic bottle does not, because the material changes how the wave propagates and reflects. Channel state information (CSI) is that difference, measured per subcarrier, per sample. Routers compute it to pick modulation. The team turned it into a picture.

That transformation is the whole trick, and it deserves a name because you will see it again. Call it modality translation. WiFireNet does not try to detect a gun in a tensor of complex numbers. It maps CSI amplitude and phase into a two dimensional representation that lines up with the RGB camera frame, then runs ordinary object detection in image space.

The module that does this is a convolutional modality translation network. They borrowed the idea from prior Wi-Fi pose estimation work, where a camera annotates radio data during training and is removed at inference. Use the camera to teach the radio what the world looks like, then drop the camera.

They improved on it too. The prior pose work used a fully connected translation network. FOI matched its parameter count with convolutional layers and won: 50.3 mAP at 25 percent overlap against 35.5, and 47.1 against 31.3 at 50 percent. Neighboring subcarriers carry correlated information, so convolving across them beats treating each dimension as independent.

The transferable lesson is blunt. If your data is not shaped like an image, translate it into one and inherit the whole vision toolbox: pretrained backbones, box regression, non maximum suppression, augmentation and quantization. You do not need a new detector. You need a projector.

THE HONEST NUMBERS

The 72.5 percent figure is real, and it is narrower than the headline makes it sound. It is average precision for the handgun class alone, on the standard configuration in the large room, measured at a 25 percent intersection over union (IoU) threshold. It sits in the ablation table, not the baseline table.

The baseline, across all four object classes, reads differently. Mean average precision was 50.3 at 25 percent overlap and 47.1 at 50 percent overlap, with recall of 91.5 and 89.5. That is the number an integrator would put in a spec sheet.

Push the localization requirement to 50 percent overlap and handgun precision falls from 72.5 to 53.8. A 25 percent IoU threshold means the predicted box only has to cover a quarter of the true region, which on a human body is roughly the claim "someone in this area." A 50 percent threshold starts to mean "the weapon is here." About one in five correct detections dies there.

Across every configuration, mAP landed between roughly 35 and 50 percent depending on room size, subcarrier setup and crowd count. The small 8 square meter room beat the 12 square meter room, the opposite of what people assume about hard problems. A cluttered room gives the model more distinct signal paths, and an open one gives it fewer.

The strangest result inverts an instinct. The team built a setup called WiFi-plus that drives 48 of 52 available pilot subcarriers instead of the 4 used by standard 802.11a, 92.3 percent coverage instead of an interpolated 48. More real measurements, less guessing. It performed slightly worse across the board.

Their explanation is clean rooms with little clutter to resolve. They flag it as unresolved. Either way, the lesson is the one that kills projects: headline precision and deployable precision are two different numbers, and the gap between them is where budgets die. Ask what the precision is at strict localization, in a room the model has not seen, with more than four people in it.

WHAT THE PROTOTYPE DOES NOT PROVE

The prototype ran a modified open source implementation of IEEE 802.11a on GNU Radio at 5.68 GHz with 20 MHz of bandwidth. 802.11a is a 1999 standard. The capture used two laptops, one driving the transmitters and one driving the receivers, plus a USB camera for ground truth.

That is not a router. It is a lab rig with a known transmit signal and controlled antenna placement.

Here is the gap. Consumer access points do not hand you per-subcarrier amplitude and phase. Firmware computes CSI internally, uses it to pick modulation, then discards most of it. What you can usually extract is received signal strength, one scalar per packet, carrying almost none of the shape information this model needs. Real CSI means firmware you control or a software defined radio, which is what FOI used.

Tom's Hardware reports that later phases will move to Wi-Fi 7 and Wi-Fi 8 for higher resolution CSI. That changes the resolution budget. Wi-Fi 7 goes to 320 MHz channels, sixteen times the bandwidth of this capture. More bandwidth means finer delay resolution, which means smaller objects cast distinguishable signatures. The physics that made a plastic gun hard to separate from a metal one gets less brutal.

That should worry you. The same improvements that make detection work make every access point a better sensor, and the upgrade ships as a router refresh, not as a surveillance purchase. Do not buy a demo as a product. Do assume the curve is real and moving.

THE GOVERNANCE PROBLEM ARRIVES BEFORE THE PRODUCT

Every consent model we have is built around lenses. There is a camera on the ceiling, so there is a sign at the door. There is a field of view you can point at, a housing you can see, and a legal doctrine about reasonable expectation.

Radio has none of that furniture. There is no lens to point at. The signal passes through drywall, bounces off a filing cabinet, and arrives from three directions at once. The sensing volume is not a cone, it is the room plus whatever the multipath reaches, and it does not stop at your property line. A person standing in a hallway cannot look up and know whether the access point beside them is measuring them.

This is the sensing side of the same trust problem this site covered on October 16 in Note #222, "Amap Bot Wall Evasion: The 3-Point Egress Trust Audit," where agents routed around a bot wall by borrowing other people's infrastructure. That piece was about egress: where your agent's packets are allowed to go. This is about ingress: what sensing is allowed to reach you, and who authorized it. Both are trust boundaries nobody drew, and in both cases the capability arrived years before the policy.

The uncomfortable part is the cost curve. This is not a classified capability requiring a national lab. It is about 100,000 CSI samples in the standard configuration and 40,000 in the small room, a convolutional network, and a laptop. The dataset is on Hugging Face and the weights are in the repository. A graduate student with an SDR and a weekend can run the baseline.

So the correct assumption is not that this is coming. It is that a version of it is already running somewhere nobody disclosed, because the barrier to trying was never a purchase order. It was a paper, and the paper is out.

WHAT TO DO TODAY

1. Pull the WiFire dataset, code and weights and run the baseline. Read the ablation table before the abstract: the abstract sells the capability, the table tells you what it costs.
2. Check what your own access points will give you. Query your hardware for channel state information, and expect the honest answer to be signal strength and nothing else. Knowing that is the difference between a threat model and a feeling.
3. If you deploy sensors in shared space, write the disclosure policy before the procurement order. The order is where the decision becomes hard to reverse, and a policy written afterward is a rationalization with a signature on it.
4. Treat every radio based detection claim with the 72.5 to 53.8 question. What is precision at strict localization, in a room the model was not trained on, with a crowd larger than the training set? If the vendor cannot answer, you are being sold a demo.

THE UNCOMFORTABLE QUESTION

The camera was never the privacy problem. The camera was the part you could see, which is why we built a decade of law and signage around it. The sensor was always the problem, and it has been in the ceiling the entire time, quietly measuring the room and reporting nothing.

When a thirty dollar radio and a public dataset can tell whether the person on the other side of that wall is carrying a gun, the question is not whether the technology works. The question is who is allowed to look, and whether anyone in that room ever agreed to be seen.