Attacking mmWave-enabled Chest Vibration Sensing via Actuator-induced Mimicry

Millimeter-wave (mmWave) technology has enabled emerging applications such as vital-sign-based healthcare monitoring, user authentication, and emotion-aware human-computer interaction. By capturing subtle chest displacements induced by heartbeat and respiration, mmWave systems provide high-resolution, contactless chest-vibration sensing. However, the mmWave signals that power these applications are vulnerable to spoofing attacks, posing serious risks such as identity impersonation and falsified health assessments. While prior studies have demonstrated the feasibility of spoofing mmWave sensing, existing methods often require access to raw mmWave data or rely on expensive, specialized RF equipment, limiting their real-world applicability. In this work, we present a real-time, low-cost spoofing attack using a programmable actuator concealed under clothing to physically mimic a target user’s chest vibrations. Our attack allows adversaries to bypass authentication systems or falsify health data, potentially granting unauthorized access, or concealing critical medical conditions and triggering false emergency responses. To ensure high-fidelity spoofing, we introduce a mitigation strategy that integrates IMU-assisted compensation and quaternion-based alignment to mitigate interference from the attacker’s own chest motion. We further employ deep learning to dynamically adjust actuator behavior in real time. Experiments with eight participants over six months validate the attack’s effectiveness, revealing a critical security vulnerability in emerging mmWave-based sensing systems.