TagStroke: Stealthy Keystroke Inference via Passive RFID Arrays Beneath Keyboards

Keystroke inference attacks severely threaten data security and user privacy. Existing methods often exploit typing-induced signals—such as vibrations, acoustics, and visual cues—but typically require close proximity, line-of-sight, or precise transceiver placement, limiting their practicality. We propose TagStroke, a non-invasive, wireless keystroke inference attack that leverages low-cost COTS RFID systems. TagStroke uses passive UHF RFID tags placed beneath keyboards and a concealed RFID reader to detect typing-induced signal changes, enabling accurate keystroke recognition and semantic recovery.TagStroke addresses key challenges, including RFID signal instability, interference from hand and body movements, and limited spatial sensing resolution. To overcome these, it introduces robust signal preprocessing, a hybrid Temporal Convolution-Transformer model for keystroke detection, and a multi-stage recognition framework integrating spatial decoding with large language models (LLMs). We prototype and evaluate TagStroke with 11 volunteers using a low-cost COTS RFID setup. TagStroke achieves 97.21% keystroke detection accuracy, 87.24% keystroke recognition accuracy, and a word error rate (WER) of 21.06%, along with high content recovery similarity scores e.g., 0.71 at 2 m. These results rival existing CSI-based attacks while avoiding their constraints, demonstrating TagStroke’s practicality, accuracy, and cost-effectiveness.