PaperlayerView exact revision on arXiv

Source-linked AI summary

Secrets in Preamble: Practical and Robust PHY Information Hiding for Wi-Fi

Rui Pan, Guanxiong Shen, Linning Peng, Xinyu Qi, Junqing Zhang

arXiv:2610.13367v1cs.CReess.SP

TL;DR

Existing Wi-Fi information-hiding approaches face limits in capacity and robustness to environmental variation. This paper embeds secrets in the L-STF using paired neural networks, and reports 46-bit messages in indoor and outdoor prototype experiments.

  • Problem

    Existing Wi-Fi information-hiding approaches have limited steganographic capacity or robustness to channel variation, while embedding must also avoid disrupting normal Wi-Fi reception.

    Source: §I · p. 1

  • Method

    A paired neural-network encoder and decoder embed secrets in the L-STF, preserving its periodic structure and using channel simulation and L-STF equalization to address channel effects.

    Source: §I · p. 2, B. L-STF Equalization · p. 7

  • Results

    46 secret bits were embedded in Wi-Fi packets in indoor and outdoor prototype experiments without affecting payload demodulation.

    Source: §I · p. 2

  • Takeaways & Limitations

    The prototype demonstrates the feasibility of Wi-Fi information hiding that preserves L-STF packet-detection and coarse frequency-offset-compensation functions.

    Source: §I · p. 2

Abstract

from arXiv · show

Physical layer (PHY) information hiding refers to the concealment of secrets within PHY waveforms without compromising the integrity of the primary communication link, thereby enabling critical applications such as covert communication, PHY steganography, and watermarking. The widespread deployment of Wi-Fi has motivated substantial research interest in hiding secrets within Wi-Fi waveforms. However, existing Wi-Fi information hiding approaches suffer from two limitations: restricted steganographic capacity and insufficient robustness against environmental variations, both of which severely constrain practical deployment. This work proposes to embed secrets within the Wi-Fi legacy short training field (L-STF). The designed method preserves the autocorrelation properties of Wi-Fi L-STF, ensuring that packet detection and coarse frequency offset compensation functionalities remain uncompromised. The secret embedding and extraction processes employ a pair of neural networks designed to learn optimal embedding rules and maximize steganographic capacity. We developed a prototype system and conducted comprehensive experiments across both indoor and outdoor environments. Experimental results show that our method can reliably embed 46 secret bits within Wi-Fi packets across diverse channel conditions, achieving significantly enhanced steganographic capacity and environmental robustness. The hardware prototype study validates the feasibility of the proposed Wi-Fi information hiding scheme.

I. INTRODUCTION

Wi-Fi information hiding must provide useful secret capacity and withstand channel variation without disrupting ordinary Wi-Fi communication. This work embeds secrets in the L-STF and reports a 46-bit prototype tested indoors and outdoors.

I. INTRODUCTION

  • Prior Wi-Fi approaches were described as limited by static-environment assumptions or low capacity, while constellation manipulation can degrade payload decoding.The cited examples include a 2-bit-per-packet capacity for Shadow Wi-Fi and a static-environment limitation attributed to.Source: §I · p. 1
  • The proposed system embeds secrets in the Wi-Fi L-STF while preserving its periodic repetition property for packet detection and coarse frequency offset compensation.A paired neural network performs secret embedding and extraction.Source: §I · p. 2
  • TGn channel simulation during training and equalization of both the payload and L-STF are used to address channel variations.The trained model is described as deployable on real-world devices without fine-tuning.Source: §I · p. 2
  • 46 secret bits were embedded in the L-STF in prototype experiments across indoor and outdoor environments without affecting payload demodulation.The prototype used commodity SDR platforms.Source: §I · p. 2

II. RELATED WORK

  • Conventional media-hiding methods assume the cover can be stored and read back exactly, while image and audio methods are not directly transferable to wireless signals subject to fading, noise, and hardware impairments.The related work contrasts these settings with information hiding at the PHY layer.Source: §II · p. 2
  • Prior PHY approaches include covert Wi-Fi symbol-amplitude manipulation, LoRa amplitude modulation, and secret embedding that mimics transmitter hardware noise.The paper describes these as demonstrations of embedding secrets in conventional PHY waveforms.Source: §II · p. 3

III. SYSTEM OVERVIEW AND CHALLENGES

The system inserts a secret into Alice’s L-STF and has Bob recover it while retaining standard Wi-Fi payload demodulation. Its design addresses the linked challenges of preserving normal reception, surviving channel variation, and achieving sufficient capacity.

A. System Overview

  • Alice’s secret embedder distorts the L-STF while the remaining packet fields follow the Wi-Fi standard; Bob demodulates the unmodified fields and uses a paired extractor on the equalized L-STF.Bob reuses CSI estimated from the L-LTF to equalize the L-STF.Source: A. System Overview · p. 3

B. Motivation, Challenges and Solutions

  • The design challenges are to preserve standard Wi-Fi demodulation, keep secrets extractable after realistic multipath propagation, and achieve sufficient steganographic capacity.The embedding rule must satisfy these requirements together.Source: B. Motivation, Challenges and Solutions · pp. 3–4
  • Identical distortions across all ten short training symbols preserve L-STF periodicity, while payload equalization, L-STF equalization, and neural networks address channel effects and learned embedding and extraction.Training incorporates a TGn channel simulator; the payload waveform is kept unchanged.Source: B. Motivation, Challenges and Solutions · p. 4

IV. SECRETS EMBEDDING AT ALICE

The section selects the L-STF for secret embedding because its repeated structure supports synchronization functions that can be preserved. Keeping other packet fields unchanged protects standard Wi-Fi demodulation.

A. Selection of Secret Embedding Field

2) Function of Wi-Fi L-STF:

1) Wi-Fi Packet Structure:

  • The L-STF is suitable for embedding because modifying the L-LTF risks channel-estimation errors, while modifying L-SIG or DATA compromises payload integrity.The L-STF’s periodic structure can be maintained without degrading standard demodulation.Source: 1) Wi-Fi Packet Structure · p. 4

2) Function of Wi-Fi L-STF:

  • Identical distortions across repeated STSs preserve L-STF periodicity, maintaining packet detection and coarse CFO compensation.The design applies identical distortions to each repeated STS.Source: 2) Function of Wi-Fi L-STF · p. 5

B. Neural Network-based Secret Embedder

The embedder uses a neural network to introduce subtle distortions into the frequency-domain representation of an L-STF short training symbol. It changes only the 12 active subcarriers.

B. Neural Network-based Secret Embedder

  • The neural embedder introduces imperceptible distortions to the 12 active subcarriers of a frequency-domain STS to carry a secret message.The embedding function is denoted Nemb(·; θemb).Source: B. Neural Network-based Secret Embedder · p. 5
  • The frequency-domain STS is obtained by applying an FFT to four consecutive time-domain STSs.The passage identifies the representation as 64-point frequency-domain STS.Source: B. Neural Network-based Secret Embedder · p. 5
  • Figure 4 depicts the 1D-CNN architectures used for the secret embedder and extractor.Source: Figure 4 · p. 5

STS, X2

The embedder modifies the 12 active L-STF subcarriers, then converts the distorted STS to time domain and repeats it to form the L-STF. Identical distortions preserve the periodicity used for packet detection and coarse CFO compensation.

1) Network Architecture:

  • The 1D-CNN takes the secret and frequency-domain STS as input, and its skip connections retain access to the cover signal and secret while setting distortions.Real and imaginary STS values and the repeated secret form an input tensor of shape (2 + M, 12).Source: 1) Network Architecture · pp. 5–6

C. L-STF Generation

  • The distorted STS is zero-padded to 64 points, converted by IFFT, and its first 16 samples are repeated ten times to construct the L-STF.The IFFT output contains four identical STSs; the constructed L-STF preserves the periodic pattern.Source: C. L-STF Generation · p. 6
  • Identical distortions across ten repeated STSs preserve the 16-sample periodicity, keeping autocorrelation-based packet detection and phase-difference-based coarse CFO compensation effective.The design modifies the 12 active subcarriers while leaving null subcarriers unmodified.Source: C. L-STF Generation · p. 6
  • A visualization with a 14-bit secret shows slight time-domain distortion across the L-STF while retaining its 16-sample repetition pattern.The frequency-domain visualization shows amplitude modulation across the 12 active subcarriers.Source: C. L-STF Generation · p. 6, Figure 5 · p. 6

D. Wi-Fi Modulation and Packet Construction

The packet retains standard Wi-Fi waveform components outside the L-STF. At the receiver, standard demodulation and L-STF equalization support payload recovery and secret extraction.

A. Wi-Fi Demodulation

  • Bob uses the received L-STF for packet detection and coarse CFO compensation; preserved 16-sample periodicity keeps both operations effective.The L-LTF then supports fine synchronization and channel estimation using least-squares CSI estimation.Source: A. Wi-Fi Demodulation · p. 7
  • Because distortion is confined to the L-STF, the unmodified L-LTF, L-SIG, and DATA fields preserve standard Wi-Fi demodulation performance.The L-LTF supports channel estimation, while standard sequences and transmit processing generate the remaining packet fields.Source: D. Wi-Fi Modulation and Packet… · p. 6, A. Wi-Fi Demodulation · p. 7

B. L-STF Equalization

  • After payload demodulation, Bob equalizes the L-STF using CSI estimated from the L-LTF, then feeds the equalized signal to a neural secret extractor.Equalization mitigates channel-induced amplitude and phase distortions on the secret-bearing subcarriers.Source: B. L-STF Equalization · p. 7, §V · p. 7

C. Neural Network-Based Secret Extraction

A pre-trained neural secret extractor recovers messages from the equalized STS. Joint end-to-end training uses simulated channel effects and L-STF equalization to make the embedder and extractor adapt together.

C. Neural Network-Based Secret Extraction

  • After L-STF equalization, a pre-trained neural secret extractor processes the equalized STS to recover the embedded secret.Its output represents the extracted M-bit secret.Source: C. Neural Network-Based Secret… · p. 7
  • The extractor is a 1D-CNN that normalizes equalized frequency-domain STS inputs and maps their real and imaginary parts through convolutional layers to M output values.Adaptive average pooling and a fully connected layer produce the final output, which Tanh and sign functions convert to hard bit decisions.Source: C. Neural Network-Based Secret… · p. 7

A. End-to-End Training with Wireless Channel Simulator

  • End-to-end training concatenates the embedder and extractor and uses a TGn channel model to simulate multipath effects so the networks co-adapt to channel corruption.Training uses a CSI bank and added AWGN, followed by L-STF equalization before secret extraction.Source: A. End-to-End Training with Wireless… · pp. 7–8

B. Loss Functions

The loss function balances secret recovery accuracy against waveform perceptibility. Its weighting parameter sets the trade-off between recovery performance and covertness.

1) Secret Recovery Loss:

  • The secret loss penalizes discrepancies between transmitted and recovered secrets, driving the networks to minimize secret bit error rate.It measures the discrepancy between s and the recovered secret ˆs.Source: 1) Secret Recovery Loss · p. 8

2) Covertness Loss:

  • The covert loss limits distortion by enforcing similarity between the distorted and standard STS, constraining changes that could be detectable or disrupt synchronization.K represents the 12 active L-STF subcarriers.Source: 2) Covertness Loss · p. 8

3) Composite Loss:

  • The composite loss weights secret recovery against covertness; γ = 0.2 is used, with higher γ favoring imperceptibility and lower γ favoring capacity.The stated trade-off is reduced capacity at higher γ and increased detectability risk at lower γ.Source: 3) Composite Loss · p. 8

VII. SIMULATION EVALUATION

  • Simulations preliminarily validate the proposed scheme against the three core challenges identified in the paper.The passage introduces the simulation evaluation without reporting its results.Source: §VII · p. 8

A. Simulation Setting

Simulations found that embedding secrets in the L-STF preserved normal Wi-Fi packet detection, payload reception, and coarse CFO compensation. The evaluation used TGn channel simulations and repeated NN training runs.

1) Wi-Fi PHY:

  • The simulation pipeline generated 20 MHz SISO non-HT waveforms, sent them through TGn channels, then processed standard Wi-Fi reception stages before secret extraction.The receiver extracts the L-STF after packet detection, synchronization, and demodulation.Source: 1) Wi-Fi PHY · p. 8

2) Neural Network Training Configuration:

  • The NN pair was trained in PyTorch with RMSprop, batch size 64, initial learning rate 1 × 10−4, early stopping, and γ = 0.2.The scheduler reduced the learning rate after 30 consecutive epochs without validation-loss improvement; early stopping triggered after 50.Source: 2) Neural Network Training Configuration · p. 9

3) Evaluation Metric:

  • SBER measures bit-level differences between embedded and extracted messages using Hamming distance; each condition used ten independently trained pairs.Error bars are shown in the figures.Source: 3) Evaluation Metric · p. 9

B. Validation of Normal Wi-Fi Demodulation and Reception

  • Across 10,000 packets and 10–25 dB SNR, no packet loss occurred and every payload passed FCS validation.Packets were transmitted over TGn Model-B with random secrets of varying lengths embedded in the L-STF.Source: B. Validation of Normal Wi-Fi… · p. 9

1) Impact on Packet Detection Functionality:

  • Across 10,000 trials, distorted L-STF waveforms retained the autocorrelation plateau required for reliable packet detection and coarse timing synchronization.The comparison is between standard and distorted L-STF autocorrelation outputs at 15 dB.Source: 1) Impact on Packet Detection… · p. 9, Figure 7 · p. 9

2) Impact on Coarse CFO Compensation Functionality:

C. Evaluation of Steganographic Capacity

The evaluation examines simulated capacity, multipath robustness, and resilience to eavesdropping and jamming, alongside an over-the-air prototype. Secret recovery varies with secret length, channel equalization, and attack strength.

C. Evaluation of Steganographic Capacity

  • 14–46-bit secrets yielded experimental SBER below 0.17 at 10 dB, though errors exceeded simulation; FEC can mitigate them.At dense packet rates, secret throughput can reach tens of kilobits per second, while per-packet embedding capacity remains limited.Source: C. Evaluation of Steganographic Capacity · p. 10

D. Evaluation of Robustness to Channel Variations

1) Eavesdropping:

  • A mismatched extractor produced SBER near 0.5 at every secret length, while the authorized extractor ranged from 0.0052 to 0.0366.Eve knows the method, architecture, and training procedure, but not the weights shared by Alice and Bob.Source: Figure 11 · p. 10, 1) Eavesdropping · p. 10

2) Jamming:

  • At −20 dB jamming, SBER stayed close to baseline; at −10 dB, 46-bit secrets reached 0.1694 and required outer FEC for recovery.The jammer injects Gaussian noise; the attack also degrades the primary Wi-Fi link.Source: 2) Jamming · pp. 10–11, Figure 12 · p. 11

VIII. EXPERIMENTAL EVALUATION

  • The authors implemented a hardware prototype and conducted over-the-air experiments to validate the scheme.Source: §VIII · p. 11

A. Experimental Setting

The hardware evaluation tested payload reception, secret capacity, and indoor and outdoor channel robustness using simulation-trained models. Secret recovery remained workable across the tested settings, with performance varying by secret length, mobility, distance, and SNR.

A. Experimental Setting

B. Validation of Normal Wi-Fi Demodulation and Reception

C. Evaluation of Steganographic Capacity

  • 14–46-bit secrets yielded experimental SBER below 0.17 at 10 dB, though errors exceeded simulation; FEC can mitigate them.At dense packet rates, throughput can reach tens of kilobits per second, while per-packet embedding capacity remains limited.Source: C. Evaluation of Steganographic Capacity · pp. 11–12

IX. DISCUSSION

The discussion reports spectral similarity and extractor-weight secrecy, NN runtime and size, and compatibility with later Wi-Fi formats. The conclusion reports 46-bit secrets with worst-case SBER below 0.17 while preserving payload integrity across tested channel conditions.

A. Security Analysis

  • Secret-packet PSD coincided with standard Wi-Fi across occupied and out-of-band spectrum; recovery also requires extractor weights shared privately by Alice and Bob.Commodity chipsets do not expose raw preamble I/Q samples to conventional receivers.Source: Figure 19 · p. 13, A. Security Analysis · p. 13

B. Complexity Analysis

  • The embedder has 1,403,426 parameters, 5.61 MB size, and 0.301 ms/packet latency; the extractor has 1,390,816, 5.56 MB, and 0.411 ms/packet.Measurements were obtained on the workstation described in the simulation evaluation.Source: Table I · p. 13, B. Complexity Analysis · p. 13

C. Compatibility Analysis

  • The L-STF is retained in 802.11n, ac, ax, and be formats, so the framework can apply without modification; MIMO may require a different embedding strategy.Source: C. Compatibility Analysis · p. 13

X. CONCLUSION

  • The prototype embedded 46-bit secrets with worst-case SBER below 0.17 while preserving payload integrity across diverse channel conditions.The conclusion also reports that periodic L-STF structure remained preserved.Source: §X · p. 14
Loading 2610.13367v1…