RadKey: An LLM-Guided RF Backscatter System for Through-Wall Keystroke Inference

Computer Science > Cryptography and Security [Submitted on 8 Jun 2026] RadKey: An LLM-Guided RF Backscatter System for Through-Wall Keystroke Inference Qijun Wang, Chunqi Qian, Huacheng Zeng In today's digitally connected world, keyboards remain the primary interface for inputting sensitive information, making them a persistent target for eavesdropping attacks. While prior keystroke inference techniques have exploited side-channel signals such as acoustics and vibrations, they typically rely on conspicuous, short-range sensors and require victim-specific data for model training, limiting their practicality, scalability, and stealth. In this paper, we present RadKey, an RF backscatter system for covert, long-range, through-wall keystroke eavesdropping. RadKey comprises two components: a compact batteryless backscatter tag and an RF reader. The tag captures keystroke-induced vibrations and acoustic signals, modulating them onto the frequency shift of its backscattered RF signal using two magnetically-coupled LC resonators. This design also enables spectral separation between the excitation and backscatter signals, mitigating self-interference for the RF reader and thus extending eavesdropping range. The RF reader demodulates the backscattered RF signal to infer typed content. It employs a dedicated signal processing pipeline that extracts user- and keyboard-independent keystroke features across time and frequency domains, enabling strong generalizability. To further enhance adaptability, RadKey integrates an LLM for online adaptation, leveraging LLM outputs as pseudo ground-truth labels to refine the classifier during runtime. We have built a prototype of the full RadKey system and evaluated it through extensive over-the-air experiments. Results show that RadKey achieves accurate and robust keystroke inference across diverse users in real-world settings. A demo video is available at: this https URL Comments: Accepted to the 47th IEEE Symposium on Security and Privacy (IEEE S&P), 2026 Subjects: Cryptography and Security (cs.CR) Cite as: arXiv:2606.10148 [cs.CR]   (or arXiv:2606.10148v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2606.10148 Focus to learn more Related DOI: https://doi.org/10.1109/SP63933.2026.00160 Focus to learn more Submission history From: Qijun Wang [view email] [v1] Mon, 8 Jun 2026 20:26:41 UTC (2,544 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-06 Change to browse by: cs References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)