Zhenlin An

Research

Our group designs and builds wireless networking and mobile computing systems, validated through end-to-end implementations on custom hardware or off-the-shelf equipment. Below are the major research themes and selected publications from each project direction. The complete list lives on the Publications page.

Research overview: three stacked layers (AI-native wireless and radio twins, intelligent sensing, ubiquitous IoT networks) grounded in the physical world, with IoT security spanning all layers. AI-Native Wireless & Radio Twins model · simulate · reason · act Radio twins LLM agents Neural ray tracing sensed data and synthetic data feed learning; learned models drive sensing and control Intelligent Sensing perceive people, activities & surroundings Radio Acoustic Vibration RF + vision connectivity and raw signals from billions of low-power devices Ubiquitous IoT Network near-zero-power connectivity everywhere Efficient RFID Challenging media Cross-technology IoT Security trust across every layer Side channels Fingerprinting Metasurfaces Physical world — people · homes · buildings · concrete · water · the human body
How the four themes fit together: low-power IoT networks connect the physical world, sensing turns its signals into understanding, AI-native radio twins model and reason about it, and security keeps every layer trustworthy.

AI-Native Wireless and Radio Twins

Future wireless systems will be extraordinarily complex, and we believe AI should be designed into them from the ground up rather than bolted on afterward — an AI-native approach in which learning is a first-class part of how a system communicates and senses. Much like robotics, wireless has to cope with data that is scarce, high-dimensional, and highly diverse, largely because the radio environment itself is so complex. Our work therefore starts by building radio twins: physics-grounded, learnable simulations of the wireless environment that can generate large amounts of synthetic data on demand. On top of this foundation, we design AI-native wireless networks and AI-native wireless sensing systems that can be trained from synthetic data, real-world measurements, or both — for example, predicting mmWave beams for XR users before a blockage happens.

AI-native wireless loop: LLM agents turn a natural-language intent into a radio twin and simulation, observe the results, and store verified skills; the radio twin supplies synthetic data to AI-native networks and sensing systems, which return real measurements to calibrate the twin. Agentic layer “Simulate 28 GHz coverage in my lab with two APs.” LLM agents orchestrator + specialist workers Plan Build Simulate Verify learn reuse Self-evolving skill memory skills · fixes · failure roots act observe Radio twin physics-grounded · learnable · interactive Tx Rx Neural RF ray tracing NeRF2 · RadioTwin · RIS-NeRF2 · RadioSight synthetic data real data AI-native systems trained on synthetic + real data Networks • predictive mmWave beams for XR • RIS & antenna configuration • intent-driven experimentation Sensing • indoor localization • tracking & perception Real deployments commodity radios, 28 GHz phased arrays & testbeds
The AI-native loop. LLM agents turn an intent into a radio twin and a runnable simulation, then learn from what they observe. The twin generates synthetic data for AI-native networks and sensing, and real measurements flow back to keep it calibrated.

Most recently, we have put LLM agents into this loop. Setting up a valid wireless experiment means keeping scene geometry, radio materials, device placement, channel assumptions, and PHY settings consistent with one another, which normally takes an expert days. Our agents take a natural-language request, build the radio twin, run the simulation, and check the result for physical plausibility. Each failure is turned into a reusable skill, so the agents improve with every experiment. Because the radio twin is interactive, an agent can act within it, observe how the radio world responds, and improve from that feedback — closing the loop between simulation and reality. We are now applying the same self-evolving agent loop beyond wireless, to agents that build and refine pipelines for interpreting IoT sensing data in health and daily life.

Representative work

Intelligent Sensing Systems

Sensing pipeline: everyday radio, acoustic, vibration, and vision signals from commodity devices feed physics-aware learning, which infers where people are, how they move, what happens, and what is around them. Everyday signals from commodity devices Radio WiFi · RFID · mmWave Acoustic speakers · mics · earbuds Vibration read by mmWave & RFID Vision cameras fused with RF runs on commodity hardware Physics-aware learning signal models + deep / foundation models Understanding of people & environments Where indoor localization How they move gestures & fine-grained motion What happens activities & hidden vibrations What's around letting radios “see”
Ordinary signals from commodity devices, combined with physics-aware learning, reveal where people are, how they move, what is happening, and what is around them.

The same physical signals that carry data also carry rich information about the world they travel through. We build sensing systems that turn ordinary signals — radio, acoustic, and vibration — into an understanding of people, their activities, and their surroundings. This includes localizing devices and people indoors, fusing radio with vision so that radios can effectively “see,” sensing fine-grained motion and gestures using the microphones and speakers already in everyday devices, and reading subtle vibrations that reveal what is happening around a sensor. The aim is perception that runs on commodity hardware, without instrumenting the environment.

Representative work

Ubiquitous IoT Network

Ubiquitous IoT: a reader steers beams over many RFID tags; backscatter links reach into concrete, water, and the human body; cross-technology bridges let WiFi, RFID, AM radio, NFC, and cameras talk directly. Efficient RFID many tags, read fast and in parallel reader Spatial control & smart protocols NSDI'24 · MobiCom'17 · INFOCOM'19 Into challenging media links where radios usually fail Concrete Water Body MobiCom'24 · SIGCOMM'22 · INFOCOM'21 Cross-technology bridges devices never meant to talk, talking WiFi RFID RFID AM radio NFC Camera Direct, gateway-free links MobiCom'18 · MobiCom'21 · MobiCom'23
Three ways we stretch off-the-shelf low-power devices: reading many tags at once, reaching into concrete, water, and the body, and letting different technologies talk directly.

Billions of devices are already deployed around us — RFID tags, NFC chips, backscatter radios — yet each was designed for a single narrow task. We stretch these off-the-shelf, ultra-low-power devices far beyond their original specifications, turning them into a connectivity fabric that reaches places conventional networks cannot. This work makes RFID systems faster and more scalable, pushes communication into challenging media such as concrete, water, and the human body, and lets heterogeneous technologies that were never meant to interoperate — WiFi, RFID, NFC, AM radio, and cameras — talk directly to one another. The goal is ubiquitous, near-zero-power connectivity woven invisibly into the physical world.

Representative work

IoT Security

IoT security: attackers inject forged signals into a device and eavesdrop on its leakage through physical channels; defenses identify devices by hardware fingerprints and block leakage with metasurfaces, treating the physical layer as a security boundary. Offense find physical-layer threats first attacker inject forged signals eavesdrop on leakage magnetic audio injection · S&P'23 RF audio eavesdropping · INFOCOM'24 IoT device physical layer as a security boundary metasurface identify by hardware Defense protection on commodity hardware Hardware fingerprinting RF-DNA (MobiCom'22) · NFC (INFOCOM'23) Metasurface shields MetaRFence (INFOCOM'25 · TMC'26)
We look for physical-layer attacks before adversaries do (left), and build defenses that run on commodity hardware (right).

Every new sensing or communication capability is also a new attack surface. We study physical-layer threats in wireless and sensing systems before adversaries do, and turn that understanding into practical defenses that run on commodity hardware. On the offensive side, we reveal how ordinary devices can be coerced into leaking information or accepting forged signals through unintended physical channels. On the defensive side, we build physical-layer fingerprinting and metasurface-based protection that authenticate devices and shield users’ privacy without requiring new hardware. Treating the physical layer as a first-class security boundary, this work aims to make pervasive wireless and IoT systems trustworthy by design.

Representative work