arXiv CSopen access

"Take Me Home, Wi-Fi Drone": A Drone-based Wireless System for Wilderness Search and Rescue

arXiv:2604.09115v1 [cs.NI] 10 Apr 2026

"Take Me Home, Wi-Fi Drone": A Drone-based Wireless System for Wilderness Search and Rescue Weiying Hou

Luca Jiang-Tao Yu

Chenshu Wu

The University of Hong Kong [email protected]

The University of Hong Kong [email protected]

The University of Hong Kong [email protected]

ABSTRACT

KEYWORDS

Wilderness Search and Rescue (WiSAR) represents a longstanding and critical societal challenge, demanding innovative and automatic technological solutions. In this paper, we introduce Wi2 SAR, a novel autonomous drone-based wireless system for long-range, through-occlusion WiSAR operations, without relying on existing infrastructure. Our basic insight is to leverage the automatic reconnection behavior of modern Wi-Fi devices to known networks. By mimicking these networks via on-drone Wi-Fi, Wi2 SAR uniquely facilitates the discovery and localization of victims through their accompanying mobile devices. Translating this simple idea into a practical system poses substantial technical challenges. Wi2 SAR overcomes these challenges via three distinct innovations: (1) a rapid and energy-efficient device discovery mechanism to discover and identify the target victim, (2) a novel RSS-only, long-range direction finding approach using a 3D-printed Luneburg Lens, amplifying the directional signal strength differences and significantly extending the operational range, and (3) an adaptive drone navigation scheme that guides the drone toward the target efficiently. We implement an end-to-end prototype and evaluate Wi2 SAR across various mobile devices and real-world wilderness scenarios. Experimental results demonstrate Wi2 SAR’s high performance, efficiency, and practicality, highlighting its potential to advance autonomous WiSAR solutions. Wi2 SAR is open-sourced at https://aiot-lab.github.io/Wi2SAR to facilitate further research and real-world deployment.

Wilderness search and rescue, Drone-based wireless system, Wi-Fi localization, 3D Printing, Metamaterial, Luneburg lens

CCS CONCEPTS • Human-centered computing → Ubiquitous and mobile computing systems and tools; • Networks → Wireless local area networks; • Computer systems organization → Robotics; Embedded and cyber-physical systems.

This work is licensed under a Creative Commons Attribution 4.0 International License. MobiCom ’26, October 26–30, 2026, Austin, TX, USA © 2026 Copyright held by the owner/author(s). ACM ISBN 979-8-4007-2505-0/26/10. https://doi.org/10.1145/3795866.3796679

ACM Reference Format: Weiying Hou, Luca Jiang-Tao Yu, Chenshu Wu. 2026. "Take Me Home, Wi-Fi Drone": A Drone-based Wireless System for Wilderness Search and Rescue. In The 32nd Annual International Conference on Mobile Computing and Networking (MobiCom ’26), October 26– 30, 2026, Austin, TX, USA. ACM, New York, NY, USA, 16 pages. https://doi.org/10.1145/3795866.3796679

1

INTRODUCTION

Wilderness Search and Rescue (WiSAR) has become an increasingly critical societal challenge due to the rising popularity of outdoor activities, particularly mountaineering [16, 24]. Missing person incidents have increased markedly, e.g., cases in England and Wales have grown by an average of 11% annually since 2016 [51]. Victims are often unable to rescue themselves due to the high injury rate in these incidents [51]. Furthermore, despite carrying mobile phones, they are frequently incapable of calling for help because of weak or unavailable cellular, GPS, and satellite connectivity in remote, forested terrain [5, 14, 34]. Consequently, many missing person cases are reported by their families or friends only after the individual is overdue. These circumstances underscore the critical importance of timely rescue, compelling rescue teams to act swiftly to precisely locate the missing person. Traditional WiSAR methods primarily rely on ground teams conducting grid searches based on a Last Known Position (LKP) provided by the victim’s friends or family, which is time-consuming, and often inadequate in vast and complex terrain. Recently, fueled by the booming low-altitude economy (LAE) technologies, drones have emerged as a powerful ally for WiSAR [17], rapidly scanning vast landscapes and dense vegetation where human-led searches often struggle [31]. However, existing drone-aided WiSAR systems primarily rely on RGB and thermal cameras [5, 31, 36, 40, 45], which fail under blockages from forest canopies or rugged rocky areas, precisely where disappearances are most common. Radio frequency (RF) signals have emerged as a promising alternative as they can penetrate visual obstructions. Prior work has explored millimeter-wave (mmWave) radar for vital sign detection [59], but such faint signals vanish in

MobiCom ’26, October 26–30, 2026, Austin, TX, USA

outdoor conditions, underscoring a need for new RF-based solutions for WiSAR conditions. In this paper, we explore and leverage a new opportunity to shift the paradigm of drone-aided WiSAR from searching human figures to locating accompanied radio devices. We observe that most individuals lost in the wilderness carry a mobile device (e.g., a smartphone, smartwatch, or AirTag) [14], whose signals can serve as a persistent life pulse. By leveraging these signals, victims can be rapidly pinpointed even beneath dense forest canopies or in rugged terrain, overcoming the limitations of conventional optical and thermal approaches and largely broadening the odds of survival through timely rescue. Building upon this simple but effective insight, we introduce Wi2 SAR, a novel drone-based wireless system that exploits ubiquitous Wi-Fi signals for accurate and automatic victim search in wilderness environments. Wi2 SAR harnesses the automatic reconnection behavior of modern Wi-Fi devices, which reconnect to known networks upon detecting their beacons. By simulating a known Wi-Fi Access Point (e.g., home router) on the drone, Wi2 SAR can elicit identifiable packets from the target devices, effectively serving as life signals that navigate the drone to progressively converge on the victim’s location. Despite this straightforward principle, translating it into a practical and deployable system poses substantial challenges: • Victim Discovery: Victim discovery in a relatively large area without an exact location is the foremost challenge in WiSAR, where the primary objective is to detect the victim’s device as quickly and from as great a distance as possible. Achieving this with standard Wi-Fi networks in the context of WiSAR is non-trivial, since Wi-Fi radio on commodity smartphones typically communicates with a range of tens of meters, adequate for most indoor applications but not for WiSAR scenarios. As it is impossible to apply any changes to the victim’s Wi-Fi devices in advance, how to passively increase the communication range in a non-cooperative way calls for an innovative design. • Target Localization: Building on the discovery phase, once the victim’s device is locked onto, the drone must rapidly approach the target to narrow the search space and maintain reliable connectivity, demanding a robust localization solution in a standard Wi-Fi network. Traditional Wi-Fi trilateration techniques based on multiple range measurements are inadequate for this scenario, as they typically rely on external anchor infrastructure and can hardly guide the drone towards the target. Therefore, accurate direction finding in 3D space is critical to ensure that the drone continually closes in on the victim and stays within the communication range, rather than flying away from it. Despite extensive research on Angle-of-Arrival (AoA) estimation using Wi-Fi signals, they generally focus on short-range,

Hou et al. Victim Discovery (§3.1) SSID PSK

Antenna array

Wi2SAR APs

3D Angle xxx Estimation

Beacon Broadcasting Conn. Request Key (Saved key) Verification Drone Navigation (§3.3) Verified! Start

Direction Finding (§3.2) RSSI (Yaw, Pitch, Roll)

Exploratory Search Phase

Last Known Position

Drone Pose Compensation Heading Direction

Drone Pose

(azimuth, elevation)

Guided Search Phase

Stop Criterion

Search Scheme

Figure 1: Overview of Wi2 SAR System. controlled 2D indoor environments with carefully arranged and calibrated phased arrays and known anchors as references [22, 27, 37, 54]. Unfortunately, these assumptions do not hold for WiSAR, where the drone, flying high above the ground, must perform 3D direction finding over very long distances with signals barely above the noise floor using an in-motion antenna array. • Drone Navigation: After establishing the victim’s direction, the drone must translate these angular estimates into navigation commands that progressively refine its flight trajectory. Ensuring uninterrupted communication coverage is essential to avoid disconnection and unnecessary delays. Moreover, efficient navigation reduces the number of packets that need to be exchanged with the victim’s device, indirectly helping to conserve its limited battery, which is critical in life-or-death situations. Implementing Wi2 SAR as a real-time, end-to-end system on a commodity drone introduces additional layers of complexity. As outlined in Fig. 1, Wi2 SAR addresses these challenges through three novel modules. ■ Long-Range Victim Discovery (§3.1): To enable reliable victim discovery at long distances, Wi2 SAR leverages a 3Dprinted Luneburg Lens, a gradient-index spherical lens that concentrates incident signals on its surface and amplifies both downlink and uplink transmissions. Wi2 SAR periodically broadcasts beacon frames for a known network. This network is defined by its Service Set Identifier (SSID), the name of the Wi-Fi network, and credentials, such as a PreShared Key (PSK), both of which are provided when the incident is reported, enabling the system to trigger an authenticated auto-reconnection from the victim’s device and elicit identifiable packets. By combining amplification and authentication, Wi2 SAR can reliably identify the victim’s signal from background noise, even at significant distances. ■ Amplitude-Only 3D AoA Estimation (§3.2): Beyond range amplification, Wi2 SAR exploits the Luneburg Lens’s

Wi2 SAR

focusing property to enable direction estimation without a calibrated phased array. Concentrated signals on distinct surface regions encode spatial angles as measurable Received Signal Strength (RSS) patterns, allowing a lightweight RSSonly algorithm to extract both azimuth and elevation from a single packet. By eliminating the need for phase calibration, the design remains robust on a flying platform and effective even where conventional Wi-Fi arrays fail. ■ Direction-Guided Drone Navigation (§3.3): Wi2 SAR executes a dual-phase search scheme. It begins with an exploratory grid-based phase to cover a large area and discover the target. Once the victim’s device signal is detected and verified, the system transitions into a direction-guided approach phase, where the drone continuously refines its heading using reliable direction estimates. The search terminates upon meeting a stop criterion determined by the estimated 3D direction, indicating the target is directly below, where the drone reports the final location to the ground rescue team. Summary of results: We prototype Wi2 SAR on a commercial drone platform by integrating a low-cost 3D-printed Luneburg Lens array with commodity Wi-Fi modules. The system runs in real time, feeding live AoA estimates into drone navigation to achieve an end-to-end WiSAR pipeline. We evaluate it in four representative environments with varying forest coverage and terrain complexity. Results show up to 104% extension of the working range compared to a traditional antenna array without a Luneburg Lens on the 5 GHz band, robust 3D direction estimation with a median angular error of 18.4◦ , and efficient search over 160,000 m2 within 13.5 minutes with 100% discovery rate of target devices. In a field-like WiSAR case study in a forested area of 40,000 m2 , Wi2 SAR discovers the victim’s device within 4 minutes and reports a final localization error of 5 m. These outcomes highlight Wi2 SAR’s strong potential for practical deployment. Contribution: Our core contributions are as follows: • We design Wi2 SAR, the first automatic WiSAR system using the drone-based Wi-Fi network to discover and locate a victim without any infrastructure support. • We propose an RSS-only, long-range 3D AoA estimation method built on a 3D-printed Luneburg Lens, significantly extending the operational range. • We implement Wi2 SAR as an integrated real-time system on a consumer drone and validate its performance through extensive experiments in realistic mountain environments.

2 WI2 SAR SCOPE AND DESIGN CHOICES WiSAR missions can vary significantly across cases. In Wi2 SAR, we focus on a representative subset of common scenarios where a missing person is reported by an emergency contact (e.g., a friend or relative of the victim) usually because the individual is overdue [14, 51]. Rather than attempting

MobiCom ’26, October 26–30, 2026, Austin, TX, USA ① Victim Discovery

② Direction Finding Direction Found!

Autoreconnected!

🤕 SOS

③ Drone Navigation Guided

Located & Report! Luneburg Lens

🤕 SOS

🎯 🥹 SAFE

Figure 2: Typical Working Scenario. to address all possible situations, Wi2 SAR is designed as a best-effort solution aimed at maximizing applicability across diverse cases to save lives. Scope: Again, we are motivated by the goal of maximizing the chance of survival through timely rescue, rather than covering all WiSAR scenarios, which is practically impossible. Our current design leverages the auto-reconnection behavior of Wi-Fi under several conditions: 1) LKP and known network information: In typical scenarios involving an emergency report, the emergency contact can provide the victim’s Last Known Position (LKP), e.g., the last message/picture indicating the victim’s hiking destination, as well as the credentials1 of a known Wi-Fi network (i.e., SSID and PSK of the victim’s home router), which are typically stored in plain text on mainstream mobile devices of the reporter. In practice, this process can be streamlined via an official emergency App; 2) Powered devices: We assume that the victim’s smartphone or other Wi-Fi gadgets remain operational with Wi-Fi enabled. While this assumption does not apply to all the cases, it covers a significant portion of them, e.g., when the victim gets injured and/or lost and cannot return, his/her phone will still be functional given that modern phones have long battery life and a majority of users keep Wi-Fi constantly on for convenience2 ; 3) Device proximity: The victim’s smartphone will not be far from the victim, if not co-located with them; 4) WiSAR scope: The current Wi2 SAR mainly targets victim search (i.e., discovery and localization), and the rescue operations after finding the victim are out of our scope; 5) Single drone: We primarily focus on single-victim search using a single drone. Nevertheless, Wi2 SAR naturally extends to multiple victims, e.g., through SSID-multiplexed identification and dynamic prioritization of discovered devices; Wi2 SAR also extends to multiple drones, yet we keep it as future work to explore optimized multi-drone coordination. Typical Working Scenario: As illustrated in Fig. 2, Wi2 SAR integrates its modules in a typical wilderness search case. 1 If unavailable, Wi2 SAR falls back to utilizing public Wi-Fi (see §6). 2 Our survey of 115 users on phone usage behaviors shows that around 78.1% users keep Wi-Fi constantly activated during outdoor activities and the ratio goes to 91.0% in daily life.

MobiCom ’26, October 26–30, 2026, Austin, TX, USA

Consider a hiker who gets lost in a dense forest while mountaineering. The emergency contact reports the incident to the local search and rescue team, providing both the victim’s Last Known Position (LKP) and the SSID and password of the victim’s home Wi-Fi network. With this information, Wi2 SAR configures a drone to mimic the known AP and initiates a grid-based exploratory flight centered around the LKP. During this phase, the Victim Discovery Module (§3.1) continuously broadcasts beacon frames of the specified SSID. When the victim’s smartphone detects the beacons and attempts to reconnect, identifiable traffic is generated. The Direction Finding Module (§3.2) then estimates both azimuth and elevation of the signals, even under occlusions such as thick foliage, enabling the Drone Navigation Module (§3.3) to adjust the drone’s heading toward the victim. Once the drone is nearly overhead, indicated by an elevation angle approaching 90◦ , Wi2 SAR pinpoints the victim’s location. Why Wi-Fi Signals?: Modern mobile phones are equipped with multiple wireless technologies, including satellite communication (SatCom), GNSS, ultra-wideband (UWB), cellular networks (e.g., 4G-LTE/5G-NR, 6G), Bluetooth Low Energy (BLE), and Wi-Fi. To select which of these signals can serve as a practical beacon in drone-aided WiSAR, we outline five requirements. ❶ The signal should rely on native protocols so that it works on most devices without additional applications or modifications. ❷ It cannot assume the lost person is able to cooperate, since they may be injured or unconscious [51]. ❸ The signal must enable direct identification without carrier or police involvement, as such procedures are slow. ❹ The identifier must be persistent and uniquely bound to the victim or their device, rather than anonymized (e.g., randomized). ❺ The effective range should be sufficiently long to penetrate wilderness obstacles, and the signal must also provide reliable directional cues for drone navigation. Tab. 1 compares wireless signals against these requirements. While existing signals fail to meet all requirements directly, Wi-Fi offers unique potential. Although its identifiers, MAC addresses, are usually randomized [20], we observe that most Wi-Fi devices automatically reconnect to previously saved networks upon detecting their beacons. This auto-reconnect behavior provides an opportunity to natively elicit persistent and identifiable signal from non-cooperative devices. Fortunately, this network information can be provided at the time of reporting by the lost person’s family or friends, who share the same network with the victim, satisfying requirements ❶–❹. Beyond connectivity, this credential-based authentication distinguishes the target, helping to filter out signals from other active devices, such as those of rescue personnel or bystanders. However, Wi-Fi still falls short of requirement ❺: Its practical range is limited under forest or rocky occlusions, and accurate AoA estimation is difficult on an in-motion drone using commodity NICs. These challenges

Hou et al.

Table 1: Comparison of RF Signals Against WiSAR Req. Signal

Range

ID Type

Limitations & Req. violated

SatCom GNSS UWB Cellular BLE Wi-Fi

Regional Global 5–10 m km-level 10–100 m ∼100 m

Caller ID (RX only) Device ID IMEI/IMSI MAC addr. MAC addr.

Limited device/region; need LoS[33] ❶❺ Need active sharing, and LoS[35] ❷❺ Very short range; need LoS[11] ❺ Need carrier/police coordination[5] ❸❺ Randomized MAC[58] ❹❺ Randomized MAC[20] ❹❺

motivate Wi2 SAR’s design in §3, where we introduce three modules that jointly address both the long-range limitation and the AoA challenge for drone-based WiSAR.

3 WI2 SAR DESIGN 3.1 Victim Discovery The vast search area is one of the most critical challenges in WiSAR. Search and rescue teams can often obtain the victim’s Last Known Position from emergency contacts, but this only provides a vague starting point. In practice, the search area may span hundreds of square miles [36]. The terrain is often rugged and covered with dense forests, which further compounds the challenge and makes it nearly impossible for manpower alone to cover every corner. More critically, the so-called golden hour in WiSAR, when the victim’s survival chances are highest, demands rapid discovery. Confirming only the presence of a victim in a certain region can dramatically narrow the search scope and accelerate rescue operations. Thus, detecting a victim swiftly within a broad area, even without precise coordinates, is often more urgent than immediately pinpointing the exact location. We observe a promising opportunity for rapid victim discovery through Wi-Fi enabled devices that almost always accompany individuals [14]. If these devices can be reliably authenticated, Wi2 SAR can confirm a victim’s presence quickly even at long range. At first glance, periodic probe requests generated by smartphones during network scanning may appear to be useful evidence of nearby devices [21]. However, it is infeasible to obtain the hardware-specific MAC address of the victim’s accompanying device; more importantly, recent large-scale studies [9, 20] show that modern smartphones frequently randomize their MAC addresses during probing, which makes MAC-based identification unreliable. Auto-reconnection Behavior: Our approach instead leverages the auto-reconnection behavior common to commercial Wi-Fi devices. When a device detects a known network, it automatically attempts to reconnect using stored credentials. In most home and office deployments, these credentials are based on pre-shared keys, most commonly WPA2-PSK3 . We 3 Although WPA/WPA2-PSK has known vulnerabilities [46], it remains the

most widely used in practice. Our field survey shows that 99.2% of 237

Wi2 SAR

MobiCom ’26, October 26–30, 2026, Austin, TX, USA

3.2

Direction Finding

Once the target device’s packet is successfully elicited and authenticated, Wi2 SAR must navigate the drone within the device’s coverage robustly, and locate the device precisely and rapidly. Conventional range-based trilateration [1, 47] is ill-suited for the initial search phase in WiSAR. (1) Lack of directionality: trilateration infers position from scalar ranges and does not directly provide a bearing for closedloop navigation. Without directional guidance, the drone might inadvertently move away from the target instead of toward it, wasting time and weakening the signal. (2) Moreover, reliable ranging is hard to obtain in WiSAR setting: time-of-flight ranging is impractical with unsynchronized transceivers [27, 43, 47], and RSS-based path-loss models [7] break down under canopy and rugged terrain. Therefore, Wi2 SAR uses AoA estimation to obtain a bearing from the outset and benchmarks against direction-based methods (e.g., AoA/triangulation) in §5.2.2. Many existing AoA estimation methods rely on subspace separability such as MUSIC [22, 27, 54]. While highly accurate indoors, they presuppose carefully calibrated phased arrays and stable 2D environments with known anchors. Our comparison study in §5.2.2 shows that an ArrayTrackstyle MUSIC baseline [54] implemented on a Phaser-style array [22] degrades by over 10× when phase drift cannot

networks relied on pre-shared keys, predominantly WPA/WPA2-PSK, with a small fraction (4.6%) using WPA3-Personal (SAE). 4 Our survey covers 11 smartphones from Apple, OPPO, Google, Honor, MI, and Vivo, as well as an Apple tablet and smartwatch.

z

(b)

r x

sheet-Gyroid lattice with graded volume fraction

Volume fraction (%)

(a)

y

Plane Wave

Electric field (V/m)

(d)

(c) 2R = 15 cm

leverage this feature by configuring the drone to broadcast beacon frames that mimic a trusted private network at standard 100 ms intervals. This strategy relies entirely on the native Wi-Fi stack, requiring no custom App installation on the victim’s device. Since it utilizes standard background scanning and authentication processes, the energy overhead is comparable to typical phone usage. When the victim’s device initiates the authentication sequence, the standard WPA2-PSK four-way handshake confirms that the device holds the correct credentials. While this does not prove the device’s unique identity, it strongly indicates that the victim is present in the search region, allowing Wi2 SAR to quickly narrow the search area to the signal coverage range. To the best of our knowledge, our Wi2 SAR is the first WiSAR system to leverage standard Wi-Fi auto-reconnection for victim discovery in WiSAR. We validate its feasibility through a device survey, which shows that smartphones, tablets, and smartwatches from a range of manufacturers4 consistently reconnect to familiar networks once in range, thereby enabling rapid victim identification before fine-grained localization.

Figure 3: Design and Fabrication of the Luneburg Lens. (a) Cutaway showing graded sheet-Gyroid lattice with spherical coordinates. (b) Radial volume-fraction profile. (c) 3Dprinted prototype, diameter 15 cm. (d) COMSOL [13] fullwave simulation of the 15-cm Luneburg Lens at 5.745 GHz, showing electric-field focusing at the antipode. be controlled in the air. Moreover, subspace estimators fundamentally assume adequate SNR and inter-element phase coherence to keep signal and noise subspaces separable [23]. In Wi2 SAR, by contrast, the first packets captured by a highaltitude drone are often close to the noise floor, making such methods unstable at long ranges. Finally, few systems perform 3D AoA, and those are typically validated only at short distances indoors [48, 60], whereas Wi2 SAR demands robust azimuth and elevation estimation across hundreds of meters. To overcome these challenges, we introduce a Luneburglens front-end and propose an amplitude-only 3D AOA estimator that works reliably at near-noise-floor SNR, avoids fragile phase synchronization, and scales well to long-range, non-cooperative WiSAR missions under aerial mobility. Luneburg Lens: Luneburg Lens [30] originates in optical physics and has been adapted to electromagnetics for high-gain antennas [50] and mmWave backscatter retroreflectors [38]. Its gradient refractive index concentrates an incident plane wave to a focal point on the opposite surface of the sphere (see Fig. 3d). For an ideal lens with radius 𝑅, the relative permittivity 𝜀 (𝑟 ) at radial distance 𝑟 follows 𝜀 (𝑟√︁) = 2 − (𝑟 /𝑅) 2 ; equivalently, the refractive index is 𝑛(𝑟 ) = 2 − (𝑟 /𝑅) 2 . A practical implementation is feasible with consumer-grade 3D printers (see Fig. 3a–c and §4.2). For WiSAR, two properties of Luneburg Lens are especially valuable. First, its passive focusing provides high aperture gain with theoretical full-sphere coverage; practically we search a hemisphere because the lens is positioned above

MobiCom ’26, October 26–30, 2026, Austin, TX, USA (a)

(b)

24 deg

24 de

Hou et al.

(c)

wavelength. Since RX directionality is usually measured in dB, we denote by 𝑦𝑖 the received RSS at antenna 𝑖 located at 𝐿𝑖 in dBm, and by 𝐵 0dB (·) the RX template in dB. We obtain the per-antenna observation model
𝑦𝑖 = 𝐵 0dB 𝑅𝒖−1 𝐿𝑖 + 𝛽 + 𝑛𝑖 , 𝑛𝑖 ∼ N (0, 𝜎 2 ), (4)

30 deg

g

30 deg

Figure 4: Luneburg Lens Beam Patterns. (a) COMSOL simulation, (b) measured beam, and (c) chamber setup; in (a,b), the blue–red color scale indicates signal strength. the target. We therefore use a reference beam template 𝐵 0 on the lens surface, obtained once at design time (e.g., a single far-field characterization in a microwave anechoic chamber, rather than per-deployment or on-the-fly calibration). Second, the focusing property produces a deterministic three-dimensional distribution of the electric field on the lens surface, so a plane wave 𝒖 from (𝜃, 𝜙) maps to a characteristic magnitude pattern across receivers affixed to the surface. By spherical symmetry, the received beam pattern 𝐵 u for an arbitrary incident direction 𝒖 is a rotated version of 𝐵 0 . We exploit this property to enable amplitude-only inference of 𝒖 from RSS samples across receivers, replacing complex interelement phase calibration with a one-time characterization. RSS-Only 3D AOA Algorithm: Building on the above properties of the Luneburg Lens, we describe our amplitude-only 3D direction estimation method. Since the Luneburg Lens is positioned mainly above the target, we restrict the search domain to the upper hemisphere Ω = { (𝜃, 𝜙) | 𝜃 ∈ [0, 𝜋2 ], 𝜙 ∈ (−𝜋, 𝜋] }.

(1)

Let 𝒖 (𝜃, 𝜙) = [cos 𝜃 cos 𝜙, cos 𝜃 sin 𝜙, sin 𝜃 ] ⊤ denote the unit incident direction vector. Denote 𝑅𝒖 as the rotation matrix that aligns the reference (boresight) focal direction with the incident direction 𝒖. Let the reference beam template on the lens surface be the continuous function 𝐵 0 : Ω → R measured once in far-field conditions (see Fig. 4b). When a plane wave impinges from 𝒖, the induced surface distribution, i.e., the received beam pattern, is a rotated version of 𝐵 0
𝐵 𝒖 (𝜉) = 𝐵 0 𝑅𝒖−1 𝜉 , 𝜉 ∈ Ω. (2) We measure the received beam pattern using 𝑁 antennas 𝑁 ⊂ Ω. For the placed at known surface locations L = {𝐿𝑖 }𝑖=1 𝑖-th antenna, the received power satisfies Friis law  2 𝜆 𝑃𝑟,𝑖 = 𝑃𝑡 𝐺𝑡 𝐺𝑟 (𝒖; 𝐿𝑖 ) , (3) 4𝜋𝑑 where 𝑃𝑡 is the transmit power (from victim’s target device), 𝐺𝑡 is the TX gain5 , 𝐺𝑟 (𝒖; 𝐿𝑖 ) = 𝐵 𝒖 (𝐿𝑖 ) is the RX directionality at location 𝐿𝑖 (considering Lens directional gain and radiation pattern of RX antenna), 𝑑 is the range, and 𝜆 the 5We assume TX antenna is omnidirectional, thus, 𝐺

𝑡 is a constant.

where direction-independent terms are absorbed into the offset 𝛽 (e.g., 𝑃𝑡dBm , 𝐺𝑡dB , distance-dependent large-scale path loss, average canopy penetration loss, and fixed RX-chain constants). The residual 𝑛𝑖 captures unmodeled fluctuations (e.g., multipath and measurement noise) and is approximated as i.i.d. Gaussian in dB. Over all 𝑁 antennas, we stack the measurements and residuals as 𝒚 = [𝑦1, . . . , 𝑦𝑁 ] ⊤, 𝒏 = [𝑛 1, . . . , 𝑛 𝑁 ] ⊤, 𝒏 ∼ N (0, 𝜎 2 𝑰 ), and define the template vector ⊤  𝒔 (𝒖) = 𝐵 0dB (𝑅𝒖−1 𝐿1 ), . . . , 𝐵 0dB (𝑅𝒖−1 𝐿𝑁 ) .

(5)

(6)

To eliminate the unknown offset 𝛽, we remove the mean of both 𝒚 and 𝒔 (𝒖) by subtracting their sample means, yielding 𝒚˜ and 𝒔˜ (𝒖). Thus, the estimated incident direction derived from Least Squares method can be written as: 2

𝒔˜ (𝒖) ⊤ 𝒚˜ . (7) 𝒖 ∈Ω ∥ 𝒔˜ (𝒖) ∥ 2 ∥𝒚∥ ˜ 2

𝒖ˆ = arg min 𝒚˜ − 𝒔˜ (𝒖) 2 = arg max 𝒖 ∈Ω

This method has two advantages. First, it matches the measured zero-mean RSS to the template beam pattern, making it insensitive to unknown transmit power and directionindependent large-scale loss, and avoiding fragile RSS pathloss fitting. Second, it is amplitude-only: it exploits the spatial RSS pattern shaped by the Luneburg Lens without phase calibration, thereby sidestepping the synchronization requirements of phase-based AoA. Antenna Layout Considerations: The antenna layout L critically affects how the continuous beam pattern is discretized into the sampled vector 𝒔 (𝒖), thereby determining the resolution and robustness of our estimator. To support reliable direction estimation, we adopt a layout that emphasizes the upper hemisphere, where the Luneburg Lens concentrates most energy, and provides balanced angular sampling across azimuth and elevation (see § 4.2 for details).

3.3

Drone Search Scheme

To effectively localize a victim starting from a potentially outdated or imprecise LKP provided by emergency contacts, we design our Wi2 SAR to follow a dual-phase search scheme. Our goal is to progressively resolve positional uncertainty: we first explore the entire area of interest while broadcasting known network beacons to elicit potential connection

Wi2 SAR

MobiCom ’26, October 26–30, 2026, Austin, TX, USA

Guided Searc h

Target

Target Found!

Intel AX200 DJI E-port x10

Autoconnected!

Side-view

PCIe Riser

FPC Antenna

Foam

Connected!

Raspberry Pi CM4

Exploratory Search Guided Search

Start

Luneburg Lens

DJI Matrice 350 RTK drone

Target

Grid

② Packets Buffer (Four cases) ① Dual-mode NICs

Overhearing

AP3 Monitor3 AP2 Monitor2

attempts, and then, once the target device is locked on, converge on the victim’s device through signal-guided navigation. The process concludes once a robust geometric termination criterion is satisfied, as illustrated in Fig. 5. Phase 1: Exploratory Search: The objective of this phase is to guarantee comprehensive coverage around the LKP and ensure that no potential victim device remains undetected. At the start, our drone executes a deterministic zigzag trajectory that comprehensively sweeps the uncertainty region. We design the grid spacing to be twice our system’s reliable operational range, which ensures that any active device within the area will be captured by at least one flight leg. This phase ensures that the victim’s signal is detected before the search narrows to fine-grained localization in the next phase. Phase 2: Guided Search: Once our system detects and authenticates a victim’s signal, Wi2 SAR transitions to the guided search phase. Here, the drone leverages our 3D direction estimates to directly navigate toward the source. This creates an iterative refinement loop: as the drone moves closer, the signal becomes stronger, which improves AoA accuracy and further accelerates convergence, leading to a more precise final localization result. Stop Criterion: We terminate the search when the measured elevation angle surpasses a high threshold near 90◦ . This criterion is robust because, close to the zenith, the elevation angle is insensitive to small horizontal displacements of the drone. At this point, our drone records its GPS position as the victim’s estimated location. While additional actions such as landing for visual confirmation are possible, they fall outside the scope of this work.

4 WI2 SAR IMPLEMENTATION We implement the Wi2 SAR prototype onboard a DJI Matrice 350 [19], equipping the drone with a Raspberry Pi Compute Module 4 [39]. The module connects to the drone via the DJI E-port, which provides access to GPS and IMU data. As shown in Fig. 6, a 3D-printed Luneburg Lens of 15 cm

4 3 2 1

MAC addr.

Target device

AP1* Monitor1

MAC filter

…

Figure 5: Proposed Dual-Phase Search Scheme. Once the target device auto-reconnects to the on-drone AP, the search scheme shifts from exploratory search to guided search.

4: Fast 3: Absence 2: Delayed 1: Timed-out complete (wait longer) complete with loss

SN:4

SN:3

SN:2

-127dBm

1 1

SN:4

SN:2

delayed

SN:1

SN:4

SN:3

SN:2

SN:1

2 2 2

Target MAC

(*: Associated)

③ RSS snapshots

SN:1 Timed out (SN=Sequence Number) Time

4 4 4

Direction Finding Module

Figure 6: Prototype of Wi2 SAR.

Figure 7: Victim Discovery Module. ❶ Dual-mode NICs lure and overhear target’s uplink packets, which are MACfiltered and buffered by sequence number. ❷ Packets are finalized as either complete (fast/delayed) or timed-out (with loss), while absences are transient until their timers expire. ❸ RSS snapshots are then extracted and forwarded to DFM. in diameter is mounted beneath the drone, while the Raspberry Pi is expanded through PCIe risers to host five Intel AX200 NICs, yielding ten antennas in total. Although multiple antennas are deployed, the system remains simple to implement because it does not require the precise phase synchronization across RF chains demanded by prior CSIor AoA-based designs [27, 54]. Instead, Wi2 SAR relies on packet-level RSS snapshots rather than phase coherence.

4.1

Victim Discovery Module

The Victim Discovery Module broadcasts beacons to lure target devices for authentication while simultaneously measuring their uplink responses across the entire antenna array. This seemingly simple task is in fact non-trivial due to two fundamental challenges: (1) Coverage alignment: Downlink transmissions (beacons, ACKs) and uplink receptions (RSS measurements) must share not only the same angular coverage but also the same link budget. A naive design, where an omnidirectional antenna handles beaconing and the Luneburg Lens array handles reception, creates an asymmetric link: the client may hear beacons at long range, but its responses fall outside the array’s main lobe or below its decoding threshold, wasting the extended range. (2) Coherent snapshot: Our direction estimator requires a packet-level RSS vector, i.e., a coherent spatial snapshot of the same MPDU across all antennas. Antenna-switching schemes that multiplex a single NIC across multiple antennas [48, 53] cannot

MobiCom ’26, October 26–30, 2026, Austin, TX, USA

provide simultaneous per-packet RSS, and are further degraded by drone motion between successive samples. Multi-NIC Dual-Mode Architecture: Our solution (see Fig. 7) is a multi-NIC dual-mode design with five Intel AX200 NICs. Each NIC is configured via a helper framework [41] to run both an AP interface and a monitor interface concurrently67 . The five AP interfaces share the same SSID but expose unique BSSIDs, forming a standard Extended Service Set (ESS). This ensures reliable AP-Client association for WPA2-PSK validation, while the parallel monitor interfaces capture every uplink MPDU across the antenna array. RSS Snapshot Aggregation: To construct a packet-level RSS vector from parallel NICs, we implement a custom aggregation pipeline (see Fig. 7). Each MPDU is identified by a composite key consisting of the Source Address and Sequence Number (SN)8 . A temporal buffer holds RSS reports for each key until either all NICs respond or a timeout occurs. At that point, the system finalizes an RSS vector, inserting placeholders (minimum RSS) for missing entries. This strategy balances completeness with latency, enabling real-time tracking while remaining robust to low SNR and packet loss.

4.2

3D Printing Luneburg Lens Front-End

Fabricating a Wi-Fi Luneburg Lens for drone-aided WiSAR must satisfy four requirements: (i) a quasi-continuous GRIN profile with precisely controllable effective permittivity; (ii) a multi-wavelength aperture (e.g., >12 cm for 5 GHz bands) to mitigate diffraction effects; (iii) a lightweight yet robust structure suitable for on-drone mounting; and (iv) a low-cost, accessible, and easily reproducible process. However, prior fabrication methods prove unsuitable for drone-aided WiSAR due to critical trade-offs: Stacked or drilled media [8, 32] create a stepped GRIN approximation and their multi-stage assembly introduces tolerance stack-up, leading to wavefront distortion. High-resolution stereolithography [52] offers finely detailed structures, but suffers from higher costs and complex post-processing. Discrete FDM infills like crossing structures [38] result in coarse gradients, poor spherical symmetry, and limited mechanical strength. We therefore adopt a monolithic lens fabricated via fused deposition modeling (FDM) 3D printing (see Fig. 3c), using Polylactic Acid (PLA)9 material with a graded Gyroid [42] infill, a type of Triply Periodic Minimal Surface (TPMS). 6 For AX200, we apply a driver patch to enable promiscuous reporting on the AP interface, bypassing packet filtering applied to both modes by default. 7 Putting all NICs in monitor mode alone is infeasible, since most NICs cannot transmit hardware-timed ACKs in monitor mode [41], nor can user space generate ACKs within the SIFS deadline [26]. Without timely ACKs, authentication requests are endlessly retransmitted until failure. 8 In practice, the 12-bit (4096) SN is unique within a short time window. 9 PLA is chosen for its permittivity stability across the 2.4/5 GHz Wi-Fi bands [57], ensuring stable beam pattern across Wi-Fi bands.

Hou et al.

Treating "air + polymer" as a mixture, the local effective permittivity follows the material volume fraction [38]
𝜀𝑟,eff (𝑟 ) = 𝛼 (𝑟 ) 𝜀𝑚 + 1 − 𝛼 (𝑟 ) 𝜀𝑟,air, (8) where 𝜀𝑚 is the permittivity of PLA [57], 𝜀𝑟,air = 1, and 𝛼 (𝑟 ) is the local material volume fraction controlled by the Gyroid’s parametric definition [3], which results in a smooth radial sweep to realize the target GRIN (see Fig. 3a-b). This avoids stepped discretization while keeping the structure lightweight and stiff. We create the 3D model of the Luneburg Lens using MSLattice [4]. The unit-cell size is 1 cm (well below the Wi-Fi wavelength) with a lens radius of 7.5 cm, which is optimized for 5 GHz Wi-Fi. While 2.4 GHz benefits from better propagation, achieving equivalent gain requires a larger aperture10 , compromising drone mobility and durability. To ensure manufacturability and structural integrity at the periphery, we truncated the target permittivity profile at 1.25 instead of the ideal 1.0, a necessary compromise to avoid near-zero material volume. We printed two variants on a consumer-grade FDM 3D printer [28]: (i) the base Gyroid structure (Fig. 3c), and (ii) the same core with a uniform 0.5 mm outer skin to provide a solid surface for reliable Flexible Printed Circuits (FPC) antenna adhesion (Fig. 6 and Fig. 4c). This single-material process is highly cost-effective, with raw material costs of only 4 US dollars per 15 cm lens. Beam Pattern Characterization and Re-usability: To obtain the offline template 𝐵 0 for our AoA algorithm, we characterize the beam pattern of the fabricated Luneburg Lens assembly in a microwave anechoic chamber (see Fig. 4c). The measurement captures the composite response of the lens together with its surface-mounted FPC antennas. During the characterization, we use a commercial Wi-Fi transmitter operating at 5.745 GHz, while the Luneburg Lens with its 1 × 3 cm FPC antenna array acts as the receiver. RSS values are collected on a 10◦ grid over both azimuth and elevation, and the results are spline-interpolated to a 1◦ resolution for use in the estimator. The resulting beam pattern, shown in Fig. 4b, exhibits a peak gain of approximately 14 dBi. The halfpower beamwidth is about 60◦ in both azimuth and elevation. This measured beam is broader than the 48◦ beamwidth predicted by full-wave COMSOL simulations of the bare lens because the radiation pattern of the wide-beam FPC elements combines with the focusing effect of the lens, producing a wider composite lobe. A critical requirement for our system is that this one-time, offline-calibrated pattern remains a reusable template in all field deployments. The primary challenge in achieving this is mitigating near-field scattering from the drone’s airframe, which is not present during the chamber measurement. Our 10 Despite the suboptimal size, experiments in §5.2.1 confirm the lens for

5 GHz also extends the working range at 2.4 GHz.

Wi2 SAR

MobiCom ’26, October 26–30, 2026, Austin, TX, USA

(a)

0°

(b)

30°

(c)

90°

the drone’s flight controller via the existing communication link, enabling real-time guidance.

60°

300°

60° 90° 60° 30° 0°

270°

Elevation 240°

120°

FPC Antennas

180°

150°

30°

0°

300° 0°

roll

yaw 60° pitch 120°

-30°

240°

180°

-60° -90°

Figure 8: (a) FPC antenna layout. (b) Actual deployment. (c) Alignment with drone’s coord. (roll, pitch, yaw). solution is twofold. First, we physically decouple the lens from the drone by installing a layer of microwave-absorbing foam between the Luneburg Lens and the airframe (see Fig. 6). This represents a practical trade-off, incurring minimal weight while improving the fidelity of the lab-measured pattern in the operational environment. Second, the re-usability is further ensured by our algorithm’s intrinsic robustness; the shape-based, de-meaned correlation estimator is inherently resilient to minor, real-world pattern variations. This combination of physical mitigation and algorithmic robustness allows the template to be reliably applied across missions without per-deployment recalibration. Antenna Layout: We implement the antenna array on a 15 cm Luneburg Lens for Wi-Fi bands, guided by two principles: maximizing information capture in the upper hemisphere, where the lens concentrates incident energy, and ensuring balanced angular sampling across both azimuth and elevation. To this end, our prototype employs ten antennas: one at the zenith for overhead sensitivity, and two concentric rings at 60◦ and 30◦ elevation, containing three and six elements, respectively. The 1:2 allocation reflects the rings’ circumferences, yielding near-uniform angular density and exploiting regions of highest beam gradient. As shown in Fig. 8, this layout balances broad angular coverage with fine spatial resolution.

4.3

Drone Integration

A key aspect of the prototype implementation is integrating the Wi2 SAR payload with the drone’s flight control system. This integration addresses the critical step of converting the estimated AoA into navigation commands. The raw AoA is estimated in the drone’s local coordinate system (body frame), but for navigation, an absolute direction in the global coordinate system (world frame) is required. This conversion must account for the drone’s constantly changing attitude. To achieve this, we utilize the DJI Payload SDK [18] to continuously fetch the drone’s real-time attitude from its onboard IMU. This data enables a rotational transformation to be applied to each raw AoA estimate, converting it from the relative body frame into a stable, world-referenced direction. The resulting compensated direction is then transmitted to

5

EXPERIMENTS

We begin by outlining the experimental setup, followed by the definitions of key performance metrics. We then report a series of microbenchmarks and integrated system evaluations, concluding with a single-blind WiSAR trial where the location of the victim remains unknown to the pilot. Our experiments and trials are approved by our institution’s IRB and comply with local regulations.

5.1

Experimental Setup

Environments and Targets: We evaluate Wi2 SAR across four distinct outdoor environments representing different levels of foliage coverage and terrain complexity (see Fig. 9a-d): an on-hill Playground (Scene-P), a Forested hill (SceneF), rugged Terrain with exposed rock faces (Scene-T), and a hillside Shoreline (Scene-S). Our targets are commodity WiFi devices, including various smartphones, a tablet (iPad), and a smartwatch (Apple Watch), placed in realistic scenarios (see Fig. 9f). The ground-truth position for each target is obtained from its GPS coordinates, and refined against high-resolution satellite imagery to correct for GPS drift. Hardware: Our primary evaluation platform is the Wi2 SAR prototype detailed in §4, which consists of a 15 cm Luneburg Lens and a ten-antenna array mounted on a DJI Matrice 350 RTK drone. The drone is either programmed to follow a pre-defined zigzag trajectory for systematic evaluation or manually piloted for realistic trials, following the instructions generated by drone navigation module and sent to the remote controller (see Fig. 12). Unless otherwise specified, experiments are conducted on the 5 GHz Wi-Fi band, with some tests including 2.4 GHz for comparison. Baseline: We benchmark Wi2 SAR’s Direction Finding Module against ArrayTrack [54], a representative 2D AoA system based on Wi-Fi CSI. We implement it on a six-element Phaserstyle ULA [22] using five AX200 NICs on a Raspberry Pi with a modified driver for CSI extraction. For fairness, we also downgrade Wi2 SAR to a 2D six-antenna variant. Performance Metrics: We use the following metrics to quantify the performance of individual components as well as the end-to-end system. • Victim Discovery Range: The maximum distance at which a target’s packets can be detected and verified. • Direction Finding Accuracy: We quantify AoA accuracy using the Projection Rate (PR), defined as PR = 𝒖ˆ · 𝒖, where 𝒖ˆ is the estimated direction and 𝒖 the ground truth. PR ∈ [−1, 1] reflects the effectiveness of motion along the estimated direction in reducing range: 1 = perfect alignment, 0 = orthogonal (no progress), negative = moving away. Unlike angular error,

MobiCom ’26, October 26–30, 2026, Austin, TX, USA (c)

(b)

(a)

On-Hill Playground

(f1)

(f2)

Under tree

(d)

Forested Hill

(f3)

In bushes

Hou et al.

In backpack

(f4)

By the wall

(e)

Lying on ground

(d5)(f6)

Zoom-in

Hillside Shoreline

Rugged Terrain

(f5)

(f7)

By the curb

Under rugged terrain

(f8)

(f9)

Beside tetrapod

(f10)

In rock crevice

At the shoreline

Figure 9: Experiment scenarios. (a)–(d) Bird’s-eye views of four test environments: an on-hill playground, a forested hill, rugged terrain, and a hillside shoreline. (e) Zoom-in of the drone in operation. (f1)–(f10) typical placements for target devices. ~10dB gain

TX

384m

PR is signed and task-oriented. We report the MedPR (median PR) as an indicator of typical performance. • Exploratory Success Rate: Fraction of target devices successfully connected during the exploratory search phase. • Localization Error: Final horizontal distance between the reported and ground-truth target positions.

Router Luneburg Lens FPC Antennas*2 Raspberry

5.2

Component Performance

We first evaluate the performance of Wi2 SAR’s three core components in a series of experiments. 5.2.1 Victim Discovery Module (VDM). We first evaluate the Luneburg Lens’s contribution to extending victim discovery range. In a ground test (see Fig. 10a), a 5.745 GHz router serves as the transmitter and a Raspberry Pi with FPC antennas as the receiver. Placing the antenna at the lens focal point yields a RSS gain of about 10 dB across all tested distances for both high (24 dBm) and low (1 dBm) transmit powers, sufficient to raise weak signals above the noise floor and enable reception at 384 m where the bare antenna fails (Fig. 10b). We then conduct aerial victim discovery trials in Scene-F to test whether this gain translates into operational range. As shown in Fig. 10c, the Luneburg Lens extends detection range by 104%/80% in LoS at 2.4/5 GHz, and by 73%/91% in NLoS, respectively. These results establish the lens as a key enabler that significantly broadens VDM’s discovery range and boosts the likelihood of initial victim detection. 5.2.2 Direction Finding Module (DFM). We first quantify the overall accuracy of the DFM across diverse scenarios, then examine its robustness to impact factors, and finally benchmark it against the CSI-based baseline. Direction Finding Performance: We conducted controlled drone flights across four environments with varying vegetation density and terrain evenness. Each received packet is treated as an independent sample, yielding 13,671 samples in total from heterogeneous targets including smartphones, tablets, and wearables, under 12 common placements and

RX Pi (a) Ground setup

(b) RSS gain (ground)

(c) Aerial victim discovery

Figure 10: (a, b) RSS gain with Luneburg Lens (ground). (c) Extended victim discovery range (aerial). drone speeds ranging from hovering to 5.5 m/s (example trajectory in Fig. 12a). As shown in Fig. 11a, Wi2 SAR consistently delivers reliable 3D direction finding: the MedPR reaches 0.95, corresponding to an 18.4◦ angular error, while the 80%-tile angular error is 34.6◦ . Fewer than 4% of the samples fall into ambiguous cases (orthogonal or opposite bearings). These results confirm that DFM achieves high accuracy and stable performance across diverse terrains, device types, user placements, and drone maneuvers. • Target Placement. Victims may carry devices in diverse positions during a rescue scenario. We therefore test 12 typical placements in WiSAR. As shown in Fig. 11b, even under near-device occlusion that interferes with the signal, the DFM maintains MedPR above 0.9, which is sufficient to reliably guide the drone. • Incident Angle. Since signals may arrive from arbitrary directions, we examine incident angles to assess directional consistency. Across azimuth directions, MedPR remains high between 0.89 and 0.99 (Fig. 11c). Along elevation (see Fig. 11d), performance exhibits clear peaks around 30◦ , 60◦ , and zenith, which align with the antenna rings in our implementation (§4.2). Moreover, accuracy progressively improves as elevation approaches 90◦ , ensuring that our stop criterion converges reliably during search.

Wi2 SAR

0.5

0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 5 5.5

Drone speed (m/s)

(e) Drone speed

80

260

0.6

100

0.7

110

250 240

120

0.8 0.9 200

190 180 170

160

130 140 150

0.93

0.90

0.96 0.96 0.98 0.97 0.93 0.94 0.92 0.92 0.96 0.91 0.93 0.95 0.97 0.99 1.00

0.96

0.9 0.8 0.7 0.6 0.5

0.89

15202530354045505560657075808590

Elevation (deg)

0.7 0.6 30 80 130 180 230 280 330 380 430

Distance (m)

(f) Drone-Target distance

(d) Incident elevation

1.0 0.97

0.96

0.97

0.96

1.0

0.96

0.9

0.95

0.97

0.99

0.98

90

1.0

(c) Incident azimuth

0.8

0.5

70

0.5

Median Projection Rate

290

0.8 0.7 0.6 0.5

-96 -93 -90 -87 -84 -81 -78 -75 -72 -69

Average RSS (dBm)

(g) Average RSS

Empirical CDF

0.6

50

280

Placement

1.0 0.9

0.99

30

60

230 220 210

Median Projection Rate

0.7

Median Projection Rate

0.95

0.93

0.94

0.94

0.95

0.94

0.96

0.95

0.94

0.8

0.95

0.9

20

270

(b) Target placement

1.0 0.95

Median Projection Rate

(a) CDF of PR

10

0.95

0.5

350 0

40

0.94

1.0

340

300

0.95

0.8

1.00

0.6

0.96

0.4

Projection Rate

0.99

0.2

0.6

0.98

0.05 0.00 0.0

0.7

0.97

0.20

80% samples' PR ≥ 0.82 (34.6°)

0.8

330 320 310

Azimuth (deg)

0.60 0.50 50% samples' PR ≥ 0.95 (18.4°) 0.40

0.9

In backpack 0.94 Human held 0.94 In bushes 0.98 Under tree 0.95 By the wall 0.96 In box 0.92 Lying on ground 0.99 Under rugged terrain 0.98 By the curb 0.94 Beside tetrapod 0.90 In rock crevice 0.92 At the shoreline 0.95

1.0

Scene-P (MedPR=0.95) Scene-F (MedPR=0.93) Scene-T (MedPR=0.95) Scene-S (MedPR=0.94) All (MedPR=0.95, N=13671)

0.80

Median Projection Rate

Empirical CDF

1.00

Median Projection Rate

MobiCom ’26, October 26–30, 2026, Austin, TX, USA

0.8 0.6 0.5 0.4

6.0° 3.8°

0.2 0.0

0

median 46.0° Wi2SAR (2D) ArrayTrack-Cont ArrayTrack-One 50

100

150

Angular Error (deg)

(h) LL vs. ArrayTrack

Figure 11: Performance of Direction Finding Module. (a) Overall performance of four scenes. (b)-(g) Impact of diverse conditions. Error bars indicate 95% bootstrap confidence intervals. (h) Comparison study with ArrayTrack. • Drone Speed. Drone motion can introduce vibration and channel dynamics that challenge direction finding. Testing speeds from hovering to over 5 m/s, we observe stable MedPR between 0.93 and 0.96 (Fig. 11e), indicating robustness to motion-induced fluctuations across both slow maneuvers and fast scans. • Distance and Attenuation. Search operations often require long-range detection under weak signals. Wi2 SAR sustains high accuracy with MedPR ≥ 0.96 at distances up to 430 m (Fig. 11f). More importantly, performance degrades gracefully with signal attenuation: even when mean RSS drops to −93 dBm, the DFM still achieves a MedPR of 0.94 (Fig. 11g), demonstrating robustness under low-SNR conditions. • Device Types. Rescue targets may use heterogeneous devices with different transmit powers. Without any algorithm modification, our Wi2 SAR generalizes well across various devices, achieving high MedPR and long detection ranges in LoS conditions: smartphones (429 m, MedPR 0.951), a tablet (152 m, MedPR 0.918), and even a low-power smartwatch (197 m, MedPR 0.939). Comparison with Baselines: CSI-based methods such as ArrayTrack require continuous phase calibration to correct hardware-induced, time-varying phase offsets [22, 61]. While effective in controlled ground experiments, such calibration is impractical for drones in WiSAR scenarios, where a static reference signal is difficult to obtain in flight. To highlight this limitation, we evaluate two ArrayTrack variants: ArrayTrack-Cont, which continuously recalibrates using a

static reference signal, and ArrayTrack-One, which performs only a one-time calibration prior to each deployment without online updates. For fairness, we use a 2D variant of Wi2 SAR restricted to azimuth, aligning with ArrayTrack’s 2D setup11 . As shown in Fig. 11h, ArrayTrack-Cont achieves 3.8◦ median error but requires an impractical reference signal, while ArrayTrack-One degrades to 46.0◦ once the pre-deployment calibration becomes invalid. In contrast, Wi2 SAR requires only a single design-time characterization of its amplitude profile; this profile remains stable across hardware instances and deployments, sustaining 6.0◦ median error across the full 360◦ FoV without any recalibration, highlighting both its robustness and deployability for drone-based WiSAR. 5.2.3 Search Scheme Performance. We evaluate Wi2 SAR’s performance in a mid-scale feasibility study of exploratory search. The test area measures 400 m × 400 m (160,000 m2 )12 . In this area, five phones are placed at unknown locations, and the drone executes a zigzag search at 2 m/s. As shown in Fig. 12b, Wi2 SAR successfully discovered and provided initial direction estimates for all five targets within 13.5 minutes, achieving a 100% discovery rate in this large environment. By contrast, covering a comparable area typically requires 11 Both ArrayTrack and Wi2 SAR use six antennas in our experiments. ArrayTrack’s field of view (FoV) is inherently limited to 180◦ due to its linear array design; thus we report its accuracy only within this span, while Wi2 SAR provides and is evaluated over the full 360◦ FoV. 12 The area size was constrained by local flight regulations that mandate line-of-sight operations in forested zones.

MobiCom ’26, October 26–30, 2026, Austin, TX, USA

(a)

Hou et al.

(b)

Target

Estimation

(c)

Distance: 108 m

Size: 64m ⨉ 64m

⨉

re

Trajectory Estimation Target

Height: 90 m

Size: 400m ⨉ 400m

Height: 38 m

Take-off

Pr ep a

Height: 20m

Search Direction

Re tu rn

❷ ❶ (Grid

h) Searc

Start

❺

❸ Estimation

❹ Stop Criteria Met Target (under tree)

❶ Taking off ❷Connected ❸ Direction Estimated ❹ Located ❺ Return 224s 350s Guided Homing Completion

Time 0s 115s Stage Exploratory

Figure 12: Example Drone Trajectories across Trials. (a) Controlled zigzag flight with angle predictions. (b) Large-area exploratory search (400m × 400m). (c) Full WiSAR trial showing grid search, followed by direction-guided search, localizing the target under foliage within 224 s. multiple ground searchers working for several hours. We further analyze the discovery latency, defined as the time elapsed from when the drone enters the victim’s potential communication range (see Fig. 10c) until the first successful connection. Based on log data from the five test phones, the average discovery latency is 39.8 s. This latency is primarily determined by the victim device’s Wi-Fi scan interval. Our offline measurements show that the median scan intervals of these devices in active, idle, and power-saving modes are 9 s, 36 s, and 165 s, respectively. Consequently, flying faster is not always better: if the drone passes through the working range too quickly, the victim may not scan and auto-connect during that visit. To mitigate this, one can (i) reduce the flight speed, (ii) use a denser zigzag grid to increase overlap and revisit frequency, or (iii) deploy multiple drones to shorten revisit times, improving the chance of timely discovery.

5.3

End-to-End Trial: Wi2 SAR in the Wild

We conduct a single-blind WiSAR trial in the foliage-dense Scene-F, where the pilot has no prior knowledge of the target and relies solely on Wi2 SAR’s guidance, searching a forested area of 40,000 m2 . The full trajectory is shown in Fig. 12c. The drone first performs an exploratory search and acquires the initial signal, i.e., the target’s auto-reconnection request, at 115 s, then switches to guided navigation. At 224 s, the system signals successful localization; the pilot reports the target’s position by ascending, and we log the drone’s GPS coordinates at that moment. The resulting horizontal localization error is only 5 m. This trial demonstrates that Wi2 SAR efficiently and accurately guides search operations to completion under realistic conditions.

5.4

System Latency and Overhead

We profile Wi2 SAR’s runtime performance on the Raspberry Pi CM4 used onboard our drone: Processing a single RSS snapshot for direction finding takes 48 ms, and, with seven concurrent targets the system sustains an overall update rate

of 7.8 Hz, sufficient for real-time tracking. The pipeline consumes 635 MB memory and 48–52% CPU, confirming that Wi2 SAR runs efficiently on embedded hardware. Additionally, we quantify the impact of the Wi2 SAR payload on drone battery endurance. During the 13.5-minute search flight in §5.2.3, the drone consumed an extra 6% battery with the payload compared with a matched flight without the payload at the same speed and duration, indicating a manageable impact for practical WiSAR missions.

6

DISCUSSIONS AND FUTURE WORK

As a pioneering Wi-Fi drone system for WiSAR, there is room to further improve Wi2 SAR. Random Targets: In cases where the target is an unidentified individual (e.g., a missing hiker with no prior information), Wi2 SAR can be adapted to broadcast common network beacons (e.g., airport Wi-Fi) and overhear all nearby network traffic. In a wilderness environment where such traffic is sparse, any active device becomes a potential point of interest for investigating all signs of digital life. Scalability to Larger Areas: While our experiments validate Wi2 SAR in a mid-scale area (400 m × 400 m), the design is scalable to larger regions. By partitioning a large search area into manageable grids, our proven mid-scale search performance can be replicated across each grid section. This "divide and conquer" approach can be further accelerated by employing multi-drone swarms to search multiple grids in parallel, sharing discoveries for expedited search. We are currently engaging with a local voluntary mountain search team for larger-scale field trials in real-world search. Privacy and Ethics: Wi2 SAR should be deployed only by authorized organizations with appropriate consent or authorization. Unlike LTE pseudo-base stations [5] that can use persistent identities (IMSI), Wi2 SAR uses changeable Wi-Fi credentials (SSID/PSK) for the mission; discard all credentials and collected traffic after the mission. Specific legal and ethical adjudication regarding this controlled application is left to regulatory bodies.

Wi2 SAR

Implications for Wi-Fi protocol: Wi2 SAR’s reliance on auto-reconnection behaviors highlights potential modifications to Wi-Fi authentication protocols that could improve both security and usability in emergency scenarios. Future iterations of IEEE 802.11 could consider standardized support for emergency beacon SSIDs, enabling sanctioned rescue operations to trigger safe and rapid device response. Migration Beyond Wi-Fi Signals: The core principle of Wi2 SAR could be extended beyond Wi-Fi signals. The Luneburg Lens, being a passive electromagnetic lens, could be adapted for other wireless signals like Cellular (LTE/5G/6G), LoRa, or Bluetooth. The migration requires three key steps: (1) adopting a "spoofing" technique for packet elicitation and identification; (2) adapting the Luneburg Lens to the new wavelength; and (3) re-characterizing the beam pattern. Since Wi2 SAR relies only on RSS rather than specific protocols, our open-sourced direction-finding algorithm can be directly reused to process the captured RSS patterns. Victims without Wi-Fi: There are cases where a victim does not have a powered Wi-Fi device and Wi2 SAR is not applicable. However, we believe a system that can facilitate rescue and save lives in a significant subset of cases is already invaluable. Furthermore, the system could be extended to work with dedicated low-power electronic trackers for hikers, reinforcing its effectiveness.

7

RELATED WORKS

Drone-aided WiSAR. In the domain of WiSAR operations, drones have emerged as potent tools to augment manual search efforts [31]. Various systems employ vision-based sensors such as RGB cameras [6, 45], infrared and thermal cameras [12, 15, 29]. However, vision-based pipelines degrade severely under canopy or rugged rocky areas, despite efforts to address partial occlusion [10, 40]. In practice, RGB and thermal imaging are well-suited for rapid sweeps over open terrain, but their effective working range drops sharply once occlusion becomes dominant. To mitigate weather and occlusion, RF sensing has been explored: recent work attaches mmWave radar to drones to detect subtle chest motion as a life sign [59], demonstrating promise indoors, but outdoor dynamics easily mask such weak physiological signals at long ranges. Beyond vision and mmWave, several attempts localize mobile devices via infrastructure-free airborne radios, such as LTE pseudo-base-station methods [5] and noncooperative Wi-Fi ranging [1, 2, 25, 44, 49]. However, most of these approaches rely on range-based estimators that require multiple measurements from different positions. Without directional guidance, the drone may inadvertently fly away from rather than toward the target, wasting both time and energy or even failing the search task.

MobiCom ’26, October 26–30, 2026, Austin, TX, USA

Wi-Fi localization for WiSAR. Among RF modalities, WiFi stands out for its ubiquity; however, adapting indoor positioning techniques to wilderness settings is challenging. Classic Wi-Fi localization spans three main categories. First, fingerprinting [55] builds a radio map from dense site surveys, which is impractical in wilderness where pre-survey is impossible and propagation varies widely. Second, distance-based methods estimate range via RSS path-loss [7, 56] or ToF [47]. RSS trilateration is brittle in WiSAR due to foliage absorption and multipath, while ToF approaches require client cooperation or nanosecond-scale synchronization. Third, directionbased methods estimate AoA from phase differences with subspace estimators [22, 27, 54]. These techniques achieve high accuracy indoors but depend on adequate SNR, tight inter-element phase coherence, and careful phase calibration. Such assumptions break down on vibrating aerial platforms operating near the noise floor, and few works [48, 60] demonstrate true long-range 3D bearing suitable for drone navigation. To the best of our knowledge, Wi2 SAR is the first system for RSS-only 3D direction finding on a Wi-Fi-enabled drone over extended distances, with non-cooperative Wi-Fi devices and free from on-the-fly calibration. Our approach differs from traditional RSS-based localization, utilizing the Luneburg Lens to boost signal strengths and find direction from unique RSS patterns, and expands the applications to outdoor WiSAR.

8

CONCLUSION

This paper presents the design and implementation of Wi2 SAR, a novel drone-based wireless system for automatic WiSAR operations without relying on any existing infrastructure. Wi2 SAR leverages the auto-reconnection behavior of Wi-Fi networks to discover and locate victims by their accompanying devices. Wi2 SAR incorporates three core components: a power-efficient victim discovery scheme, a long-range 3D direction finding approach using a 3D-printed Luneburg Lens, and a direction-guided drone navigation strategy. We implement Wi2 SAR as an end-to-end system on commodity drones and validate it in real-world wilderness scenarios. The results highlight its remarkable performance, underpinning its potential for real-world deployment.

ACKNOWLEDGMENTS This work was supported by NSFC under grant No. 62222216, Hong Kong RGC GRF No. 17212224 and No. 17211725, and CRF No. C5002-23Y. We thank the anonymous Reviewers and our Shepherd for their insightful feedback.

REFERENCES [1] Ali Abedi and Deepak Vasisht. 2022. Non-cooperative wi-fi localization & its privacy implications. In Proceedings of the 28th Annual International Conference on Mobile Computing And Networking. ACM, Sydney

MobiCom ’26, October 26–30, 2026, Austin, TX, USA NSW Australia, 570–582. https://doi.org/10.1145/3495243.3560530 [2] V. Acuna, A. Kumbhar, E. Vattapparamban, F. Rajabli, and I. Guvenc. 2017. Localization of WiFi Devices Using Probe Requests Captured at Unmanned Aerial Vehicles. In 2017 IEEE Wireless Communications and Networking Conference (WCNC). IEEE, 1–6. https://doi.org/10.1109/ WCNC.2017.7925654 [3] Oraib Al-Ketan and Rashid K. Abu Al-Rub. 2019. Multifunctional Mechanical Metamaterials Based on Triply Periodic Minimal Surface Lattices. Advanced Engineering Materials 21, 10 (2019), 1900524. https://doi.org/10.1002/adem.201900524 _eprint: https://onlinelibrary.wiley.com/doi/pdf/10.1002/adem.201900524. [4] Oraib Al-Ketan and Rashid K. Abu Al-Rub. 2021. MSLattice: A free software for generating uniform and graded lattices based on triply periodic minimal surfaces. Material Design & Processing Communications 3, 6 (2021), e205. https://doi.org/10.1002/mdp2.205 _eprint: https://onlinelibrary.wiley.com/doi/pdf/10.1002/mdp2.205. [5] Antonio Albanese, Vincenzo Sciancalepore, and Xavier Costa-Perez. 2022. SARDO: An Automated Search-and-Rescue Drone-Based Solution for Victims Localization. IEEE Transactions on Mobile Computing 21, 9 (Sept. 2022), 3312–3325. https://doi.org/10.1109/TMC.2021.305 1273 [6] Mykhaylo Andriluka, Paul Schnitzspan, Johannes Meyer, Stefan Kohlbrecher, Karen Petersen, Oskar Von Stryk, Stefan Roth, and Bernt Schiele. 2010. Vision based victim detection from unmanned aerial vehicles. In 2010 IEEE/RSJ International Conference on Intelligent Robots and Systems. IEEE, 1740–1747. [7] P. Bahl and V.N. Padmanabhan. 2000. RADAR: an in-building RF-based user location and tracking system. In Proceedings IEEE INFOCOM 2000. Conference on Computer Communications. Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies (Cat. No.00CH37064), Vol. 2. 775–784 vol.2. https://doi.org/10.1109/INFC OM.2000.832252 ISSN: 0743-166X. [8] Jonathan Bor, Olivier Lafond, Hervé Merlet, Philippe Le Bars, and Mohamed Himdi. 2014. Foam Based Luneburg Lens Antenna at 60 GHz. Progress In Electromagnetics Research Letters 44 (2014), 1–7. https: //doi.org/10.2528/PIERL13092405 Publisher: EMW Publishing. [9] Tomáš Bravenec, Joaquín Torres-Sospedra, Michael Gould, and Tomas Fryza. 2023. UJI Probes: Dataset of Wi-Fi Probe Requests. In 2023 13th International Conference on Indoor Positioning and Indoor Navigation (IPIN). 1–6. https://doi.org/10.1109/IPIN57070.2023.10332508 arXiv:2308.04435 [cs]. [10] Daniel Broyles, Christopher R. Hayner, and Karen Leung. 2022. WiSARD: A Labeled Visual and Thermal Image Dataset for Wilderness Search and Rescue. In 2022 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). 9467–9474. https://doi.org/10.1109/ IROS47612.2022.9981298 ISSN: 2153-0866. [11] Yijie Chen, Jiliang Wang, and Jing Yang. 2024. Exploiting Anchor Links for NLOS Combating in UWB Localization. ACM Transactions on Sensor Networks 20, 3 (May 2024), 1–22. https://doi.org/10.1145/3657639 [12] L-P Chrétien, Jérôme Théau, and Patrick Menard. 2015. Wildlife multispecies remote sensing using visible and thermal infrared imagery acquired from an unmanned aerial vehicle (UAV). The International Archives of the Photogrammetry, Remote Sensing and Spatial Information Sciences 40 (2015), 241–248. [13] COMSOL. 2025. COMSOL: Multiphysics Software for Optimizing Designs. https://www.comsol.com/. Accessed: Aug. 30, 2025. [14] Krystal Dacey, Rachel Whitsed, and Prue Gonzalez. 2023. Understanding lost person behaviour in the Australian wilderness for search and rescue. Australian Journal of Emergency Management 10.47389/38, No 2 (April 2023), 29–35. https://doi.org/10.47389/38.2.29 [15] Diulhio Candido De Oliveira and Marco Aurelio Wehrmeister. 2018. Using deep learning and low-cost RGB and thermal cameras to detect

Hou et al. pedestrians in aerial images captured by multirotor UAV. Sensors 18, 7 (2018), 2244. [16] Jakob Derks, Lukas Giessen, and Georg Winkel. 2020. COVID-19induced visitor boom reveals the importance of forests as critical infrastructure. Forest Policy and Economics 118 (Sept. 2020), 102253. https://doi.org/10.1016/j.forpol.2020.102253 [17] DJI. 2025. Drone Rescue Map. https://enterprise.dji.com/drone-rescuemap. Accessed: Aug. 30, 2025. [18] DJI Developer. 2025. DJI Payload SDK. https://developer.dji.com/doc/ payload-sdk-tutorial/en/. Accessed: Aug. 30, 2025. [19] DJI Enterprise. 2025. Matrice 350 RTK. https://enterprise.dji.com/mat rice-350-rtk. Accessed: Aug. 30, 2025. [20] Ellis Fenske, Dane Brown, Jeremy Martin, Travis Mayberry, Peter Ryan, and Erik Rye. 2021. Three Years Later: A Study of MAC Address Randomization In Mobile Devices And When It Succeeds. Proceedings on Privacy Enhancing Technologies 2021, 3 (July 2021), 164–181. https: //doi.org/10.2478/popets-2021-0042 [21] Julien Freudiger. 2015. How talkative is your mobile device?: an experimental study of Wi-Fi probe requests. Proceedings of the 8th ACM Conference on Security & Privacy in Wireless and Mobile Networks (2015). https://api.semanticscholar.org/CorpusID:8719030 [22] Jon Gjengset, Jie Xiong, Graeme McPhillips, and Kyle Jamieson. 2014. Phaser: enabling phased array signal processing on commodity WiFi access points. In Proceedings of the 20th annual international conference on Mobile computing and networking. ACM, Maui Hawaii USA, 153–164. https://doi.org/10.1145/2639108.2639139 [23] Marco Gunia, Adrian Zinke, Niko Joram, and Frank Ellinger. 2023. Analysis and Design of a MuSiC-Based Angle of Arrival Positioning System. ACM Transactions on Sensor Networks 19, 3 (Aug. 2023), 1–41. https://doi.org/10.1145/3577927 [24] Andreas Skriver Hansen, Thomas Beery, Peter Fredman, and Daniel Wolf-Watz. 2023. Outdoor recreation in Sweden during and after the COVID-19 pandemic – management and policy implications. Journal of Environmental Planning and Management 66, 7 (June 2023), 1472– 1493. https://doi.org/10.1080/09640568.2022.2029736 [25] Yao-Hua Ho and Yu-Jung Tsai. 2022. Open Collaborative Platform for Multi-Drones to Support Search and Rescue Operations. Drones 6, 5 (May 2022), 132. https://doi.org/10.3390/drones6050132 [26] IEEE Standards Association. 2009. IEEE Standard for Information technology– Local and metropolitan area networks– Specific requirements– Part 11: Wireless LAN Medium Access Control (MAC)and Physical Layer (PHY) Specifications Amendment 5: Enhancements for Higher Throughput. (2009), 1–565. https://doi.org/10 .1109/IEEESTD.2009.5307322 [27] Manikanta Kotaru, Kiran Joshi, Dinesh Bharadia, and Sachin Katti. 2015. SpotFi: Decimeter Level Localization Using WiFi. In Proceedings of the 2015 ACM Conference on Special Interest Group on Data Communication. ACM, London United Kingdom, 269–282. https://doi.org/10.1145/27 85956.2787487 [28] Bambu Lab. 2025. Bambu Lab X1 Carbon 3D Printer. https://us.store.b ambulab.com/collections/3d-printer/products/x1-carbon. Accessed: Aug. 30, 2025. [29] Frederik S Leira, Håkon Hagen Helgesen, Tor Arne Johansen, and Thor I Fossen. 2021. Object detection, recognition, and tracking from UAVs using a thermal camera. Journal of Field Robotics 38, 2 (2021), 242–267. [30] R. K. Luneburg and Allen L. King. 1966. Mathematical Theory of Optics. American Journal of Physics 34 (1966), 80–81. https://api.semanticsc holar.org/CorpusID:120653112 [31] Mingyang Lyu, Yibo Zhao, Chao Huang, and Hailong Huang. 2023. Unmanned Aerial Vehicles for Search and Rescue: A Survey. Remote Sensing 15, 13 (June 2023), 3266. https://doi.org/10.3390/rs15133266

Wi2 SAR [32] Hui Feng Ma and Tie Jun Cui. 2010. Three-dimensional broadband and broad-angle transformation-optics lens. Nature Communications 1, 1 (Nov. 2010), 124. https://doi.org/10.1038/ncomms1126 [33] Sami Ma, Yi Ching Chou, Miao Zhang, Hao Fang, Haoyuan Zhao, Jiangchuan Liu, and William I. Atlas. 2024. LEO Satellite Network Access in the Wild: Potentials, Experiences, and Challenges. IEEE Network 38, 6 (Nov. 2024), 396–403. https://doi.org/10.1109/MNET.2 024.3391271 arXiv:2405.06801 [cs]. [34] Andrew Moore, Nicholas Rymer, J. Sloan Glover, and Derin Ozturk. 2023. Predicting GPS Fidelity in Heavily Forested Areas. In 2023 IEEE/ION Position, Location and Navigation Symposium (PLANS). IEEE, Monterey, CA, USA, 772–780. https://doi.org/10.1109/PLANS53410.2 023.10140075 [35] Andrew Moore, Nicholas Rymer, J. Sloan Glover, and Derin Ozturk. 2023. Predicting GPS Fidelity in Heavily Forested Areas. In 2023 IEEE/ION Position, Location and Navigation Symposium (PLANS). IEEE, Monterey, CA, USA, 772–780. https://doi.org/10.1109/PLANS53410.2 023.10140075 [36] Robin Murphy and Thomas Manzini. 2023. Improving Drone Imagery For Computer Vision/Machine Learning in Wilderness Search and Rescue. In 2023 IEEE International Symposium on Safety, Security, and Rescue Robotics (SSRR). IEEE, Naraha, Fukushima, Japan, 159–164. ht tps://doi.org/10.1109/SSRR59696.2023.10499934 [37] Alejandro Blanco Pizarro, Joan Palacios Beltrán, Marco Cominelli, Francesco Gringoli, and Joerg Widmer. 2021. Accurate ubiquitous localization with off-the-shelf IEEE 802.11ac devices. In Proceedings of the 19th Annual International Conference on Mobile Systems, Applications, and Services. ACM, Virtual Event Wisconsin, 241–254. https://doi.org/10.1145/3458864.3468850 [38] Kun Qian, Lulu Yao, Kai Zheng, Xinyu Zhang, and Tse Nga Ng. 2023. UniScatter: a Metamaterial Backscatter Tag for Wideband Joint Communication and Radar Sensing. In Proceedings of the 29th Annual International Conference on Mobile Computing and Networking. ACM, Madrid Spain, 1–16. https://doi.org/10.1145/3570361.3592526 [39] Raspberry Pi Foundation. 2025. Compute Module 4. https://www.rasp berrypi.com/products/compute-module-4/. Accessed: Aug. 30, 2025. [40] DC Schedl, I. Kurmi, and O. Bimber. 2021. An autonomous drone for search and rescue in forests using airborne optical sectioning. Science Robotics 6, 55 (June 2021), eabg1188. https://doi.org/10.1126/scirobot ics.abg1188 Publisher: American Association for the Advancement of Science. [41] Domien Schepers, Mathy Vanhoef, and Aanjhan Ranganathan. 2021. A framework to test and fuzz wi-fi devices. In Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks. ACM, Abu Dhabi United Arab Emirates, 368–370. https://doi.org/10.1 145/3448300.3468261 [42] Alan H. Schoen. 1970. Infinite periodic minimal surfaces without selfintersections. https://api.semanticscholar.org/CorpusID:119912824 [43] Elahe Soltanaghaei, Avinash Kalyanaraman, and Kamin Whitehouse. 2018. Multipath triangulation: Decimeter-level wifi localization and orientation with a single unaided receiver. In Proceedings of the 16th annual international conference on mobile systems, applications, and services. 376–388. [44] Yunpeng Sun, Xiangming Wen, Zhaoming Lu, Tao Lei, and Shan Jiang. 2018. Localization of WiFi Devices Using Unmanned Aerial Vehicles in Search and Rescue. In 2018 IEEE/CIC International Conference on Communications in China (ICCC Workshops). IEEE, 147–152. https: //doi.org/10.1109/ICCChinaW.2018.8674518 [45] Norbert Tuśnio and Wojciech Wróblewski. 2021. The Efficiency of Drones Usage for Safety and Rescue Operations in an Open Area: A Case from Poland. Sustainability 14, 1 (Dec. 2021), 327. https: //doi.org/10.3390/su14010327

MobiCom ’26, October 26–30, 2026, Austin, TX, USA [46] Mathy Vanhoef and Frank Piessens. 2017. Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (Dallas, Texas, USA) (CCS ’17). Association for Computing Machinery, New York, NY, USA, 1313–1328. https://doi.org/10.1145/3133956.3134027 [47] Deepak Vasisht, Swarun Kumar, and Dina Katabi. 2016. {DecimeterLevel} localization with a single {WiFi} access point. In 13th USENIX symposium on networked systems design and implementation (NSDI 16). 165–178. [48] Fuhai Wang, Zhe Li, Rujing Xiong, Tiebin Mi, and Robert Caiming Qiu. 2025. WiCAL: Accurate Wi-Fi-Based 3D Localization Enabled by Collaborative Antenna Arrays. https://doi.org/10.48550/arXiv.2505. 21408 arXiv:2505.21408 [eess]. [49] Wei Wang, Raj Joshi, Aditya Kulkarni, Wai Kay Leong, and Ben Leong. 2013. Feasibility study of mobile phone WiFi detection in aerial search and rescue operations. In Proceedings of the 4th Asia-Pacific Workshop on Systems. ACM, Singapore Singapore, 1–6. https://doi.org/10.1145/ 2500727.2500729 [50] Wei Wang, Philip Lambert, and Jonathan Chisum. 2023. Highfrequency Limits for 3D-Printed Gradient-index (GRIN) Lens Antennas. http://arxiv.org/abs/2304.14863 arXiv:2304.14863 [eess]. [51] Judy Whiteside (Ed.). 2024. Mountain Rescue WINTER 2024. [52] Chuanming Wu, Yuqi He, Ge Zhao, and Luyu Zhao. 2022. Continuous Variable Dielectric Constant Luneburg Lens Antenna Based on 3D Printing Technology. In 2022 International Conference on Microwave and Millimeter Wave Technology (ICMMT). IEEE, Harbin, China, 1–3. https://doi.org/10.1109/ICMMT55580.2022.10022890 [53] Yaxiong Xie, Yanbo Zhang, Jansen Christian Liando, and Mo Li. 2018. SWAN: Stitched Wi-Fi ANtennas. In Proceedings of the 24th Annual International Conference on Mobile Computing and Networking. ACM, New Delhi India, 51–66. https://doi.org/10.1145/3241539.3241572 [54] Jie Xiong and Kyle Jamieson. 2013. ArrayTrack: A Fine-Grained Indoor Location System. (2013). [55] Zheng Yang, Chenshu Wu, and Yunhao Liu. 2012. Locating in fingerprint space: wireless indoor localization with little human intervention. In Proceedings of the 18th annual international conference on Mobile computing and networking. ACM, Istanbul Turkey, 269–280. https://doi.org/10.1145/2348543.2348578 [56] Moustafa Youssef and Ashok Agrawala. 2005. The Horus WLAN location determination system. In Proceedings of the 3rd international conference on Mobile systems, applications, and services. ACM, Seattle Washington, 205–218. https://doi.org/10.1145/1067170.1067193 [57] Jaroslav Zechmeister and Jaroslav Lacik. 2019. Complex Relative Permittivity Measurement of Selected 3D-Printed Materials up to 10 GHz. In 2019 Conference on Microwave Techniques (COMITE). IEEE, Pardubice, Czech Republic, 1–4. https://doi.org/10.1109/COMITE.201 9.8733590 [58] Apolline Zehner, Iness Ben Guirat, and Jan Tobias Mühlberg. 2025. Privacy-Enhancing Technologies Against Physical-Layer and LinkLayer Device Tracking: Trends, Challenges, and Future Directions. In Proceedings 2025 Workshop on Innovation in Metadata Privacy: Analysis and Construction Techniques. Internet Society, San Diego, CA, USA. https://doi.org/10.14722/impact.2025.23080 [59] Bin-Bin Zhang, Dongheng Zhang, Ruiyuan Song, Binquan Wang, Yang Hu, and Yan Chen. 2023. RF-Search: Searching Unconscious Victim in Smoke Scenes with RF-enabled Drone. In Proceedings of the 29th Annual International Conference on Mobile Computing and Networking. ACM, Madrid Spain, 1–15. https://doi.org/10.1145/3570361.3613305 [60] Lingyan Zhang and Hongyu Wang. 2019. 3D-WiFi: 3D Localization With Commodity WiFi. IEEE Sensors Journal 19, 13 (2019), 5141–5152. https://doi.org/10.1109/JSEN.2019.2900511

MobiCom ’26, October 26–30, 2026, Austin, TX, USA [61] Jincao Zhu, Youngbin Im, Shivakant Mishra, and Sangtae Ha. 2017. Calibrating Time-variant, Device-specific Phase Noise for COTS WiFi Devices. In Proceedings of the 15th ACM Conference on Embedded

Hou et al. Network Sensor Systems. ACM, Delft Netherlands, 1–12. //doi.org/10.1145/3131672.3131695

https: