The unprecedented success of speech recognition methods has stimulated the wide usage of intelligent audio systems, which provides new attack opportunities for stealing the user privacy through eavesdropping on the loudspeakers. Effective eavesdropping methods employ a high-speed camera, relying on LOS to measure object vibrations, or utilize WiFi MIMO antenna array, requiring to eavesdrop in quiet environments. In this paper, we explore the possibility of eavesdropping on the loudspeaker based on COTS RFID tags, which are prevalently deployed in many corners of our daily lives. We propose Tag-Bug that focuses on the human voice with complex frequency bands and performs the thru-the-wall eavesdropping on the loudspeaker by capturing sub-mm level vibration. Tag-Bug extracts sound characteristics through two means: (1) Vibration effect, where a tag directly vibrates caused by sounds; (2) Reflection effect, where a tag does not vibrate but senses the reflection signals from nearby vibrating objects. To amplify the influence of vibration signals, we design a new signal feature referred as Modulated Signal Difference (MSD) to reconstruct the sound from RF-signals. To improve the quality of the reconstructed sound for human voice recognition, we apply a Conditional Generative Adversarial Network (CGAN) to recover the full-frequency band from the partial-frequency band of the reconstructed sound. Extensive experiments on the USRP platform show that Tag-Bug can successfully capture the monotone sound when the loudness is larger than 60dB. Tag-Bug can efficiently recognize the numbers of human voice with 95.3%, 85.3% and 87.5% precision in the free-space eavesdropping, thru-the-brick-wall eavesdropping and thru-the-insulating-glass eavesdropping, respectively. Tag-Bug can also accurately recognize the letters with 87% precision in the free-space eavesdropping.

As an important indicator of the infusion monitoring for clinical treatment, the drip rate is expected to be monitored in an accurate and real-time manner. However, state-of-the-art drip rate monitoring schemes either suffer from high maintenance or incur high hardware cost. In this paper, we propose DropMonitor, an RFID-based approach to perform the mm-level sensing for infusion drip rate monitoring. By attaching a pair of batteryless RFID tags on the drip chamber, we can estimate the drip rate by capturing the RF-signals reflected from the vibrating liquid surface caused by the falling droplets. Particularly, we use the sensing tag to perceive the liquid surface vibration in the drip chamber and further derive the drip rate for infusion monitoring. Moreover, to sufficiently mitigate the multi-path interference from the surrounding human activities, we use the reference tag to perceive the multi-path signals from the indoor environment. By computing the difference of RF-signals from tag pairs, we cancel the multi-path interference and extract the drip-rate-related signals. We have implemented a prototype system and evaluated its performance in real applications. The experiment results show that DropMonitor can accurately estimate the infusion drip rate, and the average relative error of drip rate estimation is below 1% for conventional cases. In this way, considering the essential sampling rates of each tag, DropMonitor is able to monitor the drip rate for over a dozen of infusion bottles/bags in parallel with one COTS RFID system.