Willow: Practical WiFi Backscatter Localization with Parallel Tags

WiFi backscatter localization is a promising technology for the Internet of Things. However, existing works cannot work well for large-scale and low-cost tags with commodity WiFi devices. We present Willow, which provides accurate localization for parallel backscatter tags with commodity WiFi devices. We design a packet-level orthogonal backscatter modulation method to generate multiple orthogonal backscatter signals and support in-band backscatter with ambient WiFi. We show that backscatter signals can be effectively extracted even under strong in-band interference. To work in real WiFi traffic, we propose adaptive packet selection-based modulation to guarantee the orthogonality of backscatter signals. For parallel localization, we propose an iterative inter-tag interference cancellation method and a location filtering method to remove location ambiguity. We theoretically analyze the effectiveness of our method in supporting parallel tags. We prototype Willow tags using low-cost hardware and implement Willow AP on commodity WiFi NIC AX200. Through extensive experiments, we show that Willow achieves a median localization error of 27 cm and supports 51 parallel tags, which is 2× and 17× better than the state-of-the-art method.

There emerges an extensive collection of WiFi backscatter localization techniques, with representative ones shown in Table 1.Existing works, however, have the following limitations: 1) Spectrum eciency.To avoid in-band interference with excitation signals, previous backscatter systems shift the frequency of the excitation signal and make the backscatter signal out-of-band.For example, WiTag [6] shifts the backscatter signal into a non-overlapped band.However, considering tens, even hundreds of Mhz signal bandwidth in WiFi, frequency-shifting will lead to low wireless spectrum efciency and high tag power consumption.Batch localization [8] utilizes OFDM modulation to obtain concurrent tag signals.However, maintaining orthogonality in OFDM requires a high-precision oscillator to control the shifting frequency and is dicult to achieve on low-cost tags.2) Strong excitation interference.Some works try to do in-band backscatter localization.TagFi [7] toggles backscatter tags and creates a new signal subspace based on the MUSIC spatial spectrum calculation, which partially separates backscatter signals from the excitation.However, the strength of the excitation signal is typically magnitudes higher than the backscatter signal, leading to inevitable residual interference with backscatter signals.
3) No parallel localization.WiTag [6] and TagFi [7] only work for a single or very few tags.Batch Localization [8] supports parallel localization for multiple tags but is not compatible with commodity WiFi.In summary, none of the existing works achieves large-scale parallel localization with low-cost hardware platforms.
This paper presents Willow, the rst WiFi localization system for large-scale parallel low-power backscatter tags.As shown in Fig. 1, Willow takes packets from commodity WiFi devices as excitation signals.Instead of shifting signals out-of-band, a Willow tag only toggles between two reection coecients according to a certain pattern.The toggling rate is low to ensure low power consumption and low complexity for tags.We design orthogonal patterns for the reection coecients so that multiple backscatter signals along with the excitation signal can be simultaneously received and separated by commodity WiFi devices.The WiFi receiver analyzes the CSI (Channel State Information) in the received packets, separates the channel states of each tag, and calculates the locations of tags.
To turn the basic idea of Willow into reality, we need to address the following key challenges: First, how to extract backscatter signals under strong in-band interference of excitation signals?Typically, we can generate backscatter signals by shifting the excitation signal out-of-band.This method works well for low-bandwidth excitation signals (e.g., LoRa, Bluetooth, etc), but leads to high spectrum consumption and tag complexity for high-bandwidth signals like modern WiFi.The time division method cannot work here either.Because the backscatter signal is always derived from the excitation signal, it's impossible to assign dierent time slots to them.We propose a packetlevel orthogonal backscatter modulation (POBM) method to embed backscatter signals into ambient WiFi trac.We take a sequence of WiFi packets as excitation signals, where all packets have the same channel .Willow tag reects WiFi signals with dierent coecients, e.g., -1 and 1.By carefully designing the coecient pattern, we can construct a sequence that is orthogonal with the excitation signal and thus extract backscatter channels from excitation signals.For example, assume the backscatter channel is ⌘ and the coecient pattern is ⇠% ⌫ = [1, 1, 1, 1], the received CSI sequence will be Ĥ(<) = [ , , , ] + ⇠% ⌫ • ⌘ = [ + ⌘, ⌘, + ⌘, ⌘], given each backscatter coecient aligned with one WiFi packet.We derive the backscatter channel as ⇠% ⌫ • Ĥ(<) = 4 • ⌘.The tag switches its coecient pattern at the packet level, which can be easily achieved by low-power and low-complexity hardware.
Second, how to adapt to real WiFi trac and devices?To extract the backscatter channel information, Willow requires orthogonality among coecient patterns.Packets in real WiFi trac may not accurately align with patterns in POBM.For example, there may be no packets for modulation in some periods.This destroys the orthogonality and leads to strong leakage from the excitation signal.We nd that the coecient pattern of the excitation signal is always 1, the backscatter tag only needs to create a pattern having an equal number of coecients 1 and -1 to maintain the orthogonality.We design a packet selection mechanism to actively select the desired excitation packets, ensuring orthogonality between the backscatter signal and the excitation WiFi signal.Meanwhile, practical WiFi transceivers are not synchronized in time and frequency.It will create packet detection delay and overall phase oset, both leading to phase discontinuity among packets and destroying the pattern orthogonality.To settle this, we search for the best linear t of the packet detection delay and phase osets and then compensate them among dierent packets to achieve continuous phases.
Third, how to enable parallel backscatter localization?Some active localization systems such as GPS [22] listen to downlink trac to enable concurrent localization.However, it requires the power-hungry down-conversion on the tag.In the context of WiFi backscatter localization, as the number of tags (uplinks) increases, the interference among tags signicantly increases and thus degrades the localization accuracy.We design orthogonal POBM patterns for dierent tags, which can separate backscatter channels for each parallel tag.Then, we use the estimated backscatter channels for tag localization.To guarantee the orthogonality among backscatter signals, tags need to be time-synchronized when toggling.However, due to the restriction of power consumption and hardware complexity, some tags do not have synchronization circuits, which will break the orthogonality of parallel coecient patterns.We introduce a two-level channel separation scheme to achieve parallel localization for unsynchronized tags.At the coarse level, we design a pseudo-orthogonal POBM pattern such that dierent tags can be semi-orthogonal.Further, at the ne-grained level, we propose an iterative interference cancellation method that searches and eliminates the strongest signal from the parallel transmissions, as the strongest one is the least inuenced.We also nd that tags with dierent signal powers are typically not co-located, due to the occurrence of similar multipath in nearby locations.We propose a location ltering algorithm to further decrease the interference.If a tag with a strong power is detected in one location, we can make sure that it will not be the location of the tag with a weak signal.
In summary, we have made the following contributions: • We propose Willow, the rst WiFi backscatter localization system for large-scale parallel low-power tags.We design a packet-level orthogonal backscatter modulation method to generate orthogonal in-band backscatter signals with ambient WiFi trac.We analyze the requirements for maintaining the orthogonality between the tag and the excitation source and propose an active

PRIMER
Signal propagation model.We rst introduce the signal propagation model of WiFi backscatter.To emit the signal, a WiFi transmitter (Tx) rst generates an OFDM signal in the baseband.We focus on the signal on one subcarrier as signals of other subcarriers go through a similar propagation process.Assuming the data transmitted is G, the baseband signal can be expressed as B (C) = G • 4 92c 5 ?C , where 5 ? is the subcarrier frequency.Then, the Tx upper-converts the baseband signal with a high-frequency carrier as: We rst consider the LoS (Line-of-Sight) path of the backscatter signal.As shown in Fig. 2(a), the WiFi signal arrives at the backscatter tag with the attenuation U 1 1 and delay g 1 1 .The tag can switch between dierent states to modify the incoming signal and multiply it with dierent coecients, denoted as ~.Thus, the backscatter signal is: Similarly, the backscatter signal propagates to a WiFi receiver (Rx) with another attenuation U 1 2 and delay g 1 2 .Thus, the backscatter signal received at the Rx is: Here we ignore the time, frequency and phase misalignments between the Tx and Rx as they can be eliminated in the location calculation.The Rx down-converts ' ⌫ (C) to the baseband by multiplying it with 4 92c 5 2 C as: Then, the Rx applies FFT to A ⌫ (C) and checks the ?C⌘ point to get the channel of the backscatter signal: where 2 ) is the channel of the backscatter signal.When there are multiple signal propagation paths, the estimated channel will be a linear superposition of multipath signals.For example, there are two propagation paths in Fig. 2(a).The backscatter channel will be: 2 ) .Here we neglect the reected signals (including the signal scattered by other tags) scatter again as previous works [2,23,24] do.Because they are too weak to capture in the MUSIC spectrum.
Localization model.After extracting the backscatter channel ⌘ ?, we can locate the tag.The Rx can measure the wireless channel at dierent subcarriers and apply the MUSIC algorithm [25] to the channel to obtain the CIR (Channel Impulse Response).CIR describes the propagation delay of each signal path and can reect the distance between tags and Tx/Rx.When there are multiple signal paths, the MUSIC spectrum will exhibit them all, for example, g 1 1 + g 1 2 and g 1 1 + g 2 2 in Fig. 2(b).Rx can also obtain AoA (Angle of Arrival) information that measures the channel by the multiple antennae.The phase (propagation distance) dierences between adjacent antennae are proportional to B8=(\ ), where \ is the AoA of this path.As shown in Fig 2 (c) and (d), the incident phase is shown as distinct peaks in the MUSIC spectrum [26].Rx can use the channel from both multiple subcarriers and antennae to joint-estimate the ToF and AoA simultaneously [27,28].After Rx obtains channel measurements in subcarrier #? and antenna #@, ⌘ ?,@ , it performs eigenvalue decomposition to the CSI matrix and calculates the energy intensity for each ToF-AoA combination with 2D-MUSIC algorithm [29].For example, in Fig. 2 separated spots lying in the pair of {g 1 1 + g 1 2 , \ 1 } and {g 1 1 + g 2 2 , \ 2 }, as shown in Fig. 2(e).We ignore the time misalignment between Tx and Rx, as it can be calibrated by the distance and measured delay between them.We only need to get the {ToF, AoA} pair with the shortest time delay to identify the LoS path.With the LoS ToF, we know the sum of the Tx-to-Tag and Tag-to-Rx distance.We can then determine an ellipse based on the location of the Tx and Rx.With the aid of LoS AoA, we can determine a ray starting from the Rx.The intersection of the ellipse and ray is the tag location.Willow can also use more Rx to nd their intersection to provide higher accuracy.

Challenges
The Backscatter channel is mixed with strong in-band excitation interference.We assume that we could extract pure backscatter channel ⌘.However, since Willow tags work in the same frequency band with the excitation signal, the channel estimated by Rx will be mixed with the excitation channel.Similar to Eq. 5, the excitation channel is ˆ ?= G • ? .In Fig 2(a), the channel of excitation signal is ?= U 1 3 4 92c (5? +5 2 )g 1  3 .The hybrid channel can be expressed as: It is challenging to extract the backscatter channel from Eq. 6.
Compatible with real WiFi trac and devices.Willow tag creates an orthogonality pattern to extract the backscatter channel and try to avoid interference from the excitation signal.However, real WiFi trac is not always uniform and desynchronization between transceivers will lead to the destruction of orthogonality and leaked interference from the excitation signal.Considering the greatly stronger power dierence between backscatter and excitation signal, which can be up to tens of dB [24], the residual error of excitation will dramatically distort the estimation of the backscatter channel and thus disable the localization.
Inter tag interference in parallel localization.In parallel localization, there are more terms in Eq. 6 to be resolved.Willow assigns dierent orthogonality patterns to dierent tags.However, the time misalignments among tags also destroy the orthogonality.To make matters worse, the tag with a stronger signal strength may leak its channel value to the weaker ones, known as the near-far problem.In lower-cost tags, this near-far problem is more dicult to deal with due to the lack of a synchronization mechanism.Willow should ensure the robustness of the system in this case.

WILLOW BASIC DESIGN
We rst introduce how Willow works for a single tag and then extend it to parallel localization in the next section.

Extract Backscatter Channel
To extract the backscatter channel ⌘, we need to separate it and the excitation channel from the hybrid channel measurement Ĥ.We use the POBM scheme to achieve this.
We rst see how a standard WiFi receiver estimates the wireless channel.WiFi transmitters send packets sharing the same preamble to enable channel measurement and calibration, known as LTF (Long Training Field).In other words, the transmitted data G of LTF in Eq. 6 remains unchanged for dierent packets.In the WiFi standard, the LTF is pre-dened for every subcarrier.Without loss of generality, we assume the coecient in every WiFi packet is set to 1, i.e., G is consistently equal to 1.In fact, G is either 1 or -1 for dierent subcarriers in WiFi.But both cases can be normalized to 1, which doesn't aect the orthogonality in POBM.Therefore, for the < C⌘ packet, the receiver estimates the channel based on the LTF as ˆ (<) = G (<) • = .Then, we discuss how the backscatter signal impacts the channel estimation.Backscatter tags can toggle between two states, which introduces two dierent coecient values for each arrived WiFi packet.For the < C⌘ incident packet, the tag multiplies it by ~(<) = { 1, 1} as shown in Eq. 2. Note that even if the coecients are not -1 and 1, we can always regard them as -1 and 1 with a DC oset and linear scaling, without aecting the orthogonality in POBM either.After superposing a backscatter signal, the channel for the < C⌘ packet can be expressed as ⌘ Signals in an actual WiFi channel contain both the excitation and backscatter signals.Thus, the measured hybrid channel is Ĥ(<) = ± ⌘.Our goal is to separate backscatter channel ⌘ from the actual estimated channel Ĥ(<).As shown in Fig. 3, the coecients in LTF compose a coecient pattern ⇠% ⇢ = [1, 1, 1, 1].Meanwhile, the tag toggles the coecient for dierent packets to generate an orthogonal coecient pattern, e.g., ⇠% ⌫ = [1, 1, 1, 1].The hybrid signal is the combination of these two patterns.For each packet, the Rx estimates the hybrid channel and outputs a sequence: To extract backscatter channel ⌘ from the estimated Ĥ sequence, Willow dot multiplies Ĥ with the predened backscatter coecient pattern, i.e., Ĥ By normalizing the result, Willow gets the pure backscatter channel: Similarly, by multiplying the received channel sequence with the pattern corresponding to the excitation source ⇠% ⇢ , Willow can get the pure excitation channel .
With the POBM method, Willow can also capture the weak backscatter channel.Due to the strong excitation interference, when the tag toggles between two coecients, it only creates little inuence for the hybrid channel shown in Fig. 4(a).However, with the POBM and according decoding method, we get the pure backscatter channel estimation as shown in Fig. 4(b).Since the Willow tag only needs to toggle from dierent coecients in a packet level, regardless of the original bandwidth of the excitation signal, it ensures low power consumption and hardware complexity on the tag.A designed pattern here can also resist the dynamic environment.Assuming there are walking people, it will also aect the hybrid channel with certain patterns.The typical frequency of a human walking is around 1.8 to 2 Hz [30].Willow chooses a dierent toggling frequency from 20 to 100 Hz to avoid this interference [7].

Time Misalignment
The POBM method needs orthogonality between patterns, which requires the excitation source and tag to transmit synchronically.Willow could achieve this by setting the toggling rate of the tag the same as the excitation packet sending rate.Ideally, even if the tag is not synchronized with the excitation source, as long as the period of them is the same, the Rx is still able to collect all the necessary coecients.As shown in Fig. 5(a), the tag starts sending coecients with a certain time oset C 1 .If the tag can hold the current state for exactly the same time interval, the next packet will be with the targeted next backscatter coecient.The Willow tag can blindly toggle its switch without a synchronization circuit.However, as WiFi adopts the CSMA/CA mechanism where a transmitter rst detects the ongoing trac and delays its next transmission accordingly, the interval between two adjacent WiFi packets may vary.If the delay is too large, the tag may switch to the next coecient.As shown in Fig. 5(b), the packet #2 is delayed by C. If C is larger than the scheduled packet interval C 1 , then the second coecient sent by tag is not -1, but 1. Correspondingly, the second channel measurement Ĥ(2) is no longer the targeted one ⌘, but is + ⌘.The coecient pattern of the tag now is [1, 1, 1, 1], which is not orthogonal to ⇠% ⇢ anymore.
We qualify the distribution of delay in a practical wireless environment with an experiment.We use a commodity WiFi NIC AX200 to send packets every 20 ms in a laboratory.We analyze the time intervals between adjacent packets by checking the timestamp of received packets.The result shows that the maximum interval is around 22 ms, which means the extra delay can be up to 2 ms.
However, we have a key observation here: the pattern of the excitation signal is only composed of coecient 1, i.e., ⇠% ⇢ = [1, 1, ..., 1].Thus, for a backscatter pattern ⇠% ⌫ = [⇠ 1 , ..., ⇠ 9 = ±1, ...], the dot multiplying with ⇠% ⇢ is the sum of every coecient, which is equal to the number of coecient 1 minus the number of coecient -1: Thus, if the pattern is composed of the same amount of coecients 1 and -1, the result of Eq. 7 is 0, i.e., ⇠% ⌫ is still orthogonal with ⇠% ⇢ .The Rx can process the timestamp of each packet, through which it can calculate the packet intervals and infer the coecient value of each packet.Then, it can calculate the dierence between the number of coecient 1 and -1.In the example of Fig. 5(b), the Rx will know the received backscatter pattern is [1, 1, 1, 1].This pattern has two more coecients 1. Willow only needs to select the same number of coecient 1 to meet the number of -1 now.In this case, Willow can pick any one of coecient 1 from the rst three packets and the coecient -1 from the last packet.
As the unexpected delay is randomly distributed, both coecients 1 and -1 have the same possibility of being transferred.The mathematical expectation number of coecients 1 and -1 should be equal.We further consider the expectation of the minimum number of 1 and -1 (i.e., E [min (=D<(1), =D<( 1))]).Suppose we have a pattern containing 2" coecients, and the possibility of ipping is 0, then the number of 1 or -1 follows the binomial distribution ⌫(", 2"0(1 0)).According to the central limit theorem [31], this distribution can be approximated to the normal distribution # (", 2"0(1 0)).The probability density function of the number of 1 or -1 as ?(G) = If the coecient number 2" is 100, even in the worst case that coecients ip fully randomly (0 = 0.5), we have this expectation to be 46.This means that more than 90% (46 ⇥ 2/100) coecients can be selected to ensure an equal number of 1 and -1.This also indicates that even for aperiodic packets, such as burst data packets with fully non-uniformed time intervals, its impact on Willow can still be eliminated by carefully selecting orthogonal coecient patterns with low overhead.

Unsynchronized Transceivers
The excitation source generates the same packet header on the baseband.Willow utilizes it and creates a coecient pattern full of coecient 1.However, there are PDD (Packet Detection Delay) and CFO (Carrier Frequency Oset) among unsynchronized commodity WiFi devices [25,28].The PDD X will add an extra linear phase 2c 5 ?X into dierent subcarriers in a packet.The CFO will cause an overall phase oset V when the transceivers up/down-converting the baseband signals.Thus, the < C⌘ actual hybrid channel measurement in subcarrier #? and antenna #@ of the Rx is: These two types of oset are consistent for dierent antennae in the same packet because the dierent receiving chains are synchronized.But they vary among packets, which makes the pattern of the excitation signal no longer all consist of coecient 1 and ruins the orthogonality.To tackle this problem, Willow applies the widely used CSI sanitization algorithm in MonoLoco [27], TagFi [7], and SpotFi [28].Willow rst calculates the unwrapped phase value ?,@ (<) of CSI measurement Ĥ0 ?,@ (<).Then, Willow nds the best linear t and overall oset value to cancel the residual oset in the unwrap phase: Then, Willow compensates the phase value in the measured channel Ĥ0 ?,@ (<) by the estimated X< and V< , which gives us: Ĥ0 ?,@ (<)•4 92c 5 ?X< •4 9 V< .This process eliminates the phase oset caused by unsynchronized transceivers.The excitation source is still sending the pattern full of coecient 1 and is ready for Willow to extract the backscatter channel.

Working with existing WiFi
Willow tag does not require a special packet format from the excitation source and can tolerate time misalignment to the excitation.Thus, Willow is completable with commodity WiFi transmitters.For commodity WiFi receivers, they will apply standard channel estimation as described in Eq. 6.The tag path is regarded as a normal multipath, which can be seamlessly captured by the WiFi hardware.Thus, Willow is also completable with commodity WiFi receivers.
But for an unsynchronized Willow tag, there are two possible situations for ongoing WiFi transmission.First, if the tag doesn't toggle state during the packet, as shown in Fig. 6(a).The commodity WiFi Rx will process the header and get the channel estimation Ĥ(1) = + ⌘.For the payload, the baseband signal G 30C0 will also go through the same channel.Thus, the received data will be Ĥ(1) • G 30C0 .By dividing the received data with the channel estimated by the header, Rx recovers the original data: Ĥ(1) •G 30C0 / Ĥ(1) = G 30C0 .This process is done seamlessly by the commodity receiver.So, it won't aect the excitation transmission.We note that because of the short packet duration for active WiFi packets, the possibility of this case is large.For example, if the duration of each coecient state for the backscatter signal is 10 ms, and the duration of WiFi packets is 60 `s, the possibility for the second case is only 1 2 •

60
`B 10 <B = 98.8%.The second situation is tag toggles its coecient during the ongoing packet, as shown in Fig. 6(b).Here we assume a representative case in which the tag toggles its coecient after the header.The estimated channel is Ĥ(1) = + ⌘.But the undergo channel for payload data is Ĥ(2) = ⌘.If the Rx tries to recover payload data by Ĥ(2) • G 30C0 / Ĥ(1), there will be extra noise ⌘ in decoding.We take advantage of the POBM method to avoid the impact of backscatter signals on the decoding of normal WiFi packets.As POBM can tolerate extremely low SNR backscatter signals, the backscatter channel ⌘ can be regarded as a negligible noise term in decoding a single packet.In a typical WiFi backscatter network, the power dierence between the source and tag is normally up to 40 dB [32].For example, a WiFi packet with 20 dB SNR, an interference source that is 40 dB weaker, only increases the BER by 2.6 5 with 256 QAM modulation [33].For packets with 64-byte payload, the PRR is only degraded by 0.16% [34].Considering the possibility of this case, the overall PRR loss 0.16% ⇥ (1 98.8)% = 1.92 ⇥ 10 5 , which is negligible.

PARALLEL LOCALIZATION
When there are multiple tags, Willow uses the POBM to separate channels of parallel tags and locate multiple tags simultaneously.To achieve this, Willow assigns dierent orthogonal coecient patterns to dierent tags.Each tag toggles its states according to the predened coecient pattern.Then, the WiFi Rx collects the channel which contains an excitation and multiple backscatter channels.With the carefully designed interference separation approach, Willow Rx can get the pure channel for each backscatter tag.Finally, Willow calculates the location for each tag based on the localization model mentioned in § 2.

Synchronized Tags
We rst focus on the case with synchronized tags, where tags and the excitation source are time-synchronized.Thus, they can generate the arranged coecients in the same time slot, as shown in Figure 7(a).In this case, we assign fully orthogonal patterns to dierent tags to cancel inter-tag interference.Considering the possible jitter from the sending time of excitation packets, we extend the coecient duration at tags, promising each packet falls into one coecient slot.Willow can achieve the synchronization by a leader-follower mechanism [32,35].The excitation source wakes the tag by a certain interval, tags will use a simple envelop detector to recognize the interval and set the common starting time of patterns sending.
For example, there are two synchronized tags, as shown in Fig. 7(a).Willow assigns two orthogonal patterns: . Those two tags toggle coecients accordingly and simultaneously.The hybrid channel Ĥ(<) now contains both excitation channel and two backscatter channels ⌘ 1 and If we dot multiply the received channel Ĥ(<) with ⇠% 1 ⌫ , we will get the channel measurements of ⌘ 1 .Similarly, we get ⌘ 2 by dot multiplying the channel sequence with ⇠% 2 ⌫ .Willow adopts the widely used Walsh code to generate the assigned patterns.In Walsh code, it always contains the excitation pattern ⇠% ⇢ which only consists of coecient 1. Willow tags choose other patterns dierent from ⇠% ⇢ to keep the orthogonality.

Unsynchronized Tags
Then, we look at the situation with unsynchronized tags.The lack of time synchronization will break the orthogonality between the assigned coecient patterns.As shown in Fig. 7(b), the pattern for tag#1 now is . The time asynchronization also exacerbates the near-far problem.It makes the signal from tags with stronger power strength leak to the weaker ones.A straightforward idea for the near-far problem is to use a central AP to explicitly lower the power of stronger tags [23].However, unsynchronized tags cannot receive down-link arrangements.We propose several designs to ease the tag asynchronization-induced interference problem.First, Willow uses the S-Kasami sequences to generate the pattern, which is a "pseudo-noise" sequence and can lower the correlation between unsynchronized patterns.Then, Willow adopts an interactive elimination method to further decrease the leaked signal.At last, Willow adopts a location ltering method to lter out the unwanted locations caused by the residual leaked signal.

Iterative Elimination.
We have a key observation here: the signal of the strongest strength is typically least inuenced by other signals.Willow can calculate the channel of the tag with the current strongest strength, and then cancel it in the hybrid signal and proceed to the next round.This idea is widely used in multisignal separation [36,37].In Willow, however, we have a dierent restriction.In backscatter systems, due to more signal propagation attenuation, the power of the excitation signal is typically several orders of magnitude stronger than the backscatter signal [24,32,38].Thus, the strongest terminal is always the excitation source with the pattern consisting of all coecients 1.Even a small residual error in the elimination process for the excitation source will spread into the estimation of the backscatter channel and greatly degrade the localization accuracy.Willow avoids this by always ensuring the orthogonality between the excitation signal and the backscatter signal.Here, Willow also adopts the active packet-picking method in § 3.2.Moreover, we extend the one coecient duration according to the scale of the network to lower the possibility of the coecient ipping caused by the jitter of excitation packets sending.
To be specic, after receiving a channel sequence containing multiple tag signals with arbitrary time osets, Willow uses a sliding window and the predened pattern to nd the strongest backscatter signal.During this process, Willow also actively picks packets to form backscatter patterns with equally distributed coecients 1 and -1 to avoid strong interference from the excitation source.After extracting the current strongest backscatter channel, Willow subtracts the channel value from the hybrid channel and encounters the next round of calculation, till the channels of every tag are obtained.The simulation results show our method can provide a dynamic range of up to 60 dB.

Location
Filtering.After using the quasi-orthogonal pattern and iterative elimination, we lower the signal leakage among tags.However, there is always residual error which will be leaked among backscatter channel measurements.When applying dot multiplication of the channel sequence with the target pattern of a specic tag, the residual error from other tags will be added to current channel measurements.This phenomenon is essentially equal to adding more multipath which accords to the location of those tags with stronger signal strengths.When it acts on the MUSIC spatial spectrum, there will appear more pseudo peaks.Here we nd a key fact that the tag with a signicantly weaker power is more likely to be far away from those with a stronger power.To lter those pseudo peaks, Willow rst records the location of stronger tags.When locating those weaker tags, there may appear an unwanted location corresponding to those stronger tags.Willow actively ignores the location that appeared before and picks the targeted location.
To be specic, Willow also follows the iterative style for location ltering.In each round, Willow always locates the current strongest tag.It rst checks all the possible locations corresponding to the MUSIC spatial spectrum which exhibit hot dots.Then, it selects the location among all the possible locations with the highest weight.Initially, the weight F : of location : is set to the value of F : = 1/3 : , where 3 : is the sum of Tx-to-: distance and :-to-Rx distance.The initial weight design implies that Willow tends to choose locations with a lower ToF value because the target LoS path is always the shortest.In each round of ltering, the selected target location will refresh the whole area weight.For a location with weight F, whose distance from the selected location is ⇡, and the power of the current strongest tag is %, the updated weight F 0 = F %/⇡.With this proposed location ltering method, Willow further decreases the inter-tag interference.

IMPLEMENTATION
Willow Tags.We develop two types of backscatter tags: synchronized and unsynchronized tags.Both use o-the-shelf components including an ADG902 [39] RF switch, a 2.4 GHz omnidirectional antenna with a gain of 5 dBi, and an STM32L011D3P6 [40]        Excitation source and AP.The excitation source and AP are x86 PCs with Intel AX200 [43] WiFi NIC.We use the PicoScenes [44] to collect CSI measurements from 2 antennae and 489 subcarriers.The Wi-Fi NIC is congured to operate on 2422 MHz with a bandwidth of 40 MHz.All transceivers use 2.4 GHz omnidirectional antennae with a gain of 5 dBi.The POBM method requires the received training eld of excitation signals to remain the same among packets.Although the baseband value of this eld is predened and xed, we need to x the transmitting power and the receiving gain.It's feasible for AX200 to x the transmitting power, but we can't set the receiving gain.So, in our implementation, we lter out those packets with outlier magnitude.Other WiFi NICs which provide a specic gain value or xed receiving gain can also be adopted here [45].

EVALUATION 6.1 Micro Benchmark
We evaluate the localization performance of Willow and compare it with a previous work TagFi [7], a state-of-the-art WiFi backscatter localization system with commodity WiFi transceivers.TagFi toggles the tag and creates a new subspace from the excitation signal in the same MUSIC spatial spectrum.We use the same hardware design and the same amount of AP when conducting comparisons with TagFi.The localization accuracy depends on many factors, such as the multipath environment, AP (Rx) density, SNR, etc.In this section, we test the performance of Willow with dierent factors.Tag toggles with a coecient pattern of [1, 1, ..., 1, 1] with a frequency of 100 Hz.

Angle estimation accuracy.
We experiment in an indoor oce to evaluate the angle estimation accuracy of Willow.We move one tag to dierent places and measure the angle estimation error in the AP.The placement of tags and AP are shown in Fig. 11(a).The tag is placed uniformly in this room, with some placement where there are obstacles such as furniture between the tag and Rx.At each place, according to the SNR of the backscatter signal, we use 50 to 200 pattern length to calculate the backscatter channel.We plot the CDF (Cumulative Distribution Function) of the angle estimation error, as shown in Fig. 8. Willow achieves a median angle estimation error of 6.3 degrees.However, TagFi suers from strong in-band excitation signal interference, the median error is 10.7 degrees.We also observe that TagFi goes through a much more severe long-tail eect.The 90 C⌘ percentile tail error is 13.5 degrees for Willow compared to 38 degrees for TagFi.This is because the multipath relationship decides the amount of interference from the excitation source.The error can be signicant in specic places.We will evaluate this phenomenon in § 6.1.4.We also evaluate the performance in an open eld, in which the multipath is weaker, as shown in Fig. 11(b).As shown in Fig. 9, the median error of Willow and TagFi both decrease to 4.5 degrees and 7.4 degrees respectively.Willow outperforms TagFi in dierent scenarios.

Location estimation accuracy. Both Willow and TagFi can
nd the intersection of multiple locating results from multiple APs to infer the nal location of the tag.In this experiment, we measure the location estimation error.We place another three to four APs on the random corner of experimental elds.Each AP picks the useful backscatter channel based on accordingly SNR.The average distance between dierent APs is around 9 m.The result for the indoor oce is shown in Fig. 10, the median error of Willow is 57.5 cm.However, the median error of TagFi is 117 cm.The result for the outdoor eld oce is shown in Fig. 12.The median error of Willow and TagFi is 27 cm and 54.4 cm respectively.

Accuarcy under dierent AP densities. We put four or ve
APs in the indoor oce to verify the impact of collaborative APs.In this experiment, we extend the pattern length to 250 to make sure every AP receives the backscatter signal with sucient SNR.The result is shown in Fig. 13.More APs will average the noise and improve the accuracy.The median localization errors for Willow decrease to 52.6 cm and 32.7 cm for four and ve APs respectively.For TagFi, the median localization errors are 116 cm and 66.5 cm.We notice that there is more improvement for TagFi than Willow.This is because, for TagFi, the geometrical relationship will greatly inuence the localization results for the backscatter tag.When there are more APs, it will create various relative angles for the excitation source and the tag.However, even Willow with four APs still outperforms TagFi with ve APs.AoA Error (degrees) Figure 17: AoA error with dierent attenuation on LoS path.

Impact of the geometrical relationship between tag and AP.
Willow extracts the pure backscatter channel by the orthogonal coecient pattern with POBM.However, TagFi calculates the MU-SIC spectrum for the backscatter signal with the presence of the excitation signal.If the tag is closer to the source, the inferred AoA and ToF for the tag and source are also closer.It means the peak of the excitation signal will cover the backscatter signal more easily.Thus, the geometrical relationship between tag and AP will inuence the localization results of TagFi greatly.We experiment in the open eld to evaluate this eect.We x the distance between the excitation source and the AP and gradually move the tag away from the source along the dashed line in Fig. 11(b) to verify the impact of the geometrical relationship of devices.The distance between the tag and the source varies from 1 m to 6 m.As this distance increases, the interference from the source will decrease.We measure the angle estimation error at each location.The results are shown in Fig. 14.When the tag is close to the excitation source, TagFi exhibits a high angle estimation error of more than 20 degrees.That is because the strong interference from the excitation source masks and distorts nearby backscatter peaks in the MUSIC spectrum.However, the error for Willow in this case is only 1.3 degrees.As the distance increases, the error of Willow also approximately increases because of the decrement of SNR.But for TagFi, its error rst falls abnormally and then increases.It shows that TagFi is greatly inuenced by the geometrical relationship between tag and AP.However, Willow achieves lower error regardless of the relative location of the tag.
6.1.5Impact of paern length.The length of the backscatter pattern aects the SNR of the backscatter signal and the localization accuracy.We x the distance between the tag and source to 2 m and change the length of the coecient pattern from 30 to 70.We note that for higher localization accuracy or longer source-to-tag distance, Willow does need a longer pattern length to achieve the trade-o between system performance and localization latency.In this experiment, we measure the localization estimation error for each length of the coecient pattern.The result is shown in Fig. 15.When the length is only 30 packets, the localization error is 115 cm for Willow.At the same time, the error for TagFi is however 178 cm.As the length increases, the localization error decreases gradually and nally reaches 29.3 cm when the length is 70 packets.Willow achieves lower localization error for any length of the pattern.
6.1.6Paern length for dierent accuracy requirements.To verify the required pattern length regarding the AoA estimation accuracy, we examine the minimal needed length to achieve dierent accuracies in the indoor oce.We place the tag 5 meters away from the AP.We set the target accuracy from 10 degrees to 4 degrees, and then we make the tag consistently output the coecient pattern and record the minimal packets needed to achieve the target accuracy.The result is shown in Fig. 16.As the accuracy requirement increases, Willow needs more packets to improve the accuracy.From 10 to 9 degrees, we only need 6 extra packets.But it needs 42 packets from 5 to 4 degrees.We only test the performance of Willow here because it can achieve an accuracy of less than 4 degrees in this experimental setting.shortest time delay like many previous papers do [2,25,28].To verify its impact, we conduct a trace-based simulation experiment to verify the eect of obstacles on the localization accuracy.We assume there are two paths, one of them is LoS path and the other one is a reection path with a propagation of 3 and 6 m respectively.Then we gradually add attenuation to the LoS path and check the AoA estimation error to verify the impact of dierent degrees of obstacles.The result is shown in Fig. 17.Willow can support accurate AoA results with 20 dB attenuation.Even with 30 dB attenuation, the error is slightly increased to 5 degrees.
6.1.8Impact of bandwidth.The bandwidth aects the localization accuracy from the following two aspects.First, more subcarriers (bandwidth) provide more diversity gain and thus increase the SNR.Second, it also increases the ability to distinguish the multipath as it infers a ner-grained time delay prole.In this experiment, we set the distance between the excitation source and the tag to 5 meters in the indoor oce.Then we gradually increase the number of used subcarriers from 230 to 480 and measure the AoA estimation accuracy.The result is shown in Fig. 18.The error drops from 14.6 degrees to less than 2 degrees when using 230 and 480 degrees.
6.1.9Packet selection.To evaluate the eects of the packet selection method to maintain the orthogonality to the excitation signal described in § 3.2.We deliberately chose the case with unbalanced numbers of coecients 1 and -1.We change the unbalanced number from 0 (with our packet selection method) to 5. We set the sourceto-AP distance equal to the tag-to-AP distance.The incident angle for the excitation signal is 0 degrees and the incident angle for the backscatter signal is 45 degrees.We measure the angle estimation as the unbalanced number increases.As shown in Fig. 19, when the number of coecients 1 and -1 are equal, Willow outputs the target angle estimation with low error.However, because of the tremendous power dierences between the excitation and backscatter signal, even if there is just one more coecient 1, the leaked energy in the formed nonorthogonal pattern will greatly distort the estimated angle error to 11.5 degrees.When there are more than 2 extra coecients 1, almost only the excitation signal can be shown in the MUSIC spectrum, so the output result is the AoA of the excitation signal, which has an error of approximately 45 degrees.
6.1.10Tracking Objects.We move the tag across a U-shaped trajectory in an open eld (6 m in length and 3 m in width).And we collect the location results by 4 APs at dierent points along this trajectory.We show the ground truth trajectory and corresponding inferred trajectory by Willow in Fig. 20.Because of the high localization accuracy, it allows us to faithfully capture the shape of the ground truth trajectory.

Parallel Localization
In this section, we examine the parallel localization performance.We rst examine dierent impacting factors to parallel localization and then show the overall parallel localization performance in a real-deployed testbed.
6.2.1 Near-far problem.Willow uses various methods including orthogonal coecient, iterative elimination, and location ltering to mitigate the near-far problem.However, TagFi calculates the location in the same MUSIC spectrum, in which the tag with a weaker signal strength will be greatly inuenced by a stronger one.We experiment to evaluate the robustness of the near-far problem for both systems.We rst assign two orthogonal coecient patterns to tag#1 and tag#2.Then, we set the incident angle of the tag #1 and #2 to 20 degrees and 60 degrees.The distance between tag #2 and the AP is three times that of tag #1.We measure the angle estimation error for tag #2 with and without tag #1.We also connect tag #2 with 10 dB attenuation and test the error.We implement three versions of Willow.The rst one uses synchronized tags, called Willow.The second one uses unsynchronized tags and with the iterative elimination and location ltering method, called Willow-I.The third one uses unsynchronized tags and without those methods, which is called Willow-II.The result is shown in Fig. 21.When there's only tag #2 transmitting, it is marked as "1 Tag".Willow uses full orthogonal patterns, it reaches nearly the same AoA estimation error of around 5.4 degrees regardless of the presence of tag #1.Willow-I and Willow-II also achieve similar accuracy.But for TagFi, even with 1 tag, it exhibits a higher error of 10.4 degrees, due to the interference from the excitation signal.With 2 tags, the estimation error grows to be 14.4 degrees.To make matters worse, after connecting the attenuator, the errors for TagFi with 1 and 2 tags are 13.4 and 19.6 degrees respectively, as shown in Fig. 22.For Willow, it achieves a similar error of around 8.1 degrees with a single and two parallel tags.Because of the 10 dB attenuation, Willow-II is easier to be inuenced by the interference from tag #1, increasing the error to 8.7 degrees.After applying our method, Willow-I achieves a similar error as the case with only 1 tag.The results show that Willow has better resistance to the near-far problem than the previous work.6.2.2 Impact of the geometrical relationship between tags.We then change the geometrical relationship between tag #1 and #2 to evaluate its impact.We keep the incident angle for tag #1 to 20 degrees and set it for tag #2 to 30 degrees.Then we keep the distance between tag and AP the same for both tags.And we still measure the AoA error for tag #2 with and without tag #1.The result is shown in Fig. 23.Because of the same localization distance, there should be less interference to tag #2.Willow and Willow-I indeed achieve similar AoA estimation errors of around 6.5 degrees with and without tag #1 transmission.Willow-II increases the error to 6.8 degrees.However, for TagFi, the AoA estimation error is even larger when there's a stronger near-far problem.This is because TagFi calculates the AoA in the same MUSIC spectrum.When the geometrical relationship is closer for tags, there will be more interference between them.Willow is more robust for dierent deployment situations.
6.2.3 Deployment in the Field.Finally, we deploy 51 tags in a meeting room as shown in Fig. 24.The tags are assigned with dierent orthogonal patterns in advance.The excitation source and AP are all commodity WiFi NICs AX200.Tag detection.We rst test if Willow can detect dierent tags with the assigned coecient pattern.We use a sliding window to correlate the received CSI sequence with the predened backscatter coecient pattern and check if the absolute exceeds the threshold value.Tag detection is the precondition of localization, and it can also meet tasks such as object recognition.We test how many tags can be detected with dierent pattern lengths.The result is shown in Fig. 25.With a pattern length of 384, Willow successfully detects every tag linearly.With a pattern length of 128, as the number of tags increases, Willow can detect more tags, but there is a greater number of misread tags.Eventually, Willow detects 38 tags out of 51 tags with 128 pattern length.The pattern length of 384 will cause bigger latency but provide a more robust tag detection function.Thus, we use this pattern length to localize every tag.
Localization accuracy.In this experiment, we start with only 5 tags and gradually increase the number of tags to 51.Every time there are a few more tags added to the network, we measure the mean localization error.We use 7 APs to capture the backscatter coecient pattern.We also develop dierent versions of Willow, which are Willow, Willow-I, and Willow-II, the same as in § 6.2.1.The result is shown in Fig. 26.Theoretically, our method supports as many tags as possible if patterns are orthogonal to each other.With the full orthogonal patterns, Willow does achieve a similar localization error of around 69 cm regardless of the number of tags.However, the increase in unsynchronized tags will lead to higher errors.For Willow-II, its error grows rapidly with the number of tags.We nd that even after there are only 10 tags, the localization error of Willow-II has a sudden increase.It's because there are two tags with a very strong signal strength that consistently interfere with others.Finally, it reaches a mean localization error of 119 cm when there are 51 tags.With the method of iterative elimination and location ltering, Willow-I greatly reduces the localization error for Willow-II.It nally reaches a mean error of 98 cm.However, TagFi can't provide parallel localization even for 5 tags.The maximum supported concurrent number is 3. Thus, Willow extends the localization network by 17⇥ without a reduction in the accuracy.

RELATED WORKS
Backscatter communication.Research on WiFi backscatter technology has attracted widespread attention in recent years.Hitchhike [32] embeds data on ambient Wi-Fi packets by converting the excitation Wi-Fi codeword to another valid codeword.WiTAG [46] alters the wireless channel to communicate data by leveraging MAC-layer features.Wi-Fi Backscatter [47] transmits data bits by changing the RSSI of Wi-Fi packets.BackFi [48] and Hitchhike [32] change the phase of the incoming Wi-Fi signal to transmit data bits.Interscatter [49] uses a single-tone signal sent by a BLE device as an excitation signal to generate a legitimate Wi-Fi signal.OFDMA Backscatter [50] and Digiscatter [51] enable OFDMA in Wi-Fi backscatter tags.P 2 LoRa [24] designs a parallel backscatter for ambient LoRa signal.Prism [52] scales the LoRa backscatter networks with non-linear chirps.Some papers [53,54] work on enabling CDMA for backscatter with single-tone excitation.We can't directly use the current CDMA method in WiFi networks.Because the constraint in WiFi packet format and uniform distribution of WiFi signal raises new challenges.Willow uses the specic pattern design and interference cancellation method to adapt to WiFi trac.SD-PHY Backscatter [55] enables software-dened PHY for backscatter communication and can generate WiFi packets.Leggiero [35] uses extra spatial sounding features to embed data into special format WiFi packets.OFDMA downlink [56] transforms the digital demodulation approach into the ltering-based analog one.SyncScatter [57] achieves accurate synchronization with ambient WiFi signals and realizes the maximum possible sensitivity.MOXcatter [58] embeds the tag data on ambient spatial-stream packets.X-tandem [59] achieves multi-hop backscatter communication in WiFi networks.Freerider [60] frequency shifts and transfers the code of ambient WiFi packets.TiScatter [61] encodes backscatter data into the timespan between two WiFi codewords.Chameleon [62] demodulates ambient WiFi and generates arbitrary carriers into valid WiFi packets.Some papers work on compressive sensing methods to recover the data sent by parallel tags [54,63,64] for communication purposes.They distinguish the wireless channel by the possibility from one state to another.As the number of tags increases, the complexity of the algorithm grows exponentially.Unlike Willow tags, the bits they send are dened by the pattern in advance.So, we can obtain channel state by using the orthogonality among patterns.So Willow can provide more accurate and larger-scale backscatter localization.
Backscatter localization.To lower the power of tags, backscatter localization systems use a variety of information to locate backscatter tags.Tagoram [65] leverages the mobility of RFID tags to construct a virtual antenna array to achieve precise localization.RFind [4] and TurboTrack [14] compose a large bandwidth of the backscatter signal from the RFID tag to enable 3D localization.RF-IDraw [66] uses antennae with dierent spacing to achieve high-resolution RFID localization.TurboTrack [14] uses a pipelined architecture and a Bayesian spacetime super-resolution algorithm to provide ne-grained localization.Millimetro [17] designs a millimeter wave tag to achieve long-distance and highprecision localization.P2PLocate [67] utilizes the assistant from the backscatter tag to locate other WiFi devices.MetaSight [68] designs a metasurface to read the NLoS RFID tags.`locate [1] combines signals from multiple ISM bands to achieve accurate ToF estimation of LoRa backscatter.LocRa [2] enables accurate LoRa backscatter localization with spatially dispersed base stations.To achieve more ubiquitous localization, recent studies utilize existing WiFi devices to locate backscatter tags.WiTag [6] frequency shifts the excitation signal and calculates the location of the tag in the new band.TagFi [7] adapts a MUSIC-based algorithm to locate WiFi backscatter tags.Batch Localization [8] assigns dierent subcarriers to dierent backscatter tags for parallel localization.

CONCLUSION
We propose Willow, the rst WiFi backscatter localization system for large-scale parallel tags.We design a packet-level orthogonal backscatter modulation method to embed backscatter signals into ambient WiFi trac.We show that backscatter signals can be eectively extracted even under strong in-band WiFi interference.To adapt to real WiFi trac, we propose a packet selection method to retain the orthogonality between backscatter signals and the WiFi signal.For parallel localization with multiple tags, we eliminate the inter-tag interference by an iterative signal cancellation method.We remove the location ambiguity and improve localization accuracy by designing a location ltering approach.We prototype Willow tags using custom low-cost hardware and use commodity WiFi NICs (i.e., Intel AX200) as the excitation source and Willow AP.The evaluation results show that Willow achieves a median localization error of 27 cm and supports 51 parallel tags, which is 2⇥ and 17⇥ better than the state-of-the-art method.

JiliangFigure 1 :
Figure 1: Willow provides parallel WiFi backscatter localization for low-cost tags with commodity devices.

Figure 2 :
Figure 2: (a) Backscatter signal propagates along two paths to reach the Rx.(b) The MUSIC spectrum describes the signal propagation delay.(c) Incident angles create phase dierences among antennae.(d) The MUSIC spectrum describes the incident angle.(e) The MUSIC spectrum describes both the time delay and incident angle.

Figure 3 :
Figure 3: Tag toggles between two coecients to enable packet-level orthogonal backscatter modulation.

Figure 5 :
Figure 5: (a) Ideal case when Tx is transmitting packets uniformly.(b) There is a jitter for the second packet.

Figure 6 :
Figure 6: (a) Tag doesn't toggle during the transmission.(b) Tag toggles during the transmission.

Figure 8 :
Figure 8: AoA error in the oce.

Figure 9 :
Figure 9: AoA error in the open eld.

Figure 12 :
Figure 12: Localization error in the open eld.

Figure 13 :
Figure 13: Localization error with dierent densities of AP in the oce.

Figure 14 :
Figure 14: Localization error with dierent Source-to-Tag distance.

Table 1 :
Comparison with existing WiFi backscatter localization systems.