PlasTrack: Path-Independent Plasma-Induced Attacks on mmWave Sensing Tracking

Millimeter-wave (mmWave) sensing has been widely used in critical tracking applications to enhance safety and convenience. However, it is vulnerable to signal manipulation attacks. These attacks are typically path-dependent, deploying devices into the signal propagation path to cause false detections, while their impact on tracking algorithms remains unexplored. In this paper, we introduce PlasTrack, the first path-independent and through-occlusion attack method targeting mmWave sensing tracking, which leverages plasma near the sensor antenna to reduce Signal-to-Noise Ratio (SNR) by inducing local noise. These unpredictable measurement errors undermine tracking algorithms, leading to significant trajectory deviations and tracking failure. We conduct a theoretical analysis of plasma's impact on mmWave sensing to elucidate the mechanisms that enable such attacks. Furthermore, we design a general attack framework to implement and optimize the attack's effectiveness. Our extensive real-world experiments show that PlasTrack achieves high attack success rates in compromising tracked trajectories (e.g., 88% on coordinates, 100% on similarity/angle). Additionally, we perform an in-depth analysis and discussion on countermeasures against PlasTrack to enhance sensing and embedded system security.