MobiCom 2026 Papers

Deploying large language models (LLMs) on edge devices has garnered significant attention due to their inherent privacy and security benefits. However, the enormous parameter scale of modern LLMs poses fundamental challenges for resource-constrained edge devices. Mixture-of-Experts (MoE) models emerge as a promising solution by dynamically activating only a subset of experts during inference, and thus enhance computational efficiency. Nevertheless, the runtime uncertainty in expert activation still leads to high memory demands during inference. To address this, prior works concentrate on either compressing or offloading experts, all striving around the tradeoffs among the model precision, memory consumption, and serving throughput, and thus form an “impossible triangle”.

Accurate 3D localization is critical for indoor applications such as XR and drone operation, requiring centimeter-level accuracy, real-time updates, and deployment from a single site. In many indoor XR-style deployments, these requirements arise in LoS-dominant, room-scale environments where the direct path remains observable or separable. Existing optical, acoustic, WiFi/BLE, and prior UWB systems address parts of these requirements but typically struggle to satisfy them simultaneously due to infrastructure cost, limited bandwidth, or computational complexity. We present XRLoc3D, a single-anchor UWB localization framework that combines algorithmic innovation, hardware design, and bias-aware modeling. Instead of brute-force or stochastic likelihood search, XRLoc3D analytically enumerates consistent TDoA/PDoA hyperboloid intersections, collapsing billions of volumetric candidates into a tractable set and achieving maximum-likelihood accuracy with over 107× fewer evaluations than a volumetric maximum-likelihood reference. On the hardware side, we build a compact two-tier array that enables near-field observability from a single site. We further incorporate lightweight calibration to remove angle-dependent antenna biases, sustaining centimeter-level accuracy in room-scale indoor environments where the direct path remains separable. In a 5 m × 5 m × 3 m indoor space, XRLoc3D achieves a median error of 1.51 cm and a 90th-percentile error of 5.76 cm at 60 updates/s, using DW3000-class radios on the globally standardized 8 GHz UWB band. These results demonstrate practical real-time 3D localization for room-scale indoor deployments using a single-site prototype built from off-the-shelf UWB evaluation modules.

Direct-to-cell (DtC) satellites borrow licensed RF bands from terrestrial cellular networks to connect our phones anytime, everywhere. However, this spectrum sharing may introduce unexpected satellite RF signals into licensed bands, leading to interference across satellite and terrestrial networks. A prerequisite for addressing these issues is to trace which DtC satellite transmits these radio signals. However, our real-world measurements reveal that this basic task encounters three challenges unique to DtC satellites: inaccurate tracing after their RF pre-compensation for optimization, exhausting tracing to satellite mobility, and incomplete tracing due to dedicated monitoring systems' low coverage and high cost. We devise SatMon, a community-driven backtracer of DtC satellite RF signals at scale. Upon detecting signals of interest, SatMon traces their originating satellites by sensing their cross-user uplink synchronization under orbital constraints. This fingerprint is accurate despite signal pre-compensations. It is deployable not only on existing dedicated monitoring systems but also on ubiquitous regular phones. It also needs only sparse monitors and their existing measurements for wide-area, timely satellite signal tracing at low cost. SatMon has been released to the community and tested in 5 countries. Our real-world field tests and data-driven emulations using 203 million signaling records show that SatMon can identify DtC satellite transmitters at 96.7% accuracy using only two phones at low cost and is robust to radio interference.

Software-defined radios are central to wireless systems research, but their host-centric streaming interfaces grow fragile exactly where modern experiments push hardest: wide bandwidth, many antennas, and fine slot-level control. The root difficulty is a timing-domain mismatch: the FPGA and RF front-end run on a deterministic, sample-clock-driven timeline, while the host operates asynchronously under operating-system scheduling, and traditional stacks resolve this by forcing the host to keep pace with the radio, producing late packets, underflows, and overflows at wideband rates. We present RadioStream, a radio-centric, slot-synchronous SDR architecture that makes the slot, rather than the raw sample stream, the unit of coordination across the host-radio boundary. The FPGA owns slot timing and time-critical radio actions and exports slot boundaries to the host as explicit slot-tick Ethernet packets, while the host runs asynchronously behind slot-aligned buffers over a lightweight fronthaul, with a two-slot look-ahead for control. A DPDK-based host path integrates directly with frameworks such as GNU Radio, Python, and MATLAB. On a 100G interface, RadioStream sustains 90 Gbps concurrently on uplink and downlink with no packet drops, streams 2 GHz of aggregated RF bandwidth, bounds slot-tick jitter below 600 ns at the 99th percentile, and applies per-slot control reaching the RF output in under 500 ns. We demonstrate RadioStream across communication, mmWave beam sweeping, and sub-6 GHz multi-antenna sensing workloads, showing that reliable, high-throughput streaming and deterministic fine-grained control hold together in practice.

Continuous wearable AI perception must capture transient, meaningful events throughout the day, yet always-on visual processing rapidly exhausts batteries of compact wearables. We present ActiveSight, an algorithm-hardware co-designed multimodal gating system that exploits the complementarity between audio and vision: audio is energy-efficient but perceptually limited, while vision is accurate but too power-hungry to run continuously. ActiveSight uses a low-power audio front-end as an always-on trigger and activates a unified CLIP-based detector only when visual semantic filtering is needed. The detector performs keyword-guided semantic filtering with reconfigurable text anchors, transmitting only relevant frames without on-device retraining. To enable on-wearable execution, we design a custom FPGA accelerator featuring the PatchDW dataflow, which mitigates the memory bottleneck of depthwise convolutions and achieves 44.3 GOPS/W in PL-side active power. Evaluation on Ego4D shows that ActiveSight achieves 87.7% event hit rate at 453 mW average power, reduces average power by 3× compared with continuous visual streaming, and reaches 88.5% hit rate in live smart-glasses deployment.

Heart rate (HR) monitoring during swimming is crucial for athlete performance optimization and physiological assessment. Yet existing solutions remain unsatisfactory. ECG chest straps require tight skin contact and are often uncomfortable during swimming, while photoplethysmography (PPG) sensors suffer severe accuracy degradation due to swimming-induced motion artifacts. We present SwimHR, the first wearable-free HR monitoring system that captures electrocardiogram (ECG) signals transmitted through pool water without any on-body device. To enable practical pool-scale underwater ECG sensing, we (1) derive and validate a physical model of ECG transmission in water and quantify environmental attenuation in swimming pools through simulation, (2) design a lane-scale sensing architecture with a bias-electrode-free acquisition circuit for reliable full-lane coverage, and (3) develop a U-Net-based pipeline for robust R-peak detection under stroke-dependent swimming artifacts. We evaluate SwimHR with 34 swimmers (12 amateur and 22 professional) across four strokes and multiple pools. SwimHR achieves a mean HR error of 1.0 bpm with a standard deviation of 0.9 bpm relative to the ECG ground truth, significantly outperforming PPG-based wearables. SwimHR demonstrates the feasibility of accurate, real-time, wearable-free HR monitoring in standard swimming pool settings while avoiding the discomfort of body-worn sensors.

As multi-protocol radio-frequency (RF) environments (e.g., RFID, Wi-Fi, and 5G) become increasingly prevalent, practical RF modeling is expected to overcome single-band limitations and achieve zero-shot generalization across a broad spectrum. This requires a unified representation of frequency-dependent electromagnetic (EM) propagation rather than modeling each band separately. In this paper, we present XBandGS, a unified cross-band RF radiance field modeling framework built on 3D Gaussian Splatting (3DGS). Unlike prior 3DGS-based RF modeling methods restricted to single-frequency fitting, XBandGS introduces an EM propagation Mixture-of-Experts (MoE) that disentangles and learns the frequency-specific behaviors of different physics-guided propagation modes within a given 3D environment. In addition, our approach enables the effective use of non-co-located datasets measured at various locations for different frequency bands. Trained on sparse frequencies, XBandGS can predict RF radiance fields for arbitrary unseen frequencies across a broad spectrum. We evaluate the cross-band RF Power Angular Spectrum (PAS) reconstruction capability of XBandGS across diverse 3D environments, including 7 simulated indoor scenes spanning 1–94 GHz and 6 real-world scenes (4 indoor and 2 outdoor) spanning 0.7–5.8 GHz. Results show that XBandGS achieves high-fidelity PAS reconstruction in unseen frequency bands, with an average SSIM of 0.822 on simulated traces and 0.650 on real-world datasets.

Parkinson's disease (PD) assessment currently relies on subjective, episodic expert observations that often miss critical symptom fluctuations. Existing mobile methods are either impractical for home use or fail to capture the full spectrum of motor deficits. In this paper, we present TulipTender, a system that runs entirely on a consumer laptop using only its built-in camera, without any cloud offloading. TulipTender introduces a multi-scale 3D human modeling framework that jointly recovers full-body motion and fine hand articulations in metric space from a single video. This enables both millimeter-scale finger-tapping and meter-scale gait analysis. Furthermore, it suppresses visual artifacts, such as specular reflections and floor penetration, in uncontrolled home environments via a physics-aware purification framework. The system then extracts interpretable kinematic variables mirroring Movement Disorder Society Unified Parkinson's Disease Rating Scale (MDS-UPDRS) descriptors. These variables are processed by a lightweight hierarchical cross-modal transformer (HCT) for accurate, explainable score prediction. Evaluated on an RTX 4090 with 70 participants across diverse settings, including 43 inpatients, 20 outpatients, 2 nursing-home residents, and 5 home-based participants, TulipTender achieves F1-scores of 82% and 84% for finger tapping and gait, respectively. The full pipeline also runs locally on a MacBook Pro, supporting the feasibility of privacy-preserving assessment on consumer hardware.

Today's virtualized and disaggregated RAN (vRAN) architectures bind all User Equipments (UEs) in a cell to a single PHY layer (L1) implementation, leaving operators with no ability to run multiple L1s concurrently and select different L1 processing for different UEs. As such, this precludes the possibility of incremental L1 updates, A/B testing of new L1s, and prevents any form of service differentiation at the L1. In this paper, we present Thor, a practical system that introduces a new primitive for vRANs: fine-grained per-UE baseband routing. Thor enables operators to route each UE to its designated L1 instance by interposing lightweight, standards-compliant middleboxes at the FAPI and O-RAN fronthaul interfaces. These middleboxes safely split and merge control, data, and IQ samples across multiple concurrently running L1 implementations while preserving cell-wide shared context and meeting strict slot-level deadlines. We prototype Thor on a standard-compliant 5G testbed and show that it is robust and incurs negligible overhead. Finally, we demonstrate Thor's per-UE baseband routing primitive using incremental L1 updates as an example case study.

Unmanned Aerial Vehicles (UAVs) are emerging as critical enablers of next-generation wireless networking and autonomous systems. Despite their potential, deploying and testing networked UAV systems in real-world environments remains challenging, largely due to the absence of well-developed, end-to-end, ready-to-use protocol stacks. To fill this gap, we present C2Stack, a configurable protocol stack and experimental framework designed for real-time control, evaluation, and optimization of UAV networks. C2Stack incorporates a modular control plane, referred to as the C2Stack Network Operating System (CNOS), alongside a programmable data plane that exposes APIs for cross-layer algorithm development, digital twin integration, and autonomous swarm control.

LoRa extends communication range by operating well below the noise floor, yet this capability hinges on reliable packet detection—an overlooked bottleneck. Carrier frequency offset (CFO) introduces deterministic inter-chirp phase shifts that prevent coherent preamble accumulation; because all existing detectors fall back on non-coherent, magnitude-only addition, they forfeit substantial signal power. We present DeRa, a phase-coherent LoRa detection and decoding framework built on three contributions: (1) a phase-coherent detection method that exploits the relationship between CFO and inter-chirp phase evolution to detect weak packets; (2) analytical compensation of compound CFO-induced scaling distortions—timing drift, frequency migration, and energy leakage—so that coherent accumulation remains effective even under 40 kHz CFO, eliminating the need for expensive oscillator hardware; and (3) a CRC-guided, phase-compensated iterative decoder that coherently recombines split symbol energy and closes the detection-to-decoding feedback loop. On COTS LoRa devices across SF 7–12, DeRa lowers the detection threshold by 4.3–4.8 dB and the decoding threshold by 3.3–3.9 dB over state-of-the-art baselines, while maintaining O(N log N) per-symbol complexity and consistent gains in real-world field experiments.

The trend towards softwarized and AI driven radio access network (RAN) in 5G and beyond has created a need for RAN emulators to test and enhance cellular network performance prior to real-world deployment. However, large-scale RAN emulation remains challenging due to the complexity of the RAN protocol stack and the high cost of hardware-based solutions. Software alternatives are more affordable but current solutions sacrifice scalability or fidelity. This paper presents Chronos, a cloud-based RAN emulation system that overcomes these challenges by abstracting the compute-intensive PHY layer, virtualizing emulation time, introducing RAN slot level synchronization, and scalable middlebox based traffic forwarding. Chronos operates at the FAPI boundary: it models PHY outcomes that affect higher-layer behavior, while deliberately excluding complex physical layer signal processing. Experiments using OpenAirInterface based prototype on cloud infrastructure demonstrate Chronos's ability to emulate a RAN with 10,000 mobile devices and 10,000 base stations on 130 cloud instances (with 6400 CPU cores), two orders of magnitude larger scale than existing solutions, reflecting its potential for enabling scalable RAN emulation in an affordable manner, all while maintaining fidelity.

GNSS-Real-Time Kinematic (RTK) is designed to deliver precise GNSS positioning, yet its in-the-wild performance on smartphones (i.e., accessibility, precision, and utility) remains unknown. We present the first nationwide, in-the-wild measurement of GNSS-RTK, conducted over 2.5 years across 370 cities in China. Specifically, we leverage the operational processes of JD Logistics, a leading Chinese delivery company serving over 500 million customers, to enable nationwide GNSS-RTK measurement at scale. During daily operations, delivery couriers routinely traverse different areas with smartphones for positioning, enabling low-cost GNSS-RTK data collection at scale. The collected data provides extensive spatio-temporal coverage and repeated sampling, providing a unique opportunity for comprehensive GNSS-RTK performance measurement. Our large-scale measurement reveals that RTK achieves 92.3% overall accessibility, improves precision by 0.95 m over standalone GNSS, and yields an estimated $1.37M in recurring annual benefits from anomaly delivery detection and delivery distance measurement, together with $1.2M in one-time benefits from address coordinate mining.

A long-standing challenge for LoRa devices has been to enable ultra-low-power reception that supports always-on listening while preserving the standard LoRa PHY and compatibility with existing COTS transmitters. Currently, COTS LoRa radios fail to support spontaneous actuation due to the prohibitive receive power (~43.5 mW) required to listen continuously, which effectively locks out applications that fall under LoRaWAN Class C. Recent works achieve substantially lower receive power, but either require modified physical layers and coordinated helper transmissions, or forgo dechirping and the range it provides. To this end, we present Hark, an ultra-low-power LoRa receiver that enables always-on listening at 1.90 mW while fully demodulating and decoding standard frames from unmodified COTS transmitters. We achieve this by pairing a novel digital wake-up pipeline with an analog tunnel-diode oscillator frontend that exhibits autodyning and is disciplined by a shared, unsynchronized, unmodulated carrier emitter. Specifically, Hark samples the channel at a fraction of the Nyquist rate to minimize compute and ADC power, yet successfully demodulates standard LoRa frames even below the noise floor. Hark demonstrates a communication range of nearly 500 m while still reducing receive power by over 22× compared to the COTS LoRa receiver. Hark therefore targets deployments where standard LoRa transmitters must remain unmodified and a receiver-side carrier emitter can be shared across multiple receivers.

Electrical transformers are critical to power grids, and their mechanical integrity directly impacts system stability. Existing monitoring approaches, such as accelerometer, acoustic, and piezoelectric sensing, require intrusive installation and are often costly or impractical for real-time assessment. To overcome these limitations, we propose Transcope, a computational imaging framework that remotely infers transformer mechanical states by analyzing the illumination variations of a transformer-connected bulb. The key principle is vibration-to-flicker coupling, where abnormal mechanical states induce voltage ripples that modulate bulb brightness and create a visual proxy for internal vibrations. To this end, we develop a flicker-aware physical model to characterize the mapping from bulb images to flicker signals, and further design a diffusion-based framework to reconstruct vibration signals from weak visual observations. Extensive experiments on a real-world testbed with more than 100k samples show that Transcope achieves 0.070 MAE and 19.08 dB SNR in vibration reconstruction, and reaches 98.79% accuracy and 96.19% macro F1-score in anomaly diagnosis. These results demonstrate the promise of reliable, non-contact transformer monitoring using ordinary cameras.

On-device fine-tuning of Large Language Models (LLMs) is becoming increasingly important for personalized AI assistants and adaptive agents. However, standard backpropagation imposes substantial training-state memory overheads that often exceed the stringent resource budgets of mobile platforms. To address this, Zeroth-order (ZO) optimization leverages forward-only probing instead of backpropagation, drastically reducing memory footprints and offering a compelling alternative for on-device adaptation. Nonetheless, scaling ZO fine-tuning to billion-scale trainable parameter spaces remains challenging, as the cost of recovering reliable update directions scales poorly with dimensionality under mobile constraints. In this paper, we present Prism, a mobile-native infrastructure for practical billion-scale on-device ZO fine-tuning. Prism re-architects the ZO loop around a scalable probing substrate, bringing both per-step training latency and memory overhead closer to the inference footprint. We implement Prism end to end on commodity smartphones and evaluate it across diverse tasks and multiple model scales. Prism achieves accuracy comparable to that of state-of-the-art ZO fine-tuning baselines while reducing per-step latency by 53.4%-76.3% and peak memory by 10.6%-13.8% relative to the best baseline in each setting. These results demonstrate the practical feasibility of billion-scale on-device ZO fine-tuning for LLMs under real mobile constraints. We will release our code to support future research.

Emerging high frequency wireless sensing and communication systems often leverage metasurfaces to modulate the signal propagation, thereby transcending Snell's law. Yet, existing metasurfaces are either active, which is constantly sustained by electrical power, or passive, which cannot be reconfigured. In this paper, we explore a quasi-dynamic meta-surface using electrically morphable ferrofluid that enables a new category of metasurface design for wireless sensing and communication. We first characterize how ferrofluid material interact with high-frequency millimeter-wave signals. Next, we present a practical fabrication method of quasi-dynamic metasurface using thermoplastic 3D printing. We then develop a model to effectively manipulate the wireless signal propagation using an array of field-programmable ferrofluid cells. Our extensive evaluation results reveal the capabilities of a novel quasi-dynamic metasurface as an alternative to existing wireless tags for joint radar communication, and beamforming metasurfaces for enhancing millimeter-wave network coverage.

Muscle activation initiates contractions that drive human movement, and understanding it provides valuable insights for injury prevention and rehabilitation. Yet, sensing muscle activation is barely explored in the rapidly growing mobile health market. Traditional methods for muscle activation sensing rely on specialized electrodes, such as surface electromyography, making them impractical, especially for long-term usage. In this paper, we introduce Press2Muscle, the first system to unobtrusively infer muscle activation using insole pressure sensors. The key idea is to analyze foot pressure changes resulting from full-body muscle activation that drives movements. To handle variations in pressure signals due to differences in users' gait, weight, and movement styles, we propose a data-driven approach to dynamically adjust reliance on different foot regions and incorporate easily accessible biographical data to enhance Press2Muscle's generalization to unseen users. We conducted an extensive study with 30 users. Under a leave-one-user-out setting, Press2Muscle achieves a root mean square error of 0.025, marking a 19% improvement over a video-based counterpart. A robustness study validates Press2Muscle's ability to generalize across user demographics, footwear types, and walking surfaces. Additionally, we showcase muscle imbalance detection and muscle activation estimation under free-living settings with Press2Muscle, confirming the feasibility of muscle activation sensing using insole pressure sensors in real-world settings.