MobiCom 2026 Papers

The human ear presents unique physiological and practical advantages for cardiac monitoring. However, existing ear-able systems rely on extra hardware and complex processing, making them unsuitable for resource-constrained True Wireless Stereo (TWS) earbuds. We present EarCardio, a system that repurposes the built-in IMU sensors of commercial TWS earbuds for cardiac monitoring. Our key insight is that the built-in IMUs can capture ballistocardiogram (BCG) signals, which are streamed to a smartphone via Bluetooth for processing. EarCardio enhances the low-rate and unreliable IMU data through multi-axis fusion and signal enhancement, and further reconstructs fine-grained seismocardiogram (SCG) signals using a region-focused translation framework. We implement EarCardio as a real-time system and evaluate it with 110 human subjects. Results show that EarCardio accurately reconstructs cardiac signals and remains robust to motion artifacts, missing data, and low sampling rates, thus enabling a wide range of cardiac monitoring applications.

Underwater communication has long been constrained by the fundamental requirement for low power consumption, driven by applications such as environmental monitoring that demand long-term operation. While backscatter technology is promising in terms of power consumption, existing systems rely on simplistic reflection states (e.g., binary modulation), resulting in low data rates and the communication range is also limited. In this paper, we present MetaScatter, the first piezoelectric metasurface that overcomes these limitations by simultaneously enabling high-order backscatter modulation and beamforming. Unlike conventional mechanical metasurface designs, MetaScatter leverages programmable piezoelectric meta-atoms to control the phase of reflected acoustic signals in real time at milliwatt-level power. By decoupling beamforming and modulation via novel meta-surface codebook designs, we achieve long-range communication and high-order modulation with significantly reduced complexity. Experimental results in real-world underwater environments show that MetaScatter supports reliable high-order modulation, including 16-QAM, achieving over 500% higher throughput than the state-of-the-art underwater backscatter system [24].

Liquid adulteration poses critical societal challenges by endangering public health and causing economic losses. Existing methods on mobile devices rely solely on vibration-based solutions, which face practical limitations due to requirements of specific container materials/structures and vibrational contact. In this paper, we present LiquidLens, a practical, non-contact mobile system for detecting liquid adulteration based on RGB images of liquid surfaces. Inspired by hyperspectral reconstruction, we aim to analyze liquid food's hyperspectral properties from RGB data for effective adulteration detection. To achieve this, we address three major challenges: First, the specular reflections of liquid, which act as a mirror image of surrounding obstacles, distort spectral measurements. Second, the camera's spectral range is restricted to the visible domain, which lacks access to vital information in the invisible bands. Third, the target liquid spectrum is entangled with uncertain ambient illumination, rendering it uninterpretable. To overcome these challenges, we first exploit the camera flash as visible light source and validate its spectral consistency across mobile devices. Next, we design a specular noise suppression technique to cancel the specular noise. Then, we design an RGB-based VIS-NIR spectral recovery (RVN-SR) framework to overcome the spectral range limitation. Besides, a cross-spectral training scheme is designed to train the RVN-SR model in the flash domain, compensating for the lack of NIR radiation. We deploy and validate LiquidLens across multiple smartphones. Experimental results show robust detection accuracy of 96.2% for 8 honey adulteration types and 94.0% for 5 wine adulteration types.

This paper presents Serena, the first spatially selective radar backscatter communication system that is capable of delivering messages to radars at specific locations. Serena offers a low-power solution for properly delivering location-specific messages (e.g., no-fly-zone alert, speed-reduction warning, turning notification) to radar-equipped vehicles (e.g., automobile, UAV, UGV). Rather than manipulating RF signals with power-intensive components, Serena leverages the limited modulation capability of multiple low-power backscatter tags to generate spatially selective radar signal feature, and further utilizes such signal feature to represent bits. Such design philosophy is primarily realized by our two core designs: (i) a multi-tag distributed and synchronous modulation technique that generates spatially selective radar signal feature (i.e., the combination of the frequencies of tag-generated harmonics in radar IF spectrum); (ii) an intermittent mutual synchronization protocol that achieves 10-μs level inter-tag synchronization under only 10μW-level power consumption. Our extensive experiments demonstrate that Serena achieves desirable spatial selectivity in diverse environments: it achieves less than 1% average BER at target locations, while keeping the average BER around 30% at non-target locations.

Mobile advertising dominates app monetization but introduces risks ranging from intrusive user experience to malware delivery. Existing detection methods rely either on static analysis, which misses runtime behaviors, or on heuristic UI exploration, which struggles with sparse and obfuscated ads. In this paper, we present MANA, the first agentic multimodal reasoning framework for mobile ad detection. MANA integrates static, visual, temporal, and experiential signals into a reasoning-guided navigation strategy that determines not only how to traverse interfaces but also where to focus, enabling efficient and robust exploration. We implement and evaluate MANA on commercial smartphones over 200 apps, achieving state-of-the-art accuracy and efficiency. Compared to baselines, it improves detection accuracy by 30.5%-56.3% and reduces exploration steps by 29.7%-63.3%. Case studies further demonstrate its ability to uncover obfuscated and malicious ads, underscoring its practicality for mobile ad auditing and its potential for broader runtime UI analysis (e.g., permission abuse). Code and dataset are available at https://github.com/MANA-2026/MANA.

Sniffing 5G New Radio (NR) transmissions presents a significantly greater challenge compared to LTE, primarily due to the concealment of Radio Network Temporary Identifiers and relevant scrambling parameters. Existing techniques rely on exhaustive searches and simplifying assumptions that often do not hold in real deployments. In this paper, we propose a fundamentally different approach that exploits the linearity and non-cryptographic nature of the Gold sequences used in 5G NR for scrambling, drastically reducing the sniffer parameter space to a handful of test alternatives. We also propose and assess a countermeasure that disrupts the phase-based demodulation reference signal reconstruction used by our approach, with only minor impact on legitimate users.

Deep learning (DL) models can now run on microcontrollers (MCUs). Through neural architecture search (NAS), we can search DL models that meet the constraints of MCUs. Among various constraints, energy and latency costs of the model inference are critical metrics. To predict them, existing research relies on coarse proxies such as multiply-accumulations (MACs) and model's input parameters, often resulting in inaccurate predictions or requiring extensive data collection. In this paper, we propose InstMeter, a predictor leveraging MCUs' clock cycles to accurately estimate the energy and latency of DL models. Clock cycles are fundamental metrics reflecting MCU operations, directly determining energy and latency costs. Furthermore, a unique property of our predictor is its strong linearity, allowing it to be simple and accurate. We thoroughly evaluate InstMeter under different scenarios, MCUs, and software settings. Compared with state-of-the-art studies, InstMeter can reduce the energy and latency prediction errors by 3× and 6.5×, respectively, while requiring 100× and 10× less training data. In the NAS scenario, InstMeter can fully exploit the energy budget, identifying optimal DL models with higher inference accuracy. We also evaluate InstMeter's generalization performance through various experiments on three ARM MCUs (Cortex-M4, M7, M33) and one RISC-V-based MCU (ESP32-C3), different compilation options (-Os, -O2), GCC versions (v7.3, v10.3), application scenarios (keyword spotting, image recognition), dynamic voltage and frequency scaling, temperatures (21°C, 43°C), and software settings (TFLMv2.4, TFLMvCI). Our source codes and the MCU-specific benchmark datasets are available here: https://github.com/haoliu001/InstMeter.