Skip to main content

Thank you for visiting You are using a browser version with limited support for CSS. To obtain the best experience, we recommend you use a more up to date browser (or turn off compatibility mode in Internet Explorer). In the meantime, to ensure continued support, we are displaying the site without styles and JavaScript.

Metasurface-enabled smart wireless attacks at the physical layer


In current wireless communication systems, sophisticated attack strategies at the physical layer—the electromagnetic wave signals carrying the information—leave traces in the physical environment, which mean such attacks are typically detectable. This may not be the case for future—sixth generation and beyond—wireless networks, whose current vision relies on the concept of smart radio environments, which use metasurfaces to manipulate wave signals in unconventional ways. Here we report metasurface-enabled smart wireless attacks at the physical layer. We illustrate both passive and active operational modes. In the passive mode, an attacker is capable of eavesdropping on the wireless information transfer of a target by controlling the programmable metasurface, without actively radiating any signal. In the active mode, an attacker can eavesdrop as well as falsify the wireless communications by sending deceptive information to the target. In both operational modes, the detectability of the attacker can be minimized. As a proof of concept, we create an attacker prototype working in the Wi-Fi band at around 2.4 GHz, and demonstrate its ability to hack wireless data streams. Our results highlight potential security threats for next-generation wireless networks, and emphasize the need to develop suitable mitigation strategies and specific security protocols at an early stage.

This is a preview of subscription content, access via your institution

Access options

Rent or buy this article

Prices vary by article type



Prices may be subject to local taxes which are calculated during checkout

Fig. 1: Conceptual illustration of the metasurface-enabled smart wireless attack.
Fig. 2: System configurations of metasurface-enabled smart wireless attacks.
Fig. 3: Selected experimental results on passive attacks.
Fig. 4: Selected experimental results on the active attacks.

Data availability

The data that support the findings of this study are available from the corresponding authors upon reasonable request.

Code availability

The code that supports the findings of this study is available upon reasonable request from L.L.


  1. Larsson, E. G., Edfors, O., Tufvesson, F. & Marzetta, T. L. Massive MIMO for next generation wireless systems. IEEE Commun. Mag. 52, 186–195 (2014).

    Article  Google Scholar 

  2. Albreem, M. A., Sheikh, A. M., Alsharif, M. H., Jusoh, M. & Mohd Yasin, M. N. Green internet of things (GIoT): applications, practices, awareness, and challenges. IEEE Access 9, 38833–38858 (2021).

    Article  Google Scholar 

  3. Cui, T. J., Qi, M. Q., Wan, X., Zhao, J. & Cheng, Q. Coding metamaterials, digital metamaterials and programmable metamaterials. Light: Sci. Appl. 3, e218 (2014).

    Article  Google Scholar 

  4. Arun, V. & Balakrishnan, H. RFocus: beamforming using throusands of passive antennas. in Proc. 17th USENIX Symposium on Networked Systems Design and Implementation 1047–1061 (USENIX Association, 2020).

  5. Li, L. et al. Intelligent metasurface imager and recognizer. Light: Sci. Appl. 8, 97 (2019).

    Article  Google Scholar 

  6. Liu, S. & Cui, T. J. Concepts, working principles, and applications of coding and programmable metamaterials. Adv. Opt. Mater. 5, 1700624 (2017).

    Article  Google Scholar 

  7. Cui, T. J., Liu, S., Bai, G. D. & Ma, Q. Direct transmission of digital message via programmable coding metasurface. Research 2019, 2584509 (2019).

    Article  Google Scholar 

  8. Shuang, Y. et al. One-bit quantization is good for programmable coding metasurfaces. Sci. China Inf. Sci. 65, 172301 (2022).

    Article  MathSciNet  Google Scholar 

  9. Basar, E. et al. Wireless communications through reconfigurable intelligent surfaces. IEEE Access 7, 116753–116773 (2019).

    Article  Google Scholar 

  10. Pan, C. et al. Reconfigurable intelligent surfaces for 6G systems: principles, applications, and research directions. IEEE Commun. Mag. 59, 14–20 (2021).

    Article  Google Scholar 

  11. Cheng, Q. et al. Reconfigurable intelligent surfaces: simplified-architecture transmitters—from theory to implementations. Proc. IEEE 110, 1266–1289 (2022).

  12. Di Renzo, M. et al. Smart radio environments empowered by reconfigurable intelligent surfaces: how it works, state of research, and road ahead. IEEE J. Sel. Areas Commun. 38, 2450–2525 (2020).

    Article  Google Scholar 

  13. Flamini, R. et al. Towards a heterogeneous smart electromagnetic environment for millimeter-wave communications: an industrial viewpoint. IEEE Trans. Antennas Propag. 70, 8898–8910 (2022).

    Article  Google Scholar 

  14. Akyildiz, I. F., Kak, A. & Nie, S. 6G and beyond: the future of wireless communications systems. IEEE Access 8, 133995–134030 (2020).

    Article  Google Scholar 

  15. Martini, E. & Maci, S. Theory, analysis, and design of metasurfaces for smart radio environments. Proc. IEEE 110, 1227–1243 (2022).

    Article  Google Scholar 

  16. Zheng, P. et al. Metasurface-based key for computational imaging encryption. Sci. Adv. 7, eabg0363 (2021).

    Article  Google Scholar 

  17. Georgi, P. et al. Optical secret sharing with cascaded metasurface holography. Sci. Adv. 7, eabf9718 (2021).

    Article  Google Scholar 

  18. Shaikhanov, Z., Hassan, F., Guerboukha, H., Mittleman, D. & Knightly, E. Metasurface-in-the-middle attack: from theory to experiment. in Proc. 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks 257–267 (ACM, 2022).

  19. Zhao, H. et al. Metasurface-assisted massive backscatter wireless communication with commodity Wi-Fi signals. Nat. Commun. 11, 3926 (2020).

    Article  Google Scholar 

  20. Li, L., Zhao, H., Liu, C., Li, L. & Cui, T. J. Intelligent metasurfaces: control, communication and computing. eLight 2, 7 (2022).

    Article  Google Scholar 

  21. Wu, B. et al. On the selection of the number of bits to control a dynamic digital MEMS reflectarray. IEEE Antennas Wireless Propag. Lett. 7, 183–186 (2008).

    Article  Google Scholar 

  22. Shuang, Y. et al. Programmable high-order OAM-carrying beams for direct-modulation wireless communications. IEEE Trans. Emerg. Sel. Topics Circuits Syst. 10, 29–37 (2020).

    Article  Google Scholar 

  23. Zhang, N. et al. Programmable coding metasurface for dual-band independent real-time beam control. IEEE Trans. Emerg. Sel. Topics Circuits Syst. 10, 20–28 (2020).

    Article  Google Scholar 

  24. Saifullah, Y. et al. Dual-band multi-bit programmable reflective metasurface unit cell: design and. experiment. Opt. Express 29, 2658–2668 (2021).

    Article  MathSciNet  Google Scholar 

  25. Zhang, X. G. et al. Polarization-controlled dual-programmable metasurfaces. Adv. Sci. 7, 1903382 (2020).

    Article  Google Scholar 

  26. Chen, K. et al. Active anisotropic coding metasurface with independent real-time reconfigurablity for dual polarized waves. Adv. Mater. Technol. 5, 1900930 (2020).

    Article  Google Scholar 

  27. Yener, A. & Ulukus, S. Wireless physical-layer security: lessons learned from information theory. Proc. IEEE 103, 1814–1825 (2015).

    Article  Google Scholar 

  28. CST Studio Suite 3D EM Simulation and Analysis Software;

  29. Lu, X., Lei, J., Shi, Y. & Li, W. Intelligent reflecting surface assisted secret key generation. IEEE Signal Process. Lett. 28, 1036–1040 (2021).

    Article  Google Scholar 

  30. Leung-Yan-Cheong, S. & Hellman, M. The Gaussian wire-tap channel. IEEE Trans. Inf. Theory 24, 451–456 (1978).

    Article  MathSciNet  MATH  Google Scholar 

Download references


This work was supported by the National Key Research and Development Program of China under grant nos. 2021YFA1401002, 2017YFA0700201, 2017YFA0700202 and 2017YFA0700203. T.J.C. acknowledges support from the National Natural Science Foundation of China under grant no. 62288101.

Author information

Authors and Affiliations



L.L., T.J.C. and V.G. conceived the idea and wrote the manuscript. M.W. and H.Z. designed and developed the system and conducted the experiments. All authors participated in the data analysis and interpretation, and read the manuscript.

Corresponding authors

Correspondence to Vincenzo Galdi, Lianlin Li or Tie Jun Cui.

Ethics declarations

Competing interests

The authors declare no competing interests.

Peer review

Peer review information

Nature Electronics thanks the anonymous reviewers for their contribution to the peer review of this work.

Additional information

Publisher’s note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Supplementary information

Supplementary Information

Supplementary Notes 1–4, Figs. 1 and 2 and Table 1.

Supplementary Video 1

Video recording of the experimental results of a metasurface-enabled active wireless attack.

Rights and permissions

Springer Nature or its licensor (e.g. a society or other partner) holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.

Reprints and Permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Wei, M., Zhao, H., Galdi, V. et al. Metasurface-enabled smart wireless attacks at the physical layer. Nat Electron 6, 610–618 (2023).

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI:


Quick links

Nature Briefing

Sign up for the Nature Briefing newsletter — what matters in science, free to your inbox daily.

Get the most important science stories of the day, free in your inbox. Sign up for Nature Briefing