⚡ electrical engineering

RateCount: Learning-Free Device Counting by Wi-Fi Probe Listening

RateCount is a lightweight, learning-free approach that accurately estimates the number of Wi-Fi devices and people by using a provably unbiased closed-form expression based on probe request frame rates, thereby eliminating the extensive data collection and model maintenance costs associated with machine learning-based methods while achieving state-of-the-art accuracy.

Original authors: Tianlang He, Zhangyu Chang, Zhongming Lin, S. -H. Gary Chan

Published 2026-07-27

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Tianlang He, Zhangyu Chang, Zhongming Lin, S. -H. Gary Chan

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine walking through a busy airport terminal or a crowded university campus. You aren't just surrounded by people; you are surrounded by a silent, invisible swarm of digital chatter. Every smartphone, smartwatch, and laptop you carry is constantly shouting out into the void, sending out tiny digital "hello" signals called Probe Request Frames (PRFs) to find nearby Wi-Fi networks. It's like everyone in the room is holding a flashlight and blinking it on and off every few seconds to see who else is there.

For a long time, scientists and city planners have wanted to count these blinking flashlights to understand how many people are in a crowd. This is crucial for everything from managing traffic at bus stops to deciding when to turn on the air conditioning in a study hall. However, there's a catch: to protect your privacy, your phone doesn't just use its permanent ID; it often changes its digital name (MAC address) every time it blinks. This means one person might look like ten different strangers to a sensor. The usual solution has been to use complex, heavy-duty computer brains (machine learning) to try and figure out which blinks belong to the same person. But these computer brains are hungry for data, expensive to train, and need constant babysitting by experts. What if there was a simpler way to count the crowd without needing a supercomputer?

Enter RateCount, a new approach that acts like a clever detective who ignores the names on the flashlights and instead just counts how fast they are blinking. The researchers, led by Tianlang He and colleagues, discovered that you don't need to know who is blinking to know how many people are there; you just need to know the rate at which the blinking happens.

Here's the magic trick: The paper proposes that if you listen to all the "hello" signals over a specific period (a "window" of time), the total number of signals is directly related to the number of devices present. Think of it like counting raindrops hitting a roof. You don't need to know which drop came from which cloud; you just need to know that if the rain is falling at 10 drops per second, and you know a single cloud usually drops 1 drop per second, then you have roughly 10 clouds. RateCount uses a simple math formula to divide the total "blinking speed" of the crowd by the average "blinking speed" of a single device.

The paper argues strongly against the idea that we must use machine learning to solve this. The authors show that the complex methods used by the "state-of-the-art" (the best existing systems) are overkill. Those methods try to link every single signal back to a specific device, which is hard because of the privacy name-changes. RateCount skips that step entirely. Instead of trying to solve a puzzle of identity, it solves a puzzle of volume. The researchers proved mathematically that their method is "unbiased," meaning it doesn't systematically over-count or under-count the crowd, even with all the name-changing chaos.

To make sure this isn't just a lucky guess, the team tested RateCount in the real world. They set up sensors in a university lab, a building entrance, a campus atrium, a study room, and a busy bus station. Crucially, while the system avoids the heavy lifting of machine learning training, it does require a one-time, on-site data collection phase. The system needs to listen to the network for a while to learn the specific "blinking rhythm" (probing interval distribution) of that particular location, as different environments have different patterns. Once this local rhythm is learned, the system can count devices accurately without further training or complex model tuning.

However, there is one important nuance when moving from counting devices to counting people. Since one person might carry multiple devices (like a phone and a watch), simply counting devices isn't enough to know the number of humans. To bridge this gap, the system employs a multimodal calibration scheme. This involves setting up a specific "calibration region" (such as a campus atrium) where the Wi-Fi sensors work alongside other technologies, like cameras, to estimate the device-to-person ratio. By comparing the Wi-Fi device count against the camera's human count in this specific area, the system learns the local ratio (e.g., 1.14 devices per person). This calibrated ratio is then applied to other areas to convert the device count into an accurate people count.

The team compared their simple "blinking rate" method against the heavy-duty machine learning systems and even against cameras (which are usually the gold standard for counting people). The results were surprising: RateCount was just as accurate as the complex machine learning systems but required no machine learning training data and no ongoing model maintenance. In fact, when they used it to count people (using the calibration scheme described above), it cut the counting errors of previous Wi-Fi methods by a massive 66%.

The paper also gives us a tool to know how "sure" the count is. They created an "error model" that acts like a weather forecast for the data. It tells you that if you count over a longer time (a bigger window), your guess gets more accurate, but if the crowd is changing too fast, you might need a shorter window to catch the action. They found that in crowded places, the method is actually more accurate in relative terms, meaning the bigger the crowd, the better the percentage of error gets.

In short, RateCount proves that sometimes the simplest answer is the best. By listening to the rhythm of the digital crowd rather than trying to identify every single member, we can get a clear, accurate picture of how many people are around us without needing expensive machine learning setups or invading anyone's privacy. It turns a complex problem of identity into a simple problem of counting beats, making it possible to deploy crowd-counting systems anywhere with minimal setup and low maintenance.

Technical Summary: RateCount: Learning-Free Device Counting by Wi-Fi Probe Listening

Problem Statement
Counting Wi-Fi devices within Access Point (AP) coverage by listening to Probe Request Frames (PRFs) is a fundamental task for IoT applications such as crowd management and public transportation scheduling. A primary challenge in this domain is MAC address randomization, where unconnected devices broadcast virtual MAC addresses to protect user privacy. This causes a single physical device to appear as multiple distinct devices, leading to significant overcounting if simple MAC address counting is used.

Current State-of-the-Art (SOTA) approaches address this by employing machine learning (ML) models to associate PRFs from the same device. However, these approaches suffer from high deployment and maintenance costs:

Setup Costs: They require extensive data collection, curation, and model training.
Maintenance Costs: Models require regular fine-tuning to accommodate new device brands and models.
Computational Costs: They demand significant computing power for ML inference.

Furthermore, existing methods often lack a theoretical understanding of counting bias and error variance, particularly regarding the relationship between device dwell time and probing intervals.

Methodology: RateCount
The authors propose RateCount, a lightweight, learning-free approach that estimates device counts based on the probing rate (the frequency of PRF bursts received by APs) rather than the number of unique MAC addresses. The system operates on a sliding window basis and utilizes two closed-form expressions:

Rate Model (Unbiased Estimator):
- Concept: The model estimates the window-averaged device count ( $\bar{N}$ ) by calculating the ratio of the aggregated probing rate ( $R$ ) of all devices in the window to the mean probing rate ( $r$ ) of a single device.
- Formula: $\hat{N} = \frac{R}{r} = \frac{B \cdot \tau}{w}$ , where $B$ is the total number of probing bursts, $w$ is the window size, and $\tau$ is the mean probing interval.
- Theoretical Basis: The authors prove that this estimator is unbiased for the time-averaged device count over the window, independent of the specific distribution of probing intervals. This proof relies on the Elementary Renewal Theorem.
- Data Requirement: Instead of per-device training, the system requires only the marginal distribution of probing intervals for a specific counting area, which can be collected automatically over time.
Error Model (Variance Estimation):
- The authors derive a closed-form expression for the Mean Squared Error (MSE) of the count, which is dominated by the variance since the estimator is unbiased.
- Formula: $MSE(\hat{N}) \approx \frac{B \sigma^2_\tau}{w^2}$ , where $\sigma_\tau$ is the standard deviation of the probing intervals.
- Insight: This model demonstrates that counting error decreases as the window size ( $w$ ) increases and is influenced by the variability of probing intervals. It provides a theoretical basis for selecting window sizes to balance real-time performance and accuracy.

Extension to People Counting
To apply device counting to people counting, RateCount incorporates a device-to-person calibration scheme:

Calibration: A "calibration region" (e.g., a campus atrium) uses a secondary sensing modality (e.g., cameras) to estimate the number of people ( $\bar{M}$ ) and the device count ( $\hat{N}$ ) simultaneously.
Ratio Estimation: The device-to-person ratio ( $\alpha = \bar{N}/\bar{M}$ ) is derived from this region.
Application: This ratio is applied to other counting areas to estimate people counts ( $\hat{M} \approx \hat{N}/\alpha$ ). The system uses geofencing (via RSSI and SVM) to ensure only devices within the camera's field of view are counted during calibration.

Key Contributions

Learning-Free Unbiased Estimator: The first approach to count Wi-Fi devices under MAC address randomization without machine learning, utilizing a provably unbiased closed-form rate model.
Closed-Form Error Model: A theoretical derivation of counting variance that explains the impact of window size and probing interval variance, guiding system configuration.
Practical People Counting: A multimodal calibration framework that extends device counting to people counting, significantly reducing errors compared to previous Wi-Fi-based methods.

Experimental Results
The authors implemented RateCount and conducted extensive experiments across diverse environments (lab room, building entrance, campus atrium, bus station, study room) with varying crowd densities.

Device Counting: RateCount achieved accuracy comparable to SOTA learning-based approaches but without any ML deployment costs. It significantly outperformed traditional MAC counting and simple calibrated MAC counting.
People Counting: When compared to the SOTA Wi-Fi-based people counting scheme (CountMeIn), RateCount reduced the counting error by 66% (specifically, reducing RMSE by ~4.57 and NRMSE by ~0.66).
Error Model Validation: The experimental errors closely matched the theoretical error model, with a negligible gap (approx. 2% in NRMSE), validating the model's utility for predicting system performance.
Real-world Application: The system was successfully deployed to monitor crowd levels in a study room and a bus station, demonstrating its ability to capture usage patterns (e.g., peak hours after classes) for infrastructure management.

Significance and Claims
The paper claims that RateCount offers a fast-deployment, low-maintenance, and cost-effective alternative to machine learning-based counting. By eliminating the need for training data curation, model tuning, and specialized hardware, it makes Wi-Fi-based crowd sensing accessible for scenarios with limited computing resources or those requiring rapid setup. The authors emphasize that their approach provides a theoretically grounded understanding of counting bias and error, which was previously lacking in the field. The results suggest that for crowded scenarios, the relative error of RateCount is particularly low, making it scalable for high-density environments.

Technical Summary: RateCount: Learning-Free Device Counting by Wi-Fi Probe Listening

More like this