VIGIL/docs/detection-rotation-clone.md

VIGIL — Detecting Key-Rotating Tracker Clones by Presence, Not Identity

Design document · the core novel detection algorithm (problem #1) · v1 · 2026-07-14

Target: on-device Android (Kotlin), no server. Slots into VIGIL's scan/ + detect/ architecture; the co-movement v1 in detect/CoMovementEvaluator.kt ships now, the presence engine below (detect/PresenceEngine.kt) is next.

---

0. Thesis (TL;DR)

Every deployed anti-stalking detector — Apple Tracker Detect, iOS Find My unwanted-tracking alerts, and TU-Darmstadt's AirGuard — keys on device identity: it counts repeat sightings of one BLE identifier and alarms at a threshold (AirGuard: the same identifier seen ≥ 3 times across a location change). A key-rotating clone (Positive Security's Find You: an ESP32 cycling 2000 Find My public keys, a new one every ~30 s) presents each sighting as a brand-new device, so the repeat count never accumulates. In the authors' 5-day carry test, no tool raised any passive alert.

VIGIL's differentiator: stop tracking identities, start tracking the presence. Ask "is there one physical radio maintaining an unbroken, close-range, co-moving RF presence, even though no single identifier survives?" This is detectable because the attack, to function as a tracker, must emit an unbroken stream of separated-state beacons at roughly stable close-range RSSI that moves with the victim across locations where the ambient tracker population fully turns over. Identity churn cannot hide that.

The most exploitable fact: the standards mandate slow rotation. IETF DULT, Apple, and Google all specify that a separated accessory rotates its address/key once per 24 hours (AirTag: static MAC+key for 24 h, re-rolling at 04:00; DULT accessory-protocol: rotate every 24 h; Google FMDN: 24 h in unwanted-tracking mode). A real separated tracker following you produces one identity for a full day. A clone rotating every 30 s runs ~2880× faster than any spec-compliant device — not "suspicious," but categorically impossible for a legitimate separated tracker. VIGIL anomaly-detects against that standardized baseline.

---

1. Formalization: the observable signal

1.1 Per-sighting record

Sighting {
  t, wallT   : Long        // monotonic + epoch ms
  eco        : Ecosystem   // APPLE_FM | GOOGLE_FMDN | SAMSUNG_ST | TILE
  eid        : ByteArray   // ephemeral identity (§1.2) — the churning label
  separated  : Boolean     // separated/lost-state beacon? (§1.3)
  rssi       : Int         // dBm
  txPower    : Int?        // advertised TX power if present (path-loss norm.)
  lat,lon    : Double; gpsAcc, speed : Float   // last fused fix + speed
}

1.2 The identity that churns (eid)

Ecosystem	eid	Spec rotation (separated)
Apple Find My	28-byte public key (MAC ⧺ payload key bytes); MAC as cheap proxy	24 h (re-roll 04:00)
Google FMDN	rotating EID (Rx)	~1024 s normal; 24 h unwanted-tracking mode
Samsung SmartTag	rotating region of offline-finding payload	~15 min–24 h
Tile	rotating id (but MAC is static)	vendor-specific

Structural fact for Apple: the MAC is derived from the key, so both rotate together — you cannot even fall back to MAC-tracking. Identity churn is total.

1.3 The separated predicate

Only separated-state beacons are relevant: a tracker with its owner is nearby/connectable (no threat). A tracker following you without its owner is by definition separated and broadcasts its full key every 2 s. VIGIL filters to separated == true — this cuts noise and is exactly the population the clone must join.

1.4 The three core computable quantities

Close band: rssi ≥ R_close (starter −65 dBm).

(a) Novel-identifier churn rate λ_novel. Keep a set Seen of eids over horizon H (30 min). A sighting is novel if eid ∉ Seen. λ_novel(t) = |distinct eid first seen in (t−W, t]| / W (W = 5 min). Real separated tracker → ~0.0007/min. Find You @30 s → ~2/min. A ~2800× gap.

(b) Presence continuity PC — is the close band continuously occupied, regardless of who occupies it? o(t)=1 iff ∃ separated sighting in (t−δ,t] with rssi≥R_close (δ = 10 s); PC(W) = duty cycle of o; Runmax = longest run with no gap > g_break (20 s). Clone → PC≈1, Runmax = whole session. A crowd also keeps it occupied, so PC alone is insufficient — it must be tied to coherence (§1.5) and co-movement.

(c) Co-movement CM — did the presence follow you across a population turnover? The physics that makes this a hard discriminator — the ambient dwell bound: a fixed tag or a passer stays in your close band (radius R≈10 m) for at most dwell ≤ 2R / v_rel. At 13 m/s (driving) → ~1.5 s; walking → ~14 s; only a co-moving emitter (v_rel≈0) has unbounded dwell. So conditioned on measured v̄ > 0, a close-band presence whose dwell ≫ 2R/v̄ is co-moving by construction. Over K ≥ 3 non-adjacent cells at speed, no single ambient tag can appear — the presence is provably not any one ambient source.

1.5 The unifying reframe: presence tracking without identity

Discard eid as a tracking key; keep it only as a novelty signal. Treat close-band separated sightings as points in (t, rssi) and ask: does one continuous, low-variance trajectory explain them (one radio), or a diffuse high-variance cloud (a crowd)? At each handover (close-band identity changing) test continuity:

seamless handover:  |rssi_new − ewma_rssi| ≤ ε_rssi (8 dB)  AND  Δt ≤ g_seam (6 s)

A rotating clone emits a long chain of seamless handovers into novel identities — the radio never leaves, only its name does. A crowd emits gappy, RSSI-discontinuous handovers. This seamless-novel-handover chain is the algorithmic heart of VIGIL and the quantity no identity churn can fake while remaining a functioning tracker.

---

2. Algorithm

2.1 Weighing four candidate approaches

Approach	Catches clone?	Cost	FP in dense RF	Verdict
Sliding-window novelty count	Yes	Trivial	Bad (busy street churns)	cheap trigger only
CUSUM change-point on λ_novel	Yes, bounded latency	Trivial	Better (regime vs baseline)	good trigger, must gate
Density on (rssi,t)	Yes	Heavier	Separates single-radio track from crowd	do the online single-track version
Presence-occupancy + seamless chain	Yes	Moderate O(1)/sighting	Best (coherence + co-move)	core confirmer

None alone is deployable. The design is a hybrid pipeline: a cheap CUSUM churn trigger wakes an expensive presence-coherence confirmer, which only alarms behind a co-movement gate.

2.2 Pipeline

Stage A  CUSUM on λ_novel (always on, O(1))         → trigger
Stage B  presence-track confirmer (armed on trigger): identity-agnostic single
         (t,rssi) track; counts novel *seamless* handovers, RSSI residual σ,
         presence-run duration                        → candidate
Stage C  co-movement gate + scoring: requires Dnet, distinct cells, v̄>0 → 0–100

2.3 / 2.4 State + update rule

class ChurnCusum(val mu0: Double, val sigma0: Double, val k: Double, val h: Double) {
  var S = 0.0
  fun update(novelInLastMin: Int): Boolean {          // per minute
    val z = (novelInLastMin - mu0) / sigma0
    S = maxOf(0.0, S + z - k)
    return S > h                                        // sustained regime shift
  }
}

data class PresenceRun(
  var startT: Long, var startLat: Double, var startLon: Double,
  var lastT: Long, var lastEid: ByteArray,
  var ewmaRssi: Double, var ewmaAbsResid: Double,       // coherence
  var handovers: Int, var seamlessNovelHandovers: Int,
  var cells: MutableSet<Long>, var dnet: Double, var vSum: Double, var vN: Int,
  var active: Boolean
)

fun onSeparatedSighting(s: Sighting, st: State) {
  val novel = !st.seen.contains(s.eid); if (novel) st.seen.add(s.eid)
  st.novelThisMinute += if (novel) 1 else 0
  if (s.rssi < R_CLOSE) return                          // only close band builds presence
  val p = st.run
  if (!p.active || s.t - p.lastT > G_BREAK) {           // (re)start a run
     if (p.active) evaluate(p, st)
     st.run = PresenceRun(s.t, s.lat, s.lon, s.t, s.eid, s.rssi.toDouble(), 0.0,
        0, 0, mutableSetOf(cellOf(s.lat,s.lon)), 0.0, s.speed.toDouble(), 1, true)
     return
  }
  val resid = s.rssi - p.ewmaRssi
  if (!s.eid.contentEquals(p.lastEid)) {                // handover
     p.handovers++
     if (abs(resid) <= EPS_RSSI && (s.t - p.lastT) <= G_SEAM && novel)
        p.seamlessNovelHandovers++                      // ← THE tell
  }
  p.ewmaRssi     = ALPHA*s.rssi + (1-ALPHA)*p.ewmaRssi
  p.ewmaAbsResid = ALPHA*abs(resid) + (1-ALPHA)*p.ewmaAbsResid   // ≈ RSSI σ
  p.lastT = s.t; p.lastEid = s.eid
  p.cells.add(cellOf(s.lat,s.lon)); p.dnet = haversine(p.startLat,p.startLon,s.lat,s.lon)
  p.vSum += s.speed; p.vN++
  scoreLive(p, st)
}

fun scoreLive(p: PresenceRun): Int {
  val durMin = (p.lastT - p.startT)/60_000.0; val vbar = p.vSum/p.vN
  val moving  = vbar > V_MIN                             // 1 m/s
  val comoves = p.dnet >= D_NET && p.cells.size >= K_CELLS       // 500 m & 3 cells
  if (!(moving && comoves)) return 0                     // Stage-C gate: silent
  val coherent = p.ewmaAbsResid <= SIGMA_MAX             // single-radio tightness
  val churnAnom = (p.seamlessNovelHandovers/max(durMin,1e-3)) >= RHO_NOVEL
  val seamlessFrac = if (p.handovers>0) p.seamlessNovelHandovers.toDouble()/p.handovers else 0.0
  var sc = 0.0
  sc += clamp(durMin/T_MIN,0.0,1.0)*30
  sc += clamp(p.seamlessNovelHandovers/N_HANDOVER,0.0,1.0)*30
  sc += clamp(p.cells.size/(2.0*K_CELLS),0.0,1.0)*20
  sc += (if (coherent) 1.0 else 0.3)*(if (churnAnom) 1.0 else 0.5)*(0.5+0.5*seamlessFrac)*20
  return sc.roundToInt()
}

Tiers (VIGIL 4-tier): <40 clear · 40–69 WATCHING (soft) · 70–84 probable clone · 85+ persisted across ≥ K_CELLS cells / mode change.

2.5 Starter parameters

R_CLOSE −65 dBm · δ 10 s · G_BREAK 20 s · G_SEAM 6 s · EPS_RSSI 8 dB · SIGMA_MAX 8 dB · H 30 min · W 5 min · CUSUM k 0.5, h 5, μ0/σ0 = rolling personal baseline · α 0.3 · ρ (min novel-seamless rate) 0.7/min · D_NET 500 m · K_CELLS 3×250 m · V_MIN 1 m/s · T_MIN 10 min (ORANGE)/3 min (WATCHING) · N_HANDOVER 12.

2.6 Fit to VIGIL

Runs entirely on-device over the existing scan path. scan/TrackerParser.kt already emits per-ecosystem separated sightings; add speed to the record via LocationProvider. New detect/PresenceEngine.kt holds ChurnCusum + PresenceRun + the novelty set as a pure streaming function (offline-testable, §5). Keep a bounded ring buffer over horizon H; multi-session mode (§4.3) is opt-in.

---

3. False positives (the crux)

The enemy is dense urban RF where legitimate separated-Find-My churn is naturally high. FPs are where this feature lives or dies.

Scenario	Fires	Killed by
Dense-urban walk / festival	high λ_novel, PC≈1	seamless chain fails — a crowd is many radios ⇒ gappy, RSSI-discontinuous handovers, high ewmaAbsResid
Apartment / at home	high PC, stationary	co-movement gate (v̄≈0, 1 cell) ⇒ score 0
One stranger's real AirTag on your bus	co-moving, close, stable	not the clone path (it has 1 id/24 h) — handled by the identity detector + dismiss/whitelist UX
Busload of strangers' real tags	co-moving, PC≈1	novel-churn ≈ 0 (stable set of stable ids) ⇒ clone path silent
Rush-hour subway w/ heavy boarding churn	A + B + partial C	the genuinely hard case — §3.3

Discriminators, strongest first: (1) seamless-novel-handover chain — only one physical emitter yields |Δrssi|≤8 dB, Δt≤6 s across identity changes, repeatedly; (2) co-movement across turnover (dwell bound); (3) RSSI coherence; (4) stationary suppression (removes the whole home/apartment class).

Where it breaks: live rush-hour transit. People board/alight with real separated tags, so λ_novel is high, the vehicle co-moves you across cells, PC≈1 — three signals align. What still separates it: those tags are at many distances (high ewmaAbsResid, low seamless fraction) and turnover is bursty/stop-synced, not a 30 s metronome. The decisive gate: persistence across a mode change — a transit crowd cannot follow you off the train and down the street. Requiring the coherent co-moving presence to survive a context transition drops transit FPs to ~0, at the cost of latency. That is the honest central trade: lower transit FP is bought with detection latency. The MVP keeps transit at WATCHING (silent) and escalates only after a mode change or ≥ T_MIN beyond the transit segment.

---

4. Robustness

4.1 The rotation-rate squeeze (the strongest claim)

VIGIL runs the identity path (classic AirGuard-style; catches any key held

~3–5 min, seen ≥3× across a location change) and the churn path (this doc; catches novel-seamless rates above ~0.5–1/min) together:

rotation period:  30s ──── 2min ──── 5min ─────────── 24h
                  └ churn path ┘
                        └ overlap seam ┘
                              └────── identity path ──────┘

No rotation period evades both. Fast → churn path; slow → identity path; middle → both. Moreover the presence-continuity/co-movement path is rotation-rate-agnostic — slowing rotation lowers λ_novel but does nothing to the unbroken coherent co-moving close-band track. The attacker's only real lever is continuity, not rate.

4.2 Adaptations

Move	Effect	Response	Residual
Slower rotation	λ_novel drops	identity path re-engages	high (squeeze)
Variable TX power	RSSI jitter weakens coherence	normalize by advertised txPower; lean on continuity+co-move+churn	med–high
Intermittent duty-cycling	gaps reset runs	reacquire logic: a gap < G_reacq (3 min) resuming at coherent RSSI along your path = same presence; accumulate across gaps	medium (this is the biting attack)
Blend into transit	crowd cover	mode-change gate (§3.3)	medium (needs latency)

4.3 The true floor

Every evasion degrades the attacker's own tracker (slower/duty-cycled = fewer fixes; lower power = shorter range). Below some duty cycle (a few random beacons per 15 min, random power) the emitter is information-theoretically indistinguishable from sparse ambient pass-bys in a single session, and detection must move to cross-session recurrence — the same anomalous weakly- co-moving presence recurring day after day along your routes (a per-day coarse RSSI/timing fingerprint matched across sessions). That trades days of latency and needs opt-in persistent storage. The honest floor: a patient, low-duty-cycle adaptive attacker pushes VIGIL from minutes-latency single-session detection to days-latency multi-session detection. Say so; don't claim an impossible guarantee.

---

5. Validation plan (on-device Kotlin, no server, no real stalker)

1. Red-team emitter. Parameterized OpenHaystack / Find You ESP32 clone (base: positive-security/find-you), sweeping rotationPeriod ∈ {30 s … 24 h}, txPower ∈ {fixed, ±k dB}, dutyCycle ∈ {100%, 50%, 20%, bursty}, keyPoolSize. Carried, it is a real co-moving emitter → ground-truth-positive without endangering anyone.
2. Ambient baselines (ground-truth-negative), by class: rural drive · suburban · dense-urban walk · bus · subway/rush-hour · highway · apartment · café. Paired runs (same route, emitter on/off).
3. Record/replay harness — make PresenceEngine a pure List<Sighting> → List<ScoredEvent>; record raw sightings once, replay JSONL to A/B thresholds deterministically offline (unit tests / in-app debug screen). Synthesize attack-in-context by merging a clean run with an emitter-only trace.
4. Metrics: TPR @ ≤ 1 FP / active-carry-day per class; detection latency (attach → first ORANGE), target ≤ 10–15 min for default Find You; ROC/AUC; robustness curves (TPR vs rotationPeriod / txPower / dutyCycle); ablations (churn-only → +coherence → +co-move gate → full).

---

6. Verdict

Feasible enough to be VIGIL's headline — for a precisely scoped claim, with honest caveats.

Real, not hype: the attack must maintain a continuous coherent co-moving presence to function; the standards mandate 24 h rotation, giving a categorical anomaly baseline; the identity×churn squeeze leaves no safe rate; and VIGIL strictly dominates incumbents on this attack (they raise zero alerts on Find You, VIGIL raises one). Research-grade long shots: robust low-FP detection in live rush-hour transit, and a patient low-duty-cycle adaptive attacker (provably forced to multi-session/days latency).

Minimum viable version (ship first). Target the published Find You config (30 s, fixed power, ~100% duty) — the exact attack that renders AirGuard silent: Stage A CUSUM trigger; Stage B presence track counting novel seamless handovers with RSSI coherence; Stage C hard co-movement gate (ORANGE after ≥10 min coherent co-moving presence, ≥12 novel seamless handovers, ≥3 cells while v̄>1 m/s; RED after a cell/mode change). Run the classic identity detector in parallel. New tier distinct from the identity-based alert, with a dismiss/whitelist UX for the stranger-on-your-commute case. Detects the real-world clone in ~10–15 min at a near-zero FP rate outside rush-hour transit — and is honest about the adaptive-attacker floor.

---

7. References

• Positive Security, "Find You: Building a stealth AirTag clone" — https://positive.security/blog/find-you · https://github.com/positive-security/find-you
• Heinrich et al., "Who Can Find My Devices?" PETS 2021 — https://petsymposium.org/popets/2021/popets-2021-0045.pdf
• Heinrich et al., "AirGuard", WiSec 2022 — https://arxiv.org/pdf/2202.11813
• A. Catley, AirTag reverse engineering — https://adamcatley.com/AirTag.html
• IETF DULT — accessory-protocol + threat-model — https://datatracker.ietf.org/wg/dult/
• Google Fast Pair FMDN spec — https://developers.google.com/nearby/fast-pair/specifications/extensions/fmdn
• SEEMOO OpenHaystack — https://github.com/seemoo-lab/openhaystack
• E. S. Page, "Continuous Inspection Schemes" (Biometrika 1954) — CUSUM; Basseville & Nikiforov, Detection of Abrupt Changes (1993)
• Datar/Gionis/Indyk/Motwani sliding-window distinct counting; Flajolet et al. HyperLogLog
• Becker et al., "Tracking Anonymized Bluetooth Devices", PETS 2019
• DP-3T / Google-Apple Exposure Notification — RSSI attenuation-bucket presence reasoning