Leakage-Aware Benchmark Audit of Augmented Radio Frequency and Wi-Fi Channel State Information Data for Breathing Rate Classification

Radio frequency (RF) sensing and Wi-Fi channel state information (CSI) have become important candidates for unobtrusive physiological monitoring because they can capture small changes in the propagation channel without requiring a camera, a body-worn belt, or direct skin contact. In this setting, respiration is an especially attractive target: periodic chest motion perturbs the wireless channel, and the resulting amplitude, phase, or spectral patterns can be processed as a proxy for breathing rate. Recent surveys describe Wi-Fi CSI as a rapidly expanding wireless sensing modality with applications in human activity sensing, localization, and vital sign monitoring, while also emphasizing that the same sensitivity which makes CSI useful also makes it dependent on environment, subject, hardware, and preprocessing choices [1], [2], [3]. For a biomedical paper, this means that high classification accuracy is not enough by itself; the evaluation protocol must show whether the model has learned a physiologically meaningful signal or merely a repeatable artifact of the dataset.

Respiration monitoring is also increasingly connected to breath analysis, exhaled humidity, and exhaled breath condensate sensing. Wearable and mask-based breath sensors now measure respiratory patterns, airflow, temperature, humidity, and molecular biomarkers, and recent reviews argue that these systems may support continuous and noninvasive health monitoring when they can be made robust, comfortable, and clinically interpretable [4], [5], [6]. In parallel, a smart mask for harvesting and analyzing exhaled breath condensate has demonstrated that real-time breath biochemistry is becoming technically feasible outside conventional laboratory workflows [7]. These advances provide the broader biomedical motivation for studying radio frequency-based exhaled breath signals, but they also clarify an important boundary: a RF reflection measurement related to exhaled water vapor is not automatically equivalent to a validated clinical hydration biomarker.

The dataset considered in this study belongs to a recent line of work that combines ESP32 Wi-Fi CSI respiration sensing with ultra-wideband RF sensing of exhaled breath. Saied et al. [8] investigated synchronous monitoring of respiratory rate and exhaled breath dielectric changes using Wi-Fi and ultra-wideband antenna sensors in controlled care environment experiments. Khan et al. [9] then framed Wi-Fi CSI respiration monitoring as a digital twin problem, using signal processing and machine learning models for respiration rate estimation and decision support. A subsequent study introduced statistical time-series augmentation for unobtrusive respiration classification [10], and the related IEEE DataPort release provides augmented respiration and exhaled-breath radio RF files for 12, 20, and 28 breaths-per-minute classes [11]. A newer study extends this line to RF multi-sensing for respiration and exhaled-breath RF monitoring within a human monitoring digital twin framework [12].

This related work is valuable because it makes a rare public RF/CSI biomedical dataset available, but it also creates a methodological problem that has not yet been fully resolved. Augmentation is often necessary in physiological sensing because controlled human experiments are expensive, small, and difficult to repeat; time series augmentation surveys show that transformation, pattern-based, decomposition, and generative methods can improve learning when used carefully [13]. However, augmentation can also create near-duplicate files, preserve subject or acquisition-specific signatures, or place synthetic variants of the same original measurement on both sides of a train-test split. In that case, the model may appear to generalize while actually recognizing repeated signal fingerprints. This risk is especially relevant for small RF datasets, where class labels, file names, source recordings, and augmented variants can be strongly entangled.

The machine learning literature now treats data leakage as a central threat to scientific validity rather than a minor technical detail. Kapoor and Narayanan [14] described leakage as a driver of the reproducibility crisis in machine learning-based science, and Rosenblatt et al. [15] showed empirically that leakage can inflate model performance in connectome-based prediction. The same problem has been reported directly in Wi-Fi CSI sensing: Varga [16], [17] re-evaluated CSI-based human action recognition studies and showed that subject-insensitive partitioning can produce overestimated results. For breaths-per-minute classification using radio frequency/CSI respiration and exhaled-breath RF data, the corresponding question is therefore not simply “which classifier is most accurate?”, but “which accuracy remains after exact duplicates, near duplicates, augmented siblings, file groups, and source-level dependencies are prevented from crossing the evaluation boundary?”

Recent medical artificial intelligence reporting and data quality guidance supports this stricter view of evaluation. The METRIC framework argues that medical training data should be assessed across dimensions such as representativeness, consistency, completeness, and measurement quality before claims about trustworthy artificial intelligence are made [18]. The Transparent Reporting of a multivariable prediction model for Individual Prognosis Or Diagnosis (TRIPOD)+artificial intelligence statement similarly emphasizes transparent reporting of prediction model development, validation, data handling, and open science practices [19]. Although the present dataset is not a clinical trial and does not contain external clinical hydration outcomes, these frameworks are still relevant: they make clear that a publishable benchmark should describe what the labels mean, what sources of bias exist, which splits are valid, and which claims are outside the evidence provided by the data.

Explainable artificial intelligence adds another layer of evidence, but only if it is used as an audit tool rather than as decoration after a high accuracy result. General explainable artificial intelligence reviews distinguish between global explanations, local explanations, feature attribution, surrogate models, and concept-oriented methods [20]; medical explainable artificial intelligence work further stresses that explanations must be aligned with the data modality and the clinical or technical question being asked [21]. For RF/CSI time series data, this suggests using grouped feature ablations, grouped permutation importance, subcarrier level analysis, and frequency band analysis to ask whether the classifier depends on plausible respiration-related structure, narrow sensor artifacts, coarse amplitude summaries, or duplicated file signatures. In this study, explainability is therefore used to test the stability and plausibility of learned evidence under leakage-aware splits, not merely to visualize a model after training.

Robustness is a second necessary enhancement because RF measurements are affected by noise, gain changes, packet loss, smoothing, baseline drift, frequency band dropout, and environmental multipath. A recent scoping review of robustness in healthcare machine learning identifies input perturbation, missing data, label noise, feature selection, domain shift, and adversarial effects as distinct concepts that should be evaluated explicitly [22]. Benchmark work on out of distribution detection in medical tabular data likewise shows that healthcare models can become overconfident when inputs move away from the training distribution [23]. For the present RF/CSI setting, robustness testing can translate these general concerns into signal-level stress tests: noise injection, amplitude scaling, baseline shifts, moving average smoothing, subcarrier dropout, and RF band dropout.

Taken together, the current literature leaves a clear gap. Prior RF/CSI respiration and exhaled-breath RF studies demonstrate that the sensing pipeline is technically feasible and that machine-learning classifiers can separate breaths-per-minute classes under controlled conditions [8], [9], [10], [12]. However, there is still a need for a reproducible benchmark audit that quantifies exact duplicate and near-duplicate structure, compares naive and leakage-aware splits, explains which signal groups drive the decisions, and reports robustness under signal perturbations. This gap is scientifically meaningful because it turns the contribution from “another classifier on the same augmented dataset” into a validity study of the dataset and benchmark protocol itself.

Accordingly, this study proposes a leakage-aware and explanation-stable benchmark audit for augmented RF/CSI data used in breathing-rate classification. The study makes four contributions. First, it audits the file inventory, labels, exact duplicates, near-duplicate structure, and source-level class counts in the public dataset. Second, it compares diagnostic window-level validation with stricter source/hash-level holdouts and reports confidence intervals, confusion matrices, per-class recall, and label permutation controls. Third, it adds explainable artificial intelligence, window length, normalization, and frequency band analyses that test whether performance is supported by stable signal evidence or shortcut structure. Fourth, it packages the benchmark as a reproducible workflow with fixed configuration, generated reports, and robustness tests. The intended outcome is not to claim a clinical hydration diagnosis from the available data, but to define what can and cannot be concluded from this BPM-labeled benchmark.

This study was designed as a benchmark audit rather than as a single model optimization study. The complete pipeline is shown in Figure 1. Starting from the public IEEE DataPort dataset [11], this study created a file inventory, parsed labels and P-ids/file identifiers from file names, computed exact file hashes, extracted respiration and exhaled-breath RF features, evaluated leakage-aware validation protocols, quantified explainability with feature group tests, and stress-tested robustness under signal perturbations. All modeling steps used a fixed random seed of 42.

This study used the publicly available IEEE DataPort dataset [11]. The dataset page states that respiration was collected using an ESP32 Wi-Fi CSI sensor and that exhaled breath was collected using a stepped monopole RF sensor over 0.5–5 GHz. The labels are controlled breathing rates of 12, 20, and 28 breaths per minute. The released files are organized as augmented CSV files for 15 filename-based P-ids/file identifiers, denoted P1–P15; these identifiers are not verified as distinct participants or subjects. Respiration CSV files contain 52 CSI subcarrier columns, whereas exhaled-breath RF CSV files contain one signal column over recorded frequency components. The benchmark treats these RF curves only as breaths per minute-labeled exhaled-breath RF measurements; no independent clinical hydration endpoint is available.

Each CSV file was discovered recursively under the raw data directory. The P-id/file identifier and breaths-per-minute label were parsed from the file name. For respiration files, the parser used the pattern \{P-id\}-\{BPM\}BPMCSV.csv; for exhaled-breath RF files, it used \{BPM\}BPM-\{P-id\}-Exhaled Hydration.csv. For every file, this study stored modality, P-id/file identifier, breaths-per-minute label, row count, column count, byte size, relative path, and a SHA-256 hash. The hash was used as an exact duplicate detector and as a grouping variable for leakage-aware validation. No missing numeric values were found in the parsed CSV arrays.

This study specifically checked whether the release contained original-recording metadata that would support a stricter leave-one-original-recording-out design. The released archives contain only BPM/P-id folder names and CSV files; the respiration CSVs are headerless 52-column numeric matrices and the exhaled-breath RF CSVs are headerless single-column numeric vectors. No parent-recording identifier, augmentation family identifier, session identifier, acquisition timestamp per sample, hardware identifier, room/environment identifier, or true subject identifier beyond the P-id in the file name was available. Therefore, the term “source” in this audit denotes a deduplicated released CSV file or hash, not a verified original physiological recording. Table 1 shows the dataset units discovered from the IEEE DataPort release and used in the benchmark audit.

Let a respiration file be represented as a matrix $X \in \mathrm{R}^{T \times S}$, where $T$ is the number of time samples and $S$ = 52 is the number of CSI subcarriers. Respiration signals were segmented into non-overlapping windows of 600 samples. Because the benchmark script used $f_s$ = 120 Hz, each window corresponded to approximately 5 seconds. Any incomplete residual segment at the end of a file was discarded:

This produced 870 respiration windows before deduplication and 452 windows after exact duplicate files were removed. The deduplicated window counts were 300, 114, and 38 for the 12, 20, and 28 breaths-per-minute classes, respectively.

For each respiration window, this study extracted three subcarrier-wise statistical groups: mean, standard deviation, and peak-to-peak range. For subcarrier $s$, these are

where, $T_w$ = 600. To extract spectral features, each subcarrier was standardized, the standardized subcarriers were averaged into a composite respiration trace $c_t$, and the power spectrum was computed:

Only the 0.05–1.00 Hz band was retained for spectral summaries. The six spectral features were peak breaths per minute, peak-power share, spectral centroid in breaths per minute, and three band-energy ratios corresponding to 6–18 breaths per minute, 18–24 breaths per minute, and 24–33 breaths per minute. The final respiration window feature vector was:

For each exhaled-breath RF file, the raw response was represented as $v \in \mathrm{R}^{200}$. This study retained the raw curve, added first differences, and appended five global summaries:

This choice deliberately keeps the exhaled-breath RF representation simple and auditable. The dataset page states that these files do not require additional preprocessing; therefore, the primary benchmark applied no smoothing, denoising, or normalization before feature extraction. Normalization and frequency band removal were evaluated separately as shortcut control experiments. Table 2 shows the feature representations used in the benchmark.

The central methodological concern was leakage caused by exact duplicates, augmented siblings, repeated windows from the same source file, and P-id-level dependencies. This study therefore evaluated multiple validation protocols. The naive protocols used stratified random splitting at the sample-level. The stricter protocols used groups so that observable related samples could not appear in both training and testing folds. The main group identifiers were file identifier, P-id/file identifier, SHA-256 hash, respiration hash, paired respiration– RF hash, and near-duplicate similarity family cluster. These barriers reduce exact and approximate leakage, but they cannot prove separation of augmented variants that share an unobserved parent recording. Table 3 shows the validation protocols used to separate naive performance from leakage-aware performance.

Three classifiers were used to avoid making conclusions from a single model-family. First, a most frequent dummy classifier provided the chance-level baseline. Second, an $L_2$ -regularized multinomial logistic regression model was trained inside a pipeline with standard scaling and class-balanced loss. The scaler was fit only on the training fold inside each split. Third, a random forest classifier was trained with class-balanced subsampling. The random forest used 500 trees in the initial leakage benchmark, 400 trees in the explainable artificial intelligence/robustness analyses, and 100 trees in the additional reviewer-requested sensitivity controls, always with min\_samples\_leaf=2. These models were selected because they are easy to reproduce, expose different inductive biases, and are sufficient for detecting whether the dataset is intrinsically separable.

Deep learning baselines such as convolutional neural networks or long short-term memory networks were not used as primary models because the aim was a benchmark validity audit rather than model optimization. The deduplicated source-level dataset is very small, especially for 28 breaths-per-minute respiration, so high-capacity sequence models would require extensive architecture and hyperparameter choices while increasing the risk of memorizing augmented source structure. Such models are important for future deployment-oriented studies, but in this audit they would make leakage, feature dependence, and reproducibility harder to isolate.

The evaluation metrics were accuracy, balanced accuracy, and macro-F1. For $K$ = 3 breaths-per-minute classes, balanced accuracy and macro-F1 were defined as:

Balanced accuracy was treated as the primary metric because it gives equal weight to the three breaths-per-minute classes even when deduplication changes the number of available samples per-class.

This study also computed a nearest neighbor leakage probe. Features were standardized, normalized to unit norm, and compared by cosine similarity. For each sample $i$, the nearest sample outside a specified group $g(i)$ was:

The same label rate and maximum similarity were then used as descriptive leakage indicators, not as model performance metrics.

Because SHA-256 detects only byte identical files, this study added a near-duplicate analysis. For each deduplicated respiration source file, the 52 CSI subcarriers were standardized and averaged into a composite trace, then resampled to a fixed length. For each exhaled-breath RF file, the 200-point curve was standardized directly. Pairwise Pearson correlations were computed between source-level vectors, and connected components were formed at thresholds $r$ $\epsilon$ \{0.90,0.95,0.98,0.99,0.995\}. These components were used as an approximate augmentation family grouping variable when class-balanced grouped holdout was feasible.

The primary statistical unit for revised inference was the unique source file/hash, not the respiration window. Window-level results were retained as diagnostic evidence because a single source file can contribute many non-independent windows. Source-file holdout used repeated class-balanced grouped splits. In each respiration split, the test set contained 3, 2, and 1 unique source files for the 12, 20, and 28 breaths-per-minute classes, respectively; the training set contained 12, 4, and 1 unique source files. For exhaled-breath radio frequency, the corresponding test counts were 3, 3, and 2, and the training counts were 12, 12, and 8. This study reported mean, standard deviation, and empirical 95\% percentile intervals over repeated holdouts. Confusion matrices and per-class recall were pooled over test predictions. A 50 permutation label shuffle control was also run at the source-file level as a diagnostic negative control, not as a formal inferential test.

The initial respiration analysis used non-overlapping 600 sample windows, corresponding to 5 s at $f_s$ = 120 Hz. Since 12 breaths per minute equals 0.2 Hz, a 5 s window contains only approximately one 12 breathsper-minute respiratory cycle and has frequency resolution $\Delta f=f_s / N$ = 0.2 Hz, or 12 breaths per minute. This study therefore repeated respiration feature extraction using 5, 10, and 20 s non-overlapping windows. These settings correspond to spectral resolutions of 12, 6, and 3 breaths per minute. The sensitivity analysis compared all features, non-spectral features, the single spectral peak, and the full spectral feature set under file-grouped holdout.

For exhaled-breath RF curves, this study tested whether the apparently perfect breaths-per-minute separability was driven only by amplitude scale or by the upper frequency quartile. The controls included per-file z-score normalization, per-file min-max normalization, baseline subtraction using the first 10 samples, and retraining after removing Q4 from both training and test features. In the absence of an explicit per-sample frequency vector in the released CSV files, Q4 is interpreted as the nominal upper quartile of the 200-point RF response, approximately 3.89–5.00 GHz under a linear 0.5–5 GHz mapping. This Q4-removed retraining analysis is distinct from test-time Q4 dropout: retraining asks whether the classifier can still learn without that band, whereas dropout asks whether a model trained with the full band fails when that band is missing at deployment.

Explainability was implemented as a structured audit of the feature space. The aim was not to produce a post hoc visualization for a single prediction, but to test whether the benchmark result depended on plausible and stable signal groups. Two complementary approaches were used: feature subset ablation and grouped permutation importance. In feature subset ablation, the same validation splits were reused while the model was trained on selected feature groups only. For respiration, the tested subsets were all features, spectral only features, spectral peak only, subcarrier means only, subcarrier standard deviations only, subcarrier peak-to-peak ranges only, and all non-spectral features. For exhaled-breath radio frequency, the tested subsets were the full 404-feature vector, raw RF curve only, first difference curve only, five summary statistics only, and 16 coarse quartile band summaries.

Grouped permutation importance was computed after fitting the model on the complete feature set. For a feature group $G$, the group was randomly permuted across test samples while all other groups were left unchanged. The importance drop was:

where, $R$ = 10 permutations in the explainable artificial intelligence analysis. A large $D_G$ means that disrupting the group substantially damages the classifier. Table 4 lists the groups used for this analysis.

Robustness was evaluated by training each model on clean deduplicated data and evaluating it on perturbed test data from the same leakage-aware splits. These are simulated perturbation tests: they probe sensitivity to controlled signal changes, but they do not replace external domain shift validation across new rooms, hardware, sessions, or subjects. For a clean signal $u$, additive noise was generated as:

where, $\alpha \in\{0.05,0.10\}$. Amplitude scaling used $u^{\prime}=0.8 u$ and $u^{\prime}=1.2 u$.. Respiration specific perturbations included baseline drift, packet loss, and subcarrier dropout. Exhaled-breath RF perturbations included baseline shift, random frequency dropout, fourth quartile frequency dropout, and five point moving average smoothing. Table 5 shows signal perturbations used in robustness testing.

Explanation stability was computed to test whether explainable artificial intelligence conclusions remained similar after perturbation. For each split, this study first computed a vector of grouped permutation drops on clean test data, $D^{\text {clean}}$. This study then computed the same vector after perturbation, $D^{\text {pert}}$, and measured their Spearman rank correlation:

This study also recorded top-group stability:

Thus, robustness measured whether predictions survived perturbation, while explanation stability measured whether the model relied on the same feature groups after perturbation.

The benchmark was implemented as a reproducible package of scripts and machine-readable outputs. The initial leakage audit and baseline benchmark were generated by scripts/benchmark_leakage.py. The explainability analysis was generated by scripts/xai_enhancement_analysis.py. The robustness and explanation-stability analysis was generated by scripts/robustness_benchmark.py. The reviewer-revision controls were generated by scripts/reviewer_revision_analysis.py. The complete run was executed through scripts/run_full_benchmark.sh, and the configuration was documented in configs/benchmark_config.json. The fixed global random seed was 42. The revision package supplied with this manuscript included the exact configuration, requirements file, scripts, generated CSV outputs, summary reports, environment file, and figure-generation code as Supplementary File S1. The local execution environment used Python 3.12.12 with NumPy 2.3.5, pandas 2.3.3, scikit learn 1.7.2, SciPy 1.17.1, and Matplotlib 3.10.8. Table 6 shows the reproducible artifacts generated by the benchmark package.

The results are reported in seven parts: dataset integrity, near-duplicate structure, source-level predictive performance, diagnostic window-level performance, explainability, simulated robustness, and explanation stability. Unless otherwise stated, values are mean $\pm$ standard deviation across the corresponding cross-validation or repeated holdout splits. Balanced accuracy is emphasized because it is insensitive to class-count changes after deduplication. Window-level respiration results are reported only as diagnostic evidence; they are not treated as independent observations or as the main basis for the conclusions.

The file-level audit revealed substantial exact duplication in the augmented dataset. Across the 90 CSV files, the respiration subset contained 45 files but only 23 unique SHA-256 hashes, corresponding to 22 duplicate excess files and a duplicate excess rate of 48.9%. The exhaled-breath RF subset contained 45 files and 40 unique hashes, corresponding to 5 duplicate-excess files and a duplicate excess rate of 11.1%. Figure 2 summarizes the file-level and class-level duplicate structure. Table 7 reports the exact duplicate summary by modality and breaths-per-minute class.

The respiration duplicate pattern was not uniformly distributed across classes. The 12 breaths-per-minute class retained 15 unique hashes, whereas the 20 breaths-per-minute class retained only 6 and the 28 breaths-per-minute class retained only 2. After segmenting respiration files into 600 sample windows, the raw respiration dataset contained 870 windows, but the deduplicated version contained 452 windows. This class level concentration is important: even when a classifier performs well after deduplication, the small number of unique 28 breaths-per-minute respiration sources limits how strongly the result can be interpreted as broad generalization.

The nearest neighbor leakage probe supported this concern. When samples were compared outside the same P-id/file identifier, the same label rate of the nearest neighbor was 1.0 for respiration, exhaled-breath radio frequency, and multimodal features. The maximum cosine similarity reached 1.0 in all three settings. The mean similarity was highest for respiration windows (0.994), followed by multimodal files (0.650) and exhaled-breath RF files (0.388). These results indicate that the classes are highly separable, but also that repeated or near repeated signal structure must be handled explicitly.

Figure 3 shows the near-duplicate audit after exact deduplication. Source level Pearson clustering gave a stricter view than SHA-256 alone. In respiration, each source file’s nearest neighbor had the same breaths-per-minute label, with a mean nearest neighbor correlation of 0.922. At $r$ $\geq$ 0.98, the 23 deduplicated respiration sources formed 20 clusters, with six sources belonging to multi-source clusters and no cross-label edges. In exhaled-breath radio frequency, all 40 deduplicated curves were extremely similar in shape, with mean nearest neighbor correlation of 0.999; threshold clustering at$r$ $\geq$ 0.98 produced a single global cluster containing cross-label edges. Therefore, correlation clustering was useful as a near-duplicate warning, but not as a clean label-specific family split for the RF curves.

The primary revised evidence used unique source files/hashes rather than windows as the analysis unit. Figure 4 and Table 8 summarize repeated source-file holdout. For respiration, each split tested 3, 2, and 1 unique sources for 12, 20, and 28 breaths per minute, respectively, leaving only one 28 breaths-per-minute source in training. This fold composition makes 28 breaths-per-minute generalization intrinsically fragile. Logistic regression reached perfect source-level balanced accuracy, but random forest reached only 0.700, with pooled 28 breaths-per-minute recall of 0.10. This model-family divergence is a stronger caution than the window-level score alone.

Bars show balanced accuracy with empirical 95% percentile intervals. Confusion matrices are pooled over repeated random forest source file holdouts. The respiration random forest frequently mapped the scarce 28 BPM sources to 20 BPM, whereas exhaled breath RF remained separable within the released source level files.

Label permutation controls supported that the observed source-level separability was not reproduced by shuffled labels. The permuted balanced accuracy means ranged from 0.322 to 0.413 across modality/model combinations, with empirical $p$ $\leq$ 0.039 for the observed scores in the 50-permutation control. These values should be interpreted as diagnostic rather than definitive because the source-level datasets are small.

The window-level benchmark confirmed that breaths-per-minute classification is easy in this dataset, but these results are secondary because windows from the same unique source are not independent. They are useful for diagnosing whether the signal representation carries breaths per minute-discriminative information, but they should not be interpreted as independent subject-, session-, or original-recording-level evidence. Figure 5 compares balanced accuracy for deduplicated respiration and exhaled-breath RF data under naive and leakage-aware protocols. The dummy majority baseline remained near the expected three-class balanced accuracy of 0.333, whereas both logistic regression and random forest achieved very high scores.

Table 9 shows the selected leakage-aware benchmark results. The raw respiration benchmark produced perfect scores under random window splitting and file group splitting, but performance became less uniform when exact-hash grouping was applied. In the raw respiration exact-hash group protocol, random forest balanced accuracy was 0.979 $\pm$ 0.022 and Macro-F1 was 0.793 $\pm$ 0.189, showing that exact duplicates can materially affect fold behavior. After deduplication, the stratified file holdout protocol remained high for both random forest and logistic regression, with balanced accuracies of 0.998 $\pm$ 0.006 and 0.997 $\pm$ 0.006, respectively.

Within the released source-level files, the exhaled-breath RF curves were separable for breaths-per-minute labels under all tested protocols after deduplication. Both random forest and logistic regression achieved 1.000 $\pm$ 0.000 balanced accuracy under random file splitting, participant group splitting, and stratified file holdout. Multimodal paired features also reached 1.000 $\pm$ 0.000 balanced accuracy under pair hash holdout. This ceiling-level performance should not be interpreted as clinical hydration diagnosis; it means that the released breaths per minute-labeled RF curves are highly separable under the benchmarked feature representations.

The feature subset tests showed that respiration performance was driven mainly by subcarrier variability rather than by the estimated spectral peak alone. Figure 6 shows balanced accuracy for restricted feature subsets. For respiration, random forest with all features reached 0.996 $\pm$ 0.007, while the non-spectral subset remained high at 0.989 $\pm$ 0.009. Peak-to-peak subcarrier features alone reached 0.986 $\pm$ 0.013, whereas the single spectral peak feature achieved only 0.441 $\pm$ 0.009 under the selected 5 s window representation. Logistic regression showed the same pattern: non-spectral features reached 0.998 $\pm$ 0.005, but the spectral peak alone reached only 0.422 $\pm$ 0.014.

Detailed numerical feature-subset values, including standard deviations and macro-F1 scores, are provided in the accompanying Supplementary Materials as Table S1; this avoids duplicating the information already shown in Figure 6.

Respiration classification depends strongly on CSI subcarrier summary features, especially variability and peak-to-peak range. Exhaled-breath RF remains highly separable even with coarse or summary representations. The weak spectral peak result is tied to the short-window representation and is evaluated further in Figure 7.

Exhaled-breath RF feature subset behavior was even more direct. Random forest achieved 1.000 $\pm$ 0.000 balanced accuracy using the full 404 features, the raw 200-point curve, the 199 first differences, the five summary statistics, or the 16 coarse quartile-band summaries. Logistic regression also reached perfect accuracy with the full, raw, and first difference representations, and remained high with summary statistics only. This indicates that the breaths-per-minute labels can be recovered from very low dimensional summaries of the RF curves, which is evidence of strong class separability and potential shortcut structure.

The window length sensitivity analysis clarified the spectral result. With 5 s windows, the frequency resolution was 12 breaths per minute and the single spectral peak reached only 0.427–0.438 balanced accuracy depending on the model. At 20 s, the frequency resolution improved to 3 breaths per minute; the full spectral feature set reached 0.991 balanced accuracy with logistic regression, while the single spectral peak remained weaker. Thus, the main respiration result should be read as breaths-per-minute classification from CSI variability features under the selected representation, not as a definitive statement that spectral respiration estimation is uninformative.

Shortcut control experiments (Figure 8) showed that exhaled-breath RF separability was not caused only by absolute amplitude scale. Per-file z-score normalization, min–max normalization, and baseline subtraction all retained 1.000 $\pm$ 0.000 balanced accuracy for both models. However, removing the fourth frequency quartile before retraining reduced balanced accuracy to 0.906 $\pm$ 0.088 for logistic regression and 0.925 $\pm$ 0.085 for random forest. Assuming a linear 0.5–5 GHz axis, this quartile corresponds approximately to 3.89–5.00 GHz. The result indicates that Q4 carries important information, but is not the only separable structure in the RF curves.

Grouped permutation importance clarified which feature groups carried the decision. In respiration, permuting all subcarrier standard deviations produced the largest balanced-accuracy drop (0.522 $\pm$ 0.022), followed by subcarrier peak-to-peak ranges (0.297 $\pm$ 0.015). Subcarrier means produced only a small drop (0.016 $\pm$ 0.008), and the grouped spectral features produced almost no drop in the 5 s representation. In exhaled-breath RF, the fourth frequency quartile produced the largest drop (0.653 $\pm$ 0.056), followed by first differences (0.485 $\pm$ 0.061). Figure 9 summarizes these results; detailed grouped-permutation values are provided in the accompanying Supplementary Materials as Table S2.

Simulated robustness testing showed a clear difference between respiration and exhaled-breath radio frequency. Respiration was robust to Gaussian noise, packet loss, baseline drift, and moderate subcarrier dropout, but it was sensitive to global amplitude scaling. Exhaled-breath RF was robust to small Gaussian noise for random forest, but it was highly sensitive to smoothing, fourth quartile frequency removal, and amplitude scaling. Figure 10 visualizes the balanced accuracy drop relative to clean evaluation. These results should be read as perturbation robustness, not as evidence of external domain shift or clinical deployment robustness.

Table 10 shows the worst robustness degradation cases. For respiration, random forest clean balanced accuracy was 0.996 $\pm$ 0.007. Gaussian noise at 5% and 10% caused only small drops of 0.002 and 0.003, respectively. Packet loss and baseline drift did not degrade random forest performance. However, amplitude scaling to 0.8 reduced random forest balanced accuracy to 0.679 and scaling to 1.2 reduced it to 0.750. Logistic regression showed the same vulnerability, dropping to 0.618 under 0.8 scaling and 0.742 under 1.2 scaling.

For exhaled breath radio frequency, random forest clean balanced accuracy was 1.000, but moving average smoothing and fourth quartile dropout both reduced balanced accuracy to 0.333, i.e., chance-level performance for a three class problem. Amplitude scaling also caused large drops. Logistic regression was especially sensitive to amplitude scaling, fourth quartile dropout, smoothing, and random frequency dropout. These results show that perfect clean accuracy does not imply robust sensing performance and cannot distinguish physiological breaths-per-minute information from dataset-specific curve-shape shortcuts without independent acquisition data.

Explanation stability followed the same pattern as robustness. Respiration explanations were relatively stable under most perturbations, whereas exhaled-breath RF explanations became unstable under the same perturbations that damaged performance. Figure 11 reports Spearman rank correlations between clean and perturbed grouped importance vectors.

Table 11 shows the representative explanation-stability results. Exhaled-breath RF explanation stability collapsed under moving average smoothing and fourth quartile dropout, with top group stability equal to 0.00 in both cases. In contrast, respiration retained top group stability of 1.00 under amplitude scaling and baseline drift, even when amplitude scaling reduced predictive performance. This means the respiration model tended to rely on the same feature family after perturbation, while the exhaled-breath RF model evidence shifted substantially when the high frequency end of the RF curve or curve shape was altered.

All result tables in this section were generated from machine-readable CSV outputs. The initial benchmark produced inventory, duplicate, cross-validation, and nearest-neighbor reports under reports/initial_benchmark. The explainable artificial intelligence analysis produced feature-subset, grouped-permutation, and feature importance outputs under reports/xai_analysis. The robustness benchmark produced perturbation and explanation stability outputs under reports/robustness_benchmark. The source-level, near-duplicate, label permutation, window-length, and RF shortcut-control outputs were generated under reports/reviewer_revision. The figures in this section were generated by scripts/make_paper_figures.py from those CSV files, making the reported tables and plots directly reproducible. The accompanying Supplementary File S1 archive contains the exact configuration, requirements, scripts, generated CSV outputs, summary reports, environment record, and figure-generation code; its complete manifest is provided in Supplementary Table S1.

This study shows that the public augmented RF/CSI dataset is highly separable for breaths-per-minute classification, but it also shows why separability must be interpreted with caution. A conventional reading could focus only on the near-perfect window-level accuracies. That would be incomplete. The more important finding is that the dataset contains substantial exact duplication, source-level scarcity in the 28 breaths-per-minute respiration class, near-duplicate structure, and perturbation-sensitive feature dependence. Therefore, the main contribution is not a new classifier for respiration or exhaled-breath RF curves; it is a benchmark audit showing how such datasets should be validated before strong sensing or biomedical claims are made.

The duplicate audit materially changes how the benchmark should be read. Respiration contained 45 released CSV files but only 23 unique SHA-256 hashes, with the 28 breaths-per-minute class represented by only two unique hashes. This does not make the dataset unusable, but it means that random sample-level splits are not sufficient and that window counts must not be treated as independent subject counts. If augmented, duplicated, or near-duplicated signals cross the train-test boundary, model performance can reflect repeated source identity rather than generalizable physiology. This is consistent with broader warnings about data leakage in machine learning research [14], [15] and with recent Wi-Fi CSI studies showing that improper partitioning can inflate reported performance [16], [17]. The present results therefore support a practical recommendation: RF/CSI benchmark studies should report exact hash audits, similarity family checks, source-level fold composition, and per-class performance as standard outputs.

At the same time, the results do not reduce to exact duplicate leakage. Respiration windows still reached approximately 0.998 balanced accuracy under stratified file holdout, and source-level logistic regression reached 1.000 balanced accuracy. However, the source-level random forest result was much weaker, mainly because the 28 breaths-per-minute class had only two unique sources and pooled 28 breaths-per-minute recall was 0.10. This shows why model-family agreement and source-level uncertainty matter. In a real sensing deployment, such a sparse high breaths-per-minute class could translate into systematic under recognition of faster breathing patterns when acquisition hardware, room geometry, subject distance, or antenna placement changes. The supported claim is narrower but defensible: the released RF/CSI signals contain strong breaths-per-minute discriminative structure within the available controlled dataset, but the evidence is not sufficient for broad subject, session, or hardware-level generalization.

The explainability results are central to understanding what the models learned. For respiration, a single spectral peak feature performed poorly under the 5 s representation, while subcarrier variability features, especially standard deviation and peak-to-peak range, carried most of the predictive signal. The window length sensitivity analysis shows that this is partly a representation issue: 5 s windows have only 12 breaths-per-minute frequency resolution, whereas longer windows improve the full spectral feature set. Therefore, the result should not be read as a general failure of respiration frequency estimation. It shows that the high performing classifier in this benchmark relied mainly on CSI amplitude variability patterns, which may be physiologically related to breathing motion but may also be sensitive to gain, placement, and environment.

The robustness results support this interpretation. Respiration models were stable under Gaussian noise, packet loss, baseline drift, and moderate subcarrier dropout, but they were sensitive to amplitude scaling. For example, random forest balanced accuracy dropped from approximately 0.996 on clean deduplicated respiration windows to 0.679 under 0.8 amplitude scaling. This pattern suggests that respiration classification is not fragile to every perturbation, but it is vulnerable to gain-like changes. In real deployments, gain changes can arise from hardware differences, environment geometry, antenna placement, and subject distance. A future deployable respiration system would therefore need amplitude normalization, domain calibration, or external validation across acquisition settings.

The exhaled-breath RF curves behaved differently. The models achieved perfect clean accuracy, and even five summary statistics were enough for random forest to classify the breaths per minute perfectly. This is a warning sign rather than a pure strength. The normalization controls showed that separability was not caused only by absolute amplitude scale, because z-score, min–max, and baseline-subtracted curves remained perfectly separable. However, Q4-removed retraining reduced balanced accuracy to 0.906–0.925, and test-time Q4 dropout or smoothing caused chance-level performance. This indicates that the RF result is driven by strong curve-shape and upper-frequency structure, not by a validated clinical hydration endpoint. With the current release, this study cannot determine whether those curve-shape differences reflect physiological exhaled-breath information, acquisition/preprocessing artifacts, or dataset-specific shortcuts. Because the RF curves formed a globally high correlation structure rather than clean label-specific near-duplicate families, the current dataset does not allow definitive augmentation-family-independent RF validation. Parent-recording metadata would be required for a stricter leave-one-original-measurement-out evaluation.

The strongest scientific interpretation is therefore asymmetric across modalities. For respiration, the benchmark suggests a breaths-per-minute classifier whose window-level performance is high but whose source-level interpretation is constrained by the small number of unique 20 and 28 breaths-per-minute sources. For exhaled-breath radio frequency, the benchmark suggests a highly separable but potentially shortcut-dominated curve classification problem whose clean performance is impressive but whose robustness and explanation stability are weaker. This distinction matters for manuscript positioning. The paper should not claim that hydration state is clinically solved. It should claim that this dataset exposes a useful benchmark problem for evaluating leakage, shortcut separability, explanation stability, and robustness in augmented RF biomedical sensing.

Explanation stability adds value because it connects explainable artificial intelligence to robustness. Many explainable artificial intelligence analyses stop after ranking important features on clean data. Here, the feature group ranking was recomputed after perturbation. Respiration explanations remained relatively stable under most perturbations, with top group stability of 1.00 under amplitude scaling and baseline drift. Exhaled-breath RF explanations, however, collapsed under moving average smoothing and fourth quartile dropout. This means that the same perturbations that damaged RF curve accuracy also changed what the model appeared to rely on. For benchmark papers, this is a useful principle: explanations should be evaluated not only for plausibility, but also for stability under realistic signal changes. The present explainable artificial intelligence analysis is global by design: it asks which feature groups support benchmark-level separability. A future clinical or deployment-oriented system would also need local explanations for individual windows or files. SHapley Additive exPlanations (SHAP) or Local Interpretable Model-agnostic Explanations (LIME) could be used to inspect whether a specific high-BPM prediction is driven by stable subcarrier variability, narrow radio-frequency-band artifacts, or preprocessing-sensitive curve changes. Such local explanations would be most valuable after external validation data are available; otherwise, they risk providing detailed explanations for dataset-specific shortcuts.

The reproducible benchmark package is also part of the result, not merely an implementation detail. Because the analysis produces inventory tables, duplicate reports, cross-validation summaries, source-level confidence intervals, confusion matrices, explainable artificial intelligence outputs, robustness outputs, and figures from machine-readable files, the study can be rerun and audited. This aligns with current medical artificial intelligence reporting expectations that emphasize transparent data handling, validation, and open-science practice [18], [19]. This reproducibility layer helps frame the contribution as a transparent audit framework for an existing augmented RF/CSI biomedical sensing dataset. Table 12 shows the interpretation of the main findings and the claims supported by the evidence.

Overall, the publication value of this work lies in reframing the problem. A paper that only reports high accuracy on this dataset would be vulnerable to criticism because the task is small, augmented, and partially duplicated. A paper that audits leakage, reports source-level uncertainty, explains feature dependence, tests simulated robustness, and releases reproducible outputs is more defensible. The appropriate contribution is therefore a leakage-aware and explanation-stable benchmark audit for augmented RF/CSI breathing rate classification. The main message is that high accuracy can be real within the dataset while still being insufficient for strong biomedical claims unless leakage, explanation plausibility, perturbation robustness, and reproducibility are all addressed.

Several limitations constrain the scope of the conclusions. First, no additional data were collected. The analysis is restricted to the released IEEE DataPort files, so it cannot test generalization to new subjects, new rooms, new hardware, different antenna placements, or independent clinical sites. Second, the target variable is the breaths-per-minute class. The exhaled-breath RF files are measurements associated with controlled breathing rate conditions, but the benchmark does not include independently measured clinical hydration labels. Therefore, the study cannot claim diagnosis or estimation of physiological hydration status.

Third, the released P-ids/file identifiers should not be treated as sufficient evidence of true subject independence. The exact duplicate audit showed that multiple P-id-labeled files can share identical hashes, especially in the augmented respiration subset. For that reason, P-id group validation was reported but was not treated as the strongest evidence of independence. Fourth, the release does not provide parent-recording, augmentation-family, session, environment, or hardware metadata. Therefore, the study cannot guarantee that all augmented variants of the same original recording were kept on the same side of every train-test split. SHA-256 grouping prevents byte-identical leakage and similarity-family grouping probes approximate duplicates, but neither is a substitute for true leave-one-original-recording-out validation. Fifth, the 28 breaths-per-minute respiration class has only two unique hashes, so even source-level holdout leaves only one 28 breaths-per-minute source in training. Sixth, the robustness tests are simulated perturbations. They are useful stress tests, but they do not replace real domain shift experiments with new acquisition sessions. Finally, the explainable artificial intelligence analyses are feature group audits rather than direct physiological validation. They identify which signal summaries drive decisions, but they do not prove that those summaries are uniquely caused by respiration mechanics or exhaled water vapor physiology. Accordingly, this benchmark should be used to assess dataset validity and evaluation protocols, not to support direct physiological or clinical deployment claims.

This study presents a leakage-aware and explanation-stable benchmark audit for an augmented RF/CSI breathing rate classification dataset. Instead of treating high classification accuracy as the final result, the study examined whether the dataset and benchmark protocol support reliable claims. The audit found substantial exact duplication in the respiration files and smaller but non-negligible duplication in the exhaled-breath RF files. After deduplication, breaths-per-minute classification remained highly separable, but source-level analysis showed that this separability must be interpreted alongside the small number of unique 20 and 28 breaths-per-minute respiration sources. The explainability, window length, normalization, and robustness analyses clarified the nature of that structure. Respiration classification was driven primarily by CSI subcarrier variability features, especially standard deviation and peak-to-peak range, while single-peak spectral evidence was limited under the 5 s representation. Breaths-per-minute classification using exhaled-breath RF curves was highly separable even after per-file normalization, but it depended strongly on curve-shape and the upper frequency quartile and was fragile under smoothing and Q4 dropout. These findings show why clean accuracy alone is not sufficient for augmented biomedical sensing datasets: a model can be accurate, yet still depend on narrow feature groups, duplicate structure, or perturbation-sensitive shortcuts.

The main contribution of this work is therefore methodological. It provides a reproducible benchmark package that combines duplicate auditing, near-duplicate checks, source-level validation, feature group explainability, signal-level perturbation testing, and explanation stability analysis. For future RF/CSI health sensing studies, these checks should be reported alongside accuracy, especially when datasets are small, augmented, or reused as public benchmarks. The present results support breaths-per-minute classification within the available dataset, but they do not establish clinical hydration diagnosis, respiratory disorder diagnosis, external domain shift robustness, or real-world deployment performance. External data, independent subjects, new acquisition environments, and clinically grounded labels remain necessary before stronger biomedical claims can be made. Overall, the study demonstrates that the value of this dataset is strongest when framed as a transparent benchmark-validity analysis. A leakage-aware, explainable, robustness-tested, and reproducible evaluation can turn an otherwise narrow classification experiment into a more defensible contribution for RF/CSI biomedical signal processing.