Non-Cooperative Transmitter Localization

• Non-Cooperative Transmitter Localization is the process of estimating the position of RF emitters that do not assist in the measurement procedure, using passive sensing techniques.
• The topic involves challenges such as unknown emitter power, varying propagation parameters, and non-line-of-sight biases, which require specialized estimation and optimization frameworks.
• Recent advances integrate deep learning and distributed algorithms to jointly infer transmitter locations and related network parameters, improving accuracy in complex environments.

Non-cooperative transmitter localization is the estimation of an emitting source’s position when the source does not participate in the localization procedure. Across the literature, the unknowns may include only the transmitter location, or jointly the transmitter power, propagation parameters, reflector geometry, transmitter-specific processing delay, or even the receiver-network geometry itself. The topic therefore spans passive geolocation with binary detectors, RSS-only multi-emitter localization, TDOA/AOA and wideband direct localization, localization of legacy Wi‑Fi access points that do not support specialized ranging protocols, and joint formulations in which uncertain sensor positions and a non-communicating target are estimated together (Shoari et al., 2013, Bryan et al., 2019, Sie et al., 23 Jun 2025, Zhu et al., 21 Sep 2025).

1. Definitions, scope, and problem variants

“Non-cooperative” is used in a modality-specific sense rather than as a single universal condition. In the binary-detector setting, the target is a non-cooperative transmitter at unknown 2D coordinates $[x_T,y_T]$ with unknown power $P$, and the fusion center estimates $\boldsymbol{\theta}=[P,x_T,y_T]^T$ from sensor decisions (Shoari et al., 2013). In passive wideband localization, the unknown node is an “agent” observed by anchors through received waveforms, and the non-cooperative case is recovered by discarding inter-agent cooperation terms from the cooperative EFIM (Shen et al., 2010). In Wi‑Fi ranging, “non-cooperative” means that a legacy access point need not support any special localization protocol, firmware modification, or timestamp exchange; it merely behaves as a standards-compliant 802.11 device that responds normally at the MAC layer (Sie et al., 23 Jun 2025). In LTE, an “uncooperative” device neither exposes its location nor assists the localizer, and the localizer lacks privileged operator-side control over the handset’s radio behavior (Oh et al., 2024).

The problem also differs by what is being localized. Some systems localize the transmitter directly; others are framed as receiver localization but contain an explicit transmitter-localization stage. A particularly clear example is PeepLoc, which is introduced as an indoor localization system for mobile users but first estimates the positions of pre-existing Wi‑Fi APs and their processing delays, thereby turning non-cooperative transmitters into anchors (Sie et al., 23 Jun 2025). A recurrent source of confusion is therefore the assumption that “non-cooperative transmitter localization” is only about locating an unknown emitter as the final target. The literature also includes anchor-bootstrapping problems in which the non-cooperative transmitters themselves are the objects being localized.

Another major axis is cardinality. Some formulations assume a single emitter and concentrate on estimation-theoretic limits or robust geometric inversion (Shoari et al., 2013, Dureppagari et al., 26 Feb 2025). Others treat the number of emitters as unknown and recover a sparse power map over a candidate grid, either with compressed-sensing formulations for aggregate RSS or with learned variable-cardinality detectors (Bryan et al., 2019, Zhan et al., 2021). A third class jointly estimates uncertain sensor positions and an external, non-communicating target, thereby coupling cooperative network self-localization with non-cooperative target localization in a single optimization problem (Zhu et al., 21 Sep 2025).

Coordinate systems also vary. Some formulations are relative and confined to a bounded monitored area (Bizon et al., 2023). Others are absolute. PeepLoc is explicit that AP positions are inferred in UTM coordinates seeded by GPS before building entry, so the estimated transmitter positions are georeferenced rather than merely latent map points (Sie et al., 23 Jun 2025). This distinction matters because absolute localization supports later deployment as fixed anchors, whereas relative localization may only support local inference within the same sensing geometry.

2. Measurement models and observables

At the coarsest sensing level, non-cooperative localization can be based on binary local decisions. In the dense-sensor model with non-coherent detectors, each sensor reports only $d_i\in\{0,1\}$, with detection probability

$$P_{\mathrm D}(r)=Q\!\left(\sqrt{\frac{TP}{\sigma^2 r^\alpha}},\sqrt{\frac{2\tau}{\sigma^2}}\right),$$

and the network likelihood is Bernoulli: $$p(\{d_i\};\boldsymbol\theta)=\prod_i P_{\mathrm D,i}^{\,d_i}(1-P_{\mathrm D,i})^{1-d_i}.$$ The sufficient information is therefore not waveform structure or RSS amplitude itself, but the sensitivity of the detection probability to the unknown parameters (Shoari et al., 2013).

A large portion of the literature uses RSS. For multiple non-cooperative emitters on a planar search region, aggregate RSS at sensor $j$ is modeled as

$$d_j=\sum_{i=1}^N p_i\left(\frac{r_0}{r_{ij}}\right)^n$$

in the idealized one-slope model, or with multiplicative lognormal perturbations in the noisy model (Bryan et al., 2019). In the mmWave setting, the received power at sensor $k$ is modeled as a nonlinear mixture of all active sources,

$$r_k = \sum_{n=1}^{N} P_n\, d_{kn}^{-\alpha}\,\beta^{d_{kn}} + w_k,$$

so the unknowns include not only source locations and powers but also path-loss parameters such as $P$0 and $P$1 (Zandi et al., 2019). In map-assisted RSS localization, the observation is scalar RSS $P$2, but the forward model is segmented into LOS and NLOS regressions over a 2D map-induced partition (Sun et al., 8 Jan 2025).

Higher-resolution formulations use geometric timing and directional measurements. In the distributed EM model for NLOS localization, sensor $P$3 measures AOA $P$4 and TDOA relative to a reference node,

$P$5

where the reflector orientations $P$6 are latent variables (Xu et al., 2014). In passive TDOA localization, anchors form pseudo-range differences

$P$7

and estimate the transmitter position from anchor-only measurements without synchronization to the transmitter (Dureppagari et al., 26 Feb 2025). In wideband waveform localization, the received signal itself is modeled as a multipath superposition, and the localization information is derived from the waveforms rather than from pre-extracted scalar measurements (Shen et al., 2010).

A particularly distinctive modality is non-cooperative Wi‑Fi timing. PeepLoc models the observed round-trip timing to AP $P$8 as

$P$9

where $\boldsymbol{\theta}=[P,x_T,y_T]^T$0 is an AP-specific processing delay inferred from many samples rather than reported by the AP (Sie et al., 23 Jun 2025). This moves hidden transmitter-side turnaround behavior into an estimable nuisance parameter. By contrast, recent posterior-learning work compresses receiver-side processing into features such as estimated AoA $\boldsymbol{\theta}=[P,x_T,y_T]^T$1 and an SNR-like scalar $\boldsymbol{\theta}=[P,x_T,y_T]^T$2, then treats localization as inference of $\boldsymbol{\theta}=[P,x_T,y_T]^T$3 with

$\boldsymbol{\theta}=[P,x_T,y_T]^T$4

rather than as direct inversion of a hand-specified likelihood (Lei et al., 30 Sep 2025).

These measurement models encode different nuisance structures. RSS models are dominated by path-loss uncertainty, shadowing, coherence, and source indistinguishability. Timing models introduce clock or processing offsets, NLOS bias, and synchronization structure. Wideband and array models move closer to direct physics but require stronger waveform, calibration, or array assumptions. This suggests that “non-cooperative” is less a measurement class than a constraint on what the transmitter is allowed to reveal.

3. Estimation-theoretic and algorithmic frameworks

A foundational line of work characterizes achievable accuracy through Fisher information and Cramér–Rao bounds. For binary non-coherent detectors, the expected FIM is diagonal under isotropic propagation and uniform sensor deployment, with

$\boldsymbol{\theta}=[P,x_T,y_T]^T$5

so the location CRBs are $\boldsymbol{\theta}=[P,x_T,y_T]^T$6. A central structural result is that, under this model, knowledge of transmit power does not change the location CRBs because the expected FIM decouples power from $\boldsymbol{\theta}=[P,x_T,y_T]^T$7 (Shoari et al., 2013). In wideband anchor-based localization, the corresponding compact object is the EFIM

$\boldsymbol{\theta}=[P,x_T,y_T]^T$8

where each anchor contributes rank-one ranging information along its radial direction. Without prior channel knowledge, the LOS contribution is

$\boldsymbol{\theta}=[P,x_T,y_T]^T$9

while the NLOS contribution is zero (Shen et al., 2010). That result sharply formalizes the cost of unknown NLOS bias.

A second major family casts localization as sparse inverse recovery. In RSS-only multiple-emitter localization without fingerprinting, the region is discretized into candidate locations and the noiseless model is written as $d_i\in\{0,1\}$0, with sparse nonnegative $d_i\in\{0,1\}$1. Because the sensing matrix is highly coherent, the paper uses BLOOMP rather than plain OMP and develops explicit analyses of resolution and detectability, including the conservative detectability threshold

$d_i\in\{0,1\}$2

The same paper shows that refining the grid beyond the physical RSS resolution limit does not meaningfully improve separability (Bryan et al., 2019). In the mmWave case, the corresponding sparse formulation is coupled to unknown path-loss parameters and off-grid corrections, leading to an $d_i\in\{0,1\}$3-regularized program followed by clustering and local refinement (Zandi et al., 2019).

A third family uses direct geometric or convex formulations to avoid brittle preprocessing. “Super-resolved Localisation without Identifying LoS/NLoS Paths” introduces virtual scatters so that LoS and single-bounce NLoS paths share a common geometry, then formulates localization as a continuous sparse inverse problem over transmitter/scatterer pairs with TV and group-TV penalties (Liu et al., 2019). In a different vein, map-assisted segmented regression models RSS through LOS and NLOS regressions selected by sector-wise linear separators over a 2D map,

$d_i\in\{0,1\}$4

and estimates both source location and propagation regime jointly (Sun et al., 8 Jan 2025). These methods differ strongly in machinery but share a rejection of the simple pipeline “estimate intermediate path parameters, then classify, then triangulate.”

Deep learning introduces two rather different strategies. One class learns the inverse mapping directly from an RSS vector to transmitter count and positions, as in the two-stage fully connected DNN that first classifies $d_i\in\{0,1\}$5 and then applies a regressor specialized to that count (Bizon et al., 2023). Another class re-expresses the localization task as a vision problem: DeepMTL uses sen2peak for image-to-image translation from sparse RSS maps to Gaussian peak images, then YOLOv3-cust for variable-cardinality detection of transmitter locations (Zhan et al., 2021). More recent work moves from point estimation to full posterior inference, parameterizing

$d_i\in\{0,1\}$6

and training the score $d_i\in\{0,1\}$7 with Monte Carlo candidate-likelihood estimation so that multimodal posteriors can be represented explicitly (Lei et al., 30 Sep 2025). This suggests an increasingly sharp methodological split between classical inverse problems that optimize geometric consistency and learned conditional-density models that approximate the full inference map.

4. Joint, distributed, and cooperative extensions

Distributed inference enters the literature for both communication and robustness reasons. In the NLOS RF-target model with hidden reflector orientations, the distributed EM algorithm treats $d_i\in\{0,1\}$8 as latent variables, has each node compute local expected summary statistics, and then fuses those statistics by gossip rather than centralizing raw TDOA/AOA measurements. The convergence result is strong: all local estimates asymptotically agree, and their common limit approaches the stationary set of the centralized observed-data likelihood (Xu et al., 2014). For non-cooperative transmitter localization, the key point is not EM per se but the latent-variable decomposition: much of the difficulty lies in unobserved propagation geometry rather than only in sensor noise.

A more recent and more general distributed formulation is joint cooperative and non-cooperative localization with uncertain sensor positions. The JCNL model writes sensor–sensor ranges

$d_i\in\{0,1\}$9

and sensor–target ranges

$$P_{\mathrm D}(r)=Q\!\left(\sqrt{\frac{TP}{\sigma^2 r^\alpha}},\sqrt{\frac{2\tau}{\sigma^2}}\right),$$0

inside one least-squares objective, then introduces auxiliary variables and consensus copies so that local proximal ADMM updates can be performed in parallel (Zhu et al., 21 Sep 2025). The resulting SP-ADMM-JCNL is proved to converge globally to a KKT point of the reformulated problem and to a critical point of the original non-convex objective, with sublinear rate $$P_{\mathrm D}(r)=Q\!\left(\sqrt{\frac{TP}{\sigma^2 r^\alpha}},\sqrt{\frac{2\tau}{\sigma^2}}\right),$$1 (Zhu et al., 21 Sep 2025). For transmitter localization, its significance is conceptual: if receiver geometry is uncertain, source localization and network self-localization need not be sequential problems.

Cooperation can also be added to fundamentally non-cooperative localization tasks when extra internode links exist. In TDOA-based passive localization, TS-WPM is defined for anchor-only non-cooperative localization, but the same framework is extended to cooperative localization by adding TW-TOA measurements among target UEs (Dureppagari et al., 26 Feb 2025). In magneto-inductive localization, the non-cooperative baseline is anchor-only per-agent estimation, while cooperation adds agent-agent links and yields a factor of 3 accuracy improvement for 10 cooperating agents (Schulten et al., 2021). These results do not redefine the task as cooperative transmitter localization; rather, they show that when auxiliary communication among unknown nodes becomes available, it can be incorporated as additional information on top of an inherently non-cooperative source-localization core.

The distinction matters because cooperative augmentation is not universally available. Passive emitters, legacy infrastructure, and hostile or opportunistic sources often cannot provide extra links on demand. This suggests that joint and cooperative methods are best understood as extensions that relax receiver-side uncertainty or anchor scarcity, not as replacements for non-cooperative localization itself.

5. Representative systems and empirical performance

PeepLoc is a representative system-level demonstration in which non-cooperative transmitter localization is embedded inside an operational pipeline. It uses two ESP32‑S3 devices—an injector and a sniffer—to measure an RTT-like interval between an outgoing frame and the AP’s ACK, pairs those observations with GPS and PDR trajectories, and fits each AP’s position $$P_{\mathrm D}(r)=Q\!\left(\sqrt{\frac{TP}{\sigma^2 r^\alpha}},\sqrt{\frac{2\tau}{\sigma^2}}\right),$$2 and delay $$P_{\mathrm D}(r)=Q\!\left(\sqrt{\frac{TP}{\sigma^2 r^\alpha}},\sqrt{\frac{2\tau}{\sigma^2}}\right),$$3 by per-AP nonlinear least squares under building-bound constraints (Sie et al., 23 Jun 2025). Across 4 campus buildings and 5 floorplan configurations, the paper reports a median AP localization error of 1.43 m, while downstream client localization attains mean and median errors of 3.41 m and 3.06 m, respectively (Sie et al., 23 Jun 2025). The importance of the result is not only accuracy but deployability: the APs need no FTM support, no synchronization with clients, and no prior site survey.

At the cellular end of the spectrum, UMA shows that practical localization of uncooperative LTE devices is often bottlenecked less by geometry than by the inability to force sufficient, strong, and attributable uplink traffic. UMA therefore combines RNTI acquisition, scheduling manipulation, uplink power boosting via forged DCI 0 TPC commands, repeater disambiguation, and AoA-based multiangulation (Oh et al., 2024). In the end-to-end evaluation, localization with power boosting achieved 100% success rate, about 12° 70% angular accuracy, about 1.7 m 70% distance accuracy, and completion in under 5 minutes; without power boosting, success rate dropped to 77% and 70% distance accuracy was about 2.8 m (Oh et al., 2024). This is a systems contribution rather than a new estimator, but it directly alters what “observable” means in a real non-cooperative cellular environment.

RSS-only multi-emitter systems now span both simulation-heavy and partially real deployments. DeepMTL localizes multiple simultaneous transmitters by mapping a $$P_{\mathrm D}(r)=Q\!\left(\sqrt{\frac{TP}{\sigma^2 r^\alpha}},\sqrt{\frac{2\tau}{\sigma^2}}\right),$$4 sensor-reading image to a peak image and then detecting peaks with YOLOv3-cust, while DeepMTL Pro extends this with power estimation (Zhan et al., 2021). In simulation, DeepMTL achieves mean localization error around 2 to 2.5 m in the log-distance setting and about 5 to 6 m in the SPLAT! setting, with localization runtime around 20 ms; on a 915 MHz real testbed, the reported localization error is about 1.3 m and $$P_{\mathrm D}(r)=Q\!\left(\sqrt{\frac{TP}{\sigma^2 r^\alpha}},\sqrt{\frac{2\tau}{\sigma^2}}\right),$$5 is about 3% at 5 transmitters and 5% at 10 transmitters (Zhan et al., 2021). A different RSS-only blind multi-transmitter study uses a two-stage fully connected DNN and reports sub-4-meter accuracy for all tested cases up to 4 simultaneous transmitters, while the first-stage transmitter-count classifier maintains precision and recall not below 70% (Bizon et al., 2023). These results place learned set-valued localization alongside sparse model-based methods as a viable empirical branch of the field.

Recent work on probabilistic localization shifts the evaluation target from Euclidean point error to posterior quality. MC-CLE is demonstrated only in LOS simulation with a single multi-antenna receiver and known waveform structure, but it directly models multimodal posteriors over transmitter location and outperforms Gaussian posterior baselines in sampled cross-entropy loss (Lei et al., 30 Sep 2025). Although narrow in scope, it marks an empirical move toward uncertainty-native non-cooperative localization rather than only point estimation.

6. Limitations, misconceptions, and active research directions

A persistent misconception is that “non-cooperative transmitter localization” implies arbitrary RF emitter localization under no structure whatsoever. The literature is narrower. PeepLoc depends on standard-compliant Wi‑Fi MAC behavior and a sufficient density of pre-existing APs and pedestrian trajectories (Sie et al., 23 Jun 2025). UMA depends on LTE control-plane vulnerabilities and active signal injection capabilities (Oh et al., 2024). Quantum-sensor formulations assume a known field-strength model, fixed transmit power, and simulated quantum-state evolution under a specific sensing protocol (Zhan et al., 2022). Even apparently passive Bayesian methods may assume a known periodic waveform and calibrated array features (Lei et al., 30 Sep 2025). The common element is lack of localization cooperation from the transmitter, not absence of all physical or protocol structure.

NLOS and multipath remain the central technical obstacle. The wideband EFIM result that NLOS contributes zero information when there is no prior channel knowledge is an especially stark benchmark (Shen et al., 2010). Other papers respond by introducing explicit structure for the bias rather than ignoring it: latent reflector orientations in distributed EM (Xu et al., 2014), virtual scatters and direct super-resolution without LoS/NLoS classification (Liu et al., 2019), per-AP NLOS-aware slope parameters in Wi‑Fi ranging (Sie et al., 23 Jun 2025), segmented LOS/NLOS regression on 2D maps (Sun et al., 8 Jan 2025), and a 3GPP-oriented NLOS bias model for TDOA (Dureppagari et al., 26 Feb 2025). This suggests that the field has converged on a negative result and a positive design principle: raw NLOS is destructive, but structured NLOS can be estimated, marginalized, or exploited.

RSS-only localization is attractive because it avoids synchronization and directional hardware, but its limits are well documented. Sparse RSS recovery faces high-coherence sensing matrices and geometry-dependent resolution limits, with detectability tied to $$P_{\mathrm D}(r)=Q\!\left(\sqrt{\frac{TP}{\sigma^2 r^\alpha}},\sqrt{\frac{2\tau}{\sigma^2}}\right),$$6 and the noise tolerance $$P_{\mathrm D}(r)=Q\!\left(\sqrt{\frac{TP}{\sigma^2 r^\alpha}},\sqrt{\frac{2\tau}{\sigma^2}}\right),$$7 (Bryan et al., 2019). Power estimation is typically more sensitive than location estimation to path-loss mismatch (Bryan et al., 2019). In mmWave, uncertain propagation parameters $$P_{\mathrm D}(r)=Q\!\left(\sqrt{\frac{TP}{\sigma^2 r^\alpha}},\sqrt{\frac{2\tau}{\sigma^2}}\right),$$8 and $$P_{\mathrm D}(r)=Q\!\left(\sqrt{\frac{TP}{\sigma^2 r^\alpha}},\sqrt{\frac{2\tau}{\sigma^2}}\right),$$9 can strongly bias inversion unless estimated jointly with source locations (Zandi et al., 2019). Learned RSS methods alleviate some of these issues empirically, but they introduce dependence on training data, label conventions, and deployment match (Bizon et al., 2023, Zhan et al., 2021).

Another open issue is uncertainty representation. Classical bound analyses characterize achievable error but not full posterior shape (Shoari et al., 2013, Shen et al., 2010). Deep posterior models now represent non-Gaussian and multimodal uncertainty directly, but current demonstrations are still restricted to simplified LOS scenarios (Lei et al., 30 Sep 2025). A plausible implication is that future work will increasingly combine joint model estimation, uncertainty-aware inference, and modality-specific physics rather than treating localization as only point regression or only bound analysis.

Finally, the field remains heterogeneous because the sensing modalities are heterogeneous. Binary detectors, RSS mixtures, ACK-based timing, wideband array responses, and coerced cellular uplinks do not share a universal observation model. What they do share is a common estimation structure: infer an emitter’s state from measurements that are informative about the source but not under the source’s control. The literature therefore develops not one canonical non-cooperative transmitter-localization algorithm, but a family of modality-specific inference frameworks with recurring themes—nuisance-parameter absorption, sparse support recovery, joint estimation, distributed consensus, and increasingly explicit uncertainty quantification (Shoari et al., 2013, Bryan et al., 2019, Sie et al., 23 Jun 2025, Dureppagari et al., 26 Feb 2025, Lei et al., 30 Sep 2025).