  With the emerging environment-aware applications, ubiquitous sensing is
expected to play a key role in future networks. In this paper, we study a
3-dimensional (3D) multi-target localization system where multiple intelligent
reflecting surfaces (IRSs) are applied to create virtual line-of-sight (LoS)
links that bypass the base station (BS) and targets. To fully unveil the
fundamental limit of IRS for sensing, we first study a single-target-single-IRS
case and propose a novel \textit{two-stage localization protocol} by
controlling the on/off state of IRS. To be specific, in the IRS-off stage, we
derive the Cram\'{e}r-Rao bound (CRB) of the azimuth/elevation
direction-of-arrival (DoA) of the BS-target link and design a DoA estimator
based on the MUSIC algorithm. In the IRS-on stage, the CRB of the
azimuth/elevation DoA of the IRS-target link is derived and a simple DoA
estimator based on the on-grid IRS beam scanning method is proposed.
Particularly, the impact of echo signals reflected by IRS from different paths
on sensing performance is analyzed. Moreover, we prove that the single-beam of
the IRS is not capable of sensing, but it can be achieved with
\textit{multi-beam}. Based on the two obtained DoAs, the 3D single-target
location is constructed. We then extend to the multi-target-multi-IRS case and
propose an \textit{IRS-adaptive sensing protocol} by controlling the on/off
state of multiple IRSs, and a multi-target localization algorithm is developed.
Simulation results demonstrate the effectiveness of our scheme and show that
sub-meter-level positioning accuracy can be achieved.
