NoRecognition Clothing Uses AI-Generated Patterns to Evade Facial Recognition and Surveillance Cameras

Could a Shirt Fool Facial Recognition? The Answer Is Complicated - CNET

With more than a decade of experience, Nelson covers Apple and Google and writes about iPhone and Android features, privacy and security settings, and more. Read full bio A camera and its software labeled Bill Swearingen as a person. Then it suddenly wasn't sure -- all because of some weird pattern that he held up to disguise himself. I watched it happen from my seat at annual hacker convention Defcon. Swearingen, a longtime cybersecurity professional and founder of the Kansas City security community SecKC, stood onstage in front of a live camera feed as a person-detection system analyzed him. On the giant screen behind him, the software's confidence score cleared 0.75, the threshold it needed to declare that, yes, there was a human being in the frame. Then Swearingen raised a flat panel covered in a bizarre black-and-white pattern. The score started falling. It slipped below the threshold, eventually landing at 0.21. "No person detected," the screen announced in bright green letters. It felt like a low-budget magic trick. Swearingen was still standing there, plainly visible to everyone in the room. The software was still receiving the camera image, but it no longer detected a person above the configured confidence threshold. Swearingen has spent the past year searching for patterns that can confuse the computer-vision systems used to identify people. His project is called noRecognition, and its end goal is to create clothing that makes the wearer harder for AI surveillance systems to detect. It's a fascinating project, but it's still a work in progress. The camera wasn't trying to identify him We tend to call this kind of technology "facial recognition," but surveillance systems can involve several separate layers of AI-based detection. A person detector asks whether a human body is in the frame. A face detector finds and isolates a face. Facial recognition then compares that face with a database and asks whether it knows who the person is. The demonstration I saw targeted the first step. The system didn't mistake Swearingen for somebody else or decide the room was empty. It simply stopped reporting a person detection above the threshold set for the demonstration. If you break the first link, the rest of the surveillance chain may never get started. If a camera fails to detect a person, it may never crop out that person's face, send it to an identity database, then track them across a series of images. An AI detector doesn't "see" a person in the way we do. It generates thousands of guesses about what might be in an image, assigns a score to them and discards anything that fails to clear a chosen confidence threshold. Swearingen was still there. The detector's math just wasn't sure he was a person. How the patterns are made Swearingen didn't sit down and draw the patterns himself. He built a program to create them. Security researchers normally use programs called fuzzers to bombard software with strange inputs in an attempt to break it. Swearingen's fuzzer does something similar with computer vision. It creates a pattern, digitally places it on an image of a computer-generated person and then shows the altered image to several AI models. If a pattern causes a major change, like making the person's detection box disappear or sharply lowering the model's confidence score, then the fuzzer flags it for more testing. The most successful designs are altered and combined to produce new patterns, much like selectively breeding specific traits in animals. Swearingen's software repeats that process automatically, allowing it to work through far more possibilities than a person could design and test by hand. He currently tests each pattern against 11 models: five that detect people, four that find faces and two that try to recognize whose face it is. In many cases, he tested a public model that works similarly to proprietary systems, not the actual software being used by companies in the wild. Most are publicly available models that researchers can run themselves. Swearingen said the project had run 31.7 million tests as of June. About 534,600 triggered one of his system's anomaly rules. That could mean a detector found fewer people or faces than it did in the original image, invented extra ones, produced a much lower confidence score or returned the wrong identity. It doesn't mean he found 534,600 patterns that could hide someone from a camera. Of those results, 85 met the project's definition of "extreme," which means the pattern defeated at least one person detector and at least one face detector in the same test. The tests also showed that covering more of the body isn't always more effective. Torso patterns had the greatest effect on person detectors, while patterns closer to the head mattered more to systems looking for faces. In one comparison, Swearingen said a small collar pattern worked better than a much larger print across the torso. Even the winning patterns can lose Some of Swearingen's results looked promising until he tested the designs on different people. One pattern lowered the detector's confidence for all four people whose images were used while it was being developed. But when Swearingen applied that same design to images of eight new people, it didn't work once. Counted together, the pattern had worked on four of 12 people. Swearingen withdrew the resulting 33% performance claim because every success involved people whose images had been used to develop the pattern. It hadn't worked on anyone new. Another pattern, designed to fool a different detector, worked on all eight new people. That contrast shows how much the results can change between detectors -- what works with one person or detection model may fail with another. Even a successful pattern may have a short shelf life. A camera company could retrain its software to recognize it. Swearingen compared the patterns to software "zero-days" vulnerabilities -- they take advantage of a weakness that may disappear once the system is updated. The shirt doesn't exist yet, and the tech isn't field-tested On one of Swearingen's slides, in large type, were the words "Still unproven: The worn garment." During the demo, Swearingen held the pattern in front of his body on a rigid panel. It wasn't printed on clothing, which would be a much harder test. Ink on a flat board stays exactly where the software expects it to be. Fabric drapes, folds and stretches. Sunlight, shadows, wrinkles, viewing angles and distance all change what reaches the camera. Swearingen said most of his 31.7 million tests were digital, with patterns pasted onto images and scored by computer-vision models. The panel demonstration was a limited physical test using a model he said came from a fielded Flock Safety unit. Until a pattern works while printed on fabric, worn by a moving person and viewed through deployed hardware, he isn't claiming that the clothing itself works. The noRecognition website is promoting a Kickstarter-backed run of T-shirts, hoodies and neckwear, with each pattern scored against 11 models before it ships. Swearingen said the money would help pay for test fabrics, a dye-sublimation printer and additional cameras so he can see whether the patterns still work once they're printed and worn. So could a pattern on your clothing fool facial recognition? Maybe. But the real test begins when he prints it on clothing and steps back in front of the camera.

The AI-Generated Pattern Hides You From Surveillance Cameras -- Including Flock

The first public test came Friday at Def Con in Las Vegas: a 2009 Toyota Yaris wrapped in the pattern, driven past a Flock camera. Bill Swearingen spent the past year running one experiment over and over from his home in Kansas City, where he co-founded the SecKC security meetup. About 31 million tests later, he says he can produce patterns on demand that hide whatever they cover from the detection software wired into Flock cameras -- the controversial surveillance system being rolled out across America. He showed it in public for the first time Friday at Def Con, working with the YouTube channel Donut Media to cover a 2009 Toyota Yaris in one of his newest patterns and roll it past a Flock camera. "We proved it was effective," Swearingen told TechCrunch, though he said the wheels were a challenge. Donut Media said video of the demo lands in the next few weeks. The pattern doesn't blind the camera. Footage still records normally, and a human watching the screen sees a car. What breaks is the layer on top -- the object-detection model that decides "that's a vehicle, that's a plate, log it." So basically, feed an AI detector with enough visual noise engineered against its own math and it logs nothing. The car goes back to being a needle in a haystack. That's adversarial machine learning, and it works because computer vision doesn't see what you see. A wrap that reads as loud graphic design to a person can read as nothing at all to a classifier. Swearingen built it with a reinforcement learning model that grades its own homework. Pattern gets detected, model adjusts, tries again -- what he described as teaching the model "how to paint." It now spits out fresh patterns every minute, and he's keeping the strongest ones offline so camera vendors can't train against them. "Privacy is a fundamental right," he said, calling the patterns a way for people to "opt out of being tracked." He said the idea took hold last year when he wanted to attend a protest and worried about the cameras logging everyone who showed up. The long tail of hiding from machines People have been improvising against detection systems for years, usually with hardware store solutions. San Francisco activists put traffic cones on the hoods of Waymo and Cruise robotaxis to freeze them in place, an exploit that needed no code at all. During last year's Los Angeles immigration raids, protesters went further and torched several Waymos. Masks, hoods, and brimmed caps remain the default on protest lines. Adversarial clothing labels have been selling face-confusing prints for years, and anti-recognition eyeglasses have arrived with thin evidence they do much. What separates Swearingen's project, which he calls noRecognition, is the target list. Swearingen tested against the specific stacks in wide deployment, and Flock is the one drawing heat. The company is facing a growing backlash on Capitol Hill, and internal documents show it pitched a plan to turn 350,000 Uber and Lyft dashcams into a rolling plate-scanning fleet. Automated readers have already pulled over innocent drivers at gunpoint over bad matches, and immigrants and protesters keep getting swept into ICE's AI dragnet. Lawmakers are pressing Meta over facial recognition in its smart glasses on a parallel track, so any legal measure to fight against automatic detection technology is being studied by privacy enthusiasts. Swearingen's noRecognition project is running a crowdfunding campaign to fund early merchandise -- T-shirts and hoodies now, vehicle skins later. Swearingen said the goal is resolution high enough to work at a distance and design good enough that people will actually wear it. Driving a wrapped car on public roads is its own legal question, and plate obstruction statutes vary by state. The patterns cover bodywork, not plates. "Every failure improves my model, and so [the patterns] keep getting better and better," Swearingen said.

AI security cameras are everywhere. Can these garments scramble them all?

A former chief intelligence officer has turned fashion designer with one specific goal: creating a universal adversarial camouflage. The rise of public surveillance has also led to the rise of an adversarial counterpart: fashion designed to confuse AI security cameras. It's designed to baffle the senses of Axon body cams, Flock cameras, and other tools of mass surveillance through tricks like patterns that AI sensors confuse for animals, objects, or reflective fabric. A new limited-edition, crowdfunded clothing brand promises garments with patterns good enough to scramble 11 computer vision models. It's called noRecognition. Bill Swearingen, a former chief intelligence officer and founder of the monthly Kansas City security meetup SecKC, created noRecognition after running 31.7 million digital tests to determine what kinds of patterns confuse multiple models at once, with the goal of creating a universal adversarial camouflage. He used AI throughout the process, including building and training a model, using that model to generate and test adversarial pattern geometry, and determining which patterns work best. For Swearingen, the challenge is that a pattern that beats one model often won't beat several different ones. "I have beat every model I have tested, so beating a single model is a solved problem for me," he says. "The search now is finding that one pattern that works across many models at once." He unveiled noRecognition publicly at the Def Con cybersecurity conference in Las Vegas on August 7. A Kickstarter campaign he launched the same week to raise $5,000 has now raised more than $40,000. The money will go to fabric, cameras, and compute, says Swearingen, who calls the generosity and response "humbling." The limited-edition clothing line includes a buff that can be worn as a neck gaiter, a T-shirt, and a sweatshirt, plus stickers and patches. There's a 50-item run of each, and each will have a pattern generated for a single person. Swearingen's website shows examples of some of the patterns the noRecognition model generates, but its strongest work stays off the internet. By keeping the most effective patterns off the site, noRecognition prevents surveillance camera operators from training their models on what it produces.