Listen to this Post
A New Battle Against Automated Surveillance
Surveillance cameras are everywhere, but the most important part of modern surveillance may not be the camera itself. The real power lies in the artificial intelligence watching the footage, identifying people, reading license plates, recognizing vehicles, and deciding which moments deserve attention.
That distinction is at the heart of noRecognition, an experimental research project led by Kansas City cybersecurity researcher Bill Swearingen. After approximately 31 million tests, Swearingen says his system has learned to generate visual patterns capable of confusing certain computer-vision systems.
The idea sounds almost deceptively simple: print patterns, put them in front of cameras, observe what the detection software does, learn from the failures, and repeat the process millions of times.
But underneath that simple experiment is a much larger question.
Can artificial intelligence be trained to defeat the artificial intelligence used to watch us?
Swearingen’s research suggests that the answer may sometimes be yes, although the project is still far from proving that surveillance systems can be reliably defeated in everyday conditions.
The Camera Still Sees You
The most important detail about noRecognition is that it does not make someone physically invisible.
A surveillance camera can continue recording the person, vehicle, clothing, surroundings, and movement normally. The difference occurs later, inside the software responsible for interpreting the image.
Modern surveillance systems increasingly depend on computer vision rather than humans manually watching screens. A system might recognize a license plate, identify a vehicle, detect a person, or flag movement that matches a particular search criterion.
The noRecognition concept attacks that interpretation layer.
Instead of hiding the image from the camera, the pattern attempts to make the algorithm misunderstand what it is seeing.
Turning Surveillance AI Against Itself
This is an important distinction because modern surveillance has evolved far beyond traditional closed-circuit television.
A camera recording footage is relatively passive. An AI-powered surveillance platform can transform that footage into searchable information.
A vehicle can become a license-plate record.
A person can become a tracked object.
A face can become an identity candidate.
A movement can become an alert.
The noRecognition research explores whether carefully engineered visual patterns can disrupt that transformation from raw footage into machine-readable information.
Bill
According to the original report,
As a cybersecurity researcher and co-founder of the SecKC meetup, he became increasingly concerned about the growing presence of surveillance cameras in his community.
One particular concern was the possibility of being tracked while attending a protest.
That concern eventually became a technical research project focused on understanding how computer-vision systems respond to deliberately designed visual patterns.
From Simple Printing Experiments to Machine Learning
The project reportedly began with an unusually straightforward methodology.
Print a pattern.
Put it in front of a camera.
Check whether the detection system recognizes the target.
Change the pattern.
Try again.
Repeat.
The process eventually evolved into a reinforcement-learning system capable of learning from previous failures.
Instead of relying entirely on a human researcher to decide which pattern should be tested next, the system could evaluate results and use those results to guide subsequent experiments.
That transformed a basic visual experiment into an automated optimization problem.
31 Million Experiments Tell a Bigger Story
The reported figure of roughly 31 million tests is one of the most striking aspects of the project.
It demonstrates how much experimentation can now be performed when machine learning is used to automate the trial-and-error process.
A human researcher might be able to evaluate hundreds or thousands of patterns.
A computational system can evaluate vastly more possibilities.
That difference matters because adversarial machine learning often involves searching through enormous combinations of visual features that humans would never think to test manually.
The Goal Is Bigger Than One Detector
The
That goal has not been achieved.
In fact, the
One of its strongest validated results against a detector derived from a real deployed surveillance camera reportedly reached 61.7% non-detection across held-out test subjects.
That is significant.
But it is also nowhere close to 100%.
Why 61.7% Matters, and Why It
A 61.7% non-detection rate should not be interpreted as saying that a person or vehicle becomes invisible to surveillance cameras 61.7% of the time in the real world.
The number comes with important experimental limitations.
Much of the research involves digital or simulated testing environments. Those environments can provide valuable evidence about whether an adversarial pattern works against a particular detection model.
However, the physical world introduces variables that simulations cannot perfectly reproduce.
Lighting changes.
Camera angles change.
Objects move.
Fabric folds.
Rain changes reflections.
Surfaces curve.
Cameras differ in quality.
Compression artifacts alter images.
All of these factors can change the outcome.
Simulation Is Not the Same as Reality
This may be the most important caveat in the entire story.
A pattern that defeats a virtual camera under controlled conditions is not automatically a reliable privacy tool.
The real challenge is something researchers in adversarial computer vision have struggled with for years: physical-world robustness.
An attack that works on a carefully positioned image may fail when the object moves several feet away.
A pattern that works under laboratory lighting may behave differently at night.
A design that works perfectly on a flat surface may fail when printed on fabric.
This is why the physical DEF CON experiment attracted so much attention.
The DEF CON Reality Check
At DEF CON in Las Vegas, Swearingen reportedly conducted a real-world test with help from Donut Media.
The experiment involved covering a 2009 Toyota Yaris with one of the project’s newer patterns and testing the vehicle against a Flock Safety camera.
This represented a major step beyond simulation.
Instead of asking whether a mathematical or digital representation could confuse a detector, the experiment asked whether a physical vehicle covered in a physical pattern could produce a similar result.
Swearingen said the demonstration proved effective.
But there was an immediate complication.
The Wheels Became the Weak Point
The
That detail may sound minor, but it highlights one of the fundamental problems with physical adversarial patterns.
A flat printed design can behave predictably on a relatively flat vehicle panel.
A wheel is different.
It has curves, shadows, movement, changing angles, reflections, and a completely different visual structure.
The failure demonstrates why defeating computer vision in a controlled environment is easier than defeating it across an entire moving object.
Why Physical-World Attacks Are So Difficult
A digital image has predictable dimensions.
Reality does not.
A person wearing a shirt moves.
A hoodie wrinkles.
A car changes direction.
A vehicle becomes partially hidden behind another vehicle.
Sunlight creates glare.
Headlights introduce bright areas.
Rain changes surface appearance.
A surveillance camera may be mounted several meters above the road.
A second camera may view exactly the same object from another angle.
Every one of these variables creates another opportunity for the detection system to recover.
The Arms Race Between AI and Anti-AI
The noRecognition project illustrates a larger technological arms race.
Surveillance companies are using increasingly sophisticated AI to improve detection.
Researchers are simultaneously studying ways to confuse those systems.
Then surveillance developers can update their models.
Researchers can develop new patterns.
Manufacturers can add additional detection techniques.
Researchers can adapt again.
The result is an ongoing contest between systems designed to recognize patterns and systems designed to disrupt recognition.
Why Swearingen Is Not Publishing His Best Patterns
Interestingly, Swearingen reportedly does not intend to publish his strongest patterns openly.
There is a strategic reason for that decision.
If the most effective designs were publicly released, camera and computer-vision vendors could potentially use them as training examples and specifically harden their systems against those patterns.
That could turn a successful research result into a short-lived exploit.
Instead, the project is reportedly exploring crowdfunding and commercial products such as printed T-shirts and hoodies.
Vehicle wraps could potentially follow later.
Privacy Tool or DEF CON Experiment?
That question remains unanswered.
It is easy to imagine the appeal of clothing designed to reduce automated recognition.
But practical privacy technology has to work outside a conference demonstration.
It needs to survive different cameras.
It needs to work at different distances.
It needs to function under different lighting.
It needs to tolerate movement.
It needs to remain effective after washing and repeated use.
And most importantly, it needs to perform consistently against detection models that its creators did not specifically optimize against.
Those are extremely difficult requirements.
The Bigger Privacy Debate
The significance of noRecognition extends beyond one researcher or one surveillance-camera company.
Across the world, governments, businesses, residential communities, transportation systems, and private organizations increasingly use cameras equipped with automated analysis.
The public conversation often focuses on whether cameras should exist.
But the more complicated question is what happens after the footage is collected.
A camera recording a street is one thing.
A system capable of automatically identifying vehicles, searching historical footage, and linking observations together is something considerably more powerful.
Surveillance Is Becoming Searchable
Traditional CCTV produced enormous quantities of footage that humans could only review selectively.
AI changes the economics.
Instead of asking an employee to watch ten thousand hours of footage, an organization can allow software to search for specific characteristics.
That makes surveillance considerably more scalable.
The consequence is that computer vision is not simply improving cameras.
It is changing what surveillance means.
The NoRecognition Approach Exposes a Fundamental Weakness
Machine learning systems are extremely powerful, but they do not see the world exactly as humans do.
They process numerical representations of visual information.
Small changes that appear insignificant to a person can sometimes have disproportionately large effects on a machine-learning model.
This is one of the central concepts behind adversarial examples.
A person might look at an image and see an ordinary object.
A computer-vision model may interpret the same image completely differently after carefully chosen visual modifications.
This Is Not Magic
The research should not be described as a magical invisibility cloak.
That would oversell the evidence.
The patterns do not erase a person from recorded video.
They do not guarantee that every camera will fail.
They do not necessarily defeat facial recognition, license-plate recognition, object detection, and tracking simultaneously.
And they do not eliminate the possibility that a human reviewing footage could still recognize what happened.
The technology is better understood as an attempt to interfere with automated interpretation.
The Security Implications Go Both Ways
There is also an uncomfortable irony here.
The same research that can help people understand surveillance weaknesses can also teach surveillance developers how to build stronger systems.
If researchers discover which visual characteristics cause detection failures, vendors can potentially use that knowledge to improve robustness.
That makes adversarial research valuable even when the original attack is not commercially practical.
It exposes weaknesses before attackers or researchers encounter them under less controlled circumstances.
Deep Analysis
Understanding the Detection Pipeline
A modern computer-vision surveillance system can be thought of as a pipeline.
First, a camera captures an image.
Second, the system preprocesses the frame.
Third, a detection model searches for relevant objects.
Fourth, classification or recognition systems interpret those objects.
Finally, software may store, correlate, or alert on the result.
NoRecognition primarily targets the machine-learning interpretation stage rather than the physical camera.
A Safe Simulation Model
For researchers studying the concept defensively, the basic workflow can be represented without interacting with real surveillance systems.
mkdir adversarial-vision-lab cd adversarial-vision-lab
python3 -m venv .venv source .venv/bin/activate
python -m pip install --upgrade pip pip install numpy pillow matplotlib
The environment can then be used to study how small image transformations affect a local, offline model or synthetic dataset.
Inspecting Image Metadata
A simple defensive experiment can begin by inspecting an image rather than attacking a live camera.
Run from PIL import Image
img = Image.open("sample.jpg")
print("Size:", img.size)
print("Mode:", img.mode)
This allows researchers to understand the dimensions and color representation of the test image before performing controlled experiments.
Testing Controlled Transformations
Researchers can also evaluate how image transformations affect their own models.
Run from PIL import Image, ImageEnhance
img = Image.open("sample.jpg")
modified = ImageEnhance.Contrast(img).enhance(0.8)
modified.save("controlled-test.jpg")
The purpose of an experiment like this is not to evade a real surveillance network, but to measure how robust a computer-vision system is against ordinary visual variation.
Building a Defensive Robustness Test
A more useful security exercise is to evaluate a model against transformations such as:
brightness changes
contrast changes
rotation
scaling
compression
blur
partial occlusion
perspective changes
The goal is to determine whether the model remains reliable when images stop looking exactly like its training data.
Measuring Detection Performance
A simple research workflow can record:
Total test images
Correct detections
Missed detections
False detections
Confidence scores
Transformation applied
Model version
This produces a reproducible dataset that can help determine whether a model has unexpected weaknesses.
Why Reproducibility Matters
The 31 million reported tests are interesting partly because large-scale experimentation makes it possible to search through an enormous design space.
But raw experiment counts do not automatically prove real-world effectiveness.
Researchers must also document:
training data
test data
held-out subjects
camera characteristics
lighting conditions
model architecture
evaluation methodology
physical-world conditions
Without those details, a percentage can easily be misunderstood.
The Importance of Held-Out Testing
Testing a pattern against the same images used during optimization can produce misleadingly strong results.
A stronger experiment uses held-out subjects or images.
The model never sees those examples during optimization.
The final evaluation then provides a better indication of whether the discovered behavior generalizes.
That is why the reported 61.7% figure deserves attention, but also careful interpretation.
Physical Robustness Is the Real Challenge
The DEF CON demonstration highlights the difference between computational success and physical success.
A physical test should ideally evaluate:
different distances
different camera angles
daylight
nighttime
artificial lighting
motion
weather
different cameras
different backgrounds
partial visibility
Only then can researchers determine whether a visual pattern survives the complexity of real environments.
Why Multiple Detectors Matter
A pattern optimized against one model may fail against another.
Different systems may use different:
model architectures
training datasets
image preprocessing
confidence thresholds
object classes
tracking methods
camera hardware
A pattern that confuses one detector therefore should not automatically be described as a universal surveillance defense.
The Cat-and-Mouse Problem
This is where the research becomes particularly interesting.
Suppose an adversarial pattern works against
Tomorrow, the manufacturer updates the model.
The pattern may stop working.
Researchers then adapt.
The manufacturer adapts again.
That creates an iterative security cycle remarkably similar to malware detection, spam filtering, and intrusion prevention.
Defensive Lessons for Camera Operators
Organizations deploying computer-vision systems should assume that adversarial inputs are possible.
Defenders can improve resilience through:
adversarial training
data augmentation
multi-angle cameras
temporal consistency checks
cross-camera correlation
human verification
model diversity
confidence thresholds
No individual technique guarantees protection.
The strongest defense is usually layered detection.
Why Multiple Signals Are Stronger Than One
A surveillance system that relies entirely on one frame is inherently more fragile than one that considers a sequence of observations.
If a model fails to identify a vehicle in one frame but correctly identifies it in the next twenty frames, the system can potentially recover.
Temporal information therefore becomes an important defensive mechanism.
The Role of Human Review
Automation is powerful, but high-impact decisions should not necessarily depend on a single machine prediction.
A robust architecture can flag uncertainty and request human verification.
That is particularly important when surveillance systems are used in situations where an incorrect identification could have serious consequences.
Privacy Researchers Have a Different Objective
From the privacy perspective, however, the research asks a different question.
If society increasingly accepts automated surveillance, should individuals have any practical way to resist automated identification?
There is no universally accepted answer.
Some people will view adversarial clothing as a legitimate privacy technology.
Others will argue that deliberately interfering with surveillance systems creates security and accountability problems.
That tension is unlikely to disappear.
What Undercode Say:
1. The Real Innovation Is the Method
The most interesting part of noRecognition may not be the printed pattern itself.
It is the automated process used to discover the pattern.
2. Millions of Experiments Change Research
Thirty-one million experiments demonstrate how machine learning can transform visual-security research from manual trial and error into large-scale optimization.
3. The 61.7% Figure Needs Context
A 61.7% non-detection result is meaningful, but it should never be presented as universal invisibility.
4. Simulation Results Have Limits
Virtual experiments are valuable for discovering weaknesses, but physical environments introduce variables that simulations cannot perfectly reproduce.
- DEF CON Was the More Interesting Test
The physical Toyota Yaris experiment is arguably more important than millions of simulated tests because it introduces real-world complexity.
6. The Wheels Reveal the Problem
The difficulty with the wheels demonstrates why covering an entire moving object is much harder than optimizing a flat digital image.
7. Surveillance AI Is Becoming Infrastructure
Automated recognition is no longer a niche technology. It is becoming part of transportation, security, retail, residential, and public surveillance systems.
8. Computer Vision Has an Attack Surface
Every machine-learning model has assumptions about the world.
Those assumptions can sometimes become weaknesses.
9. More Training Does Not Guarantee Perfection
A model trained on enormous datasets can still behave unexpectedly when presented with unusual inputs.
10. Universal Evasion Is Extremely Difficult
Defeating one detector is one challenge.
Defeating every detector from every manufacturer is an entirely different problem.
11. Camera Diversity Is a Major Defense
A pattern optimized for one camera can encounter completely different processing on another.
12. Distance Changes Everything
The visual appearance of a pattern changes dramatically as an object becomes smaller inside a camera frame.
13. Motion Creates Another Layer of Complexity
A moving vehicle introduces blur, changing perspective, and rapidly changing visual information.
14. Weather Matters
Rain, snow, fog, and sunlight can alter how printed patterns appear to computer vision.
15. Fabric Is Harder Than Paper
Clothing bends, folds, stretches, and changes shape.
A pattern therefore cannot always maintain the same geometry.
16. Privacy Technology Will Become More Sophisticated
As automated surveillance expands, researchers will likely continue exploring technical methods for preserving anonymity.
17. Surveillance Vendors Will Adapt
The existence of adversarial research gives manufacturers another reason to strengthen their models.
18. This Creates an AI Arms Race
One side develops better recognition.
The other develops better disruption.
Both sides then improve again.
- Defensive AI Research Benefits From Offensive Research
Understanding how recognition systems fail can help developers design systems that fail less often.
- The Same Research Can Serve Opposite Goals
Privacy advocates may see these techniques as protection.
Security operators may see them as an attack surface.
Researchers may see them primarily as a laboratory for understanding machine learning.
21. The Human Eye Still Matters
Even if an automated detector misses an object, a human watching the footage may still see it.
That limits the meaning of non-detection.
22. Detection Is Not Identification
A system failing to recognize an object does not necessarily mean that all surveillance capabilities have failed.
Other cameras and other algorithms may still provide useful information.
23. Tracking Can Recover From Individual Failures
Modern systems can use multiple frames and cameras rather than relying on one isolated prediction.
24. One Pattern May Not Be Enough
A universal pattern must survive different environments and detection technologies.
That is a much higher technical standard.
25. The Research Dashboard Matters
Transparent reporting is valuable because it helps separate validated results from ambitious future objectives.
26. Experimental Honesty Builds Credibility
Admitting that a project has not achieved its ultimate goal makes the demonstrated results more credible.
27. The Commercial Question Is Still Open
A DEF CON demonstration does not automatically translate into a successful consumer product.
28. Consumers Need Reliability
People will not reasonably depend on privacy clothing if its performance changes dramatically from one camera to another.
29. Manufacturers Could Eventually Detect the Patterns
Once known patterns become widespread, models can potentially be trained to recognize them.
- The Research Could Become a Moving Target
Every successful pattern may have a limited lifespan once detection vendors understand it.
31. Regulation May Become More Important
As automated surveillance expands, governments may eventually need clearer rules governing where and how recognition systems can be deployed.
32. Technical Privacy Is Only One Piece
Encryption, data-retention rules, transparency, access controls, and legal protections can all matter more than an individual visual pattern.
33. Surveillance Creates Asymmetric Power
Organizations can potentially collect and process information about thousands or millions of people simultaneously.
That makes privacy-preserving research particularly important.
- AI Is Changing the Meaning of a Camera
A camera used to record.
An AI-powered camera can interpret.
That distinction is fundamental.
35. Recognition Systems Need Adversarial Testing
Manufacturers should test their models against unusual and deliberately difficult visual inputs before deploying them at scale.
36. Accuracy Percentages Need Conditions
Every percentage should be accompanied by information about the camera, environment, dataset, and testing methodology.
37. Real-World Validation Should Be the Standard
Laboratory results should eventually be followed by controlled physical experiments.
38. The Future Will Be More Competitive
As computer vision becomes more capable, adversarial machine-learning research will almost certainly become more sophisticated as well.
- The Biggest Lesson Is Not “Become Invisible”
The deeper lesson is that AI perception is not infallible.
Machines can be extraordinarily capable while still having unexpected weaknesses.
- The Surveillance Debate Has Entered a New Era
The future argument may no longer be simply about whether cameras should watch us.
It may also be about whether people should have meaningful technical and legal control over how machines interpret what those cameras see.
✅ Bill Swearingen and the noRecognition Project
The supplied article identifies Bill Swearingen as the Kansas City-based researcher behind noRecognition and describes the project as an effort to interfere with automated visual recognition rather than physically conceal the camera’s view.
✅ The Research Uses Large-Scale Automated Testing
The
✅ The Project Has Not Achieved Universal Detection Evasion
The article itself makes clear that the stated objective of defeating every detector remains incomplete. The reported 61.7% non-detection result should therefore be treated as an experimental result, not proof of universal invisibility.
⚠️ Simulation and Physical Testing Are Different
A major qualification is necessary: many of the reported results are digital or simulated. The DEF CON vehicle demonstration provides physical-world evidence, but one demonstration cannot establish reliable performance across all surveillance cameras, environments, and conditions.
⚠️ The Technology Does Not Make People or Vehicles Invisible
The patterns target automated interpretation. Cameras can still record the underlying scene, and other detection or human-review methods may still identify what is present.
Prediction
(+1) Adversarial Surveillance Research Will Grow
As computer vision becomes more deeply integrated into public and private surveillance, researchers will increasingly test how easily these systems can be manipulated, confused, or bypassed.
(+1) Camera Manufacturers Will Invest More in Adversarial Robustness
Research such as noRecognition will likely encourage surveillance vendors to strengthen their models against unusual visual patterns and physical adversarial examples.
(+1) Privacy-Preserving Clothing Will Become More Experimental
Printed patterns, reflective materials, wearable designs, and other visual privacy concepts are likely to receive greater attention as automated recognition becomes more common.
(+1) Physical-World Testing Will Become More Important
Future research will increasingly move beyond digital benchmarks and test models under realistic conditions involving movement, different cameras, changing weather, distance, and lighting.
(-1) Universal Anti-Surveillance Patterns Are Unlikely to Be Reliable
A single pattern that consistently defeats every camera, recognition model, viewing angle, and environmental condition is an extremely difficult goal.
(-1) Individual Patterns May Have Short Lifespans
If an effective design becomes widely known, surveillance vendors could potentially train their systems to recognize or compensate for it.
(+1) The Bigger Impact May Be Defensive
The most lasting contribution of projects like noRecognition may ultimately be helping researchers understand the weaknesses of computer vision so that future surveillance and security systems become more robust, transparent, and accountable.
(+1) The Real Debate Will Move Beyond Cameras
The long-term issue will increasingly concern not only who operates surveillance cameras, but also how AI interprets the information those cameras collect, how long that information is retained, and what rights individuals have over automated identification.
▶️ Related Video (74% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
