Adversarial Patterns Turn Clothes and Cars Invisible to Street Cameras

Bill Swearingen ran more than 31 million tests to generate patterns that stop common surveillance cameras from detecting the people or vehicles they cover. At Def Con in Las Vegas he wrapped a 2009 Toyota Yaris in one of those patterns and proved it defeated a Flock license-plate reader in the real world.

The cameras still record video. The patterns simply scramble the detection algorithms so no alert fires and the covered object drops out of automated search. Swearingen calls the project noRecognition project clothing and research.

That distinction matters. Recording continues without interruption. What fails is the automated handoff that turns raw footage into searchable hits, plate alerts and identity matches. The covered person or car remains on disk yet falls out of the pipelines that make mass review practical.

How the Patterns Scramble Camera Detection

Modern street cameras no longer just record. They run object and person detectors that flag license plates, bodies and faces for later search. Swearingen attacks the early detection step itself.

He extracted or reconstructed 11 production models, including software behind Flock readers, Axon body cameras and Clearview AI systems. A reinforcement-learning setup then painted candidate patterns, scored them, and kept only the winners. Failures improved the model. The result is high-frequency geometric noise that drops model confidence below the detection threshold.

• 31.7 million tests completed
• 11 production detectors scored
• 5.7 million labeled results
• 61.7% non-detection on the real extracted f-YOLOv5 person detector (digital, held-out, all-garment)

Those banked figures come from controlled digital simulations with occlusion-subtracted controls. Physical fabric and live cameras are the next validation layer. The strongest patterns stay offline so vendors cannot train against them immediately.

The loop works because each failed candidate still supplies a useful gradient. The model learns which edge disruptions cut confidence fastest and which texture frequencies survive scaling, rotation and partial cover. Over millions of rounds the noise converges on shapes that human eyes read as abstract print while the detector stack reads as statistical static.

Held-out testing keeps the scores honest. Patterns that only worked on training images are discarded. What remains has already been checked against garments and wearers the model never saw during generation.

The Def Con Car That Vanished From Flock

On Friday at Def Con, Swearingen and Donut Media covered a 2009 Toyota Yaris with a fresh pattern. A Flock camera failed to detect the vehicle. Wheels proved the hardest surface to cover cleanly. Video of the test is expected in coming weeks.

Privacy is a fundamental right.

Swearingen told TechCrunch he wants people to be able to “opt-out of being tracked.” He lives in Kansas City, co-founded the SecKC meetup, and started the work after feeling uneasy about cameras at a protest. As a middle-aged white man in the Midwest he said he has not personally faced discrimination, yet the cameras made free expression feel unsafe.

The Yaris demo moved the project from lab metrics to street conditions. Lighting, motion, distance and real Flock hardware all arrived at once. Wheels remained the weak point because curved metal and constant rotation fight clean pattern alignment. Even so, the body wrap was enough for the reader to miss the car.

That single miss is the point of the exercise. Automated plate systems thrived on the assumption that every passing vehicle would be readable. A pattern that breaks the assumption at the detection layer removes the car from the alert stream without touching the camera firmware.

A Year Teaching a Model How to Paint

Swearingen began with open-source detectors and incremental defeats. Community hardware donations let him scale compute. The system evolved into a closed reinforcement loop that generates a new batch of stronger patterns every minute.

He tested geometric noise after printed faces and text failed to deliver wearable results. The patterns work because detectors rely on quick stacks of edge and texture filters; small high-frequency changes push the person-or-not decision across the line humans barely notice.

A single universal tile that beats all eleven at once remains open. Full details sit on the project’s banked digital non-detection rates page.

Early face and text prints looked promising on screen yet collapsed once fabric stretched, folded or washed. Geometric noise survived those deformations better because the attack targets filter banks rather than semantic shapes. The model no longer needs a recognizable face or slogan; it only needs to keep local statistics outside the detector’s comfort zone.

Community hardware turned a laptop experiment into a minute-by-minute generator. Each new batch inherits the failures of the last. Over a year the win rate on held-out detectors climbed from occasional hits to the banked percentages now published.

Who Already Wants the Opt-Out

Early interest clusters around people who never consented to constant algorithmic tracking.

• Protest attendees who fear later identification from street cameras
• Drivers tired of Flock-style plate readers feeding shared databases
• Privacy-focused buyers who want everyday tees and hoodies that still look like fashion
• Vehicle owners interested in full wraps once skins become available

On X, reaction mixed technical curiosity with political framing. One widely seen post warned of government pushback while celebrating the chance to “disappear from automated tracking systems.” Others joked that 1980s patterns had suddenly become practical defense gear. The crowd treats the clothing as a concrete lever against systems that arrived without an off switch, the same systems that also power AI assistants that remember personal details.

The demand map is practical rather than abstract. Protest goers want to leave a march without feeding a searchable archive. Drivers want plate readers to stop adding their routes to shared pools. Everyday buyers simply want a shirt that looks ordinary while dropping them from person-detection indexes. Vehicle wraps extend the same logic to the objects that Flock-style networks were built to harvest.

From Face Paint Experiments to Wearable Prints

Efforts to confuse cameras predate deep learning. Adam Harvey’s CV Dazzle camouflage technique from 2010 used bold makeup and hair to break early Viola-Jones face detectors. Later art projects and brands printed faces or noise on garments with mixed real-world results. Eyeglass makers tried similar claims. Swearingen’s advance is the closed training loop scored against actual production weights, plus the public Def Con vehicle proof.

Guardian reporting this summer noted a broader fashion wave of adversarial prints. Most prior lines published no hard test numbers. noRecognition scores every pattern against a same-size solid control and held-out wearers before shipping.

The comparison is straightforward. Earlier work often stopped at visual novelty or lab demos against outdated detectors. noRecognition publishes non-detection rates, keeps strongest tiles offline, and has already shown a live Flock miss on a wrapped car. That combination of measured digital scores and a public physical proof sets the project apart from the wider fashion wave.

Why the Strongest Patterns Stay Offline

Leaving top performers unpublished is a deliberate counter to the next move vendors will make. Once a pattern is public, the same weights that lost to it can be fine-tuned until the noise no longer drops confidence. Keeping the best tiles private slows that arms race.

The reinforcement loop already produces a fresh batch every minute. Offline storage simply means the highest-scoring outputs never enter the public set that vendors could scrape. Buyers of capped one-of-one patterns receive designs generated for them alone and never released again. Everyday tiers use strong but not maximal patterns so the absolute best material remains in reserve.

Camera vendors will eventually retrain. Continuous generation is the project’s answer. Each new failure, whether from a digital hold-out or a future physical test, feeds the model and yields another unreleased candidate. The offline vault is how that cycle stays ahead of the patch cycle.

How Coverage Limits Shape the Results

The banked scores already show that surface area and geometry decide how far a pattern can go. Thin coverings hit a ceiling on the P4 / ResNet34-SSD family even when the wide-footprint version reached 62.5 percent. Torso-only tees were the hardest everyday garment to validate because they leave arms, legs and head exposed to the same detectors.

Wheels on the Yaris exposed the same constraint in metal and motion. Flat or gently curved body panels took the print cleanly. Rotating rims did not. Hoodies improve the odds by adding sleeve and torso real estate; buffs add another small high-value zone near the face. Full vehicle wraps aim for the opposite extreme: maximize printed area so the detector has fewer clean edges left to lock onto.

• Wide tiles beat thin coverings on the same detector family
• All-garment digital tests outscore partial-torso layouts
• Face-model non-detection reached 86 percent when the pattern could occupy the full frame region
• Wheels remain the open physical gap after the Def Con run

Those limits are why the roadmap lists optical materials such as retroreflective or lenticular fabrics. Changing how light returns to the lens offers another route past coverage ceilings that pure ink on cloth cannot clear.

Limited Garments and the Next Print Run

The crowdfunding campaign for the patterned garments has already raised more than $31,000 against a $5,000 goal from 205 backers. It runs until early September. Tiers include everyday tees (torso coverage tested hardest), hoodies for maximum print area, buffs, and capped “one of one” patterns generated for a single buyer and never released again.

1. 2025 Proof-of-concept lab begins defeating open-source detectors one by one
2. Early 2026 Reinforcement model online; community hardware scales tests past tens of millions
3. June-July 2026 f-YOLOv5 extracted and banked at 61.7%; P4 wall broken on wide tiles
4. 6 August 2026 Black Hat briefing
5. 8 August 2026 Def Con vehicle demo succeeds against Flock
6. Now Kickstarter live; strongest patterns remain offline

Swearingen keeps iterating. Every new failure feeds the model. Optical materials such as retroreflective or lenticular fabrics sit on the roadmap for further gains. Camera vendors will eventually retrain. The project’s answer is continuous generation of fresh, unreleased patterns.

The overfunded campaign shows demand already exceeds the original goal by a wide margin. Tee tiers test the hardest coverage case; hoodie and buff tiers buy more printed area; one-of-one tiers turn the offline vault into a private garment. Each tier still rests on the same scored loop that produced the 61.7 percent f-YOLOv5 figure and the Yaris miss.

The Yaris sat on a Las Vegas street in full pattern and the Flock unit simply failed to raise an alert. That single successful physical test turns a year of quiet GPU work into something anyone can wear or wrap.