Researcher's 'Adversarial Pattern' Hides People, Faces, and Vehicles From Surveillance Cameras
A Kansas City security researcher says his algorithm now produces adversarial patterns on demand that hide people, faces, and vehicles from surveillance cameras. He tested them against 11 open-source detection systems and demonstrated one on a car at Def Con.
Bill Swearingen spent the past year running the same experiment tens of millions of times, chasing one result: a computer-generated pattern that could stop the surveillance cameras lining America's streets from recognizing whatever it covers. Some 31 million tests later, he says he can now produce those patterns on demand.
In a report published August 9, TechCrunch security editor Zack Whittaker described how Swearingen, a cybersecurity professional in Kansas City, built an algorithm that generates adversarial patterns designed to hide people, faces, and vehicles from detection by surveillance cameras. The patterns do not stop a camera from recording. They scramble the detection model that decides what the footage contains, so a person or vehicle covered by the pattern never trips an automated alert. "Privacy is a fundamental right," Swearingen told TechCrunch, describing his work as a way to let people "opt-out of being tracked."
He calls the project noRecognition. Its premise is that algorithmic surveillance — the software layer that turns raw video into searchable events like a license plate or a matched face — has spread far enough across public space that ordinary people never meaningfully consented to it. His answer is not to blind the cameras, but to make what they see illegible to the models doing the sorting.
A Year of Teaching a Model How to Paint
Swearingen started last year with a proof-of-concept lab that picked off one open-source video-detection algorithm at a time, according to TechCrunch. Over months he scaled the work up with additional computing power, some of it donated by a community that showed up with hardware. The proof of concept grew into a reinforcement-learning model — a self-contained system that trains itself on which patterns defeat a given detection algorithm and which do not.
Each time a pattern failed and an algorithm spotted it, the model adjusted and tried again, until it could beat several detectors at once. Swearingen told TechCrunch he essentially taught the system "how to paint." The model now turns out fresh patterns every minute, he said. "Every failure improves my model, and so [the patterns] keep getting better and better," he told the outlet.
Adversarial fashion is not new. Artists, clothing brands, and eyewear makers have all tried to defeat facial recognition with printed designs, often with limited real-world success. Swearingen has said his research builds on that earlier work but pushes it from one-off designs into an automated pipeline that generates computer-generated patterns at scale.
What the Patterns Are Built to Defeat
By Swearingen's account to TechCrunch, the model eventually found recipes that beat all 11 of the open-source detection algorithms he tested — among them the software that powers Flock license plate readers, Axon body-worn cameras, and cameras running Clearview AI. Those are some of the most widely deployed names in American automated surveillance, though it is worth being precise about the claim: the tests targeted open-source detection implementations in his lab, not a guarantee about every commercial deployment as configured in the field.
From the Lab to a Las Vegas Parking Lot
The project got its first public test on Friday at the Def Con security conference in Las Vegas. Working with the YouTube channel Donut Media, Swearingen wrapped a 2009 Toyota Yaris in one of his newer patterns to see whether a Flock camera would fail to detect it. "We proved it was effective," he told TechCrunch, though he noted the car's wheels were a challenge. Donut Media said video of the demonstration would follow in the coming weeks.
Swearingen is keeping his strongest patterns off the public internet, he told TechCrunch, to stop camera makers from studying and defeating them. The noRecognition project is also running a crowdfunding campaign to sell early merchandise printed with the patterns — T-shirts and hoodies now, with the possibility of pattern-printed vehicle wraps later. He said the aim is for the designs to work at a distance while still looking like something a person would want to wear.
What It Means for Camera Vendors and Operators
Strip away the privacy framing and the research lands as a straightforward security finding: a detection model is software, and software can be attacked. For the vendors and agencies that run automated cameras, the takeaway is not that any one product has been broken, but that machine-learning detection should be treated as adversarially attackable rather than tamper-proof. In practice that means testing detection pipelines against deliberately crafted inputs, watching for weaknesses under adversarially designed patterns, and assuming a determined subject can probe an open-source model until it fails.
The wider debate is genuinely contested, and the sources do not settle it. Swearingen frames the patterns as a civil-liberties tool for people who never opted into being tracked — including, he told TechCrunch, protesters worried that dense camera networks could log their lawful participation. Law-enforcement users and camera vendors can just as reasonably describe the same capability as evasion of legitimate policing. Both readings are on the table; what the research demonstrates is only that the evasion is now, at least in a lab and one parking-lot test, technically possible.
My Read
What is solid here is narrow and real. Swearingen is a named, established figure in the security community — he co-founded the SecKC meetup — and the mechanics he describes, using reinforcement learning to generate adversarial patterns against object detectors, track a decade of published work on adversarial machine learning. The Def Con demonstration and the 31-million-test figure come from him, reported by a credible outlet.
What is not yet established deserves equal weight. The claims about specific commercial systems rest on open-source detection algorithms tested in a private lab, not on audited trials against production Flock, Axon, or Clearview deployments as they run in the field. Swearingen is withholding his best patterns, so independent researchers cannot yet verify durability, distance, or how quickly a vendor could retrain around them. Adversarial patterns have historically been brittle — sensitive to angle, lighting, and model updates — and there is no peer-reviewed paper here yet. This is an early, real proof that algorithmic detection can be defeated in public, not proof that anyone can reliably disappear on demand. The CyberSignal has tracked the surveillance side of this ledger before, from an ad-based system quietly tracking 500 million devices to Europe's fight over mandated message scanning; this is the same privacy-versus-surveillance tension, now playing out at the level of the detection model itself.
