noRecognition tests patterns that disrupt surveillance detection
Bill Swearingen says his noRecognition project has generated computer-designed patterns that defeated all 11 open-source detection algorithms in his tests after roughly 31 million trials. At the Def Con cybersecurity conference in Las Vegas, he demonstrated a 2009 Toyota Yaris covered in one of the patterns and said it successfully avoided detection by a Flock camera.
The patterns are intended for clothing, objects and vehicles. They do not prevent a camera from recording video. Instead, they are designed to interfere with the automated recognition layer, so a system may fail to identify the person, object or vehicle that the pattern covers and may not generate a detection alert.
A model trained to create adversarial patterns
Swearingen developed the project over the past year, initially testing whether patterns could defeat individual open-source video-camera detection algorithms. As he added computing power, the proof of concept became a reinforcement-learning model that learns from failed attempts and produces new variations.
He described the process as teaching the model how to paint. When a tested pattern was detected, the model tried another approach until it could defeat several algorithms simultaneously. Swearingen said the system now creates new patterns every minute and that each batch is mathematically better than the last.
The tests included software that powers Flock license plate readers, Axon body-worn cameras and cameras running Clearview AI. Swearingen said the patterns ultimately found configurations capable of defeating each of the 11 algorithms he evaluated. The Def Con vehicle demonstration was his first public real-world test, although he noted that covering the wheels presented a challenge.
Detection can fail while video remains available
The distinction between recording and detection is central to the project. Modern surveillance deployments can sift large volumes of footage for specified activity, including vehicles and faces. noRecognition seeks to return a covered subject to the wider mass of recorded footage unless an investigator already knows where to look.
Swearingen has framed the work as a privacy tool for people who do not wish to be automatically tracked in public. He cited concerns about extensive camera coverage and the ability of people to exercise free expression without feeling exposed to automated surveillance. He also said the strongest patterns will not be published online, in part to prevent camera makers from adapting their systems to them.
What organisations should take from the test
The project is still at an early stage. Swearingen plans to make patterns available through merchandise, including T-shirts and hoodies, and has raised the prospect of vehicle skins. He says the intended designs need sufficient resolution to work at distance while remaining visually usable.
For organisations operating cameras, the demonstration is a practical reason to test the limits of automated detection rather than equating an absent alert with an absent subject. Video retention, human review and clearly defined operating procedures remain important when algorithmic recognition does not flag what a camera has recorded.
noRecognition project: what the Toyota camera test showed
The noRecognition experiment explores whether adversarial patterns can disrupt automated recognition without stopping a camera from recording. Its reported results are best read as an early test of detection limits, not proof that a person, garment or vehicle can evade every surveillance system.
What the noRecognition project tests
Bill Swearingen says the project used reinforcement learning to generate and refine patterns after failed detection attempts. According to his account, roughly 31 million trials produced configurations that defeated the 11 open-source detection algorithms included in his tests. These results describe the selected test environment and do not establish universal performance against other models or deployments.
- The model changes patterns in response to failed attempts.
- The reported tests covered 11 open-source detection algorithms.
- A missed automated alert does not mean that no video was recorded.
The Toyota camera test at Def Con
For the first public real-world demonstration, a 2009 Toyota Yaris was covered with one of the generated patterns at Def Con in Las Vegas. Swearingen said the vehicle avoided detection by a Flock camera, although covering the wheels remained difficult. The demonstration involved one vehicle and should not be interpreted as proof that the pattern works with every camera, angle or recognition model.
- The test used a patterned 2009 Toyota Yaris.
- Swearingen reported that a Flock camera did not detect the vehicle.
- The camera could still retain footage despite the missed detection.
How noRecognition clothing is intended to work
The same approach is intended for clothing, objects and vehicle skins. Proposed merchandise includes T-shirts and hoodies, but the project remains at an early stage. Pattern resolution, viewing distance and the part of the subject left uncovered may all affect whether an automated system generates an alert.
- The patterns target automated recognition rather than video capture.
- Clothing designs must remain detailed enough to work at a distance.
- Swearingen says the strongest patterns will not be published online.
What camera operators can learn from the experiment
The practical lesson is to separate recording from automated detection. If a recognition layer fails to flag a subject, the underlying footage may still exist. Camera operators should therefore avoid treating the absence of an alert as proof that no relevant person, object or vehicle was present.
- Detection alerts should not be the only basis for reviewing an event.
- Human review can help when automated recognition misses a subject.
- Retention and review procedures should account for detection failures.
Frequently asked questions
What is the noRecognition project?
It is Bill Swearingen’s experiment with computer-generated adversarial patterns intended to interfere with automated recognition of covered people, objects and vehicles.
Did the noRecognition Toyota test make the car invisible?
No. Swearingen said the patterned Toyota Yaris avoided automated detection by a Flock camera, but the camera could still record video.
Does noRecognition clothing work against every surveillance camera?
No universal result has been demonstrated. The reported trials involved 11 selected open-source algorithms, and the clothing concept remains at an early stage.
What is the difference between camera recording and detection?
Recording preserves video, while detection software analyses it and may generate an alert. A system can record a subject even when its recognition layer fails to identify or flag it.