This ‘adversarial’ pattern can prevent surveillance cameras from detecting you

Bill Swearingen has spent the past year running largely the same test, over and over again. The goal was to produce a computer-generated pattern that could block the surveillance cameras lining America’s streets from detecting it.

Some 31 million tests later, Swearingen says he can now produce patterns on-demand that, when applied to clothing and objects, prevent some of the most commonly deployed license plate readers and surveillance cameras from detecting whatever the pattern covers, from people to vehicles.

His project, which he calls noRecognition, allows people to escape the automatic detection and algorithmic surveillance used across the U.S. and beyond.

In recent years, surveillance cameras have been supercharged with the ability to detect what is happening in the footage being recorded, from tracking the license plates of speeding vehicles to using facial recognition to identify suspected criminals, albeit with mixed success and sometimes terrifying results. The detection algorithms that power most surveillance cameras today can sift through vast amounts of footage, allowing law enforcement to pick out activity of interest, akin to pulling a needle out of a haystack.

Swearingen’s computer-generated patterns do not block surveillance cameras from recording video footage. Instead, they scramble the camera’s ability to identify objects, people, or faces, so that the cameras do not trigger any detection alerts. By blocking the camera’s ability to detect what the pattern covers, the person becomes a needle in a haystack again — until someone knows where to look. 

“Privacy is a fundamental right,” Swearingen told TechCrunch in a call this week. He described his patterns as a way to allow people to “opt-out of being tracked.”

In its first public test Friday at the Def Con cybersecurity conference in Las Vegas, Swearingen successfully demonstrated the pattern printed on a vehicle, proving that these patterns can be effective at defeating surveillance detection in the real world.

Teaching a model how to paint

In a call from his home in Kansas City, where he co-founded cybersecurity meet-up SecKC, Swearingen told TechCrunch that as a cyber professional he is acutely aware of the privacy and security risks of surveillance.

He described how his town is swamped with surveillance cameras, sometimes located just a few feet from each other. He said that he and others never opted in to being watched, just like he never opted-in to having the government use his driver’s license for facial recognition.

Swearingen described himself as a middle-aged white guy who lives in the center of the United States, and acknowledged that as a result he has not faced hardship or discrimination for being who he is or what he looks like. Swearingen recounted how last year he wanted to attend a protest, but felt uncomfortable and concerned that the vast number of cameras could track people who were exercising their constitutional rights to free expression.

If he felt this way, undoubtedly others would as well, including those who wanted to exercise their rights but may not feel safe or comfortable doing so themselves. Swearingen got to work.

For as long as there have been cameras capable of detecting things, there have been efforts to counter the technology. Several art projects and clothing brands have introduced apparel that aims to help people defeat facial recognition. Some eyeglass makers are jumping on the trend, albeit not with much efficacy. 

Swearingen said his research builds on some of this earlier work, which showed that it was possible to block camera detections. 

He started out last year with a proof-of-concept test lab that began by incrementally defeating one open-source video camera detection algorithm after another. Over the course of the year, he refined the patterns by scaling up his tests with additional computer processing power. He thanked the wider community who showed up with hardware to help further the project along. 

His proof-of-concept evolved over time into a reinforcement learning model, essentially a self-contained system that could train itself on which patterns work and which do not against the specific camera algorithms he is testing. In simple terms, Swearingen told TechCrunch that he essentially taught his model “how to paint.”

Each time a pattern failed and an algorithm detected it, the model would try again, over and over, until it eventually defeated multiple algorithms at once.

His model soon began to find perfect recipes for patterns that were able to defeat all of the 11 open-source detection algorithms he tested, including the software that powers Flock license plate readers, Axon body-worn cameras, and cameras running Clearview AI.

Now the model creates new patterns every minute, each batch mathematically better than the last, he said.

On Friday at the Def Con cybersecurity conference in Las Vegas, Swearingen ran his first real-world test. With help from Donut Media, the test involved covering a 2009 Toyota Yaris with one of Swearingen’s newest patterns to see if the car would be invisible to detection by a Flock camera.

“We proved it was effective;” said Swearingen; though, the wheels were a challenge, he said. The video of the demo will be out in the next few weeks, said Donut Media.

With a public demo in Las Vegas now under his belt, the project is early proof that it is possible to avoid algorithmic detection in public spaces. The next step is getting the patterns into the hands of people who want them, he said.

The noRecognition project also has a crowdsourcing campaign to help fund the sale of early merchandise featuring the patterns, from T-shirts to hoodies, with the potential for pattern-printed skins for vehicles down the line. Swearingen said the aim is for the patterns to be high quality and resolution good enough to work from a distance, while also looking aesthetically fashionable.

He said he is keeping his strongest patterns off the internet to prevent the camera makers from defeating them, but that the work is not yet done. His models are continuing to grind out new patterns.

“Every failure improves my model, and so [the patterns] keep getting better and better,” he said.