noRecognition Tests Adversarial Patterns Against Surveillance AI

TechCrunch reported that Swearingen had run roughly 31 million tests to generate patterns intended to interfere with automatic object, person, vehicle, and license-plate detection. The publication reported that the patterns do not prevent a camera from recording video. Rather, they are intended to disrupt the downstream detector so that it does not generate an alert for the covered object.

CNET observed a DEF CON demonstration using a person-detection system. In that test, the system initially assigned Swearingen a confidence score above 0.75, its configured threshold for declaring a person present. After he raised a flat adversarial-pattern panel, CNET reported that the score fell to 0.21 and the display read, "No person detected."

SC Media reported that Swearingen described using a reinforcement-learning model to iteratively refine patterns against multiple open-source detection algorithms. It also reported a public DEF CON demonstration in which a vehicle covered with a pattern was not detected by a Flock camera.

CNET noted that person detection, face detection, and facial recognition are separate stages of a surveillance pipeline. A person detector classifies whether a human body appears in a frame; a face detector locates a face; facial recognition compares that face against a database. The observed DEF CON test concerned person-detection confidence, not an end-to-end demonstration that a person could evade facial identification.

That distinction matters for ML practitioners evaluating adversarial robustness. Lowering a detector's confidence beneath a threshold can suppress an automated alert, but it does not remove the underlying pixels from footage or prevent later human review. A system with a different model, threshold, camera position, illumination condition, or preprocessing pipeline may produce a different result.

CNET characterized worn clothing as the major unproven test. Its observed result used a held flat panel, whereas garments introduce folds, pose changes, occlusion, motion, distance variation, and changing illumination. Those physical-world transformations are a longstanding challenge for adversarial examples that perform well in controlled camera setups.

The noRecognition site's disclosure of held-out wearers and baseline comparisons is more substantive than a demonstration alone, but the cited public materials do not provide per-model results, error rates, or independent replication. For defenders of computer-vision systems, the project is a practical reminder that physical adversarial inputs can target confidence thresholds, not only model labels. Comparable robustness evaluations commonly require testing across cameras, viewpoints, environmental conditions, models, and threshold configurations before operational conclusions are drawn.