Adversarial Patterns That Defeat Surveillance Cameras Go Public at Def Con
Security researcher Bill Swearingen has developed an algorithm that generates computer-produced adversarial patterns capable of hiding people, faces, and vehicles from detection by commonly deployed surveillance cameras and license plate readers. Swearingen first publicly demonstrated the patterns printed on a vehicle at the Def Con cybersecurity conference in Las Vegas. The project, called noRecognition, is hosted at norecognition.org. TechCrunch
The patterns do not obscure video recording. Instead, they scramble the camera's ability to identify objects, people, or faces, preventing the system from triggering detection alerts. Applied to clothing and objects, the adversarial designs target some of the most widely deployed license plate readers and surveillance cameras in use today. TechCrunch
Swearingen ran roughly 31 million tests over about a year of development. He is based in Kansas City and co-founded SecKC (seckc.org), a cybersecurity meet-up. TechCrunch
The noRecognition project arrives amid a surge of independent research into physical adversarial attacks on computer vision systems. At the Black Hat 2026 security conference, held days before Def Con in the same city, a separate hacker demonstrated that printing adversarial patterns on everyday clothing can poison facial recognition algorithms without requiring masks. PCMag A survey published in March 2026 in the peer-reviewed journal Neurocomputing provides a systematic analysis of existing research literature on physical adversarial attacks targeting face recognition, indicating that academic attention to this attack surface is growing. Neurocomputing / ScienceDirect
Adversarial attacks on machine learning models are, of course, not new. The technique exploits the gap between how a model represents input data internally and how a human perceives the same input. A pattern that looks like noise or abstract art to a person can produce a confidently wrong classification inside a convolutional neural network. What shifts with Swearingen's work, and the Black Hat demonstration, is the move from digital adversarial examples (modified pixels in an image file) to physical ones (patterns printed on fabric or vehicle wrap) that survive the transition through a real camera lens, varying lighting, and viewing angles. That transition has been the hard problem in this subfield, and the volume of testing Swearingen reports suggests the difficulty of achieving reliable transfer from simulation to physical deployment.
The broader context here is a deployment asymmetry. Surveillance and license plate reader infrastructure has scaled rapidly across public and private spaces, relying on off-the-shelf detection models whose internal architectures and training data are often known or inferable. Adversarial patterns invert that asymmetry: the defender must now consider that any visible surface, a jacket, a hat, a car wrap, may be optimized to defeat a specific detection pipeline. Swearingen's claim of effectiveness against "some of the most commonly deployed" systems matters because commodity cameras are the installed base. If the patterns work against those, the effective coverage is wide.
Worth flagging: the arms-race dynamic this invites. Camera vendors can retrain models on adversarial examples (data augmentation with known attack patterns is a standard defensive technique), and Swearingen's 31 million test iterations suggest the patterns were tuned against specific detection pipelines. Whether the patterns generalize across models the researcher did not test against is an open question, and one that noRecognition's public release may help answer as independent testers evaluate the designs. The arXiv preprint server, which hosts nearly 2.4 million scholarly articles across physics, computer science, and related fields without peer review, has been a common venue for adversarial ML research, though no specific noRecognition paper has been identified on the platform at time of writing. arXiv
The practical ceiling on adversarial clothing has always been social, not technical. A pattern that defeats a camera also draws human attention. Swearingen's vehicle demonstration at Def Con sidesteps that constraint: a patterned car wrap is less conspicuous than a person wearing an adversarial hoodie, and license plate readers are positioned to scan vehicles, not pedestrians. For fleets or individuals concerned about automated tracking, the vehicle application may be the more immediately viable use case.
Looking at what this enables: the noRecognition project, combined with the Black Hat demonstration, puts defensive tooling into the hands of the surveilled rather than the surveillors. The long-arc question is whether adversarial patterns become a durable countermeasure or a catalyst for more robust, adversarially trained detection models that render them obsolete. Both outcomes push the field forward. For now, the patterns exist, they are public, and they work against deployed hardware.
