Adversarial Patterns That Hide People and Vehicles from Surveillance Cameras Go Public
Security researcher Bill Swearingen has developed an algorithm that generates patterns capable of hiding people, faces, and vehicles from commonly deployed surveillance cameras and license plate readers. Swearingen first demonstrated the patterns printed on a vehicle at the Def Con cybersecurity conference in Las Vegas. The project, called noRecognition, is hosted at norecognition.org. TechCrunch
The patterns do not obscure video recording. Instead, they confuse the camera's ability to identify objects, people, or faces, preventing the system from triggering detection alerts. Applied to clothing and objects, the designs target some of the most widely deployed license plate readers and surveillance cameras in use today. TechCrunch
Swearingen ran roughly 31 million tests over about a year of development. He is based in Kansas City and co-founded SecKC (seckc.org), a cybersecurity meet-up. TechCrunch
The noRecognition project arrives amid a surge of independent research into physical adversarial attacks on computer vision systems. At the Black Hat 2026 security conference, held days before Def Con in the same city, a separate hacker demonstrated that printing adversarial patterns on everyday clothing can disrupt facial recognition algorithms without requiring masks. PCMag A survey published in March 2026 in the peer-reviewed journal Neurocomputing provides a systematic analysis of existing research literature on physical adversarial attacks targeting face recognition, indicating that academic attention to this area is growing. Neurocomputing / ScienceDirect
Adversarial attacks on machine learning models are not new. The technique exploits the gap between how a model processes input data internally and how a human perceives the same input. A pattern that looks like noise or abstract art to a person can produce a confidently wrong classification inside a neural network, the type of AI model commonly used for image recognition. What shifts with Swearingen's work, and the Black Hat demonstration, is the move from digital adversarial examples (modified pixels in an image file) to physical ones, patterns printed on fabric or vehicle wraps that still work after passing through a real camera lens under varying lighting and viewing angles. That transition has been the hard problem in this subfield, and the volume of testing Swearingen reports suggests the difficulty of achieving reliable results outside a controlled digital environment.
The broader context here is one of deployment asymmetry. Surveillance and license plate reader infrastructure has scaled rapidly across public and private spaces, relying on detection models whose internal architecture and training data are often known or inferable. Adversarial patterns invert that asymmetry: the defender must now consider that any visible surface, a jacket, a hat, a car wrap, may be optimized to defeat a specific detection pipeline. Swearingen's claim of effectiveness against some of the most commonly deployed systems matters because commodity cameras are the installed base. If the patterns work against those, the effective coverage is wide.
It is worth flagging the arms-race dynamic this invites. Camera vendors can retrain models on adversarial examples, a standard defensive technique called data augmentation, and Swearingen's 31 million test iterations suggest the patterns were tuned against specific detection pipelines. Whether the patterns generalize across models the researcher did not test against is an open question, and one that noRecognition's public release may help answer as independent testers evaluate the designs. The arXiv preprint server, which hosts nearly 2.4 million scholarly articles across physics, computer science, and related fields without peer review, has been a common venue for adversarial ML research, though no specific noRecognition paper has been identified on the platform at time of writing. arXiv
The practical ceiling on adversarial clothing has always been social, not technical. A pattern that defeats a camera also draws human attention. Swearingen's vehicle demonstration at Def Con sidesteps that constraint: a patterned car wrap is less conspicuous than a person wearing an adversarial hoodie, and license plate readers are positioned to scan vehicles, not pedestrians. For fleets or individuals concerned about automated tracking, the vehicle application may be the more immediately viable use case.
What this enables, ultimately, is defensive tooling in the hands of the surveilled rather than the surveillors. The long-arc question is whether adversarial patterns become a durable countermeasure or a catalyst for more robust, adversarially trained detection models that render them obsolete. Both outcomes push the field forward. For now, the patterns exist, they are public, and they work against deployed hardware.
