A computer-generated pattern designed to confuse machine-vision systems has passed its first reported public test against a deployed surveillance camera, highlighting the gap between what a camera records and what its artificial-intelligence software notices. Security researcher Bill Swearingen demonstrated the technology during the Def Con cybersecurity conference in Las Vegas, using a pattern-covered vehicle to test whether a networked camera would automatically detect it.

The experiment involved a 2009 Toyota Yaris covered with one of the newest designs produced by Swearingen’s noRecognition project. According to Swearingen and reporting by TechCrunch, the vehicle avoided detection by a Flock camera during the Friday test. Automotive media company Donut Media assisted with the demonstration and plans to release video of the experiment. Swearingen said the result showed that the pattern was effective, although the vehicle’s uncovered or differently shaped wheels presented a challenge.

The test is significant because it was conducted against a physical camera rather than solely against images processed in a laboratory. Much of the project’s published performance data remains digital, including simulated printing, camera transformations and tests on held-out images. The Las Vegas demonstration therefore represents an early bridge between model-level findings and the unpredictable conditions of the physical world. It is not, however, a comprehensive certification that the pattern will work across every camera or surveillance network.

Adversarial patterns exploit the difference between human vision and machine classification. To a person, a covered car remains plainly recognizable as a car, and a person wearing a patterned shirt remains visible as a person. A computer-vision model does not interpret the scene in the same semantic way. It searches for combinations of edges, textures, shapes and other statistical features learned during training. Carefully arranged visual signals can reduce its confidence below a detection threshold or cause it to draw incorrect conclusions.

The camera itself continues to capture footage. The pattern does not jam the sensor, cut power, obstruct the lens or penetrate the surveillance network. Instead, it targets the automated analysis layered on top of the video. If the software fails to classify an object as a vehicle, person or face, the system may not create an alert, attach searchable metadata or send the relevant frames to an operator. The object remains in the recording but effectively returns to the mass of footage that no person has time to examine continuously.

That distinction is central to the technology’s potential impact. Modern surveillance products are valuable partly because they turn video into structured, searchable information. License-plate systems can associate a vehicle with a time and location. Object detectors can flag people entering controlled areas. Facial-recognition pipelines can attempt to match an observed face against a database. If an adversarial surface breaks the first detection stage, downstream identification and alerting functions may never run.

Swearingen began the project with a test environment that repeatedly generated patterns, applied them to sample images and measured how detection or recognition models responded. The initial process relied heavily on brute-force exploration. According to the project’s research account, a distributed network completed about 31.7 million tests, identifying more than 534,000 anomalies and roughly 481,000 results that affected multiple models. Volunteers contributed computing hardware to expand the search.

The early system started with three models and later grew to cover several computer-vision families, including YOLO, SSD, InsightFace, FaceNet, MTCNN, RetinaFace and ArcFace. These represent different functions and architectures. Some determine whether a person or vehicle is present, others locate a face within an image, and recognition models convert a detected face into a mathematical representation that can be compared with stored identities.

Testing across model families is important because adversarial attacks often transfer poorly. A pattern optimized against one known model may fail when shown to another architecture, making a dramatic laboratory result less useful in the field. The noRecognition effort is intended to find patterns that suppress several systems simultaneously rather than exploiting only one carefully selected detector.

The project’s approach evolved after brute-force generation reached practical limits. Swearingen used the accumulated test results to train models that could rank promising designs, then adopted reinforcement learning to generate new ones. In that setup, the system proposes a visual recipe, applies it to test subjects, evaluates the result against a detection suite and updates its policy according to which models were defeated. Successful features are reinforced across subsequent attempts.

The newer generator operates in a continuous latent space rather than selecting only from a fixed menu of pattern templates. That gives it scope to create gradients, textures and combinations that a conventional search process might never propose. Swearingen has described the process as teaching the model how to paint: each detection is treated as a failure that informs the next design, while lower detection confidence or broader model evasion increases the reward.

One reported technical finding is that the way a pattern is blended with the underlying object can matter as much as the pattern itself. The project says many high-performing recipes used overlay or multiply blending, which changes the contrast and apparent structure of the surface rather than merely placing a translucent design over it. The hypothesis is that these treatments disrupt features associated with body or object contours, weakening the signals on which detectors rely.

The current project materials describe an 11-detector gauntlet. Ten components cover person detectors, face detectors and recognition models. An additional detector is described as a production person-detection model obtained from a deployed surveillance camera and tested using its actual on-device weights. The project reports that a digitally simulated, full-coverage adversarial garment produced a 61.7% non-detection rate against that model in held-out tests after subtracting the effect of ordinary occlusion.

Other published digital results include a 90% non-detection rate against a YOLOv5 person detector and a 62.5% held-out result against a ResNet34-SSD detector using a wide-coverage tile. These figures are useful indicators of vulnerability but require careful interpretation. The project itself labels them as digital, simulated print-and-camera results rather than evidence from physical fabric. Test thresholds, subject selection, pattern coverage and access to model weights can all materially affect reported success rates.

The public vehicle demonstration is therefore more consequential than another increase in a simulation metric, but it remains a single reported event. A rigorous assessment would require repeated trials across several vehicles, plates, cameras and distances, with controlled comparisons and full logs of successful and unsuccessful passes. Independent researchers would also need to test changes in sunlight, motion blur, rain, nighttime illumination, compression and oblique viewing angles.

Questions also remain about precisely which part of the Flock pipeline failed. A complete evaluation would distinguish among vehicle detection, plate localization, optical-character recognition, vehicle classification and alert delivery. Avoiding one automated event does not necessarily mean every component failed, nor does it prevent an investigator from later finding the vehicle by manually reviewing footage.

The project’s own research page acknowledges a physical coverage constraint. Thin patches occupy only a small share of a video frame and may lack sufficient influence over a detector, while full-coverage garments or vehicle wraps create a much larger attack surface. That limitation could make effective deployment less discreet and more dependent on careful printing, placement and viewing geometry.

Surveillance suppliers also hold an important advantage: they can change their software. A pattern that suppresses detections today may become an adversarial-training example for the next model release. Vendors could add the design to training data, adjust confidence thresholds, detect suspicious high-frequency textures or combine several models whose errors are less correlated. Swearingen has said he is withholding his strongest patterns to make it harder for camera companies to neutralize them before products reach users.

That dynamic points to an iterative contest rather than a permanent invisibility mechanism. Releasing a pattern allows defenders to study it; keeping it private limits independent verification and broad adoption. Camera makers can harden their models, while pattern generators can optimize against the updated systems. Because many commercial platforms update centrally, a design that works against a device one week could lose effectiveness after a remote software change.

Defensive research has already explored mechanisms for detecting localized adversarial patches. One approach, DetectorGuard, supplements a conventional object detector with a robust model that predicts whether image regions contain object-like features. When expected objectness is not explained by the conventional detector’s bounding boxes, the system can issue an attack warning. Such methods demonstrate that a detector does not always have to correctly classify an adversarially covered object to recognize that its normal analysis may be unreliable.

Operators can also reduce dependence on any single visual model. Thermal sensors, radar, inductive road sensors, human monitoring and redundant cameras with different angles can provide signals that a printed color pattern cannot easily suppress at once. Temporal analysis across consecutive frames may identify motion inconsistent with an empty scene. For vehicle applications, back-end systems can search raw footage after an expected detection is missing.

Those countermeasures have costs. Additional sensors increase hardware, networking and maintenance expenses. More sensitive anomaly detection can produce false alarms, weakening the efficiency gains that automated surveillance is meant to deliver. Raising detection sensitivity may also increase erroneous matches or alerts involving people and vehicles that are not targets. The commercial challenge is therefore to improve adversarial robustness without degrading ordinary accuracy or overwhelming operators.

The project also intensifies a policy debate over whether defeating automated surveillance is a privacy tool or a security threat. Swearingen frames noRecognition as a way for individuals to opt out of tracking that they never authorized. He has linked the work to concerns about people being cataloged while attending protests or moving through heavily monitored public spaces. Clothing or vehicle coverings are passive and visible, unlike electronic jamming, but their intended effect is still to frustrate automated observation.

The same capability could be used to evade legitimate security controls, conceal unauthorized access or prevent investigators from receiving time-sensitive alerts. That dual-use character is familiar in cybersecurity, where tools developed to expose weaknesses can also facilitate exploitation. The appropriate legal treatment may depend on the location, the user’s intent, whether a system was interfered with and whether an adversarial design is considered ordinary expressive clothing or a circumvention device.

Swearingen is seeking to translate the research into physical products through a crowdfunding campaign for T-shirts and hoodies, with vehicle skins contemplated later. Manufacturing will be a technical issue rather than merely a merchandising one. Color reproduction, textile stretching, seams, print resolution and the amount of covered surface could determine whether a pattern retains its effects outside the model-development pipeline.

For enterprise buyers, municipalities and law-enforcement agencies, the immediate takeaway is narrower than the prospect of universal machine invisibility. Detection models should be treated as fallible software operating in an adversarial environment. Procurement tests typically emphasize accuracy on representative footage, but systems deployed in public can receive deliberately manipulated visual inputs. Robustness testing should therefore include printed patterns, unusual textures, partial coverage, changing angles and attempts to generate false detections.

Audit trails are equally important. Systems should preserve enough information for operators to understand why an alert was or was not generated, retain original video separately from AI metadata and record model versions and confidence scores. An empty search result should mean that the software found nothing meeting its threshold—not that the underlying footage conclusively contained nothing.

The Def Con test gives surveillance providers a visible example of a threat that computer-vision researchers have studied for years. Its importance lies less in one patterned car than in the demonstration that automated perception can potentially be manipulated through the ordinary visual field. The next phase will determine whether noRecognition’s designs remain effective under repeated independent testing and whether vendors can detect or absorb the attack without sacrificing the speed and accuracy on which their products depend.