The rise of public surveillance has also led to the rise of an adversarial counterpart: fashion designed to confuse AI security cameras. It’s designed to baffle the senses of Axon body cams, Flock cameras, and other tools of mass surveillance through tricks like patterns that AI sensors confuse for animals, objects, or reflective fabric.
A new limited-edition, crowdfunded clothing brand promises garments with patterns good enough to scramble 11 computer vision models. It’s called noRecognition.
Bill Swearingen, a former chief intelligence officer and founder of the monthly Kansas City security meetup SecKC, created noRecognition after running 31.7 million digital tests to determine what kinds of patterns confuse multiple models at once, with the goal of creating a universal adversarial camouflage. He used AI throughout the process, including building and training a model, using that model to generate and test adversarial pattern geometry, and determining which patterns work best.
For Swearingen, the challenge is that a pattern that beats one model often won’t beat several different ones. “I have beat every model I have tested, so beating a single model is a solved problem for me,” he says. “The search now is finding that one pattern that works across many models at once.” He unveiled noRecognition publicly at the Def Con cybersecurity conference in Las Vegas on August 7. A Kickstarter campaign he launched the same week to raise $5,000 has now raised more than $40,000. The money will go to fabric, cameras, and compute, says Swearingen, who calls the generosity and response “humbling.”
The limited-edition clothing line includes a buff that can be worn as a neck gaiter, a T-shirt, and a sweatshirt, plus stickers and patches. There’s a 50-item run of each, and each will have a pattern generated for a single person.
Swearingen’s website shows examples of some of the patterns the noRecognition model generates, but its strongest work stays off the internet. By keeping the most effective patterns off the site, noRecognition prevents surveillance camera operators from training their models on what it produces.
Warships in World War I used black-and-white, zigzag-style “dazzle camouflage” to confuse enemy ships, and today, automakers use car camouflage to obfuscate details during test drives. Adversarial fashion primarily uses repeating tiles.
Most but not all the patterns are repeating tiles, since a tile pattern can survive the fabric-cutting process and it shows up in a detector’s view no matter what part of the garment is picked up. These patterns aren’t designed for aesthetics—they’re functional-first, as the specific sizing of the pattern is critical to whether or not it works.
Some people dress for the cameras. NoRecognition is designed to do just the opposite.