Pattern-Generating AI Defeats Surveillance Camera Detection in First Real-World Test

For the past year, Bill Swearingen has methodically tested thousands of computer-generated visual patterns against some of the most widely deployed surveillance systems in North America. After 31 million iterations, he has created designs that reliably prevent license plate readers, body cameras, and facial recognition systems from detecting what they cover—whether a person, vehicle, or license plate.

The project, called noRecognition, represents a practical demonstration of adversarial patterns: images engineered to confuse artificial intelligence detection systems while remaining visible to human eyes. Unlike privacy-focused clothing concepts shown in art installations, Swearingen’s approach has now been tested against real surveillance hardware in live conditions.

The Origins of a Counter-Surveillance Tool

Swearingen, a cybersecurity professional based in Kansas City where he co-founded the SecKC cybersecurity meetup, approached the project from personal conviction about constitutional rights. He described an environment in his city where surveillance cameras are densely clustered—sometimes just feet apart—and residents never consented to being monitored. The turning point came when he wanted to attend a protest but felt unsafe exercising his right to free expression due to the pervasive camera network.

Privacy as Motivation

In conversations about the project, Swearingen characterized privacy as fundamental, and surveillance as something people should be able to opt out of rather than accept by default. He acknowledged that as a middle-aged white person, he had not experienced the discrimination that surveillance disproportionately affects others, but recognized that others with legitimate reasons to avoid tracking face far greater stakes. He also noted his concern about government use of driver’s license photos for facial recognition without consent.

Building on Existing Research

The noRecognition project did not emerge in isolation. Prior art projects and clothing brands have explored how visual designs can defeat facial recognition. Some eyewear manufacturers have incorporated similar concepts, though with limited practical success. Swearingen’s contribution was scaling these ideas through modern machine learning and testing against algorithms actually deployed in the field rather than theoretical systems.

The Technical Architecture Behind the Patterns

Read also: Polish Researchers Expose Systemic Flaws in Government Web · Google replaces APT numbers with geography-coded threat names · Meta Ordered to Pay $567M and Restrict Features for New Mexico Minors

Swearingen began with a proof-of-concept environment where he incrementally defeated open-source computer vision detection algorithms one at a time. As he refined his approach and added processing power with help from collaborators who contributed hardware, the project evolved into something more sophisticated: a reinforcement learning model that teaches itself to generate effective patterns.

How Reinforcement Learning Finds the Pattern

The system operates on a simple principle: when a candidate pattern fails to fool a detection algorithm, the model learns from that failure and tries again. Swearingen described the process as teaching the model “how to paint.” Each failed attempt generates information about what the detection system is looking for, which the model uses to adjust its next candidate. Over countless iterations, the model converged on pattern designs that could defeat not just one algorithm, but multiple simultaneously.

Testing Against Real Surveillance Systems

Swearingen focused his testing on 11 open-source detection algorithms representing systems actively used in policing and corporate surveillance. The targets included software powering Flock license plate readers—among the most prevalent automatic license plate recognition systems in the United States—Axon body-worn cameras used by law enforcement, and Clearview AI, which operates one of the largest facial recognition databases in the world. The fact that patterns could defeat multiple systems at once suggested they exploit fundamental properties of how these detection algorithms interpret images.

Continuous Pattern Evolution

Once optimized, the model did not stop. According to Swearingen, it now generates new patterns every minute, with each batch mathematically superior to the last. This ongoing refinement means the patterns are constantly improving, adapting to any incremental changes in detection algorithms. He has intentionally kept his most effective patterns offline to prevent camera makers from using them as training data to update their systems—a deliberate choice to maintain the advantage.

The First Public Demonstration

On Friday at the Def Con cybersecurity conference in Las Vegas, Swearingen conducted his first real-world field test. Working with Donut Media, a YouTube channel focused on automotive content, he applied one of his generated patterns to a 2009 Toyota Yaris and tested whether the vehicle would evade detection by an operational Flock camera.

What the Def Con Test Showed

The demonstration proved successful. Swearingen confirmed that the pattern-covered vehicle was effectively invisible to the Flock system’s detection algorithms. The test validated the theoretical research by showing that patterns created entirely through machine learning could defeat surveillance hardware in real conditions, not just in controlled lab environments. Video documentation of the test is expected within weeks.

Technical Challenges

Despite the overall success, Swearingen noted that certain vehicle components presented obstacles. The wheels, for example, proved difficult to cover with the pattern while maintaining the design’s effectiveness. This suggests that real-world deployment will require refinement to account for the geometry and material properties of actual objects.

Deploying Patterns to the Public

The next phase of noRecognition involves making the patterns accessible to people who want them. Swearingen has launched a crowdfunding campaign to support early merchandise featuring the patterns, including t-shirts and hoodies. Vehicle skins may follow. A critical requirement is that the patterns maintain high resolution and quality over distance, so they function against surveillance systems while appearing aesthetically appealing as consumer products.

The Business of Counter-Surveillance

Converting research into wearable or vehicle-applied products introduces practical constraints. Patterns must be visually attractive enough for people to wear or display, while maintaining the mathematical properties that defeat detection. The balance between functionality and fashion represents a novel challenge in commercializing adversarial AI research.

Staying Ahead of Detection Improvements

Swearingen faces an ongoing arms race. As detection systems improve or as camera manufacturers learn about adversarial patterns, his model must continue generating new designs faster than countermeasures can be deployed. By keeping powerful patterns off the public internet, he preserves a window of advantage. But he acknowledges that the work is incomplete—the model continues grinding out new candidates, and each failure in the real world feeds back into the system as training data.

The noRecognition project demonstrates that the cat-and-mouse dynamic between surveillance systems and privacy-protective technologies is shifting into new territory. Adversarial AI, once confined to academic papers and security research, is becoming a practical toolkit available to people who view algorithmic tracking as a threat to fundamental freedoms.