A cybersecurity researcher covered a Toyota in an AI-generated pattern to confuse Flock cameras

Bill Swearingen's NoRecognition project aims to impede AI-powered surveillance systems by creating intricate patterns that confuse software designed to detect people and objects. The initiative gained its initial exposure at the Def Con cybersecurity convention in Las Vegas. Swearingen collaborated with Donut Media to cover a 2009 Toyota Yaris with one of his patterns and drove it near a Flock camera. Swearingen, a cybersecurity expert and the creator of SIXCYBER, confirmed to TechCrunch that the approach was successful.

The pattern does not obstruct the camera from recording; instead, it seeks to prevent the software linked to the camera from accurately identifying the subject. Although the person or vehicle would still be visible in the footage, the detection system might not classify it as a person or object. The primary objective of NoRecognition is to make it more challenging for automated camera systems to monitor individuals in public areas.

Swearingen's motivation for the project stems from concerns about the widespread installation of surveillance cameras. He observed the prevalence of cameras in his hometown of Kansas City, which led him to ponder the difficulty of evading automated tracking. Additionally, he expressed unease about attending a protest the previous year due to the possibility of being tracked by cameras.

NoRecognition has been developed by Swearingen from his residence in Kansas City over the past year, with more than 31 million tests conducted thus far. Initially, the project aimed to dismantle specific open-source object-detection algorithms, but it subsequently transformed into a reinforcement learning model that independently creates and enhances patterns.

The model has successfully generated patterns capable of evading all 11 open-source detection algorithms tested by Swearingen. These algorithms are employed in systems such as Flock license plate readers, Axon body cameras, and Clearview AI. Swearingen noted that the model now generates new patterns every minute, with each unsuccessful test providing valuable data to refine and create even more efficient patterns over time.

The technology falls under the umbrella of adversarial machine learning, which exploits the fact that computer-vision systems interpret images differently from humans. Patterns that appear unusual to a person may cause the detection model to misclassify an object or fail to identify it entirely. NoRecognition differs from efforts to physically obstruct cameras as it targets the software layer responsible for processing video, identifying license plates, and recognizing faces or objects.

This software is a common feature in many camera networks and is utilized by law enforcement agencies to search footage and identify vehicles or individuals of interest. Private entities and local governments also employ automated detection tools in various public spaces, including parking lots and streets.

Swearingen explained that his concerns about the proliferation of surveillance cameras prompted the project. He became increasingly aware of the density of cameras in Kansas City and began contemplating the difficulty of avoiding automated tracking. He also felt uneasy about attending a protest due to the potential for cameras to monitor participants.

While artists and clothing manufacturers have previously attempted to develop designs that confuse facial-recognition systems, Swearingen's project focuses on generating patterns at a much larger scale using a model. The project is currently running a crowdfunding campaign for clothing printed with the patterns, encompassing T-shirts and hoodies.

Swearingen mentioned that vehicle skins could also be produced. He emphasized that he is withholding his most effective patterns for now, as he does not want camera companies to quickly develop countermeasures.