NoRecognition: The Adversarial Patterns That Hide You From AI Surveillance

A security researcher has developed a system that generates computer-printed patterns capable of hiding people, faces, and vehicles from AI-powered surveillance cameras — and after 31 million tests, the patterns are making their way out of the lab and onto the street.

Security researcher Bill Swearingen calls the project NoRecognition. It uses a reinforcement learning approach — a genetic algorithm — that "breeds" adversarial textile patterns by testing millions of variations against AI detection models . The patterns don't block cameras from recording video, but they scramble the algorithm's ability to detect a person, face, or vehicle, preventing the system from triggering alerts .

How NoRecognition Works

Swearingen's core method is a self-learning fuzzer that generates adversarial patterns and tests them against open-source object detection algorithms . Patterns that still trigger detection are modified and retested in an iterative loop. After about 31 million test iterations, the system converged on pattern variants that defeated all 11 AI surveillance models in Swearingen's test suite .

"It's a genetic algorithm that breeds adversarial textile patterns, printed on ordinary fabric, that cause cascading failures across the full facial recognition pipeline — person detection, face detection, and identity match — with no electronics and nothing that reads as unusual to a person standing next to you," Swearingen said in a Black Hat preview .

Systems Defeated by NoRecognition

Swearingen's project has been tested against and claims to defeat 11 different AI surveillance models, including:

• Flock — license plate readers and surveillance cameras
• Axon — law enforcement body cameras and surveillance systems
• Clearview AI — facial recognition
• Various other person detection, vehicle detection, and facial recognition models

Notably, Swearingen has stated his system tests against "the real models. Not academic benchmarks. The actual stuff running in Clearview AI, police body cameras, airport security" .

The Def Con 34 Public Test

At the Def Con cybersecurity conference in Las Vegas on Friday, August 7, 2026, Swearingen conducted the first public real-world test of NoRecognition patterns . With help from automotive media outlet Donut Media, a 2009 Toyota Yaris was covered with the computer-generated pattern and driven past a Flock surveillance camera .

According to Swearingen, the vehicle avoided the Flock system's automated detection — the camera did not trigger a detection alert . This marked the first time the patterns were validated against a physical camera in a live environment rather than in digital simulation . However, independent reporters noted the demo was a single unblinded test, and broader peer-reviewed validation remains pending .

The Rise of Adversarial Fashion

A parallel movement called "adversarial clothing" or "adversarial fashion" has emerged as a mainstream trend alongside Swearingen's technical work .

The Guardian reported in July 2026 that designers are incorporating "adversarial patterns" — carefully arranged shapes, colors, and motifs — into garments specifically to confuse facial recognition AI . Brands like Cap_able, Urban Privacy, and Vollebak are producing clothing lines that claim to exploit weaknesses in computer vision models .

Berlin-based artist Simon Weckert debuted a conceptual collection called "Digital Camouflage" — garments printed with generative adversarial patterns designed to prevent AI surveillance detection from any angle or fabric fold . The movement is described as "privacy could be the next big fashion trend," with wearers making a visible statement about the importance of privacy while potentially evading automated facial recognition .

Cap_able, an Italian fashion startup, creates knitwear with adversarial patterns and constructs garments to be reversible, so the user can choose when they want to be detected by AI or not . Its patented process algorithmically develops adversarial patterns, creating what it calls "AI-camouflage" .

Limitations and Arms-Race Implications

The technology is not a silver bullet. Experts point to several important caveats:

• Narrow effectiveness: The patterns do not make a person or vehicle invisible to human viewers or to video recording itself — they only disrupt automated detection algorithms . A human watching the footage can still see the person .
• Model-specific: The patterns are optimized against the specific architectures in Swearingen's test suite. Surveillance companies can update their models to recognize and ignore the patterns, creating a classic adversarial arms race .
• Physical-world fragility: Deployed patterns were printed onto flat fabric in controlled conditions. Real-world factors like lighting, angle, distance, fabric folds, and weather may degrade effectiveness — and the Def Con test was a single drive-by against one camera .
• Retraining risk: As The Guardian notes, experts caution that adversarial patterns work only until the surveillance model is retrained on the adversarial examples, after which the protection may vanish .
• Legal and ethical gray area: While Swearingen frames the technology as a privacy opt-out mechanism, law enforcement agencies may view it as an evasion tool, potentially leading to regulation or legal challenges .
• Insufficient independent verification: Independent reporters noted that the Def Con demo was a single unblinded test, and broader peer-reviewed validation of the patterns' real-world effectiveness remains pending .

What This Means for Privacy

NoRecognition represents one of the most rigorous attempts yet to create a practical, wearable defense against AI surveillance. With 31 million tests and a live demonstration against a Flock camera, the project has moved beyond academic proof-of-concept. But whether adversarial patterns can survive the arms race against rapidly evolving surveillance AI — and whether the broader adversarial fashion movement will deliver real privacy protection at scale — remains an open question.

As Swearingen himself put it, the core question is: "Can physical fabrics truly defeat state-of-the-art facial recognition in real-world conditions?" The answer, for now, is that they can — until the AI catches up.