{"id":567519,"date":"2026-08-13T06:26:23","date_gmt":"2026-08-13T06:26:23","guid":{"rendered":"https:\/\/www.newsbeep.com\/nz\/567519\/"},"modified":"2026-08-13T06:26:23","modified_gmt":"2026-08-13T06:26:23","slug":"could-a-shirt-fool-facial-recognition-the-answer-is-complicated","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/nz\/567519\/","title":{"rendered":"Could a Shirt Fool Facial Recognition? The Answer Is Complicated"},"content":{"rendered":"

A camera and its software labeled Bill Swearingen<\/a> as a person. Then it suddenly wasn\u2019t sure \u2014 all because of some weird pattern that he held up to disguise himself.<\/p>\n

I watched it happen from my seat at annual hacker convention Defcon. Swearingen, a longtime cybersecurity professional and founder of the Kansas City security community SecKC<\/a>, stood onstage in front of a live camera feed as a person-detection system analyzed him. On the giant screen behind him, the software\u2019s confidence score cleared 0.75, the threshold it needed to declare that, yes, there was a human being in the frame.<\/p>\n

Then Swearingen raised a flat panel covered in a bizarre black-and-white pattern. The score started falling. It slipped below the threshold, eventually landing at 0.21.<\/p>\n

\u201cNo person detected,\u201d the screen announced in bright green letters.<\/p>\n

It felt like a low-budget magic trick. Swearingen was still standing there, plainly visible to everyone in the room. The software was still receiving the camera image, but it no longer detected a person above the configured confidence threshold.<\/p>\n

Swearingen has spent the past year searching for patterns that can confuse the computer-vision systems used to identify people. His project is called noRecognition<\/a>, and its end goal is to create clothing that makes the wearer harder for AI surveillance systems to detect<\/a>. It\u2019s a fascinating project, but it\u2019s still a work in progress.<\/p>\n

The camera wasn\u2019t trying to identify him<\/p>\n

We tend to call this kind of technology \u201cfacial recognition,\u201d but surveillance systems can involve several separate layers of AI-based detection.<\/p>\n

A person detector asks whether a human body is in the frame. A face detector finds and isolates a face. Facial recognition then compares that face with a database and asks whether it knows who the person is.<\/p>\n

\"APerson detection, face detection and facial recognition perform different jobs, though each step can depend on the one before it.<\/p>\n

The demonstration I saw targeted the first step. The system didn\u2019t mistake Swearingen for somebody else or decide the room was empty. It simply stopped reporting a person detection above the threshold set for the demonstration.<\/p>\n

If you break the first link, the rest of the surveillance chain may never get started. If a camera fails to detect a person, it may never crop out that person\u2019s face, send it to an identity database, then track them across a series of images.<\/p>\n

An AI detector doesn\u2019t \u201csee\u201d a person in the way we do. It generates thousands of guesses about what might be in an image, assigns a score to them and discards anything that fails to clear a chosen confidence threshold.<\/p>\n

Swearingen was still there. The detector\u2019s math just wasn\u2019t sure he was a person.<\/p>\n

How the patterns are made<\/p>\n

Swearingen didn\u2019t sit down and draw the patterns himself. He built a program to create them.<\/p>\n

Security researchers normally use programs called fuzzers to bombard software with strange inputs in an attempt to break it. Swearingen\u2019s fuzzer does something similar with computer vision. It creates a pattern, digitally places it on an image of a computer-generated person and then shows the altered image to several AI models.<\/p>\n

If a pattern causes a major change, like making the person\u2019s detection box disappear or sharply lowering the model\u2019s confidence score, then the fuzzer flags it for more testing.<\/p>\n

The most successful designs are altered and combined to produce new patterns, much like selectively breeding specific traits in animals. Swearingen\u2019s software repeats that process automatically, allowing it to work through far more possibilities than a person could design and test by hand.<\/p>\n

He currently tests each pattern against 11 models: five that detect people, four that find faces and two that try to recognize whose face it is. In many cases, he tested a public model that works similarly to proprietary systems, not the actual software being used by companies in the wild. Most are publicly available models that researchers can run themselves.<\/p>\n

Swearingen said the project had run 31.7 million tests as of June. About 534,600 triggered one of his system\u2019s anomaly rules. That could mean a detector found fewer people or faces than it did in the original image, invented extra ones, produced a much lower confidence score or returned the wrong identity. It doesn\u2019t mean he found 534,600 patterns that could hide someone from a camera.<\/p>\n

\"OnSwearingen\u2019s custom fuzzer automatically generates patterns, tests them against computer-vision models and flags designs that produce unusual results.<\/p>\n

Of those results, 85 met the project\u2019s definition of \u201cextreme,\u201d which means the pattern defeated at least one person detector and at least one face detector in the same test.\u00a0<\/p>\n

The tests also showed that covering more of the body isn\u2019t always more effective. Torso patterns had the greatest effect on person detectors, while patterns closer to the head mattered more to systems looking for faces. In one comparison, Swearingen said a small collar pattern worked better than a much larger print across the torso.<\/p>\n

Even the winning patterns can lose<\/p>\n

Some of Swearingen\u2019s results looked promising until he tested the designs on different people.<\/p>\n

One pattern lowered the detector\u2019s confidence for all four people whose images were used while it was being developed. But when Swearingen applied that same design to images of eight new people, it didn\u2019t work once.<\/p>\n

\"ModelsSwearingen used computer-generated people wearing different garments and accessories to test where adversarial patterns might work best.<\/p>\n

Counted together, the pattern had worked on four of 12 people. Swearingen withdrew the resulting 33% performance claim because every success involved people whose images had been used to develop the pattern. It hadn\u2019t worked on anyone new.<\/p>\n

Another pattern, designed to fool a different detector, worked on all eight new people. That contrast shows how much the results can change between detectors \u2014 what works with one person or detection model may fail with another.<\/p>\n

Even a successful pattern may have a short shelf life. A camera company could retrain its software to recognize it. Swearingen compared the patterns to software \u201czero-days\u201d vulnerabilities \u2014 they take advantage of a weakness that may disappear once the system is updated.<\/p>\n

The shirt doesn\u2019t exist yet, and the tech isn\u2019t field-tested<\/p>\n

On one of Swearingen\u2019s slides, in large type, were the words \u201cStill unproven: The worn garment.\u201d<\/p>\n

During the demo, Swearingen held the pattern in front of his body on a rigid panel. It wasn\u2019t printed on clothing, which would be a much harder test. Ink on a flat board stays exactly where the software expects it to be. Fabric drapes, folds and stretches. Sunlight, shadows, wrinkles, viewing angles and distance all change what reaches the camera.<\/p>\n

Swearingen said most of his 31.7 million tests were digital, with patterns pasted onto images and scored by computer-vision models. The panel demonstration was a limited physical test using a model he said came from a fielded Flock Safety unit. Until a pattern works while printed on fabric, worn by a moving person and viewed through deployed hardware, he isn\u2019t claiming that the clothing itself works.<\/p>\n

\"OnIn a noRecognition digital test, the detector reported the plain-shirt image as a person with 86% confidence but produced no person detection after the pattern was added.<\/p>\n

The noRecognition website<\/a> is promoting a Kickstarter-backed run of T-shirts, hoodies and neckwear, with each pattern scored against 11 models before it ships. Swearingen said the money would help pay for test fabrics, a dye-sublimation printer and additional cameras so he can see whether the patterns still work once they\u2019re printed and worn.<\/p>\n

So could a pattern on your clothing fool facial recognition?<\/p>\n

Maybe. But the real test begins when he prints it on clothing and steps back in front of the camera.<\/p>\n

\t\t\t\t\t\t\t\"Nelson\t\t\t\t\t\t<\/p>\n

\t\t\t\t\t\t\t\t\t\t\tWith more than a decade of experience, Nelson covers Apple and Google and writes about iPhone and Android features, privacy and security settings, and more.
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\tSee full bio\t\t\t\t\t<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"A camera and its software labeled Bill Swearingen as a person. Then it suddenly wasn\u2019t sure \u2014 all…\n","protected":false},"author":2,"featured_media":567520,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[365,363,364,111,139,69,145],"class_list":["post-567519","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-new-zealand","tag-newzealand","tag-nz","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/567519","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=567519"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/567519\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/567520"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=567519"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=567519"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=567519"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}