This ‘adversarial’ pattern can prevent surveillance cameras from detecting you

Bill Swearingen ran 31 million tests. That number should stop you. Thirty-one million iterations to teach a model how to paint noise that looks like nothing to a detector but looks like a shirt or a bumper sticker to a human. The result: patterns that make license plate readers and surveillance cameras go blind to whatever they cover. A person wearing one becomes a needle in the haystack again — until someone knows where to look.

Let that sink in. The cameras still record. They still stream. They still store. They just stop alerting. The detection layer — the algorithmic sieve that turns raw footage into actionable intelligence — chokes on the pattern. That distinction matters. It means the surveillance infrastructure remains intact. The panopticon keeps watching. It just fails to *see* you. For now.

Swearingen calls it noRecognition. He frames it as an opt-out button for algorithmic tracking. Privacy as a fundamental right. The rhetoric is clean. The reality is messier. He is a middle-aged white man in Kansas City who admits he has never faced discrimination for who he is. He wanted to attend a protest but feared the cameras. That fear is valid. But the solution he built assumes the adversary is a static model. It isn't. The detectors update. The models retrain. The patterns that worked on Friday's firmware may fail on Monday's patch.

This is the central flaw in adversarial defense: it is inherently reactive. You optimize against a known target. The target moves. The surveillance vendors — Flock Safety, Motorola Solutions, Genetec, the dozens of others embedding detection into municipal camera networks — have every incentive to harden their models against exactly this class of attack. They have budgets. They have teams. They have the home-field advantage of controlling the deployment pipeline. Swearingen has a GPU cluster and a clever insight. That asymmetry does not favor the defender.

The Def Con demo proved the concept works on a vehicle in a parking lot under conference conditions. One vehicle. One pattern. One moment. That is not a threat model. That is a proof of concept. Real-world deployment means weather, lighting, angle, distance, occlusion, motion blur, camera heterogeneity, firmware version fragmentation. It means adversarial training against an ensemble of detectors, not a single YOLO variant. It means the pattern on your hoodie survives a wash cycle and still fools a model trained last Tuesday.

And even if it works, what then? The camera recorded you. The footage exists. A human analyst or a later model run can still find you. The pattern buys you evasion from *automated* flagging. It does not buy you invisibility. It buys you time. Time until the next model update. Time until someone correlates your gait, your phone's MAC address, your license plate from three blocks away. Surveillance is a system. Defeating one component does not defeat the system.

Swearingen knows this. He is a cybersecurity professional. He co-founded SecKC. He understands threat modeling. His own framing — "opt-out of being tracked" — overpromises what the technology delivers. You cannot opt out of a dragnet by wearing a sweater that confuses the sorting machine. The net still catches you. The machine just fails to label the catch automatically. That is a tactical win, not a strategic one.

The deeper question is why the burden falls on the watched. Why must citizens engineer adversarial noise to reclaim a baseline of anonymity in public space? The cameras proliferated without consent. The detection layers were added without public debate. The facial recognition matches run against driver's license databases without opt-in. Swearingen never agreed to have his face enrolled in a criminal investigation lineup every time he drives to the grocery store. Neither did you. The pattern is a symptom of a broken social contract, not a restoration of it.

There is also the legal shadow. Adversarial clothing exists in a grey zone. No federal statute bans confusing a detector. But local ordinances against "obscuring license plates" or "interfering with law enforcement" are broad and creative. A prosecutor motivated by a high-profile case could stretch those statutes to cover a hoodie that defeats a plate reader. The pattern on your car — the one Swearingen demoed — is a brighter line. Plates must be readable. A pattern that blinds the reader but not the eye is an invitation to a traffic stop that becomes a court case.

The technology is clever. The insight — that detection is a separate, attackable layer atop recording — is sharp. The open-source intent is admirable. But the editorial posture must be clear: this is a niche countermeasure in an asymmetric war. It will protect a few hundred hobbyists and protesters in the near term. It will not scale to a population. It cannot. The iteration speed of the offense outpaces the defense. The vendors push updates over cellular backhaul. The pattern wearer pushes... nothing. They wear a static print.

Swearingen's next step is a pattern generator anyone can run. That democratizes access. It also accelerates the arms race. Every generated pattern is a data point for the next detector hardening cycle. The vendors harvest. They label. They retrain. The loop tightens. The only durable fix is policy: bans on persistent identification in public space, strict purpose limitation on camera networks, deletion mandates on footage without warrant. Technical evasion is a protest tactic, not a privacy regime.

We should celebrate the ingenuity. We should use the patterns where they help. We should not mistake them for a solution. The haystack is still burning. The needle is still you. The pattern just lets you slip past the smoke detector — until the building codes change.