Adversarial fashion clothing aims to fool AI surveillance cameras
AI-powered cameras that can identify faces and license plates now line streets worldwide, and a backlash against them is building. Some people vandalize automated license plate readers (ALPRs) or map them through the DeFlock project; others are turning to clothing designed to confuse the AI itself, a movement often called adversarial fashion. One example, a Kickstarter project called noRecognition, was shown last month at the DEF CON hacker convention.
At the same event, cybersecurity expert Bill Swearingen presented adversarial patterns he built after starting in 2025 with a simple Python fuzzer aimed at YOLO, a widely used object-detection framework. He turned what he learned into a reinforcement learning algorithm that generates colorful geometric patterns, then tested them against 11 object detection models, four built to search for faces, two built to recognize faces, and five built to detect people, most of them publicly available. Successful patterns lowered the models' confidence scores and sometimes stopped detection entirely.
Two companies are already selling wearable versions. Cap_able, founded by Rachele Didero, who is also an assistant professor at the Free University of Bozen-Bolzano in Italy, weaves bold motifs into jacquard-knitted fabric using a patented process; the pattern can lead certain computer vision systems, particularly those built on fast convolutional neural networks, to misclassify wearers as animals or objects. Urban Privacy, cofounded by Daniel Preuss, targets OpenCV-based facial recognition with its Faception Reloaded collection: black-and-white prints abstracted from a human face register as extra faces to detectors, while asymmetrical cuts and wide silhouettes are meant to obscure a wearer's shape and gait.
The idea predates the current wave. Technologist Adam Harvey designed anti-surveillance hairstyles, makeup and heat-reflecting clothing in the 2010s, and in 2019 artist and activist Kate Bertash launched a clothing line called Adversarial Fashion printed with fake license plate numbers meant to feed junk data into ALPR databases.
Experts caution the clothing is a limited defense. Niloofar Mireshghallah, an incoming professor of engineering and public policy at Carnegie Mellon University, notes that camera angle, lighting and how fabric moves can all undercut a pattern, since a single clean frame is enough for a system to succeed, and that gait alone can still flag a wearer even if a camera briefly misreads them as something else. Patterns are also tuned to specific detection models and do not transfer to others, and if surveillance operators manually retrain a future model on a given pattern and the person wearing it, the clothing stops working. Dippu Kumar Singh, senior director of emerging data and analytics at Fujitsu North America, calls it a fragile shield against a threat that keeps improving. Mireshghallah adds that the bigger risk is aggregation: systems can combine weak signals such as a partial face, a background building, a timestamp or a tagged social media post to identify someone even when no single piece would give them away on its own.
Key facts
- Bill Swearingen built a reinforcement learning algorithm that generates adversarial patterns and tested it against 11 object detection models: 4 for face detection, 2 for face recognition, and 5 for person detection, presenting the work at DEF CON.
- Cap_able (founder Rachele Didero) sells jacquard-knitted clothing that can cause certain computer vision systems to misclassify wearers as animals or objects; Urban Privacy (cofounder Daniel Preuss) sells the Faception Reloaded collection targeting OpenCV-based facial recognition.
- The movement traces back to technologist Adam Harvey's 2010s anti-surveillance designs and Kate Bertash's 2019 Adversarial Fashion line, which printed fake license plate numbers to pollute ALPR databases.
- Experts including Niloofar Mireshghallah (Carnegie Mellon University) and Dippu Kumar Singh (Fujitsu North America) say the clothing is model-specific and degrades under real-world conditions, and that gait recognition and data aggregation can still identify a wearer.
- A Kickstarter project called noRecognition was presented at last month's DEF CON alongside Swearingen's research.
Why it matters
AI-equipped cameras that read faces and license plates have spread across streets worldwide, and public pushback is growing beyond complaints: the DeFlock project maps ALPRs, some people vandalize the devices outright, and a small but real industry has formed around clothing that confuses the detection models instead. It marks privacy activism moving from policy debate into something a person can put on their body.
Who it affects
Anyone photographed by street-level facial recognition or license-plate cameras is the intended beneficiary, while the clothing itself is aimed at the object detection and face recognition models operated by surveillance system builders and operators. Researchers like Swearingen and companies like Cap_able and Urban Privacy are the ones building the countermeasures.
How to use it
The approaches on offer differ: Swearingen's reinforcement-learning-generated patterns are research shown at DEF CON rather than a shipped product; noRecognition is a Kickstarter project; Cap_able sells jacquard-knitted clothing through its own line; Urban Privacy sells its Faception Reloaded collection and plans a further piece, a 'shadow cap' with an acrylic face shield cut to blur facial contours. No pricing for any of these is given in the source.
How solid is it
Swearingen's patterns were measured against 11 real object detection models split across face detection, face recognition and person detection, and successful ones lowered the models' confidence scores or eliminated detection outright, a concrete if narrow test. No overall success rate or percentage is given, only that description of the effect, and Cap_able's and Urban Privacy's garments are described by their makers' stated intent rather than by independent test results in the source.
Risks and caveats
The defense is narrow: patterns are tuned to a specific detection model and do not transfer to a different one, and real-world variables such as camera angle, lighting and how fabric folds while walking can defeat them, since a single good frame is enough for a system to work and gait recognition can still flag a wearer's movement. If surveillance operators retrain a future model on a known pattern and its wearer, which they could do manually, the clothing stops working altogether. The deeper risk experts flag is aggregation: partial faces, background details, timestamps and tagged social media posts can be combined to identify someone even when no single signal, including a hidden face, gives them away.
“Privacy is a human right, and the popularity of this just goes to show that people are interested in preserving their privacy”
— Bill Swearingen, cybersecurity expert who built the adversarial patterns