This Toyota Yaris Vanished From an AI Surveillance Camera
All blog articles
A 2009 Toyota Yaris, wrapped in a computer-generated pattern, sat parked in a Las Vegas lot. A surveillance camera built to spot it automatically simply didn't.
The camera was recording just fine. It was the algorithm interpreting the footage that got fooled, and that distinction is the entire point.
We proved it was effective, though the wheels were a challenge.
An adversarial pattern tested live at Def Con
Bill Swearingen has spent the past year producing computer-generated patterns designed to block street-lining surveillance cameras from detecting whatever they cover, after roughly 31 million tests. His project, called noRecognition, targets the systems that identify people, faces, and vehicles.
His patterns managed to defeat all 11 open-source detection algorithms he tested, including the software behind Flock license plate readers, Axon body-worn cameras, and Clearview AI. On Friday, at the Def Con conference in Las Vegas, he ran his first real-world test.
Meet the invisible Yaris
With help from car YouTube channel Donut Media, the test involved covering a 2009 Toyota Yaris with one of his newest patterns to see if the car would be invisible to a Flock camera. "We proved it was effective," Swearingen said, though he admitted the wheels were a challenge.
Footage of the demo is expected in the coming weeks. It's easy to laugh at a wrapped hatchback playing digital ghost, but the stakes here go well beyond convention-floor novelty.
This trick has history
The concept isn't new. Back in 2019, researchers at KU Leuven showed that a printed 40-square-centimeter patch could significantly lower the accuracy of a person detector. Academic teams have since applied similar logic to vehicles, generating 3D camouflage optimized against real-time detection models.
What's different with noRecognition is scale and durability: a self-training model running continuously against software actually deployed in the field, not just in a lab. Flock, Axon, and Clearview AI aren't obscure names, they're vendors widely used by American police departments.
A legal and technical gray zone
Wrapping a car or wearing adversarial clothing isn't automatically illegal, but deliberately obscuring a license plate is, in several US states. The line between security research and an evasion tool stays blurry, and that's probably intentional on Swearingen's part, since he frames the work as a demonstration of these systems' limits rather than a how-to guide.
For more on the friction between AI and surveillance, check our coverage of Google pulling its AI from Google Earth after deepfake incidents.
What is an adversarial pattern?
It's an image or texture engineered to exploit weaknesses in a neural network, causing it to fail at detecting or classifying an object, person, or vehicle correctly, without the image looking altered to a human eye.
Does Bill Swearingen's pattern work against every camera?
No, it has only been validated against 11 specific open-source detection algorithms, including software used by Flock, Axon, and Clearview AI, and its effectiveness varies with angle, distance, and camera model.