A Pattern Against Surveillance: How to Fool Recognition Cameras

Cybersecurity specialist Bill Swearingen spent nearly a year running the same experiment over and over — roughly 31 million times in all. His goal was to produce a computer-generated pattern that would keep street cameras from recognizing whatever the pattern covered. He named the project noRecognition.

An important caveat: the patterns don't stop a camera from recording video. What they “jam” is precisely the algorithm's ability to identify objects, people and faces, so the system never triggers and never sends an alert. According to Swearingen, today's detectors let law enforcement fish the frame they need out of an enormous volume of footage, “like a needle from a haystack” — and his patterns put the person back into the haystack.

How it works

Swearingen lives in Kansas City and is a co-founder of the local SecKC community. He told TechCrunch that his city is studded with cameras, sometimes standing just a couple of meters apart, and that neither he nor his fellow citizens ever consented to that kind of surveillance. The spark was wanting to attend a protest: the abundance of cameras capable of tracking participants exercising their constitutional right to free speech struck him as alarming.

He drew on earlier art projects and clothing designed to fool facial recognition. Starting with a simple rig that worked its way through one open algorithm after another, Swearingen eventually turned the tool into a reinforcement learning model — a system that trains itself on which patterns work and which don't. He described it as if he had “taught the model to draw”: every time a pattern failed the test and the algorithm spotted it, the model tried again, until it began defeating several detectors at once.

According to the researcher, the model found “perfect recipes” that beat all 11 of the open algorithms he tested, including the license-plate-reader software from Flock, the body cameras from Axon and systems based on Clearview AI. It now generates new patterns every minute, and each batch is mathematically better than the last.

The first test

Swearingen ran the first public trial on Friday at the Def Con conference in Las Vegas. With help from Donut Media, a 2009 Toyota Yaris was plastered with the pattern to see whether the car would become invisible to a Flock camera. “We proved it works,” the researcher said, admitting that the wheels posed a challenge. Donut Media has promised to release video of the demonstration in the coming weeks.

The next step is to hand the patterns out to anyone who wants them. The project has a crowdfunding campaign to finance a first run of merchandise: T-shirts and hoodies, and eventually wraps for cars. Swearingen keeps the strongest patterns secret so that camera makers can't learn to get around them. The work, he says, is far from finished: “Every failure improves my model, so the patterns just keep getting better.”

Source: TechCrunch