As people become more aware of the capabilities of AI-powered detection and related surveillance technologies (see some of my posts on these topics below), demand for technology that can defeat facial and voice recognition, as well as other surveillance methods, is increasing.
My posts on various surveillance tech:
I predict that soon people will be asking, “Does this defeat facial recognition?” when talking about clothing, glasses, and other technology.
Counter-surveillance is not new. People have been trying to make face-confusing makeup and reflective accessories for well over a decade. The demand was somewhat lacking, though.
Demand is no longer missing. Flock now has nearly 100,000 cameras across more than 6,000 American communities in 49 states. Facial recognition is running in public spaces across the UK. Innocent drivers have been pulled over at gunpoint because a plate reader made a mistake. People are more aware of this surveillance and its capabilities, and want to defend against it.
The Guardian ran a piece in July 2026 (https://www.theguardian.com/fashion/2026/jul/17/adversarial-clothing-are-garments-designed-to-confuse-facial-recognition-systems-about-to-go-mainstream) on exactly this, asking whether “adversarial clothing” is about to go mainstream. The co-founder of the clothing brand Vollebak told them that anti-surveillance sentiment is now so widespread that all it would take is one celebrity wearing this stuff to a high-profile event for the whole category to take off. Another brand has a coat with infrared LEDs in the hood designed to dazzle night-vision cameras.
Optical blocking. This attacks the light before it reaches the sensor. Infrared-reflective lens coatings, infrared LEDs, retroreflective materials. 404 Media actually tested the Zenni ID Guard lenses and found they do what they claim: you cannot unlock an iPhone with Face ID while wearing them, and your eyes black out in infrared photos. However, if someone photographs your face with an ordinary camera in daylight, you are still perfectly identifiable and still searchable in a face database. It defeats one specific sensing method, not recognition itself.
Adversarial patterns. This attacks the AI model rather than the camera. A pattern is computed specifically to exploit weaknesses in how a vision model decides “that is a person” or “that is a vehicle.” This is the interesting and the fragile one, and it is where the real research is happening.
Data-side reduction. Opting out of facial recognition databases, removing yourself from data brokers, killing your phone’s advertising ID, keeping your address out of public records.
If you want to understand what a serious version of this looks like, look at noRecognition (https://norecognition.org/), a project by Bill Swearingen. TechCrunch covered it here: This ‘adversarial’ pattern can prevent surveillance cameras from detecting you (https://techcrunch.com/2026/08/09/this-adversarial-pattern-can-prevent-surveillance-cameras-from-detecting-you/).
His motivation is one a lot of you will recognize. His town is packed with cameras, sometimes a few feet apart. He never opted in. Last year he wanted to attend a protest and felt uneasy about how many cameras could log people exercising a constitutional right. So he spent a year building the counter.
Here is how it works. The pattern does not stop the camera from recording. Your face is still on the tape. What it breaks is the camera’s ability to detect what it is looking at.
That distinction is the whole ballgame. Modern surveillance cameras are not just recorders; they are taggers. They run detection algorithms that decide “that is a person,” “that is a vehicle,” “that plate reads ABC-1234,” and then fire an alert or write a searchable database row. That automated tagging is what turns a wall of useless footage into a searchable index of everywhere you have been. If the tagging step never happens and no alert fires, no record is created, and you go back to being a needle in a haystack unless a human reviews the footage manually.
How he built it. He used a reinforcement learning model, a system that trains itself through trial and error. Every time a pattern was detected, the model learned from that failure and tried again. He described it to TechCrunch as teaching the model “how to paint.” Roughly 31 million tests later, it generates new candidate patterns every minute, each batch mathematically better than the last.
He scored them against 11 production computer vision models, including the software powering Flock license plate readers, Axon body-worn cameras, and cameras running Clearview AI. The eleventh detector was extracted from a real deployed surveillance camera.
In August 2026, he presented at Black Hat and DEF CON, and wrapped a 2009 Toyota Yaris in one of the patterns to test it against a live Flock camera. His verdict: it worked, though the wheels were a problem.
Here’s an example of clothing:
This project publishes its homework, including the parts that went badly. You can read the dashboard at https://sandbox.norecognition.org/research. Their reported results are strong: 61.7% non-detection on the real extracted camera detector, 90% against a common person detector, 86% on face detection. But they label nearly every one of those numbers as digital, simulated print, and camera. Real fabric, real ink, real lens, real lighting, real angle is described as a deliberate later phase. They state plainly that no single pattern defeats all eleven detectors at once. They document their walls. They score every pattern against a plain black panel of the same size, so a big print that hides you by simply covering you does not count.
That is what transparency looks like, and it is why I trust what they are doing over other companies in this space.
So be careful when you think about buying. Most anti-surveillance clothing brands publish no test results and ask you to trust their aesthetics. Thinking you're protected when you are not is riskier than not being protected, because it creates a false sense of security.
Be skeptical of claims in this space, because people will sell you something they claim “defeats” surveillance tech, but it’s difficult to verify this independently, which is why research is worthwhile.
1. Did they publish test results at all? Without public test results, I would be skeptical that the product works.
2. What was the product tested against, specifically? “Defeats facial recognition” needs clarification. Understanding what models are actually defeated; for example, facial recognition is different than person detection.
3. Are the tests physical or simulated? A number that holds in simulation may not survive real ink on real cotton under a real streetlight.
4. These products will have a shelf life. Will you know when yours is obsolete? The people and companies that make detection models will work to defeat any patterns that break the detection. Swearingen is deliberately keeping his strongest patterns off the Internet so vendors cannot train against them, which tells you exactly how durable a published pattern is. Any pattern popular enough to matter becomes a training target. Assume an expiration date, and assume nobody will tell you when it passes, although I would expect a responsible company in this space to tell you when their product is obsolete.
Also, as a caveat, don’t break any laws. For example, covering your license plate with paint will defeat license plate recognition, but it is also illegal.
I think we will start seeing more and more serious products that defeat AI surveillance; this is just one example.
Stay Safe!
Tate
Did you know that I founded a Scam Protection Company that protects you and your family from scams? It’s like an antivirus, but for scams. Check us out at hellojacana.com or follow our Substack.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.