Artificial intelligence is increasingly being used to make surveillance systems more capable, but a new cybersecurity project demonstrates the other side of that equation: AI can also be used to make people and objects harder for automated systems to recognize.

Security researcher Bill Swearingen has spent the past year developing computer-generated visual patterns designed to interfere with surveillance algorithms. After approximately 31 million tests, his project, called noRecognition, has produced patterns that he says can disrupt the automated detection capabilities of several commonly deployed surveillance systems.

The significance of the project goes beyond an unusual piece of clothing or a modified vehicle. It highlights an emerging technological contest between systems designed to identify everything in a camera's field of view and systems designed to make selected objects algorithmically difficult to identify.

Modern surveillance has evolved considerably beyond simply recording video. Computer vision systems can automatically analyze enormous quantities of footage, identify vehicles, read license plates and recognize faces. That automation allows authorities and other operators to locate specific activities without manually reviewing hours of recordings.

The noRecognition approach does not prevent a camera from recording an image. Instead, its objective is to interfere with the interpretation layer that sits between the camera and the surveillance operator. A camera may continue to capture the person or object, but the detection software can fail to classify it or trigger an alert.

This distinction is strategically important. The future of surveillance is increasingly dependent on software rather than cameras alone. As cameras become cheaper and more widespread, the competitive value increasingly lies in the algorithms capable of extracting useful information from the resulting footage.

That creates a new cybersecurity battlefield.

Swearingen began his work by testing ways to defeat individual open-source computer-vision algorithms. The project subsequently evolved into a reinforcement-learning system capable of evaluating which patterns succeeded and which failed. In effect, the model repeatedly generates visual designs, tests them against detection systems and uses the results to produce improved versions.

The researcher describes the process as teaching the model “how to paint.” Instead of optimizing a conventional image for human perception, the system optimizes patterns against machine perception.

According to Swearingen, the resulting model eventually generated patterns capable of defeating all 11 open-source detection algorithms included in his testing, including systems associated with Flock license-plate readers, Axon body cameras and cameras running Clearview AI software. He says the system can now generate new patterns every minute, with each iteration mathematically improving on previous attempts.

The first public demonstration moved the project beyond the laboratory. At the Def Con cybersecurity conference in Las Vegas, a 2009 Toyota Yaris was covered with one of the generated patterns and tested against a Flock camera. Swearingen said the experiment demonstrated that the technique could work under real-world conditions, although the vehicle's wheels presented a remaining challenge.

The commercial implications are equally interesting. The project is not being positioned solely as an academic experiment. Its creators are exploring merchandise such as T-shirts and hoodies featuring the patterns, with vehicle skins potentially following later. The objective is to combine technical effectiveness with designs that people would actually want to wear or display.

That introduces an unusual business model: turning an adversarial machine-learning technique into a consumer privacy product.

If such technology becomes reliable, it could create a new category within the privacy market. Consumers may increasingly seek products that do not simply protect data after it has been collected, but instead interfere with automated data collection at the point of capture.

The concept could extend beyond surveillance cameras. As computer vision becomes embedded in retail stores, transportation networks, smart cities and other environments, the ability to influence how machines interpret visual information could become increasingly valuable.

At the same time, the technology creates an arms race. Swearingen is deliberately withholding his strongest patterns from public distribution because surveillance-system operators could analyze them and modify their algorithms to recognize the patterns. The researcher says his models continue to generate new designs, creating a cycle in which each successful defense potentially becomes the starting point for a new detection technique.

This dynamic mirrors a broader pattern in cybersecurity. Defensive technologies rarely remain static because attackers and defenders continuously adapt to one another. What makes adversarial patterns particularly significant is that the contest takes place at the level of machine perception itself.

For surveillance companies, the development is a warning that accuracy cannot be measured only under normal operating conditions. Systems may need to be evaluated against intentionally manipulated visual inputs, environmental changes and adversarial behavior.

For governments and law-enforcement agencies, the issue is more complicated. Surveillance systems are often justified by their ability to identify threats or investigate crimes, but their expansion also raises questions about consent, proportionality and the ability of individuals to move through public spaces without being automatically identified.

The noRecognition project emerged partly from precisely this privacy concern. Swearingen said his interest intensified after he considered attending a protest and became concerned that the large number of cameras could allow participants to be tracked. His argument is that people should have a mechanism to opt out of automated tracking rather than being automatically enrolled in it.

That argument is likely to become more relevant as facial recognition and automated video analysis expand. The central policy question may eventually shift from whether authorities are allowed to deploy surveillance cameras to whether individuals should have meaningful technological mechanisms to resist automated identification.

There is also an important limitation to the current technology. Demonstrating that a pattern can defeat selected algorithms does not mean that it can defeat every surveillance system, camera configuration or future detection model. Changes in lighting, viewing angle, distance, image quality and algorithm design can affect performance. The public demonstration therefore represents early evidence rather than a universal solution.

Nevertheless, the experiment exposes an important weakness in the assumption that better AI will automatically make surveillance more effective. The same advances in machine learning that improve recognition can be repurposed to optimize inputs specifically designed to confuse recognition systems.

This could become a defining feature of the next stage of computer vision: not simply better models competing against worse models, but models competing against adversarial environments deliberately engineered to confuse them.

The commercial and regulatory consequences could be substantial. Surveillance vendors may need to invest more heavily in adversarial robustness, while privacy advocates may view machine-resistant clothing and visual patterns as a new category of personal digital rights.

Ultimately, the importance of noRecognition is less about whether a particular pattern can make a person or vehicle disappear from an algorithm and more about what the project reveals about the future of AI.

Machine perception is becoming a contested layer of the physical world. Companies and governments are developing systems that increasingly determine what cameras see and understand, while researchers are developing techniques that challenge those interpretations.

The result is a new technological balance of power: surveillance systems are becoming smarter, but so are the tools designed to resist them.