The AI-Generated Pattern Hides You From Surveillance Cameras—Including Flock

Bill Swearingen spent the past year running one experiment over and over from his home in Kansas City, where he co-founded the SecKC security meetup. About 31 million tests later, he says he can produce patterns on demand that hide whatever they cover from the detection software wired into Flock cameras—the controversial surveillance system being rolled out across America.

He showed it in public for the first time Friday at Def Con, working with the YouTube channel Donut Media to cover a 2009 Toyota Yaris in one of his newest patterns and roll it past a Flock camera.

“We proved it was effective,” Swearingen told TechCrunch, though he said the wheels were a challenge. Donut Media said video of the demo lands in the next few weeks.

The pattern doesn’t blind the camera. Footage still records normally, and a human watching the screen sees a car. What breaks is the layer on top—the object-detection model that decides “that’s a vehicle, that’s a plate, log it.”

So basically, feed an AI detector with enough visual noise engineered against its own math and it logs nothing. The car goes back to being a needle in a haystack.

That’s adversarial machine learning, and it works because computer vision doesn’t see what you see. A wrap that reads as loud graphic design to a person can read as nothing at all to a classifier.

Swearingen built it with a reinforcement learning model that grades its own homework. Pattern gets detected, model adjusts, tries again—what he described as teaching the model “how to paint.” It now spits out fresh patterns every minute, and he’s keeping the strongest ones offline so camera vendors can’t train against them.

“Privacy is a fundamental right,” he said, calling the patterns a way for people to “opt out of being tracked.” He said the idea took hold last year when he wanted to attend a protest and worried about the cameras logging everyone who showed up.

The long tail of hiding from machines

People have been improvising against detection systems for years, usually with hardware store solutions. San Francisco activists put traffic cones on the hoods of Waymo and Cruise robotaxis to freeze them in place, an exploit that needed no code at all.

During last year’s Los Angeles immigration raids, protesters went further and torched several Waymos. Masks, hoods, and brimmed caps remain the default on protest lines. Adversarial clothing labels have been selling face-confusing prints for years, and anti-recognition eyeglasses have arrived with thin evidence they do much.