Adversarial Camouflage Beat Flock, Axon and Clearview AI at DEF CON
A Kansas City researcher's reinforcement-learning-generated pattern evaded a live Flock ALPR camera at DEF CON — and in lab testing, the same pattern class defeated the object-detection code shared by Axon body cameras and Clearview AI.
Key Takeaways
- Researcher Bill Swearingen's noRecognition project used reinforcement learning across roughly 31 million automated tests to generate a printable pattern that defeated 11 open-source object-detection algorithms in lab testing — the same class of code underpinning Flock Safety's ALPR cameras, Axon body cameras, and Clearview AI.
- At DEF CON, wrapping a 2009 Toyota Yaris in the pattern (with YouTube channel Donut Media) evaded a live Flock camera in the field, but only once the windows were covered too — dropping the camera's confidence score below the roughly 75% threshold it needs to capture and log a photo.
- The pattern doesn't disable the camera or its recording; it manipulates the detection model's confidence score so the system declines to flag the vehicle, while a human watching the same footage sees a car.
- Because one pattern transferred across three independently built, commercially deployed vision pipelines, the fragility looks architectural rather than vendor-specific — a reason to test, not assume, the adversarial robustness of any computer-vision security control.
A DEF CON demo, not a lab paper
Bruce Schneier flagged it as "striking" but of uncertain practicality, and the underlying research backs that framing. Bill Swearingen, a Kansas City cybersecurity professional and founder of the SecKC meetup and SIXCYBER, spent roughly a year running his noRecognition project through about 31 million automated tests, using reinforcement learning to converge on visual patterns that scramble the object-detection models behind widely deployed surveillance systems.
He took the work out of the lab at DEF CON in Las Vegas. Working with the automotive YouTube channel Donut Media, the team wrapped a 2009 Toyota Yaris in one of the patterns and drove it past a live Flock Safety ALPR camera. Wrapping the body alone wasn't enough — the camera still flagged the car. Only after the windows were covered too did Flock's confidence score fall below the threshold Swearingen described to Carscoops: "if the camera is less than 75% sure that what it's seeing is a car, it won't snap a photo and save it." At that point the vehicle went undetected, while normal video recording continued unaffected — a person watching the footage could still see a car; the model just wouldn't classify or log it as one.
One pattern, three vendors' pipelines
The more consequential result isn't the stunt itself — it's what the lab testing showed before the car ever hit the road. According to reporting on the project, the converged pattern defeated 11 open-source detection algorithms, which happen to be the kind of code running inside Flock's ALPR cameras, Axon body cameras, and Clearview AI's facial-recognition pipeline. A single adversarial input transferring across three separately built, commercially deployed computer-vision products suggests the weakness sits in the shared architecture of common object detectors, not in one vendor's implementation.
That distinction matters for anyone evaluating vision-based security controls: a defect that's vendor-specific gets patched by switching vendors. A defect that's architectural doesn't.
The impracticality is real, and so is the direction of travel
As a personal countermeasure, this is a hard sell. Blocking the windows to defeat detection also blocks the driver's own visibility and turns a car into the most conspicuous thing on the road — the opposite of hiding in plain sight. Reporting on the project notes that less conspicuous approaches, such as adversarial patterns applied directly to license plates rather than an entire vehicle, are already being explored as a more viable evolution of the same idea.
For PyramidLedger's readers, the news value isn't the car wrap. It's the demonstration that adversarial-example attacks — a research topic since at least the mid-2010s — now reliably transfer to production surveillance and identity systems that organizations, and law enforcement agencies, treat as trustworthy detection layers.
What this means if you rely on computer vision for security
If a detection or classification model sits anywhere in your security stack — perimeter object detection, plate-based access lists, camera-driven alerting — "it worked in our validation set" is not evidence it resists someone motivated to defeat it. Adversarial robustness is a property you have to test against your specific model and deployment, ideally as part of the same red-teaming discipline applied to any other security control, and it should not be the only signal a critical decision depends on.
Not sure it's practical, but it's certainly striking.
— Bruce Schneier, Schneier on Security
Frequently Asked Questions
What is an "adversarial pattern" in this context?
It's a visual pattern engineered — here, via reinforcement learning across millions of automated tests — to exploit blind spots in a computer-vision model's object-detection logic, causing it to misclassify or fail to flag an object it would normally recognize.
Does this mean Flock's cameras were hacked?
No. The camera and recording pipeline kept working normally. The attack manipulates the confidence score of the detection model itself, so the system doesn't log a match — it's an evasion technique against a classifier, not a system compromise.
Why does it matter that the same pattern also worked against Axon and Clearview AI's algorithms?
In lab testing it defeated 11 open-source detection algorithms shared across those products, indicating the fragility comes from common computer-vision architecture rather than a single vendor's bug — which is harder to fix by simply switching suppliers.
Sources
- 1Automobile Camouflage to Hide from Flock Cameras — Schneier on Security
- 2This 'adversarial' pattern can prevent surveillance cameras from detecting you — TechCrunch
- 3You Can Hide From Flock's Cameras, If You Turn Your Car Into A Blindfold — Carscoops
- 4How Camouflage Confuses Flock Cameras And Their Detection Algorithms — Jalopnik