Security researcher develops AI patterns to hide cars from Flock surveillance cameras

Bill Swearingen spent the past year running one experiment over and over from his home in Kansas City, where he co-founded the SecKC security meetup. About 31 million tests later, he says he can produce patterns on demand that hide whatever they cover from the detection software wired into Flock cameras—the controversial surveillance system being rolled out across America.

He showed it in public for the first time Friday at Def Con, working with the YouTube channel Donut Media to cover a 2009 Toyota Yaris in one of his newest patterns and roll it past a Flock camera.

“We proved it was effective,” Swearingen told TechCrunch, though he said the wheels were a challenge. Donut Media said video of the demo lands in the next few weeks.

The pattern doesn’t blind the camera. Footage still records normally, and a human watching the screen sees a car. What breaks is the layer on top—the object-detection model that decides “that’s a vehicle, that’s a plate, log it.”

So basically, feed an AI detector with enough visual noise engineered against its own math and it logs nothing. The car goes back to being a needle in a haystack.

That’s adversarial machine learning, and it works because computer vision doesn’t see what you see. A wrap that reads as loud graphic design to a person can read as nothing at all to a classifier.

Swearingen built it with a reinforcement learning model that grades its own homework. Pattern gets detected, model adjusts, tries again—what he described as teaching the model “how to paint.” It now spits out fresh patterns every minute, and he’s keeping the strongest ones offline so camera vendors can’t train against them.

“Privacy is a fundamental right,” he said, calling the patterns a way for people to “opt out of being tracked.” He said the idea took hold last year when he wanted to attend a protest and worried about the cameras logging everyone who showed up.

The long tail of hiding from machines

People have been improvising against detection systems for years, usually with hardware store solutions. San Francisco activists put traffic cones on the hoods of Waymo and Cruise robotaxis to freeze them in place, an exploit that needed no code at all.

During last year’s Los Angeles immigration raids, protesters went further and torched several Waymos. Masks, hoods, and brimmed caps remain the default on protest lines. Adversarial clothing labels have been selling face-confusing prints for years, and anti-recognition eyeglasses have arrived with thin evidence they do much.

What separates Swearingen’s project, which he calls noRecognition, is the target list. Swearingen tested against the specific stacks in wide deployment, and Flock is the one drawing heat. The company is facing a growing backlash on Capitol Hill, and internal documents show it pitched a plan to turn 350,000 Uber and Lyft dashcams into a rolling plate-scanning fleet.

Automated readers have already pulled over innocent drivers at gunpoint over bad matches, and immigrants and protesters keep getting swept into ICE’s AI dragnet. Lawmakers are pressing Meta over facial recognition in its smart glasses on a parallel track, so any legal measure to fight against automatic detection technology is being studied by privacy enthusiasts.

Swearingen’s noRecognition project is running a crowdfunding campaign to fund early merchandise—T-shirts and hoodies now, vehicle skins later. Swearingen said the goal is resolution high enough to work at a distance and design good enough that people will actually wear it.

Driving a wrapped car on public roads is its own legal question, and plate obstruction statutes vary by state. The patterns cover bodywork, not plates.

“Every failure improves my model, and so [the patterns] keep getting better and better,” Swearingen said.