A generated pattern fooled a Flock camera on a 2009 Yaris at DEF CON

A 2009 Toyota Yaris wrapped in a computer-generated pattern pulled past a Flock license-plate camera at DEF CON 34 in Las Vegas on Friday, and the plate never registered. The camera kept recording.

Bill Swearingen spent a year running roughly 31 million tests to produce that pattern. His project, noRecognition, uses a reinforcement-learning model that trains against specific camera-detection algorithms and outputs a printable texture that confuses them, according to TechCrunch's coverage of the demo. "We proved it was effective," Swearingen told TechCrunch, with one caveat: the car's wheels were a problem.

The pattern does not hide the car from the camera's sensor. It scrambles the detection model that decides what the sensor is looking at. The video is intact. A person walking past a Flock, Axon, or Clearview AI camera wearing the right shirt is still on the recording; the algorithm that would normally flag them as a person, a face, or a vehicle is the part that fails. The camera still records. The detection does not fire.

An "adversarial pattern" is a visual design, usually a high-contrast texture, built to exploit weaknesses in a machine-learning detection model. Print it on a shirt, wrap it on a hood, or paint it on a car body, and the model that decides "is this a person / a license plate / a face" returns no answer. The model is fooled at the decision boundary, not at the sensor. The limit is that the model has to be one the project has trained against, and the 11 algorithms on the target list are open-source surrogates for the proprietary products vendors have not confirmed as defeated.

Swearingen's research page quantifies the digital results. In tests using real, extracted model weights, not physical fabric, a full-coverage noRecognition texture drives the f-YOLOv5 surveillance detector to 61.7% non-detection across all 240 held-out garment images at the 0.25 detection threshold, with an occlusion-subtracted lift of +0.537 over the untextured baseline. The YOLOv5 (P2) detector falls to 0.90 non-detection. The P4 (ResNet34-SSD) detector held out longer, "a wall" until a wide-footprint universal tile pushed it to 62.5% held-out non-detection in July 2026.

These numbers are simulated. The physical-world record is one DEF CON test against a single Flock camera, with wheels still a problem, and a Donut Media video of the run due in the coming weeks. The project's code is open on GitHub, and a Kickstarter campaign is selling T-shirts, hoodies, and eventually vehicle skins. The strongest patterns are being kept offline to slow defensive countermeasures.

Three limits, all from the same source basis. The tool does not stop the camera from recording. It does not work against every camera: the model has to be one the project has trained against, and the 11 algorithms on the target list are open-source surrogates for the proprietary products (Flock, Axon, Clearview AI) that vendors have not confirmed as defeated. And it does not work at every footprint: the research page calls out a coverage floor of about 5 to 6% of frame area, where tone rather than pattern structure is the lever, and thin coverings, like a single T-shirt on a person, are not where the banked numbers live.

There is a second number in the data the project itself deprioritizes: an identity-impersonation result where a noRecognition pattern produced an 84.7% held-out success rate at making the model see a different person. The project is keeping the result offline, in favor of the simpler opt-out use case.

Detection and recording are separate layers, and a printed pattern can break the first one without touching the second. Donut Media is set to publish a video of the DEF CON run in the coming weeks; Flock, Axon, and Clearview AI have not commented on the result.