DEF CON - noRecognition: Could a pattern on clothing fool Facial Recognition? - Bill Swearingen
DEFCONConference
73,981 views
You are being watched. Not in the vague, philosophical sense. Right now. The ATM you used this morning. The gas pump. Every doorbell on your block. The 125 smart streetlights you walked past on your way to lunch. You are indexed, cataloged, and matched against databases you never consented to join, by AI models that are wrong more often than the vendors will ever admit.
Other solutions to this involves looking ridiculous. Face paint. IR glasses. Masks. Real-time deepfake software running on your phone. Congrats, you defeated the algorithm AND ensured every human within 50 feet is staring at you. Super subtle. I built something different. noRecognition is a genetic algorithm that breeds adversarial patterns, printed on ordinary fabric, that defeat the entire facial recognition pipeline: person detection, face detection, and identity recognition across 10 models used by Clearview AI, Axon, Hikvision, and Palantir. No electronics. No software. You look like a person wearing a scarf. The AI sees nothing.
I will demonstrate this live on stage. One camera. One scarf. Zero detections. Come watch me disappear.
20 Comments
it'd be cheaper if they just gave you a new car
DEF CON - noRecognition: Could a pattern on clothing fool Facial Recognition? - Bill Swearingen
DEFCONConference
73,981 views
You are being watched. Not in the vague, philosophical sense. Right now. The ATM you used this morning. The gas pump. Every doorbell on your block. The 125 smart streetlights you walked past on your way to lunch. You are indexed, cataloged, and matched against databases you never consented to join, by AI models that are wrong more often than the vendors will ever admit.
Other solutions to this involves looking ridiculous. Face paint. IR glasses. Masks. Real-time deepfake software running on your phone. Congrats, you defeated the algorithm AND ensured every human within 50 feet is staring at you. Super subtle. I built something different. noRecognition is a genetic algorithm that breeds adversarial patterns, printed on ordinary fabric, that defeat the entire facial recognition pipeline: person detection, face detection, and identity recognition across 10 models used by Clearview AI, Axon, Hikvision, and Palantir. No electronics. No software. You look like a person wearing a scarf. The AI sees nothing.
I will demonstrate this live on stage. One camera. One scarf. Zero detections. Come watch me disappear.
One thing everyone gets wrong: person detection, face detection, and face recognition are three different problems. Beating one tells you nothing about the other two. My goal is to prevent the small model running on the camera from even detecting you, so the downstream pipe-line never runs. For example, a Flock camera detects motion, then uses a small object detector to determine if there is an object present (car, truck, person, etc) and then starts recording, and then sends that video back to the mothership. If they never detect an object, it just goes back to sleep. Nothing uploaded to the mass surveillance state.
I hold my testing to the hardest bar I know how to hold. Digital renders find the strongest patterns. Printing them on real fabric and testing against real cameras is the next phase, and that's exactly what the Kickstarter funds: the cameras, the fabric, the print runs.
Happy to answer questions, especially the skeptical ones!