To deal with more advanced convolutional detectors, consider wearing a hat or clothing with adversarial patches [2], simple patterns that can be printed onto stickers. These patches work by feeding the detector inputs that cause an overwhelming bias toward a particular class (eg. toaster), which drowns out the real signal (eg. human face). Even the first generation of adversarial patches are effective against most detectors deployed as of 2020.
[1] http://dlib.net/face_landmark_detection.py.html
[2] Brown et al. https://arxiv.org/abs/1712.09665