Coat makes wearers invisible to AI security cameras | Hacker News Reader

Coat makes wearers invisible to AI security cameras

petapixel.com

141 pointsmikece82 comments

Seems like it wouldn't take much to update an algorithm so that wearers of these jackets are again identified as people. The next step, of course, would be to flag wearers of these jackets as especially suspicious, since they are trying to evade detection.

Probably, but perhaps at the expense of a huge increase in false positives.

It's a similar reason we humans tend to get scared of rustling in the night, when the majority of the time there's nothing dangerous out there. Because predators are evolved for stealth and camouflage, our brains overcorrect pattern matching to try to detect them, but most of our "detections" are false positives.

> Probably, but perhaps at the expense of a huge increase in false positives.

"Perhaps" is a doing a lot of heavy lifting in your comment, and I find the possible outcome you describe to be very unlikely after looking at the pictures in the article.

Personally, I'm confident that these anti-AI patterns don't work consistently across different person detection models, even though the article doesn't even ask the question, let alone dig into the answer.

The article doesn't present independent evidence that these work at all, let alone against more than just a single toy model built for PoC purposes.

It's an idea that gets clicks, and the oddly-specific "$71" (just an unnecessarily specific conversion from 500 yuan) also helps with attracting clicks. This article is basically just clickbait, in my opinion, not anything substantial.

This is based (or independently developed alongside) CV Dazzle, which makes it harder for algorithms to identify "human" features by obscuring the edges they rely upon.

The original Dazzle camouflage was effective against human eyes too, so there's a pretty high bar for making an algorithm dazzle-proof.

This is not doing anything to the edges, and it does not make it harder for me to see the person on the left, at all: https://petapixel.com/assets/uploads/2022/12/cad42d4d39741ca...

Additionally, most "cvdazzle" results on Google images are trying to obscure the face, not the existence of a person. This research is apparently focused on preventing a person from being detected, not obscuring their face with weird patterns. Even then, the "cvdazzle" stuff that I'm seeing does not make it harder for me to tell there's a person there. It has the same effect of obscuring identity as a ski mask.

I'm referring more to the jackets with the dark IR spots. The one you've linked is definitely using a different weakness of the CV they're using.

>>> The original Dazzle camouflage was effective against human eyes too

> I'm referring more to the jackets with the dark IR spots.

Can your cite your source? Googling for "cvdazzle jacket" turns up nothing. "Dazzle jacket" just turns up a bunch of fashion stuff.

Plus, nothing I've seen from the article -- including the dark IR spots jacket -- is that difficult to identify as a human, so the bar doesn't seem that high.

https://cvdazzle.com/

https://en.wikipedia.org/wiki/Dazzle_camouflage

Once again, cvdazzle seems focused on obscuring a human face, not obscuring the existence of a human, and I don't see how it is more effective than a ski mask.

A choice quote from your cvdazzle link:

> This face is unrecognizable to the Viola-Jones Haar Cascade face detection algorithm. (It does not apply to DCNN face detectors)

So... modern face detectors don't even have trouble with cvdazzle. All four of the detectors in this sample correctly identify the cvdazzled subject from the cvdazzle link: https://huggingface.co/spaces/celebrate-ai/face-detection-cn...

I'll also add a few choice quotes from Wikipedia:

> Unlike other forms of camouflage, the intention of dazzle is not to conceal but to make it difficult to estimate a target's range, speed, and heading.

> The result was that a profusion of dazzle schemes was tried, and the evidence for their success was, at best, mixed.

So, no, dazzle camo does not seem to have a record of being effective against either humans or cameras, so the bar is low to start with, not "pretty high" at all. But, the goal here is also concealment, not obscuring range, speed, or heading, which dazzle camo only had "mixed success" for, and dazzle camo was never designed for concealment at all.

In either case, I'm not talking about hiding a ship on the horizon. I'm talking about the effectiveness of this for hiding a human walking in front of a camera.

What was the goal here? Dazzle camo seems like it was never proven to be that useful, according to wikipedia, and cvdazzle is obsolete according to its own website and a quick test that anyone can perform. As I said from the beginning, the article OP linked appears to be nothing more than clickbait. That $71 coat is not a general solution to AI surveillance, and training a machine learning model to detect it would not make that model suddenly overwhelmed with false positives.

As much as I dislike where this conversation is going ( edit: not this article; just our privacy expectations in general ), I am inclined to agree. Beyond the obvious, as the cat and mouse game continues, people who want to defeat it will need to account for almost inevitable increased number of algo variants and it is unlikely that:

1. They are mutually exclusive 2. They can't be run in close succession 3. They are disclosed and known to the person that tries to avoid them

tl;dr: These tricks work pretty reliably against budget AI systems. But not good ones.

The surprising truth is that these camouflage anti-patterns often work across many AI models. It's been a fairly baffling result in many research papers that the same trick-images work regardless of the model, but with an important catch...

The models need to have been trained on the same dataset. If the model was trained on COCO (super common for finding objects in an image), then you can fool it. Since there are a handful of academic datasets that underlie a ton of CV models, these tricks will often work.

But if the AI company used their own dataset to train the model, you can't fool it like this. (Unless you have an insider steal the dataset for you.) So if a company is good enough to come up with their own data, this doesn't work.

"Model detects people and can be fooled" is a poor way to understand ML in the first place. It's actually "model detects people with an accepted false positive and false negative rate". Different amounts of necessary accuracy lead to completely different model architectures, so of course it's easier to fool one that's been made easier to be fooled.

> Different amounts of necessary accuracy lead to completely different model architectures

Not really. For object detection, there are really only two kinds of architecture in common use - the multi-stage RCNN-style and the single-pass YOLO style. YOLO's are much faster, and not as accurate. But within each of these architectures, there's a big knob you can turn to trade-off speed vs accuracy.

But the incredible truth is that those speed/accuracy trade-offs don't matter at all when facing an adversarial attack like this. The attacks will work reliably very well, as long as there are enough pixels and the t-shirt or whatever is facing the right direction, regardless of how the model is tuned for speed vs accuracy. That is, if you know the dataset it was trained on.

>The next step, of course, would be to flag wearers of these jackets as especially suspicious, since they are trying to evade detection.

https://xkcd.com/1105/

I recently saw a car with all zeros (or O's?) except the 5th digit, which was a U. It took me forever to be sure what I was seeing.

I saw a news story about 'NO TAG' being a particularly bad choice in vanity tags, so of course I went to the DMV and got 'N0 TAG'. ~3.5 years later I haven't gotten anyone else's tickets in the mail but I'm pretty sure it scored me a warning on a thoroughly earned stop.

https://i.imgur.com/SAbCH5Z.png

I have seen something like that: https://photos.app.goo.gl/fMBpenHYzNPg4BsX9

Depending on where on is and how much time it takes for one personally to deal with their mistake, it might be worth it to wear it just to f up surveillance. Any minute of their time wasted a success.

> Seems like it wouldn't take much to update an algorithm so that wearers of these jackets are again identified as people.

Or worse, shell such coat wearers with automatic gunfire: https://www.telegraph.co.uk/world-news/2022/09/26/israel-pil...

sort of like using the Tor Browser.

I feel like we need to give a hat tip to Philip K. Dick's Scramble Suit from "A Scanner Darkly".

http://www.technovelgy.com/ct/content.asp?Bnum=997

And a less metaphorical hat tip to CV Dazzle and the original Dazzle camouflage as well.

And the Ugly T-shirt from one of William Gibson's books.

I experimented with these sorts of adversarial patterns a few years back. It was straightforward to develop a dazzle pattern which messed with your bog-standard Resnet, but they didn't remotely generalize well. Just using a different architecture or sometimes even a different pre-trained model was enough to thwart it.

That's the thing I don't get, why are people making such a big deal about these adversarial patterns when they might not even work on any models that are actually in use?

If you like this there is also https://adversarial-designs.shop/

They sell mugs that show up as dogs/birds/toasters/nothing ... shirts that are stop signs, stickers that are toasters, etc.

Great secret santa gifts or stocking stuffers for ML nerds.

No affiliation, I just think it's cool :)

If I wear that on the side walk, and confuse a self driving car enough that it causes an accident, does that make me an asshole?

Presumably the self-driving car would do a controlled stop for the fake stop sign, so the asshole should be the human driver who rear-ends them for stopping in the middle of the block.

Self driving cars are still required to have a human at the wheel so I don't see much of a problem. Self driving cars need to be

If you get hit yourself, though, don't expect sympathy from the courts or your insurance company.

Chaotic neutral application of Postel's law.

These seem a tad pricey, but very, very cool!

Based on my experience with vision models (my previous company has several thousand models in production), basic CNNs are great at detecting camouflage patterns that they have seen before in training. This type of strategy would have the exact opposite of the intended effect once models were updated with these patterns in the training set.

I guess that is an opportunity for subscription "camouflage as a service".

I think this opens up an interesting cat and mouse game however. Once the model is trained on this shirts, the shirts could just be left around town and all of a sudden everything is a human. Now they have to refine their algorithm even more and the people refine their methods even more and so on and so on until there's too many cases for the model to function effectively.

No, none of this is how ML models work either, unless you're leaving humans in those shirts lying around town.

The model would not be trained against "just shirt" == "human". It would just be more samples from the surveillance cameras of actual humans walking around being labeled properly. (The huge assumption here is that the shirt actually worked in the first place, which would only happen against a specific model, and the article doesn't provide any useful insights into anything.)

That's not necessarily true without knowing what model they're using though. If they're doing dimensionality reduction, the model could learn that if the shirt is present, than the human part of the image really isn't important because the presence of the shirt is a 100% accurate indication for people.

Person detection models draw an outline around each person in frame. What you describe would completely break that, regardless of the model.

The model has to keep more of the context or else the bounding rectangles would be all over the place.

The shirt gives a good idea of proportion and it could figure out the size of the rectangle pretty accurately from that

Not really.

If you want to link to some useful examples of dimensionally reduced person detection models that exhibit this behavior, then by all means, but none of this is how any current models I've seen work. It also wouldn't make sense to deploy such a model if it were so easily confused by shirts lying around. That model would be pretty terrible by any standard. If they're using terrible technology, you probably don't need a special shirt anyways.

Teaching a model to notice people walking through the frame regardless of what shirt they're wearing is simply not "a cat and mouse game", assuming they're not intentionally using a terrible model or a terrible dataset.

I am inclined to treat "research" into gimmicks that undermine assumptions made by one particular trained AI as attention seeking spam by this point. There is no through-line from this discovery to a greater outcome, and we just see this article over and over from different groups.

Nevermind the fact that authorities do not disclose what AI implementations they use to detect people in footage.

Pretty clearly this clothing needs to be digitized (electrified fabrics or screen-like or curvable/bendable screens somewhere) to actually useful and update-able. Using last year's design could mean this year you get caught...

A digitized pendant or pin seems to accomplish the same idea and easy to take with you.

>A digitized pendant or pin seems to accomplish the same idea and easy to take with you.

They don't even resolve at the distances the camera detect people, what effect could they possibly have?

> A digitized pendant or pin seems to accomplish the same idea and easy to take with you.

Citation needed, for each neural network.

This is a losing battle. Basically they are providing training data for the surveillance companies. It's pretty scary that soon we will have more powerful surveillance than Orwell imagined in "1984".

The fact that research was published openly by Chinese students and favorably recognized by Huawei strongly supports that interpretation. That's more or less the polar opposite of what you'd do if you were trying to subvert mass surveillance systems rather than improve them.

A much more thorough investigation of these ideas was done by Adam Harvey 11 years ago: https://ahprojects.com/cvdazzle/

This wouldn't do anything useful in real-world scenarios. Source: I've been heavily involved in AI security cameras for the last decade+.

So... how does this fail and what would be effective these days?

In short, there are too many different kinds of approaches to AI in surveillance cameras to have a universally effective camouflage.

In many cases there is simply not enough pixels on target for these patterns to render in a way that makes them at all distinguishable. You also have to account for the fact that you may wind up viewing a person from any range of a 360 arc/angle, so the pattern would need to be around the entire jacket.

Most algorithms are looking for more of an overall target size and proportions, plus things like target location relative to an artificial horizon or ground plane.

In some cases, this might work to reduce the overall classification confidence, but is unlikely to truly make the person "invisible".

Also, thermal cameras are hardly used anymore. They have been stuck at relatively low resolutions (D1 / 640x480), and modern sensors have really good low-light imaging. Because thermal cameras are still very costly, and because they never produce a "good" image with any identifiable detail, they have become really really rarely used overall. Even so, a few patches on a jacket that show small regions of high thermal contrast are unlikely to fool any systems.

I doubt that these researchers had access to current state of the art perimeter protection analytics products. The most likely tested on lower end easily available consumer based products.

It is hard to say what would be effective overall that is practical. Many systems ultimately fail on people crawling, some will detect this, but often at the trade off of many false alarms, so it is usually not enabled. However, crawling around is not really that practical.

Large groups of people moving very closely together are harder to detect, particularly if they are all dressed very similarly. But, I wouldn't call this a reliable evasion technique.

these fail for a variety of reasons. The dead simple answer is that people who are trying to sell these are doing it off of a gimmick because to truly do this as the commenter suggested is nearly impossible if you are trying to offer an actual solution. Compression often adds noise that is hard to capture, the patterns can change on model updates, you can easily update models to capture these sequences. It relies on both a dumb model and dumb consumer for this work.

I'm curious whether $71 is supposed to be 'surprisingly cheap' for a surveillance-defeating measure, or 'surprisingly expensive' for a coat.

A really good north face winter jacket (The kind you'll want in somewhere like Canada, Chicago, Northern US, etc) are $200-$350. A women's stylish (non-winter) coat can be $500+.

So no, $71 is not that expensive for a coat.

You can usually beat adversarial examples by training against them, which makes the whole thing a cat and mouse game, which in the end only strengthens the AI.

See also "Zero History" by William Gibson (2010) (although the "invisible t-shirt" idea apparently came from Bruce Sterling).

See the scramble suit in Philip K. Dick's A Scanner Darkly

I wonder if there would be repercussion from the Chinese government for wearing this. The fact that people would attempt to create something like this and publicize its finding means maybe there's a bit of hope for more free China?

>I wonder if there would be repercussion from the Chinese government for wearing this.

Only if they are really stupid. Adversarial attacks are easily beatable and if anything this only improves the AI. These attacks exploit the specific structure and training of a neural network, they do not make you "invisible to AI".

What you really want for avoiding security cameras is more high-tech solution (and I know I might be crossing into science-fiction territory here):

A device that looks like forehead flashlight, but actually has a camera and some computer vision AI (or some other way of detecting security cameras), and a laser beam that it can use to blind those cameras.

Or you need something like this: https://futurism.com/the-byte/watch-invisibility-cloak-milit...

Why isn't the security guard curious that someone's just blinded their camera?

You're being downvoted, but I have no idea why. You're completely correct.

Anyone who believes this $71 coat will make them "invisible to AI" doesn't know how machine learning works.

Next step would be programmable patches of IR emitters/absorbers that change in real time during use.

Or beanie caps that use a IR laser to target and blind surveillance cameras like in Doctorow's "Pirate Cinema" novel.

There are guides all over the internet (https://urbanarmor.org/portfolio/miss-my-face/ seems rather effective) but I doubt such clothes will gain any popularity any time soon. I'm also wary of the impact all the IR light emitted from some of these powerful LED lights on the human eye; remaining flood-lighted by invisible light, especially late at night, seems rather risky to me.

All efforts I can find seem rather amateurish. Very little light diffusion on the IR LEDs, or even entire LED strips wrapped around oneself as a way to get a bigger spread.

The final step is we all travel around in the exact same black cube on wheels. Can't get bometrics or your unique gait.

Or just not leave home.

I've always thought that surveillance footage gathered using our tax money should be available to everybody. I thought if everybody can access them, they would understand how we exposed we all are as soon as you leave the house.

Why is it surprising that other people can see whose car is whose when that's the point of having a license plate on the back?

There is a difference between knowing who owns a car, and knowing exactly where is and has been. Imagine a public database where you can type in a license number and get a log of every sighting of the car in the last few weeks.

Somebody has this data, but far as I know its not public.

It’s not super-public, but there are ALPR databases available to private investigators, and of course the police have them.

Cool! I’m gonna add it to the training set.

Until the algorithm gets updated.

The AI is evolving faster everyday. I work on some ai adjacent work, and we have translation and drawing ai internal service that are basically multiple AI's working together seamlessly. Ideally to automate the localization of one our products across 150 countries, even it boosts our productivity 20% it's going to be a huge win.

I wonder about the law here: you wear one of these and get hit by a self-driving car - are you at all culpable? :)

I've heard that an infrared light will make an object invisible to a camera. Anyone know if it's true? That would, surely, make sure it's invisible to the camera and the AI.

Note:

Got my answer: https://www.wikihow.com/Blind-a-Surveillance-Camera

It's no very practical.

The thing is, the answer is really "sort of" or even "maybe". Some of it depends on the camera in question. As I recall the genesis of this idea was rooted in the fact that at a certain point in time, many security cameras (especially cheaper ones) had little or no IR filtering, and a bright IR light source could cause a "flare" effect that would effectively mask other parts of the field of view. But it's hard to know in advance if this will or will not apply to any given camera.

Also, it might be able to, for example, hide your face or mask your car's license plate... but it doesn't make you invisible. In fact, just the opposite... using this technique makes you acutely visible, but just (if all goes well) unrecognizable. Or if you masked the entire field of vision, you might be effectively "invisible" but it would be obvious to anyone watching the camera output that something weird is happening. So you'd be making yourself conspicuous if there's a live operator watching.

So yeah... it does kinda work, but definitely of questionable (but probably non-zero) practicality.

Actually, all security cameras tends to have an IR filter by default, otherwise colors will be off.

Better surveillance cameras will have a "movable cut filter", meaning a mechanism to remove the IR filter from the light path to the sensor to allow for better low-light images. In this mode, the camera reverts to black and white images so you don't get the color shift from the ambient IR light.

Using some average 5mm IR LEDs in a flashlight setup during daylight hours would do nothing most of the time. At night you might be able to cause problems with some cheaper cameras, better units with good Wide Dynamic Range specifications would be able to handle most of these kinds of disruptor devices. You'd need some really powerful IR LEDs, like an array of OSRAM IR LEDs (https://ams-osram.com/products/leds/ir-leds) to create a strong IR floodlight that would cause the camera to be blown out. Also it is common these days for cameras to send alerts on problems with massive image disruption, so you'd have to hope you're trying to disrupt a very cheap system with nobody receiving event notifications (which is admittedly still very common).

Reminds me of the "ugly t-shirt" in William Gibson's _Zero History_.

What I want is small device I can wear under a ball cap running a ML model trained on detecting pronounced and obscured mounted cameras, with a small reticulating arm, an accurate guidance system and fast-targeting 30W laser. Let them detect all they want with cooked image sensors.

Your laser will assuredly shoot people blind in the eyes. Don't do this.

That's not how ML works. Trained properly, it could never mistake an eye for a mounted camera. Also, you missed the descriptor, "accurate."

Get in on it early. Everyone will be wearing one of these.

I can feel a "no true ML fallacy" brewing. 'Properly trained ML' is 'accurate' until it makes a silly mistake and somebody loses an eye. Then it's "still in beta" with Perfect Accurate Function just around the corner, right behind Full Self Driving.

I was surprised by this part of the story... "The coat won first prize in a contest sponsored by Huawei Technologies". The same Huawei between a rock and a hard place (on paper) i.e., much feared in the West, a success story for China. And to evade the AI security of both?

If you were making tech to track people, how would you incentivize people to think outside the box and come up with ways to circumnavigate your tech?

You run a competition and test your tech against the entries.

When your tech fails, know what you need to fix.

>...run a competition and test your tech...

In a typical capitalistic, privately owned and run company, yes.

These coats should change the pattern they generate every second, like Rorschach from Watchmen. That'd not only be cool, but should guarantee anonymity since the current photo of you doesn't match the last photo of you.

Just need a giant soft e ink display.

Reply on news.ycombinator.com