What if the AI is designed to flag them as potential bad actors.
If someone whose photo is basically a dark circle with eyes is entered in the system then the next time you ask the system to identify a photo that is basically a dark circle with eyes the system will respond to with the previous match.
Like a bloom filter with a bitvector of size 1.