This ‘adversarial’ pattern can prevent surveillance cameras from detecting you
This ‘adversarial’ pattern can prevent surveillance cameras from detecting you
这种“对抗性”图案可以防止监控摄像头检测到你
Bill Swearingen has spent the past year running largely the same test, over and over again. The goal was to produce a computer-generated pattern that could block the surveillance cameras lining America’s streets from detecting it. 在过去的一年里，Bill Swearingen 一直在反复进行着同样的测试。他的目标是生成一种计算机图案，能够阻挡美国街头监控摄像头的检测。
Some 31 million tests later, Swearingen says he can now produce patterns on-demand that, when applied to clothing and objects, prevent some of the most commonly deployed license plate readers and surveillance cameras from detecting whatever the pattern covers, from people to vehicles. 经过约 3100 万次测试后，Swearingen 表示，他现在可以按需生成图案。当这些图案应用于衣物或物体上时，可以防止一些最常用的车牌识别器和监控摄像头检测到被图案覆盖的目标，无论是人还是车辆。
His project, which he calls noRecognition, allows people to escape the automatic detection and algorithmic surveillance used across the U.S. and beyond. In recent years, surveillance cameras have been supercharged with the ability to detect what is happening in the footage being recorded, from tracking the license plates of speeding vehicles to using facial recognition to identify suspected criminals, albeit with mixed success and sometimes terrifying results. 他的项目名为“noRecognition”，旨在让人们摆脱美国乃至全球范围内使用的自动检测和算法监控。近年来，监控摄像头的功能得到了极大增强，能够识别录制画面中发生的事情，从追踪超速车辆的车牌到利用人脸识别锁定犯罪嫌疑人，尽管效果参差不齐，有时甚至会产生令人恐惧的结果。
The detection algorithms that power most surveillance cameras today can sift through vast amounts of footage, allowing law enforcement to pick out activity of interest, akin to pulling a needle out of a haystack. Swearingen’s computer-generated patterns do not block surveillance cameras from recording video footage. Instead, they scramble the camera’s ability to identify objects, people, or faces, so that the cameras do not trigger any detection alerts. 目前大多数监控摄像头所采用的检测算法能够筛选海量视频片段，使执法部门能够挑出感兴趣的活动，这就像从大海捞针。Swearingen 生成的计算机图案并不会阻止监控摄像头录制视频，而是会干扰摄像头识别物体、人或面部的能力，从而使摄像头无法触发任何检测警报。
By blocking the camera’s ability to detect what the pattern covers, the person becomes a needle in a haystack again — until someone knows where to look. “Privacy is a fundamental right,” Swearingen told TechCrunch in a call this week. He described his patterns as a way to allow people to “opt-out of being tracked.” 通过阻断摄像头对图案覆盖区域的检测能力，目标人物再次变回了“大海中的针”——除非有人知道去哪里寻找。Swearingen 在本周的一次通话中告诉 TechCrunch：“隐私是一项基本权利。”他将自己的图案描述为一种让人们“选择拒绝被追踪”的方式。
In its first public test Friday at the Def Con cybersecurity conference in Las Vegas, Swearingen successfully demonstrated the pattern printed on a vehicle, proving that these patterns can be effective at defeating surveillance detection in the real world. 在上周五于拉斯维加斯举行的 Def Con 网络安全大会上，Swearingen 进行了首次公开测试，成功展示了印在车辆上的图案，证明了这些图案在现实世界中能够有效规避监控检测。
Teaching a model how to paint
教模型如何“绘画”
In a call from his home in Kansas City, where he co-founded cybersecurity meet-up SecKC, Swearingen told TechCrunch that as a cyber professional he is acutely aware of the privacy and security risks of surveillance. He described how his town is swamped with surveillance cameras, sometimes located just a few feet from each other. He said that he and others never opted in to being watched, just like he never opted-in to having the government use his driver’s license for facial recognition. 在堪萨斯城的家中（他曾在此共同创办了网络安全聚会 SecKC），Swearingen 在通话中告诉 TechCrunch，作为一名网络专业人士，他深刻意识到监控带来的隐私和安全风险。他描述了自己所在的城镇如何被监控摄像头淹没，有时摄像头之间仅相隔几英尺。他说，他和他人从未选择被监视，就像他从未同意政府使用他的驾照进行人脸识别一样。
Swearingen described himself as a middle-aged white guy who lives in the center of the United States, and acknowledged that as a result he has not faced hardship or discrimination for being who he is or what he looks like. Swearingen recounted how last year he wanted to attend a protest, but felt uncomfortable and concerned that the vast number of cameras could track people who were exercising their constitutional rights to free expression. If he felt this way, undoubtedly others would as well, including those who wanted to exercise their rights but may not feel safe or comfortable doing so themselves. Swearingen got to work. Swearingen 将自己描述为一名居住在美国中部的中年白人男性，并承认正因如此，他没有因为自己的身份或外貌而面临困境或歧视。Swearingen 回忆说，去年他想参加一场抗议活动，但感到不安和担忧，因为大量的摄像头可能会追踪那些行使宪法赋予的言论自由权的人。如果他有这种感觉，毫无疑问其他人也会有，包括那些想要行使权利但可能觉得不安全或不自在的人。于是，Swearingen 开始行动了。
For as long as there have been cameras capable of detecting things, there have been efforts to counter the technology. Several art projects and clothing brands have introduced apparel that aims to help people defeat facial recognition. Some eyeglass makers are jumping on the trend, albeit not with much efficacy. Swearingen said his research builds on some of this earlier work, which showed that it was possible to block camera detections. 自从出现能够检测物体的摄像头以来，人们就一直在努力对抗这项技术。一些艺术项目和服装品牌已经推出了旨在帮助人们规避人脸识别的服饰。一些眼镜制造商也加入了这一潮流，尽管效果并不显著。Swearingen 表示，他的研究建立在这些早期工作的基础上，这些工作已经证明了阻断摄像头检测是可能的。
He started out last year with a proof-of-concept test lab that began by incrementally defeating one open-source video camera detection algorithm after another. Over the course of the year, he refined the patterns by scaling up his tests with additional computer processing power. He thanked the wider community who showed up with hardware to help further the project along. 去年，他从一个概念验证测试实验室开始，逐步攻克了一个又一个开源视频摄像头检测算法。在这一年中，他通过增加计算机处理能力来扩大测试规模，从而不断优化这些图案。他感谢了广大社区成员，他们提供了硬件支持，帮助推动了该项目的进展。
His proof-of-concept evolved over time into a reinforcement learning model, essentially a self-contained system that could train itself on which patterns work and which do not against the specific camera algorithms he is testing. In simple terms, Swearingen told TechCrunch that he essentially taught his model “how to paint.” 他的概念验证随着时间的推移演变成了一个强化学习模型，本质上是一个自包含系统，能够针对他正在测试的特定摄像头算法，自我训练哪些图案有效，哪些无效。简单来说，Swearingen 告诉 TechCrunch，他实际上是教了他的模型“如何绘画”。
Each time a pattern failed and an algorithm detected it, the model would try again, over and over, until it eventually defeated multiple algorithms at once. His model soon began to find perfect recipes for patterns that were able to defeat all of the 11 open-source detection algorithms he tested, including the software that powers Flock license plate readers, Axon body-worn cameras, and cameras running Clearview AI. Now the model creates new patterns every minute, each batch mathematically better than the last, he said. 每当一个图案失败并被算法检测到时，模型就会反复尝试，直到最终能够同时击败多种算法。他的模型很快开始找到完美的图案配方，能够击败他测试的所有 11 种开源检测算法，包括驱动 Flock 车牌识别器、Axon 随身摄像头以及运行 Clearview AI 的摄像头的软件。他说，现在该模型每分钟都会创建新的图案，每一批在数学上都比上一批更有效。
On Friday at the Def Con cybersecurity conference in Las Vegas, Swearingen ran his first real-world test. With help from Donut Media, the test involved covering a 2009 Toyota Yaris with one of Swearingen’s newest patterns to see if the car would be invisible to detection by a Flock camera. “We proved it was effective;” said Swearingen; though, the wheels were a challenge, he said. The video of the demo will be out in the next few weeks, said Donut Media. 上周五在拉斯维加斯的 Def Con 网络安全大会上，Swearingen 进行了首次现实世界测试。在 Donut Media 的帮助下，测试内容是将一辆 2009 年款丰田雅力士覆盖上 Swearingen 的最新图案，以观察该车是否能逃过 Flock 摄像头的检测。“我们证明了它是有效的，”Swearingen 说；不过他也提到，车轮部分是一个挑战。Donut Media 表示，演示视频将在未来几周内发布。
With a public demo in Las Vegas now under his belt, the project is early proof that it is possible to avoid algorithmic detection in public spaces. The next step is getting the patterns into the hands of people who want them, he said. The noRecognition project also has a crowdsourcing campaign to help fund the sale of early merchandise featuring the patterns, from T-shirts to hoodies, with the potential for pattern-printed skins for vehicles down the line. Swearingen said the aim is for the patterns to be high quality and resolution good enough to work from a distance, while also looking aesthetically fashionable. 随着在拉斯维加斯的公开演示圆满完成，该项目初步证明了在公共场所规避算法检测是可能的。他说，下一步是将这些图案交到有需要的人手中。noRecognition 项目还发起了一项众筹活动，旨在资助销售印有这些图案的早期商品，从 T 恤到连帽衫，未来还有可能推出用于车辆的图案贴膜。Swearingen 表示，目标是让这些图案保持高质量和高分辨率，以便在远距离下依然有效，同时在外观上看起来时尚美观。