DarkCogswell: How Adversarial Clothing Patterns Defeat Machine Vision and AI Surveillance

TL;DR: DarkCogswell (noRecognition) is an open-source adversarial machine learning research project that generates computer-designed clothing patterns to defeat production computer vision and surveillance systems. By exploiting gradient vulnerabilities in convolutional neural networks and object detection architectures like YOLO, SSD, and ArcFace, these printed fabric textures suppress person bounding boxes, shift detections, or induce identity impersonation without requiring electronic jammers.

Modern surveillance has evolved beyond human security guards monitoring closed-circuit television (CCTV) feeds. Municipal street cameras, automated licence plate readers, commercial security cameras, and tactical reconnaissance drones now run autonomous deep-learning models on edge hardware. These neural networks continuously scan optical feeds, identify human bodies, isolate faces, and track individuals across urban environments in real time.

For privacy researchers, electronic countermeasures specialists, and field operators, understanding how automated machine vision processes optical data is becoming as vital as understanding RF spectrum propagation. Optical detection algorithms don’t “see” human beings the way biological eyes do; they process mathematical tensors through convolutional layers, feature pyramids, and non-maximum suppression (NMS) thresholds. When those mathematical assumptions are systematically disrupted, the detector fails.

DarkCogswell, developed by security researcher Bill Swearingen and documented at sandbox.norecognition.org/research, represents one of the most rigorous, scientifically honest investigations into physical and digital adversarial camouflage. Rather than relying on speculative art projects, DarkCogswell uses dedicated GPU compute fleets to optimize fabric textures against an 11-detector surveillance gauntlet, including production models extracted directly from deployed enterprise cameras.

Last updated: August 2026.

What is DarkCogswell and Adversarial Camouflage?

DarkCogswell is an open-source adversarial machine learning research platform that discovers, trains, and evaluates printable fabric patterns designed to defeat automated object detection and facial recognition neural networks.

+-------------------------------------------------------------------------+
|                    Physical Reality & Optical Sensor                    |
|       [Target Individual Wearing Adversarial Printed Garment]           |
+------------------------------------+------------------------------------+
                                     | (Optical Light Wavefront)
+------------------------------------v------------------------------------+
|                         Camera Sensor & ISP                             |
|               [2D Digital Pixel Matrix (RGB Tensors)]                   |
+------------------------------------+------------------------------------+
                                     |
+------------------------------------v------------------------------------+
|                  Machine Vision Detection Pipeline                      |
|  - Feature Extraction (Backbone: CSPDarknet / ResNet / MobileNet)       |
|  - Multi-Scale Aggregation (Neck: PANet / FPN / BiFPN)                  |
|  - Dense Prediction (Head: Anchor Boxes, Objectness, Class Confidence)  |
+------------------------------------+------------------------------------+
                                     |
     +-------------------------------+-------------------------------+
     | (Without Adversarial Pattern) | (With DarkCogswell Pattern)   |
     v                               v                               v
[Standard Person Box: 94%]    [Objectness Collapses Below 0.10 / NMS Fails]
[Tracker Locks Coordinates]   [Result: 0 Boxes Detected / Total Stealth]

Traditional military camouflage is designed to blend human silhouettes into natural surroundings such as foliage, sand, or snow, deceiving the human visual cortex. In contrast, adversarial camouflage targets the mathematical feature representations inside artificial neural networks (ANNs).

When a deep learning model like YOLO (You Only Look Once) or SSD (Single Shot MultiBox Detector) inspects an image, it extracts hierarchical features:

1. Low-level features: Edges, gradients, textures, and colour contrasts.
2. Mid-level features: Limb shapes, joint angles, and torso geometries.
3. High-level semantic features: The composite concept of a “person” with an associated bounding box and confidence score.

DarkCogswell crafts high-frequency visual textures that introduce carefully calculated gradient perturbations into the image. When these textures pass through the network’s convolutional filters, they maximize the loss function associated with the “person” class or drive the “objectness” confidence score below detection thresholds (e.g., < 0.25 or < 0.10). As a result, the camera registers empty background space where a human is standing.

The 11-Detector Surveillance Gauntlet

To prevent overfitting to a single model, DarkCogswell evaluates every generated pattern against an 11-detector surveillance gauntlet spanning person detectors, face detectors, and facial recognition embedding networks.

+-------------------------------------------------------------------------+
|                    The 11-Detector Evaluation Gauntlet                  |
+-------------------+--------------------+--------------------------------+
| Person Detectors  | Face Detectors     | Recognition Models             |
| (Bounding Box)    | (Face Boxes)       | (128-D / 512-D Vectors)        |
+-------------------+--------------------+--------------------------------+
| * P1: YOLOv8n     | * F1: InsightFace  | * R1: ArcFace (ResNet)         |
| * P2: YOLOv5s     | * F2: FaceNet-MTCNN| * R2: FaceNet (Triplet Loss)   |
| * P3: SSD-MobileN2| * F3: MTCNN Cascade|                                |
| * P4: ResNet34-SSD| * F4: RetinaFace   |                                |
| * f-YOLOv5 (Edge) |                    |                                |
+-------------------+--------------------+--------------------------------+

1. Person Detectors (Full Body & Torso)

• P1 (YOLOv8n): Ultra-fast single-shot anchor-free convolutional architecture, widely deployed in consumer security devices and smart drones.
• P2 (YOLOv5s): Anchor-based single-shot detector that serves as the de facto commercial industry standard for balanced speed and accuracy.
• P3 (SSD-MobileNetV2): Lightweight edge detector utilizing depthwise separable convolutions for low-power battery cameras.
• P4 (ResNet34-SSD): High-accuracy deep residual network paired with SSD heads, standard in enterprise access control.
• f-YOLOv5 (Real-World Edge Extracted): A production person detector extracted directly from firmware on deployed commercial surveillance cameras. Attacking its exact on-device weights eliminates the “surrogate model gap” that often plagues academic research.

2. Face Detectors

• F1 (InsightFace Buffalo_L): latest multi-task CNN robust against partial facial occlusions.
• F2 (FaceNet-MTCNN): Two-stage cascaded neural detector.
• F3 (MTCNN): Classic three-stage cascade network (P-Net, R-Net, O-Net).
• F4 (RetinaFace): Feature Pyramid Network (FPN) architecture designed for small and distant face detection.

3. Facial Recognition and Feature Embedding

• R1 (ArcFace): Additive angular margin loss network mapping facial crops into discriminative hyperspherical embeddings.
• R2 (FaceNet): Deep triplet loss embedding network producing 128-dimensional identity vectors for biometric matching.

The Three Operational Goals of Adversarial Textures

DarkCogswell categorises pattern capabilities into three distinct operational goals:

+-------------------------------------------------------------------------+
|                  DarkCogswell Three Strategic Goals                     |
+-------------------+--------------------+--------------------------------+
| Goal 1: Concealment| Goal 2: Manipulation| Goal 3: Privacy Gate          |
| (Box Removal)     | (Box Shift / Impers| (System-Level Policy Bypass)   |
| Suppress objectness| Force misclassification| Exploit multi-stage logic  |
| score to zero     | or spatial misdirection| across sensor fusion           |
+-------------------+--------------------+--------------------------------+

Goal 1: True Concealment (Person Box Removal)

The primary objective: removing the bounding box entirely from the detector. When successful, the surveillance system outputs no bounding box, no tracking ID, and no event trigger. In digital simulations against the real-world f-YOLOv5 camera model, full-coverage garment patterns achieved 61.7% non-detection (148/240 held-out evaluations) and 90% non-detection on YOLOv5 (P2).

Goal 2: Output Control (Spatial Shifting and Impersonation)

Rather than hiding the subject, Goal 2 manipulates how the detector behaves:

• Box Shift: Displaces the predicted bounding box coordinates away from the person’s physical location, confusing automated tracking heads.
• Goal 2-F (Identity Impersonation): Forces facial recognition networks (R1 and R2) to produce high-confidence embeddings matching a predetermined third-party identity, poisoning biometric databases without triggering “face undetected” warnings.

Goal 3: Privacy Gate Bypass

System-level exploitation targeting automated decision engines and multi-camera handover algorithms across interconnected surveillance networks.

Scientific Rigour: Occlusion Subtraction and Held-Out Validation

A critical flaw in early adversarial research was attributing successful evasions to the pattern when the garment was simply covering the person’s body (physical occlusion). DarkCogswell enforces strict mathematical controls to ensure genuine pattern-driven defeat:

               True Pattern Evasion (Marginal Score)
                                =
  [Defeat Rate with Adversarial Texture] - [Defeat Rate with Solid Black Control]

+-------------------------------------------------------------------------+
|                    Occlusion-Subtracted Control Setup                   |
+------------------------------------+------------------------------------+
|  Control Subject: Solid Black Garment | Target Subject: Adversarial Pattern |
|  - Identical square-inch fabric area| - Identical square-inch fabric area|
|  - Covers exact same body parts    | - Contains computed gradient ink   |
|  - Baseline Occlusion Score = B     | - Total Suppression Score = T      |
+------------------------------------+------------------------------------+
                                     |
               Calculated Marginal Delta: Delta = T - B
               (Only positive Delta proves genuine adversarial efficacy)

1. Occlusion-Subtracted Scoring: Every candidate pattern is evaluated against an identical solid black control garment with the exact same pixel surface coverage. If solid black achieves 10% non-detection and the pattern achieves 65%, the true marginal gain is reported as +0.55 (55%).
2. Held-Out Person Identities: Patterns are never scored on the same virtual 3D avatars or photo subjects used during gradient optimization. They’re tested against held-out human identities to prove universal generalization.
3. Worst-Angle Metric Reporting: Rather than cherry-picking straight-on camera poses, metrics are recorded across multiple azimuth angles, elevations, and body poses, reflecting the worst-case capture angle.

Compute Fleets and Optimization Architecture

Discovering patterns capable of transferring across 11 distinct architectures requires massive distributed computing power. DarkCogswell utilizes a dual GPU cluster infrastructure:

+-------------------------------------------------------------------------+
|                      DarkCogswell Dual Fleet Setup                      |
+------------------------------------+------------------------------------+
|           Fleet 1: "Cogswell"      |            Fleet 2: "Egon"         |
|  - Gradient-Based Texture Synthesis|  - Evolutionary Multi-Model Search |
|  - White-box loss minimization     |  - PPO Reinforcement Learning      |
|  - Direct backpropagation on PyTorch|  - Cross-architecture transfer test|
+------------------------------------+------------------------------------+
                                     |
             +-----------------------v-----------------------+
             |         Master Recipe Synthesizer Engine      |
             |  - Ranks elite patterns by marginal delta     |
             |  - Validates tile repeatability for textiles  |
             |  - Emits vector print files for fabric presses|
             +-----------------------------------------------+

The optimization pipeline balances multiple mathematical constraints in its loss function:

• Objectness Loss (L_obj): Penalizes high confidence scores in target anchor cells.
• Total Variation Loss (L_tv): Smooths high-frequency noise so that the image remains printable using real textile dyes without becoming blurred into mush.
• Non-Printability Score (L_nps): Penalizes colours outside the physical CMYK gamut of textile dye-sublimation printers.

Comparison: Adversarial Camouflage vs Traditional Concealment

Practical Constraints: From Digital Simulation to Real Fabric

While DarkCogswell demonstrates strong digital results, deploying adversarial clothing in the physical world introduces engineering hurdles that every operator must consider:

1. Fabric Draping and Folds: As a person walks, clothing bends, stretches, and folds. If an adversarial pattern relies on rigid, unwarped geometric alignments, the perturbation shifts and the neural network recovers its person detection.
2. Camera Distance and Resolution: A pattern optimized for a 640×640 pixel frame loses high-frequency details when the subject is 50 metres away from a 1080p security camera. Wide-footprint repeating tiles perform significantly better across varying focal lengths.
3. Multi-Spectral Fusion: Modern military and border security systems combine optical sensors with Long-Wave Infrared (LWIR) thermal cameras. Optical fabric patterns don’t mask thermal signatures unless paired with passive thermal-dissipating textiles.

Frequently Asked Questions (FAQ)

What is DarkCogswell?

DarkCogswell is an open-source adversarial machine learning research project that develops computer-designed clothing patterns to defeat automated computer vision surveillance, object detectors (YOLO, SSD), and facial recognition systems.

How do adversarial clothing patterns fool AI cameras?

The patterns exploit mathematical vulnerabilities in neural network convolutional layers. They introduce calculated visual textures that disrupt feature extraction, driving the model’s person-detection confidence score below the threshold required to generate a bounding box.

What is the difference between digital and physical validation?

Digital validation tests patterns inside software pipelines using simulated lighting, camera angles, and textures. Physical validation requires printing the pattern with textile inks onto fabric and testing it against real-world camera sensors in diverse field environments.

What is occlusion subtraction in adversarial research?

Occlusion subtraction measures a pattern’s true effectiveness by subtracting the baseline detection reduction of a solid black control garment covering the same area. This ensures measured stealth comes from adversarial textures rather than body covering.

Can adversarial clothing defeat thermal or infrared cameras?

Standard printed optical patterns only disrupt visible light sensors. Defeating thermal or night-vision cameras requires combining adversarial geometry with infrared-reflective materials or thermal-dissipating textiles that obscure heat signatures.

Summary: Why Machine Vision Security Matters for Field Operators

The line between electronic warfare, radio frequency auditing, and computer vision security is dissolving. As autonomous drones, smart optical sensors, and edge AI cameras proliferate across the physical world, adversarial machine learning transforms clothing and physical hardware into passive visual countermeasures. Projects like DarkCogswell establish the rigorous mathematical foundation needed to audit, understand, and navigate an increasingly automated surveillance landscape.

73 from 9M2PJU.

Sources and Further Reading

• DarkCogswell Live Research Dashboard – Live metrics, 11-detector progress matrix, and status log.
• noRecognition Project Portal – Official anti-surveillance patterns and resources by Bill Swearingen.
• DEF CON 34 Presentation Materials – Adversarial clothing and machine vision bypass technical sessions.
• Adversarial Patch (Brown et al., 2017) – Foundational research on universal physical adversarial perturbations.
• Making an Invisibility Cloak (Wu et al., 2020) – Real-world adversarial patches on wearable clothing for person detector evasion.