Vollständiges Transkript von Could a Pattern on Your Clothing Fool Facial Recognition? Interview with Bill Swearingen

and you see somebody wearing a black hoodie with the 65 00:04:44,980 --> 00:04:50,420 hoodie up and sunglasses in a bandana, and you're kind of like, well, I don't know if 66 00:04:50,420 --> 00:04:52,540 I want to be standing next to that dude, right? 67 00:04:52,540 --> 00:04:57,580 So at a human level, I wanted to do something that doesn't flag for humans. 68 00:04:57,580 --> 00:05:02,540 But for a camera level, it causes detections not to work. 69 00:05:02,540 --> 00:05:05,380 I had no idea if it would work or not. 70 00:05:05,380 --> 00:05:08,620 And it's so funny when I tell this story because I think back, that was only a year 71 00:05:08,620 --> 00:05:09,620 ago. 72 00:05:09,900 --> 00:05:14,660 We had AI, but AI wasn't where it's at now, right? 73 00:05:14,660 --> 00:05:18,940 So I had to hand write, I had to hand write a fuzzer. 74 00:05:18,940 --> 00:05:19,940 It was Python. 75 00:05:19,940 --> 00:05:25,060 It was the first time that I'd ever done any real like GPU work, and it was tough and 76 00:05:25,060 --> 00:05:26,060 it was hard. 77 00:05:26,060 --> 00:05:31,980 And it was one of those projects where you get done with work and you're tired, 78 00:05:31,980 --> 00:05:32,980 but you're energized. 79 00:05:32,980 --> 00:05:37,740 And then you look up and it's 4 a.m. and you're like, oh my God, I've been 80 00:05:37,780 --> 00:05:42,220 writing code for, you know, 12 hours out of this 24-hour day. 81 00:05:42,220 --> 00:05:47,620 And what I found real early was as wild success. 82 00:05:47,620 --> 00:05:54,780 So back in the day, a year ago, I was only targeting the base computer vision models. 83 00:05:54,780 --> 00:05:59,940 But the strategy that I employed was that I would take a picture of a person and I 84 00:05:59,940 --> 00:06:03,220 would put them in a green garment. 85 00:06:03,220 --> 00:06:05,900 Let's just picture a green t-shirt or whatever. 86 00:06:05,900 --> 00:06:06,420 Yeah. 87 00:06:06,420 --> 00:06:10,900 I would run that that image past the computer vision model and I would ask it, 88 00:06:11,220 --> 00:06:13,580 how many people do you see in this image? 89 00:06:14,460 --> 00:06:20,500 And then I would apply, I would brute force, fuzzer style, just no direction, 90 00:06:21,100 --> 00:06:23,420 just fuzz and apply. 91 00:06:23,420 --> 00:06:26,620 And then I would ask that vision model, how many people do you see in this 92 00:06:26,620 --> 00:06:28,820 picture? And I would record any anomalies, right? 93 00:06:28,820 --> 00:06:30,860 So anomalies were crazy. 94 00:06:30,860 --> 00:06:34,180 Like I would find some where it would say zero people. 95 00:06:34,180 --> 00:06:37,140 I'd find some that said there were 10,000 people, right? 96 00:06:37,140 --> 00:06:39,380 It was kind of all over the place. 97 00:06:39,380 --> 00:06:42,780 And but what I learned was that, hey, man, I'm onto something. 98 00:06:43,460 --> 00:06:45,220 And so the fuzzer works. 99 00:06:45,220 --> 00:06:49,500 And I know that I'm kind of working on Lego class vision models. 100 00:06:49,500 --> 00:06:53,300 Let's let's go out and let's research what models do the big boys use. 101 00:06:53,300 --> 00:06:58,660 And so I search for S bombs and I search for open source disclosures 102 00:06:58,660 --> 00:07:03,700 and all of those kind of things trying to identify which models clear view 103 00:07:03,700 --> 00:07:10,460 and Palantir and axon and Hick vision, all of those different vendors 104 00:07:10,460 --> 00:07:14,780 trying to understand what the underlying model was and then have built 105 00:07:14,780 --> 00:07:16,940 it's from there. So nice. 106 00:07:16,940 --> 00:07:18,020 That's a great story. 107 00:07:18,020 --> 00:07:21,140 And I guess it's a good way of, I mean, you're kind of bringing 108 00:07:21,140 --> 00:07:23,180 back the the hacker in you, right? 109 00:07:23,180 --> 00:07:26,780 Of like staying up all night, a coding project. 110 00:07:26,780 --> 00:07:28,860 I know. Oh, yeah. 111 00:07:28,860 --> 00:07:30,260 It's a lot of it's been wild. 112 00:07:30,260 --> 00:07:32,380 So, you know, it's been one of those things. 113 00:07:32,380 --> 00:07:35,620 And you don't know how other people, like when they say that they've 114 00:07:35,620 --> 00:07:36,940 been working on it for a year. 115 00:07:36,940 --> 00:07:39,540 Does that mean that they've been kind of working on it for a year? 116 00:07:39,540 --> 00:07:41,820 But this has been my my passion, right? 117 00:07:41,820 --> 00:07:45,780 So and I mean, every single day, I'm trying new things. 118 00:07:45,780 --> 00:07:48,860 And the project has matured significantly since then. 119 00:07:48,860 --> 00:07:50,500 And I've been very fortunate. 120 00:07:50,500 --> 00:07:53,980 It's been amazing the way the hacker community has supported me. 121 00:07:53,980 --> 00:07:59,620 But just trying things, I ended up writing pattern generators with stuff. 122 00:07:59,620 --> 00:08:01,460 I have no idea. Is it going to work or not? 123 00:08:01,460 --> 00:08:06,620 Right. So I had one pattern generator that just literally put bad words, right? 124 00:08:06,620 --> 00:08:08,740 Like the real bad ones, right? 125 00:08:08,740 --> 00:08:12,620 And another one that tried injection strings. 126 00:08:12,620 --> 00:08:15,500 And then all of the other things that you can imagine. 127 00:08:15,500 --> 00:08:20,580 So like camouflage and and all of these, you know, just other techniques. 128 00:08:20,580 --> 00:08:25,260 And what I found actually when I was developing those those pattern 129 00:08:25,260 --> 00:08:28,100 generators is that this was work that had already been done. 130 00:08:28,580 --> 00:08:31,260 And that just absolutely blew me away. 131 00:08:31,660 --> 00:08:33,060 So, wow. 132 00:08:33,060 --> 00:08:37,980 Going back to the 90s, there was a there was an artist, Adam Harvey, 133 00:08:37,980 --> 00:08:41,180 that had worked on makeup patterns. 134 00:08:41,220 --> 00:08:46,340 So CV Dazzle and hyperface

that would do something similar. 135 00:08:46,340 --> 00:08:49,900 And so I kept digging in and I found, you know, 136 00:08:49,900 --> 00:08:53,260 several other researchers that had tried this work before. 137 00:08:53,260 --> 00:08:57,220 And so I started this research on my own and then you find, oh, my gosh, 138 00:08:57,220 --> 00:09:02,180 there's this whole like treasure trove of research has already been done. 139 00:09:02,180 --> 00:09:06,180 And so I feel like I'm kind of taking the torch from there 140 00:09:06,180 --> 00:09:09,860 and actually targeting the harder, more modern models. 141 00:09:09,860 --> 00:09:11,460 Yeah. Yeah. 142 00:09:11,460 --> 00:09:15,300 So what are some surprising things that you found during your research? 143 00:09:15,300 --> 00:09:18,620 Like, you know, obviously you were kind of testing these things on your own. 144 00:09:19,060 --> 00:09:22,740 Like what led you to discover that this is a real thing? 145 00:09:22,740 --> 00:09:24,700 Like this can actually work. 146 00:09:24,740 --> 00:09:27,420 There's been some crazy, crazy findings. 147 00:09:27,500 --> 00:09:31,300 So before I even get into it, you know, like one thing that I want to make sure 148 00:09:31,300 --> 00:09:33,780 that, you know, whenever I'm doing these interviews is that. 149 00:09:34,860 --> 00:09:39,420 For the history of computers, a parser, every single parser 150 00:09:39,420 --> 00:09:43,700 that has ever been written has had difficulty differentiating 151 00:09:43,700 --> 00:09:47,020 between the data that it's supposed to be parsing 152 00:09:47,020 --> 00:09:49,660 and the underlying control system, right? 153 00:09:49,660 --> 00:09:52,580 So from the beginning of time, if you take a look at 154 00:09:52,820 --> 00:09:54,860 that's how SQL injection worked, right? 155 00:09:54,860 --> 00:09:57,460 Like that's how log for shell worked. 156 00:09:57,460 --> 00:10:03,020 Like the parsers have a very difficult time in understanding which data is which. 157 00:10:03,020 --> 00:10:09,180 And as a hacker, our job is to get control of the input source data 158 00:10:09,420 --> 00:10:11,260 that's going inside of a parser. 159 00:10:11,260 --> 00:10:12,220 Think about a camera. 160 00:10:12,220 --> 00:10:16,260 How do I control the data that's going into a camera? 161 00:10:16,620 --> 00:10:18,740 Well, it's what it see, right? 162 00:10:19,700 --> 00:10:24,300 Once I had that realization and that kind of goes back to the fuzzer. 163 00:10:24,300 --> 00:10:25,300 I started working on that. 164 00:10:25,300 --> 00:10:28,540 But some of the things that have fallen out and the surprising things 165 00:10:28,540 --> 00:10:30,380 have been tremendous. 166 00:10:30,380 --> 00:10:35,540 For example, what I learned is I had no freaking idea what I was doing. 167 00:10:36,340 --> 00:10:38,060 I had no clue. 168 00:10:38,060 --> 00:10:43,300 Real early, I made statements like, guys, I'm hacking facial recognition. 169 00:10:43,300 --> 00:10:45,060 And and I. 170 00:10:46,260 --> 00:10:47,140 Nope, I wasn't. 171 00:10:47,180 --> 00:10:50,180 So it turns out that there are different types of detectors. 172 00:10:50,220 --> 00:10:55,420 So in a camera and I'm talking about like a like a small, 173 00:10:56,740 --> 00:11:03,660 you know, like personal, there's a flock, you know, like a small like security 174 00:11:03,660 --> 00:11:07,540 camera, we're talking about very small circuit board, right? 175 00:11:07,540 --> 00:11:09,620 And it has to make a decision very fast. 176 00:11:09,620 --> 00:11:12,860 And so the first stage is object detection. 177 00:11:12,860 --> 00:11:14,300 Do I see a person? 178 00:11:14,300 --> 00:11:15,740 Do I see a car? 179 00:11:15,740 --> 00:11:17,300 Do I see a motorcycle? 180 00:11:17,300 --> 00:11:18,380 What do I see? 181 00:11:18,380 --> 00:11:21,940 Right? Like, it's not it's not who, right? 182 00:11:21,940 --> 00:11:23,020 It's what? 183 00:11:23,020 --> 00:11:24,300 What do I see? 184 00:11:24,300 --> 00:11:29,460 And then there is so there is a person object model. 185 00:11:29,460 --> 00:11:32,300 And then there is a face object model. 186 00:11:32,300 --> 00:11:37,220 So the object model, like that detects a person or a car, it says, what am I 187 00:11:37,220 --> 00:11:40,580 seeing? And then when you take a look at a face model, it says, how 188 00:11:40,580 --> 00:11:42,700 many faces do I see? 189 00:11:42,740 --> 00:11:44,980 And then you move into facial recognition. 190 00:11:44,980 --> 00:11:46,300 Who do I see? 191 00:11:46,300 --> 00:11:49,580 And each one of those are separate problems and they're solved with 192 00:11:49,580 --> 00:11:52,020 different patterns and different injections. 193 00:11:52,020 --> 00:11:55,220 And each one of them is a different problem to solve. 194 00:11:55,900 --> 00:12:00,380 Now, as I learned that, and I actually learned that from Joshua Marpette 195 00:12:00,380 --> 00:12:03,940 from Paul security, he was the guy was like, Bill, you have no idea 196 00:12:03,940 --> 00:12:05,460 what you're talking about. 197 00:12:05,460 --> 00:12:08,860 And then he schooled me and I was like, oh, my God, thank you. 198 00:12:08,860 --> 00:12:10,420 That was so good. 199 00:12:10,460 --> 00:12:14,100 Like, you know, just our friend group is just so small, right? 200 00:12:14,100 --> 00:12:15,260 Like, yeah, just. 201 00:12:15,260 --> 00:12:20,660 And so what I learned through my just testing is that the object 202 00:12:20,660 --> 00:12:24,500 detector, what am I looking at the person, the car, the motorcycle, 203 00:12:24,500 --> 00:12:29,940 whatever is not connected to facial recognition flow whatsoever. 204 00:12:30,540 --> 00:12:35,020 But I had this problem, Tom, I had this problem where I spent, 205 00:12:35,380 --> 00:12:38,820 I don't know, a month every night, eight hours of nights trying 206 00:12:38,820 --> 00:12:42,580 to figure out patterns that would beat face detector. 207 00:12:42,620 -->

00:12:45,380 How many faces do you see zero, right? 208 00:12:45,820 --> 00:12:50,740 But then my facial recognition harness would just crash. 209 00:12:50,740 --> 00:12:52,540 And now it's so stupid looking back. 210 00:12:52,540 --> 00:12:54,300 But at that point, I didn't know. 211 00:12:54,300 --> 00:12:58,500 And it turns out that if there are no faces being detected, 212 00:12:58,500 --> 00:13:00,660 it cannot do facial recognition. 213 00:13:00,660 --> 00:13:02,420 There's a pipeline, right? 214 00:13:02,420 --> 00:13:05,620 And now you're like, well, of course, you idiot, you know. 215 00:13:05,940 --> 00:13:08,140 But back then it was like, I didn't know if it was my 216 00:13:08,140 --> 00:13:11,300 tooling or my measuring or, you know, all those kind of things. 217 00:13:11,340 --> 00:13:12,860 But they're separate problems. 218 00:13:12,860 --> 00:13:14,820 So that was a big finding. 219 00:13:14,820 --> 00:13:20,180 And other interesting things are, you know, kind of where my research is right now. 220 00:13:20,180 --> 00:13:23,900 There there is some and I don't really want to go too much into this 221 00:13:23,900 --> 00:13:25,740 because the research is still real early. 222 00:13:25,740 --> 00:13:29,980 But I'm starting to find being able to take over the camera in certain ways 223 00:13:29,980 --> 00:13:33,140 with just with a pattern on a t-shirt or whatever. 224 00:13:33,220 --> 00:13:35,660 It's been really interesting research, quite honestly. 225 00:13:35,780 --> 00:13:38,660 Yeah, it's almost like a prompt injection, right? 226 00:13:38,660 --> 00:13:41,380 Like I have a reverse prompt injection we're seeing everywhere, right? 227 00:13:41,540 --> 00:13:45,580 It truly is with a cord that I hold up in front of my body, right? 228 00:13:45,580 --> 00:13:47,260 Like, yeah, it's wild. 229 00:13:49,330 --> 00:13:51,890 Mobile apps are just part of everyday life now. 230 00:13:52,250 --> 00:13:55,410 Banking, health care, shopping, entertainment, you name it. 231 00:13:55,410 --> 00:13:59,170 And with that comes a lot of trust because users are putting 232 00:13:59,170 --> 00:14:01,890 their personal data directly into your app. 233 00:14:02,170 --> 00:14:03,290 But here's the reality. 234 00:14:03,290 --> 00:14:05,130 Mobile apps are a growing target. 235 00:14:05,450 --> 00:14:09,410 A recent survey found that 72% of organizations experienced 236 00:14:09,410 --> 00:14:15,730 a mobile app security incident last year and 92% say threats are only increasing. 237 00:14:15,890 --> 00:14:19,370 And the way attackers are going after apps is pretty sophisticated. 238 00:14:19,490 --> 00:14:23,370 They're reverse engineering them, modifying them and redistributing 239 00:14:23,370 --> 00:14:28,770 fake versions through phishing campaigns, side loading and even third party app stores. 240 00:14:29,170 --> 00:14:33,570 So from a user's perspective, everything can look completely legitimate. 241 00:14:33,850 --> 00:14:37,850 That's why

taking a proactive approach to mobile app security really matters. 242 00:14:38,010 --> 00:14:41,970 You want to stay ahead of these threats, not react after the damage is done. 243 00:14:42,290 --> 00:14:44,210 This is where Guard Square comes in. 244 00:14:44,210 --> 00:14:47,770 They provide advanced protection for both Android and iOS apps, 245 00:14:48,050 --> 00:14:52,250 along with automated security testing to catch vulnerabilities early 246 00:14:52,570 --> 00:14:57,090 and real time threat monitoring so you can actually see what's happening out there. 247 00:14:57,170 --> 00:15:00,890 If your mobile app is critical to your business, and it probably is, 248 00:15:01,170 --> 00:15:03,410 this is something worth paying attention to. 249 00:15:03,570 --> 00:15:08,450 You can learn more at GuardSquare.com, that's GuardSquare.com. 250 00:15:10,610 --> 00:15:13,570 I think one of the big questions that our listeners are going to have is, 251 00:15:13,570 --> 00:15:18,050 can I now go out and buy this magic invisibility cloak 252 00:15:18,050 --> 00:15:22,250 that will prevent any AI camera to detect who I am? 253 00:15:22,410 --> 00:15:25,730 Is that a possibility or are there still challenges 254 00:15:25,730 --> 00:15:28,170 depending on the cameras, depending on all these other things? 255 00:15:28,850 --> 00:15:31,730 So the answer to that is no, like period, right? 256 00:15:31,730 --> 00:15:33,250 And I want to be very, very clear. 257 00:15:33,250 --> 00:15:36,850 So so it's been funny as this has been, you know, 258 00:15:37,290 --> 00:15:39,690 people are starting to read my research and those kind of things. 259 00:15:39,690 --> 00:15:42,130 I get two questions, you know, like, one, 260 00:15:42,130 --> 00:15:46,210 have you talked with Ben Jordan, who is a YouTuber that's been targeting Flock? 261 00:15:46,210 --> 00:15:49,410 And and two, like, are you enabling crime? 262 00:15:49,450 --> 00:15:51,130 Right? Like, no. 263 00:15:51,130 --> 00:15:53,170 So I want to be very, very clear, right? 264 00:15:53,170 --> 00:15:58,130 So I'm only attacking the detection model, right? 265 00:15:58,130 --> 00:16:01,170 If you go commit a crime at 9 p.m. 266 00:16:01,170 --> 00:16:05,610 and there is a CCTV monitoring that parking lot or whatever you're doing, 267 00:16:06,090 --> 00:16:10,570 the only thing that a pattern or whatever that adversarial action 268 00:16:10,570 --> 00:16:14,010 you took upon that camera was only around the detection, right? 269 00:16:14,010 --> 00:16:16,210 So you're still recorded, right? 270 00:16:16,210 --> 00:16:20,570 You're still on camera, a person monitoring the screens, whatever. 271 00:16:20,810 --> 00:16:22,810 We'll still see you, right? 272 00:16:22,810 --> 00:16:25,290 All of those things still occur, right? 273 00:16:25,290 --> 00:16:28,450 So just to be one, it's not an invisibility cloak. 274 00:16:28,450 --> 00:16:30,690 We're only targeting the detection. 275 00:16:31,210 --> 00:16:36,450 And then second, the most effective adversarial patterns 276 00:16:37,210 --> 00:16:41,570 are very dependent on which detection model you're targeting, right? 277 00:16:41,570 --> 00:16:43,450 So let me make sure that I say that correctly. 278 00:16:43,450 --> 00:16:45,410 Right now, I'm testing 11 models. 279 00:16:45,970 --> 00:16:50,290 So five person detectors, four face detectors, 280 00:16:50,450 --> 00:16:52,650 two facial recognition systems. 281 00:16:52,970 --> 00:16:55,130 And so let's stay with the person detector sites 282 00:16:55,130 --> 00:16:57,610 on testing out five different models. 283 00:16:58,330 --> 00:17:03,210 What's effective on one does not mean it's effective on five, right? 284 00:17:03,450 --> 00:17:10,170 And so while I am very heavily targeting patterns that are effective 285 00:17:10,170 --> 00:17:12,290 or somewhat effective across all of them, 286 00:17:12,290 --> 00:17:17,330 if another model that I've never even tried is what's running on that camera, 287 00:17:17,330 --> 00:17:19,210 I have no idea if that would be effective or not. 288 00:17:19,370 --> 00:17:21,010 Yeah, that makes total sense. 289 00:17:21,010 --> 00:17:24,850 And so you could have a piece of adversarial clothing 290 00:17:24,850 --> 00:17:27,290 and, you know, depending on the camera system, 291 00:17:27,330 --> 00:17:31,650 depending on all those things, like it may or may not detect you, 292 00:17:31,850 --> 00:17:36,410 but it's not like one size fits all type of you wear this shirt. 293 00:17:36,530 --> 00:17:37,650 It works for everything. 294 00:17:37,650 --> 00:17:40,210 Like that's not the case here from the get go. 295 00:17:40,210 --> 00:17:41,690 And I mean, I just want to be very clear. 296 00:17:41,690 --> 00:17:43,730 I had no idea how a camera worked, right? 297 00:17:43,770 --> 00:17:45,330 Like I had to go learn that. 298 00:17:45,330 --> 00:17:49,170 And the way the detection models work is it's confidence, right? 299 00:17:49,170 --> 00:17:51,570 So what they do is they kind of shrink down the image 300 00:17:51,890 --> 00:17:53,650 and they overlay a grid over it. 301 00:17:53,650 --> 00:17:56,930 And then they ask each square in that grid, 302 00:17:56,930 --> 00:17:58,850 do you see something? Right? 303 00:17:58,850 --> 00:18:00,410 Yes or no, it's binary. 304 00:18:00,410 --> 00:18:01,850 Do you see something? 305 00:18:01,850 --> 00:18:04,010 And then if yes, make a guess, right? 306 00:18:04,410 --> 00:18:09,530 And so what my adversarial patterns do is just lower the confidence of that guess 307 00:18:09,690 --> 00:18:11,490 lower to where. 308 00:18:11,490 --> 00:18:13,370 So whatever the bar is, right? 309 00:18:13,370 --> 00:18:17,250 So let's generally on a person detectors around seventy five percent 310 00:18:17,730 --> 00:18:19,890 lower and below that seventy five percent. 311 00:18:20,050 --> 00:18:24,210 So that that camera may still be saying, I think I still see a person, 312 00:18:24,650 -->

00:18:26,810 but I'm only twenty five percent confident. 313 00:18:26,850 --> 00:18:29,570 And so because it's below that that bar, 314 00:18:29,610 --> 00:18:31,530 yeah, it doesn't identify you. 315 00:18:31,530 --> 00:18:33,610 And you've all seen it when you see a camera, 316 00:18:33,610 --> 00:18:38,570 it's got like a red or green bounding box drawn around the person that tracks them. 317 00:18:38,930 --> 00:18:42,810 What I'm doing is I'm lowering that confidence rate around that decision. 318 00:18:42,810 --> 00:18:45,650 So that bounding box is never drawn around you. 319 00:18:46,770 --> 00:18:47,970 That makes sense. 320 00:18:47,970 --> 00:18:51,210 OK, that's a good way to visually understand, 321 00:18:51,210 --> 00:18:52,730 I think, what you've been researching. 322 00:18:52,730 --> 00:18:55,730 And it does ring a bell with me of like, 323 00:18:55,730 --> 00:18:59,090 yeah, that's the detection piece that you're going after. 324 00:18:59,130 --> 00:19:03,450 So what does this mean for the vendors in this space, 325 00:19:03,450 --> 00:19:06,730 police, policymakers, like all of those things? 326 00:19:06,730 --> 00:19:09,410 Because we've seen everything going on with flock recently. 327 00:19:09,410 --> 00:19:12,010 I mean, there's people cutting cameras down, 328 00:19:12,010 --> 00:19:15,930 city council meetings are just filled with people across the whole country. 329 00:19:15,930 --> 00:19:18,090 Now this is becoming a major thing. 330 00:19:18,090 --> 00:19:21,330 And I think the research that you're doing just fits perfectly 331 00:19:21,850 --> 00:19:24,570 into what's going on in this country right now. 332 00:19:24,770 --> 00:19:27,370 What does this all mean for this movement right now? 333 00:19:27,650 --> 00:19:32,210 Well, first and foremost, I hold myself to a very high ethical bar. 334 00:19:32,210 --> 00:19:35,250 Right. And so I don't want anybody out committing crimes. 335 00:19:35,570 --> 00:19:39,530 I have my own opinions about flock and the police state and surveillance state. 336 00:19:39,530 --> 00:19:43,570 I have very strong opinions there, but we should be handling this at a policy level. 337 00:19:43,570 --> 00:19:45,770 But, you know, power to the people, too. 338 00:19:45,770 --> 00:19:47,970 But we should go about this the right way. 339 00:19:48,050 --> 00:19:51,410 But, you know, my answer to that question gets a little bit deeper. 340 00:19:51,410 --> 00:19:53,850 I think that privacy is a fundamental right. 341 00:19:53,850 --> 00:19:59,690 I think that when you walk down the street and you are facially recognized 342 00:19:59,690 --> 00:20:04,730 like facial recognition done to you when you walk into a grocery store 343 00:20:04,730 --> 00:20:09,330 or a big box store where they're analyzing how much they think you're going to spend. 344 00:20:09,330 --> 00:20:11,250 I never opted into that, right? 345 00:20:11,250 --> 00:20:13,610 Like it's just we've gone too far. 346 00:20:13,890 --> 00:20:19,810 I think that tech will always improve and that bleeding edge will always continue to push. 347 00:20:19,810 --> 00:20:21,890 We're seeing that with a lot of things right now. 348 00:20:21,890 --> 00:20:25,850 Just LLMs, AI, everything, everywhere. 349 00:20:26,290 --> 00:20:30,250 But I do think it's up to the people and specifically I do think it's up to the hackers 350 00:20:30,250 --> 00:20:36,410 to be that counterbalance to those things to show that, hey, like hacking's not magic, right? 351 00:20:36,410 --> 00:20:38,090 And I never opted in. 352 00:20:38,090 --> 00:20:40,330 So I'm going to create the opt out, right? 353 00:20:40,330 --> 00:20:45,170 And I do know that when I release patterns and when I release those 354 00:20:45,170 --> 00:20:49,890 kind of things that they probably will go in to their training models to tune out. 355 00:20:50,210 --> 00:20:55,090 It's OK, it's going to be an arms race that, you know, like I've got better ones, 356 00:20:55,090 --> 00:20:58,170 you know, they're coming to right, you know, so that's right. 357 00:20:59,090 --> 00:21:01,370 Yeah, so that's kind of how I feel about that. 358 00:21:01,370 --> 00:21:05,610 This podcast has been focused on privacy for years and we've always said 359 00:21:05,610 --> 00:21:09,650 privacy is human rights and we are all entitled to privacy. 360 00:21:09,650 --> 00:21:15,890 And when companies and these organizations and the technology feels invasive to people, 361 00:21:15,890 --> 00:21:19,770 it is always interesting to me that the hacker community always steps up. 362 00:21:19,930 --> 00:21:23,090 To try find ways to opt yourself out. 363 00:21:23,090 --> 00:21:25,090 And I love the way that you phrased that. 364 00:21:25,090 --> 00:21:29,170 One thing I did want to cover is your Kickstarter because talking about the 365 00:21:29,170 --> 00:21:32,930 patterns and clothing, what was the idea for the Kickstarter? 366 00:21:32,930 --> 00:21:36,570 Because you've raised a hundred and thirty five dollars on this Kickstarter. 367 00:21:36,770 --> 00:21:39,650 It was one of those things that I wanted to raise somewhere around five 368 00:21:39,650 --> 00:21:43,090 to six thousand dollars so that I could move my research to the next level. 369 00:21:43,090 --> 00:21:44,530 Buy some more cameras. 370 00:21:44,530 --> 00:21:48,410 Yeah. So the cameras that I want to target are like fifteen hundred bucks each. 371 00:21:48,450 --> 00:21:52,490 And you know, I'm like, I've been fronting this myself for the year. 372 00:21:52,490 --> 00:21:55,810 And just to move it to the next level, I was like, well, I'm going to 373 00:21:55,810 --> 00:22:01,370 hopefully raise six K to buy some nerd stuff and and it exploded. 374 00:22:01,410 --> 00:22:05,530 Right. So I did talks at both that Black Hat and Def Con this year. 375 00:22:05,730 --> 00:22:10,410 And so that the Def Con talk will be posted publicly when Def Con posts us. 376 00:22:10,410 --> 00:22:13,850 And I

really highly encourage anybody interested in this topic 377 00:22:13,850 --> 00:22:16,330 to watch it because I show how I show the math, right? 378 00:22:16,370 --> 00:22:18,610 Go into how this works and all of those kind of things. 379 00:22:18,850 --> 00:22:21,250 But the Kickstarter has been insane, right? 380 00:22:21,250 --> 00:22:24,650 So what that proves to me is that people care about their privacy, right? 381 00:22:24,650 --> 00:22:27,890 So what I'm releasing is basically three garments. 382 00:22:27,890 --> 00:22:31,610 I'm releasing a T-shirt, a hoodie, and I don't know if you've ever watched 383 00:22:31,610 --> 00:22:35,410 a show, Survivor, but yeah, Buff, like a tube of fabric. 384 00:22:35,410 --> 00:22:38,330 You can either wear the headband or over your face. 385 00:22:38,850 --> 00:22:41,050 And each one of them target different things. 386 00:22:41,050 --> 00:22:45,810 So the T-shirt and the hoodie target the object model, the person object model. 387 00:22:45,810 --> 00:22:51,370 So if you are wearing this T-shirt or hoodie, you are not identified as a person, right? 388 00:22:51,370 --> 00:22:54,810 And what I mean by that is that little bounding box is not drawn. 389 00:22:54,810 --> 00:22:56,370 They don't know what you are. 390 00:22:56,370 --> 00:23:00,570 Yes. Well, and so it's so funny because on the back end, I get to see that. 391 00:23:00,610 --> 00:23:03,690 Listen, I don't, you know, the model will be like, something's there. 392 00:23:04,050 --> 00:23:05,450 No clue what, right? 393 00:23:05,450 --> 00:23:06,290 Like no clue what. 394 00:23:06,290 --> 00:23:07,690 Alien. Yeah. 395 00:23:07,690 --> 00:23:08,930 Yeah. 396 00:23:08,930 --> 00:23:14,090 And so there was this prior research that was done that gets brought up every once in a while. 397 00:23:14,090 --> 00:23:16,610 So you can make those models detect what you want. 398 00:23:16,610 --> 00:23:21,410 And so someone else did some research and said, if you're wearing this dress 399 00:23:21,410 --> 00:23:24,690 or whatever they had, you were identified as a giraffe, right? 400 00:23:25,210 --> 00:23:25,570 Awesome. 401 00:23:25,570 --> 00:23:29,810 While the hacker in me just absolutely loves that. 402 00:23:29,810 --> 00:23:33,530 But that is the wrong strategy for hiding, right? 403 00:23:33,530 --> 00:23:36,970 Like if you've been alert that there is a giraffe in the crowd, 404 00:23:36,970 --> 00:23:39,690 that's going to be where the people are going to look, right? 405 00:23:39,730 --> 00:23:43,690 So my patterns, what they do is they drop that object detection to zero, right? 406 00:23:43,690 --> 00:23:48,410 And then the buff, the one that goes over your face targets the face models. 407 00:23:48,410 --> 00:23:53,650 And remember, if a face is never detected, facial recognition never happens, right? 408 00:23:53,970 --> 00:23:59,370 And so, so I'm breaking the face model with the buff is what I'm doing. 409 00:23:59,650 --> 00:24:02,050 And there's two versions that I have released. 410 00:24:02,050 --> 00:24:04,170 There's the one that everybody gets, right? 411 00:24:04,170 --> 00:24:10,130 So this will be a very effective pattern that's a little bit cheaper and everybody gets. 412 00:24:10,130 --> 00:24:14,330 And that's going to be the one that I think that the camera manufacturers 413 00:24:14,330 --> 00:24:15,810 will train on, right? 414 00:24:15,810 --> 00:24:16,250 Sure. 415 00:24:16,250 --> 00:24:20,010 Then I'm also doing runs one on one where I never show that pattern 416 00:24:20,010 --> 00:24:22,170 to anybody else other than you, right? 417 00:24:22,490 --> 00:24:26,890 You're the only person in the world that has seen that other than me, right? 418 00:24:26,890 --> 00:24:28,530 They have seen that pattern. 419 00:24:28,530 --> 00:24:31,810 And so you've never even made it into the training data set, right? 420 00:24:31,810 --> 00:24:34,210 So it should be effective for much longer. 421 00:24:34,290 --> 00:24:36,210 Yeah, yeah, that's awesome. 422 00:24:36,210 --> 00:24:38,330 Well, I mean, not only that, but I feel like this is you're 423 00:24:38,330 --> 00:24:41,210 starting a new fashion trend, right? 424 00:24:41,690 --> 00:24:42,050 Yeah. 425 00:24:42,050 --> 00:24:43,970 So there's been some comments about that. 426 00:24:44,130 --> 00:24:47,410 So Reddit, I did like a real mini AMA type thing. 427 00:24:47,410 --> 00:24:52,050 And someone was like, hey, can you make one that doesn't look like I glitched out 428 00:24:52,050 --> 00:24:56,050 on drugs or whatever fashion does evolve over time, right? 429 00:24:56,050 --> 00:24:59,490 So, you know, like maybe this will be the hot new trend next year. 430 00:24:59,490 --> 00:25:04,370 But I show some examples of patterns on my website, but never the good ones. 431 00:25:04,370 --> 00:25:06,930 But, you know, just so you can kind of get a sense of what 432 00:25:06,930 --> 00:25:08,090 the pattern is going to look like. 433 00:25:08,090 --> 00:25:15,170 And they're often high frequency repeating patterns that have circles and lines. 434 00:25:15,250 --> 00:25:18,650 It depends on what I'm targeting, object detector. 435 00:25:19,130 --> 00:25:22,090 So like the person right here, this is the hardest part. 436 00:25:22,130 --> 00:25:26,090 So your shoulder, that curve, there's a lot of contrast between your 437 00:25:26,090 --> 00:25:29,090 shoulder and your background, and it's an unnatural angle. 438 00:25:29,130 --> 00:25:32,730 And so the patterns really target that area. 439 00:25:33,610 --> 00:25:34,370 Interesting. 440 00:25:34,570 --> 00:25:35,010 Yeah. 441 00:25:35,210 --> 00:25:38,890 Well, we're going to have, in the show notes, we'll link to your Kickstarter. 442 00:25:38,890 --> 00:25:41,410 And, you know, when this episode is released, I think there'll be some 443 00:25:41,410 --> 00:25:43,170 more time on your Kickstarter as well. 444 00:25:43,170 --> 00:25:46,570 So people can still sign up and

contribute to the projects. 445 00:25:46,570 --> 00:25:49,730 I think it's super important and to get cool, cool stuff. 446 00:25:49,850 --> 00:25:52,770 What I'd really like from your audience is, hey, if you have any 447 00:25:52,770 --> 00:25:54,890 comments, especially like the tough ones. 448 00:25:54,930 --> 00:25:59,410 So I publish all of my stats on no recognition or flash research. 449 00:25:59,410 --> 00:26:03,170 You can see what I'm grinding on right now, what my strategies are. 450 00:26:03,410 --> 00:26:06,850 If you have, especially the tough feedback, I'd love to hear it. 451 00:26:06,850 --> 00:26:10,210 So I've already had a few that have come in that somebody just 452 00:26:10,210 --> 00:26:13,330 burning me down and I had responses for most of it. 453 00:26:13,330 --> 00:26:16,250 But some of it was like, you're absolutely right, and I'm going 454 00:26:16,250 --> 00:26:18,130 to change the way that I'm doing this. 455 00:26:18,130 --> 00:26:21,410 So let me have it if you have, if you have comments, for sure. 456 00:26:21,530 --> 00:26:21,770 Yeah. 457 00:26:21,770 --> 00:26:25,770 And we'll have all of Bill's contact info and the websites and all 458 00:26:25,770 --> 00:26:28,730 of that if you want to give Bill feedback. 459 00:26:28,810 --> 00:26:31,570 Like I said, he appreciates the direct feedback. 460 00:26:31,850 --> 00:26:32,930 Yeah, all taken. 461 00:26:32,930 --> 00:26:35,890 I mean, as even when I was doing security research and all of 462 00:26:35,890 --> 00:26:39,490 that, I always appreciated direct feedback, positive, negative. 463 00:26:39,490 --> 00:26:40,850 Just, just bring it all to Bill. 464 00:26:41,130 --> 00:26:41,810 He can handle it. 465 00:26:41,850 --> 00:26:42,410 I'll take it. 466 00:26:42,410 --> 00:26:43,650 Yeah, that's right. 467 00:26:44,250 --> 00:26:46,610 Even if it's, even if it's Bill, you're ugly. 468 00:26:46,650 --> 00:26:47,770 Like, yeah, I mean, it was cool. 469 00:26:48,610 --> 00:26:49,890 I don't like your hat, Bill. 470 00:26:50,210 --> 00:26:51,650 Well, thanks, man. 471 00:26:52,610 --> 00:26:53,730 Well, this has been awesome. 472 00:26:53,730 --> 00:26:55,090 Great to catch up with you. 473 00:26:55,090 --> 00:26:57,250 And I love the research that you're doing. 474 00:26:57,250 --> 00:27:00,970 I think it is so important in the privacy and security space. 475 00:27:01,010 --> 00:27:05,170 And I really believe this is what hackers are supposed to do. 476 00:27:05,290 --> 00:27:07,810 Like this is exactly our calling right here. 477 00:27:07,810 --> 00:27:11,050 And I'm really excited about everything you've been doing. 478 00:27:11,050 --> 00:27:14,090 The Kickstarter and I wish you, of course, nothing but the best. 479 00:27:14,090 --> 00:27:15,450 So thanks, buddy. 480 00:27:15,450 --> 00:27:16,610 I appreciate you having me on. 481 00:27:16,610 --> 00:27:17,690 Thanks for your welcome. 482 00:27:17,690 --> 00:27:18,130 Doing this. 483 00:27:18,490 --> 00:27:18,850 All right. 484 00:27:18,850 --> 00:27:20,290 Thanks, everyone, for listening. 485 00:27:20,290 --> 00:27:24,490 And until next time, stay safe, stay secure and stay private. 486 00:27:24,570 --> 00:27:26,130 Thank you for listening or watching. 487 00:27:26,330 --> 00:27:29,810 If you liked this episode, hit subscribe, share it with your 488 00:27:29,850 --> 00:27:34,330 friends and colleagues or jump into our community at sharedsecurity.net 489 00:27:34,330 --> 00:27:36,930 slash supporter to keep the conversation going. 490 00:27:37,050 --> 00:27:41,730 Thanks again, and we'll see you next week for another episode of Shared Security.