Could a Pattern on Your Clothing Fool Facial Recognition? Interview with Bill Swearingen

1
00:00:02,800 --> 00:00:08,960
Welcome to the Shared Security Podcast, the longest running cybersecurity and privacy show
2
00:00:08,960 --> 00:00:11,040
for actual humans.
3
00:00:11,040 --> 00:00:17,680
No jargon, no hype, just honest analysis from industry veterans who've seen everything
4
00:00:17,680 --> 00:00:19,080
and survived it.
5
00:00:19,080 --> 00:00:24,520
Each week we break down the stories that matter, expose the nonsense that doesn't, and give
6
00:00:24,520 --> 00:00:30,120
you the tools to stay safe in a world where everything is connected and nothing
7
00:00:30,120 --> 00:00:31,760
is guaranteed.
8
00:00:31,760 --> 00:00:36,780
This is Shared Security.
9
00:00:36,780 --> 00:00:41,300
This week on Shared Security, I'm interviewing researcher and speaker Bill Swaringen about
10
00:00:41,300 --> 00:00:48,860
his Black Hat USA 2026 talk, could a pattern on your clothing fool facial recognition?
11
00:00:48,860 --> 00:00:51,980
The idea seems almost science fiction.
12
00:00:51,980 --> 00:00:57,540
Could something as ordinary as a clothing pattern interfere with facial recognition systems?
13
00:00:57,540 --> 00:01:01,340
Well, the security and privacy questions are very real.
14
00:01:01,700 --> 00:01:07,180
We'll talk about adversarial textile patterns, surveillance assumptions, how these systems
15
00:01:07,180 --> 00:01:12,860
behave outside the lab, and what this research says about the future of face recognition
16
00:01:12,860 --> 00:01:15,020
in public spaces.
17
00:01:15,020 --> 00:01:19,420
Now Bill has spent more than two decades building and leading cybersecurity programs
18
00:01:19,420 --> 00:01:24,540
for critical infrastructure, Fortune 100 teams, and high-risk clients, including
19
00:01:24,540 --> 00:01:31,180
serving as CISO at CenturyLink Lutman and co-founding Trifonant Advisory Services.
20
00:01:31,180 --> 00:01:38,020
He's also the researcher behind No Recognition, an AI adversarial clothing kickstarter that
21
00:01:38,020 --> 00:01:42,780
has raised more than $130,000 so far.
22
00:01:42,780 --> 00:01:44,420
Welcome to the show, Bill.
23
00:01:44,420 --> 00:01:46,980
Well, Tom, what a great introduction.
24
00:01:46,980 --> 00:01:50,700
Thanks for having me, and man, it's good seeing you again.
25
00:01:50,700 --> 00:01:54,140
I miss you, homie, thanks for having me.
26
00:01:54,140 --> 00:01:55,140
I know, right?
27
00:01:55,140 --> 00:01:57,540
It's been a long, long time.
28
00:01:57,540 --> 00:02:03,100
You're reminiscing before we started the podcast about the olden days of Shmucon and Defcon
29
00:02:03,100 --> 00:02:06,940
and all the shenanigans we used to get into back when.
30
00:02:06,940 --> 00:02:12,100
Super early, like Shmucon one or two type days, those were the days.
31
00:02:12,100 --> 00:02:18,580
I think it was like Defcon, yes, very early Shmucon, and I think it was like Defcon,
32
00:02:18,580 --> 00:02:25,220
like 15, 16, like those early days at the Riviera, like crazy.
33
00:02:25,900 --> 00:02:29,300
I was kind of thinking when we had this scheduled and I was telling some of my friends, I was
34
00:02:29,300 --> 00:02:35,700
like, I'm pretty sure it was Tom's talk and it was real early Defcon, something like where
35
00:02:35,700 --> 00:02:44,140
me and my buddy Trent, we came up with this great plan to identify the wireless mic frequencies
36
00:02:44,140 --> 00:02:50,580
that you were going to be using, and we were going to inject bodily noises like
37
00:02:50,580 --> 00:02:53,780
into your talk, and we had this all planned out.
38
00:02:53,780 --> 00:02:55,460
Now that would be a jerk move, right?
39
00:02:55,460 --> 00:02:56,460
Let's get that clear.
40
00:02:56,460 --> 00:02:57,460
Yes, I would.
41
00:02:57,460 --> 00:02:58,460
Now that would be a jerk.
42
00:02:58,460 --> 00:03:03,140
Back then it was totally like fair game, and if I remember right, we ended up taking
43
00:03:03,140 --> 00:03:07,660
your mics completely down and I felt like such a jerk, so it was still a dick move
44
00:03:07,660 --> 00:03:08,660
back thing.
45
00:03:08,660 --> 00:03:13,820
Yes, I do remember that actually, that was at Shmucon I think.
46
00:03:13,820 --> 00:03:18,220
So you've got this black hat talk that you just gave and I want to start with just
47
00:03:18,220 --> 00:03:25,140
what was the driver to start this research, like why research adversarial clothing?
48
00:03:25,140 --> 00:03:27,500
It's an interesting story I guess.
49
00:03:27,500 --> 00:03:32,500
So not to get politically either which way or anything, but about a year ago I wanted
50
00:03:32,500 --> 00:03:36,740
to attend a protest here in Kansas City and I'm not even going to talk about which one
51
00:03:36,740 --> 00:03:40,620
or whatever, but kind of had this thought.
52
00:03:40,620 --> 00:03:47,380
I had this feeling that given who I work with, what I do, the contracts that I'm
53
00:03:47,380 --> 00:03:53,660
working with, maybe it would be better if my face wasn't identified or something like
54
00:03:53,660 --> 00:03:55,660
that in that crowd.
55
00:03:55,660 --> 00:04:04,140
As a 50-year-old white male, it was kind of like my first experience of that feeling.
56
00:04:04,140 --> 00:04:10,020
As I've talked with other people, like oh, I'm so glad you guys are starting to feel
57
00:04:10,020 --> 00:04:11,700
that too.
58
00:04:11,700 --> 00:04:19,500
And so I kind of had this idea that I don't know, maybe could with what I'm wearing impact
59
00:04:19,500 --> 00:04:21,260
detections on cameras.
60
00:04:21,260 --> 00:04:24,940
And so I set out with a goal to do two things.
61
00:04:24,940 --> 00:04:31,020
So one, if you and I are standing in a crowd together and you don't know me and I don't
62
00:04:31,020 --> 00:04:35,900
know you, I don't want to key off to you that at a human level.
63
00:04:35,900 --> 00:04:39,980
I don't want you to understand that I'm doing anything weird.
64
00:04:39,980 --> 00:04:44,980
So like if we're in a mass crowd and you see somebody wearing a black hoodie with the
65
00:04:44,980 --> 00:04:50,420
hoodie up and sunglasses in a bandana, and you're kind of like, well, I don't know if
66
00:04:50,420 --> 00:04:52,540
I want to be standing next to that dude, right?
67
00:04:52,540 --> 00:04:57,580
So at a human level, I wanted to do something that doesn't flag for humans.
68
00:04:57,580 --> 00:05:02,540
But for a camera level, it causes detections not to work.
69
00:05:02,540 --> 00:05:05,380
I had no idea if it would work or not.
70
00:05:05,380 --> 00:05:08,620
And it's so funny when I tell this story because I think back, that was only a year
71
00:05:08,620 --> 00:05:09,620
ago.
72
00:05:09,900 --> 00:05:14,660
We had AI, but AI wasn't where it's at now, right?
73
00:05:14,660 --> 00:05:18,940
So I had to hand write, I had to hand write a fuzzer.
74
00:05:18,940 --> 00:05:19,940
It was Python.
75
00:05:19,940 --> 00:05:25,060
It was the first time that I'd ever done any real like GPU work, and it was tough and
76
00:05:25,060 --> 00:05:26,060
it was hard.
77
00:05:26,060 --> 00:05:31,980
And it was one of those projects where you get done with work and you're tired,
78
00:05:31,980 --> 00:05:32,980
but you're energized.
79
00:05:32,980 --> 00:05:37,740
And then you look up and it's 4 a.m. and you're like, oh my God, I've been
80
00:05:37,780 --> 00:05:42,220
writing code for, you know, 12 hours out of this 24-hour day.
81
00:05:42,220 --> 00:05:47,620
And what I found real early was as wild success.
82
00:05:47,620 --> 00:05:54,780
So back in the day, a year ago, I was only targeting the base computer vision models.
83
00:05:54,780 --> 00:05:59,940
But the strategy that I employed was that I would take a picture of a person and I
84
00:05:59,940 --> 00:06:03,220
would put them in a green garment.
85
00:06:03,220 --> 00:06:05,900
Let's just picture a green t-shirt or whatever.
86
00:06:05,900 --> 00:06:06,420
Yeah.
87
00:06:06,420 --> 00:06:10,900
I would run that that image past the computer vision model and I would ask it,
88
00:06:11,220 --> 00:06:13,580
how many people do you see in this image?
89
00:06:14,460 --> 00:06:20,500
And then I would apply, I would brute force, fuzzer style, just no direction,
90
00:06:21,100 --> 00:06:23,420
just fuzz and apply.
91
00:06:23,420 --> 00:06:26,620
And then I would ask that vision model, how many people do you see in this
92
00:06:26,620 --> 00:06:28,820
picture? And I would record any anomalies, right?
93
00:06:28,820 --> 00:06:30,860
So anomalies were crazy.
94
00:06:30,860 --> 00:06:34,180
Like I would find some where it would say zero people.
95
00:06:34,180 --> 00:06:37,140
I'd find some that said there were 10,000 people, right?
96
00:06:37,140 --> 00:06:39,380
It was kind of all over the place.
97
00:06:39,380 --> 00:06:42,780
And but what I learned was that, hey, man, I'm onto something.
98
00:06:43,460 --> 00:06:45,220
And so the fuzzer works.
99
00:06:45,220 --> 00:06:49,500
And I know that I'm kind of working on Lego class vision models.
100
00:06:49,500 --> 00:06:53,300
Let's let's go out and let's research what models do the big boys use.
101
00:06:53,300 --> 00:06:58,660
And so I search for S bombs and I search for open source disclosures
102
00:06:58,660 --> 00:07:03,700
and all of those kind of things trying to identify which models clear view
103
00:07:03,700 --> 00:07:10,460
and Palantir and axon and Hick vision, all of those different vendors
104
00:07:10,460 --> 00:07:14,780
trying to understand what the underlying model was and then have built
105
00:07:14,780 --> 00:07:16,940
it's from there. So nice.
106
00:07:16,940 --> 00:07:18,020
That's a great story.
107
00:07:18,020 --> 00:07:21,140
And I guess it's a good way of, I mean, you're kind of bringing
108
00:07:21,140 --> 00:07:23,180
back the the hacker in you, right?
109
00:07:23,180 --> 00:07:26,780
Of like staying up all night, a coding project.
110
00:07:26,780 --> 00:07:28,860
I know. Oh, yeah.
111
00:07:28,860 --> 00:07:30,260
It's a lot of it's been wild.
112
00:07:30,260 --> 00:07:32,380
So, you know, it's been one of those things.
113
00:07:32,380 --> 00:07:35,620
And you don't know how other people, like when they say that they've
114
00:07:35,620 --> 00:07:36,940
been working on it for a year.
115
00:07:36,940 --> 00:07:39,540
Does that mean that they've been kind of working on it for a year?
116
00:07:39,540 --> 00:07:41,820
But this has been my my passion, right?
117
00:07:41,820 --> 00:07:45,780
So and I mean, every single day, I'm trying new things.
118
00:07:45,780 --> 00:07:48,860
And the project has matured significantly since then.
119
00:07:48,860 --> 00:07:50,500
And I've been very fortunate.
120
00:07:50,500 --> 00:07:53,980
It's been amazing the way the hacker community has supported me.
121
00:07:53,980 --> 00:07:59,620
But just trying things, I ended up writing pattern generators with stuff.
122
00:07:59,620 --> 00:08:01,460
I have no idea. Is it going to work or not?
123
00:08:01,460 --> 00:08:06,620
Right. So I had one pattern generator that just literally put bad words, right?
124
00:08:06,620 --> 00:08:08,740
Like the real bad ones, right?
125
00:08:08,740 --> 00:08:12,620
And another one that tried injection strings.
126
00:08:12,620 --> 00:08:15,500
And then all of the other things that you can imagine.
127
00:08:15,500 --> 00:08:20,580
So like camouflage and and all of these, you know, just other techniques.
128
00:08:20,580 --> 00:08:25,260
And what I found actually when I was developing those those pattern
129
00:08:25,260 --> 00:08:28,100
generators is that this was work that had already been done.
130
00:08:28,580 --> 00:08:31,260
And that just absolutely blew me away.
131
00:08:31,660 --> 00:08:33,060
So, wow.
132
00:08:33,060 --> 00:08:37,980
Going back to the 90s, there was a there was an artist, Adam Harvey,
133
00:08:37,980 --> 00:08:41,180
that had worked on makeup patterns.
134
00:08:41,220 --> 00:08:46,340
So CV Dazzle and hyperface that would do something similar.
135
00:08:46,340 --> 00:08:49,900
And so I kept digging in and I found, you know,
136
00:08:49,900 --> 00:08:53,260
several other researchers that had tried this work before.
137
00:08:53,260 --> 00:08:57,220
And so I started this research on my own and then you find, oh, my gosh,
138
00:08:57,220 --> 00:09:02,180
there's this whole like treasure trove of research has already been done.
139
00:09:02,180 --> 00:09:06,180
And so I feel like I'm kind of taking the torch from there
140
00:09:06,180 --> 00:09:09,860
and actually targeting the harder, more modern models.
141
00:09:09,860 --> 00:09:11,460
Yeah. Yeah.
142
00:09:11,460 --> 00:09:15,300
So what are some surprising things that you found during your research?
143
00:09:15,300 --> 00:09:18,620
Like, you know, obviously you were kind of testing these things on your own.
144
00:09:19,060 --> 00:09:22,740
Like what led you to discover that this is a real thing?
145
00:09:22,740 --> 00:09:24,700
Like this can actually work.
146
00:09:24,740 --> 00:09:27,420
There's been some crazy, crazy findings.
147
00:09:27,500 --> 00:09:31,300
So before I even get into it, you know, like one thing that I want to make sure
148
00:09:31,300 --> 00:09:33,780
that, you know, whenever I'm doing these interviews is that.
149
00:09:34,860 --> 00:09:39,420
For the history of computers, a parser, every single parser
150
00:09:39,420 --> 00:09:43,700
that has ever been written has had difficulty differentiating
151
00:09:43,700 --> 00:09:47,020
between the data that it's supposed to be parsing
152
00:09:47,020 --> 00:09:49,660
and the underlying control system, right?
153
00:09:49,660 --> 00:09:52,580
So from the beginning of time, if you take a look at
154
00:09:52,820 --> 00:09:54,860
that's how SQL injection worked, right?
155
00:09:54,860 --> 00:09:57,460
Like that's how log for shell worked.
156
00:09:57,460 --> 00:10:03,020
Like the parsers have a very difficult time in understanding which data is which.
157
00:10:03,020 --> 00:10:09,180
And as a hacker, our job is to get control of the input source data
158
00:10:09,420 --> 00:10:11,260
that's going inside of a parser.
159
00:10:11,260 --> 00:10:12,220
Think about a camera.
160
00:10:12,220 --> 00:10:16,260
How do I control the data that's going into a camera?
161
00:10:16,620 --> 00:10:18,740
Well, it's what it see, right?
162
00:10:19,700 --> 00:10:24,300
Once I had that realization and that kind of goes back to the fuzzer.
163
00:10:24,300 --> 00:10:25,300
I started working on that.
164
00:10:25,300 --> 00:10:28,540
But some of the things that have fallen out and the surprising things
165
00:10:28,540 --> 00:10:30,380
have been tremendous.
166
00:10:30,380 --> 00:10:35,540
For example, what I learned is I had no freaking idea what I was doing.
167
00:10:36,340 --> 00:10:38,060
I had no clue.
168
00:10:38,060 --> 00:10:43,300
Real early, I made statements like, guys, I'm hacking facial recognition.
169
00:10:43,300 --> 00:10:45,060
And and I.
170
00:10:46,260 --> 00:10:47,140
Nope, I wasn't.
171
00:10:47,180 --> 00:10:50,180
So it turns out that there are different types of detectors.
172
00:10:50,220 --> 00:10:55,420
So in a camera and I'm talking about like a like a small,
173
00:10:56,740 --> 00:11:03,660
you know, like personal, there's a flock, you know, like a small like security
174
00:11:03,660 --> 00:11:07,540
camera, we're talking about very small circuit board, right?
175
00:11:07,540 --> 00:11:09,620
And it has to make a decision very fast.
176
00:11:09,620 --> 00:11:12,860
And so the first stage is object detection.
177
00:11:12,860 --> 00:11:14,300
Do I see a person?
178
00:11:14,300 --> 00:11:15,740
Do I see a car?
179
00:11:15,740 --> 00:11:17,300
Do I see a motorcycle?
180
00:11:17,300 --> 00:11:18,380
What do I see?
181
00:11:18,380 --> 00:11:21,940
Right? Like, it's not it's not who, right?
182
00:11:21,940 --> 00:11:23,020
It's what?
183
00:11:23,020 --> 00:11:24,300
What do I see?
184
00:11:24,300 --> 00:11:29,460
And then there is so there is a person object model.
185
00:11:29,460 --> 00:11:32,300
And then there is a face object model.
186
00:11:32,300 --> 00:11:37,220
So the object model, like that detects a person or a car, it says, what am I
187
00:11:37,220 --> 00:11:40,580
seeing? And then when you take a look at a face model, it says, how
188
00:11:40,580 --> 00:11:42,700
many faces do I see?
189
00:11:42,740 --> 00:11:44,980
And then you move into facial recognition.
190
00:11:44,980 --> 00:11:46,300
Who do I see?
191
00:11:46,300 --> 00:11:49,580
And each one of those are separate problems and they're solved with
192
00:11:49,580 --> 00:11:52,020
different patterns and different injections.
193
00:11:52,020 --> 00:11:55,220
And each one of them is a different problem to solve.
194
00:11:55,900 --> 00:12:00,380
Now, as I learned that, and I actually learned that from Joshua Marpette
195
00:12:00,380 --> 00:12:03,940
from Paul security, he was the guy was like, Bill, you have no idea
196
00:12:03,940 --> 00:12:05,460
what you're talking about.
197
00:12:05,460 --> 00:12:08,860
And then he schooled me and I was like, oh, my God, thank you.
198
00:12:08,860 --> 00:12:10,420
That was so good.
199
00:12:10,460 --> 00:12:14,100
Like, you know, just our friend group is just so small, right?
200
00:12:14,100 --> 00:12:15,260
Like, yeah, just.
201
00:12:15,260 --> 00:12:20,660
And so what I learned through my just testing is that the object
202
00:12:20,660 --> 00:12:24,500
detector, what am I looking at the person, the car, the motorcycle,
203
00:12:24,500 --> 00:12:29,940
whatever is not connected to facial recognition flow whatsoever.
204
00:12:30,540 --> 00:12:35,020
But I had this problem, Tom, I had this problem where I spent,
205
00:12:35,380 --> 00:12:38,820
I don't know, a month every night, eight hours of nights trying
206
00:12:38,820 --> 00:12:42,580
to figure out patterns that would beat face detector.
207
00:12:42,620 --> 00:12:45,380
How many faces do you see zero, right?
208
00:12:45,820 --> 00:12:50,740
But then my facial recognition harness would just crash.
209
00:12:50,740 --> 00:12:52,540
And now it's so stupid looking back.
210
00:12:52,540 --> 00:12:54,300
But at that point, I didn't know.
211
00:12:54,300 --> 00:12:58,500
And it turns out that if there are no faces being detected,
212
00:12:58,500 --> 00:13:00,660
it cannot do facial recognition.
213
00:13:00,660 --> 00:13:02,420
There's a pipeline, right?
214
00:13:02,420 --> 00:13:05,620
And now you're like, well, of course, you idiot, you know.
215
00:13:05,940 --> 00:13:08,140
But back then it was like, I didn't know if it was my
216
00:13:08,140 --> 00:13:11,300
tooling or my measuring or, you know, all those kind of things.
217
00:13:11,340 --> 00:13:12,860
But they're separate problems.
218
00:13:12,860 --> 00:13:14,820
So that was a big finding.
219
00:13:14,820 --> 00:13:20,180
And other interesting things are, you know, kind of where my research is right now.
220
00:13:20,180 --> 00:13:23,900
There there is some and I don't really want to go too much into this
221
00:13:23,900 --> 00:13:25,740
because the research is still real early.
222
00:13:25,740 --> 00:13:29,980
But I'm starting to find being able to take over the camera in certain ways
223
00:13:29,980 --> 00:13:33,140
with just with a pattern on a t-shirt or whatever.
224
00:13:33,220 --> 00:13:35,660
It's been really interesting research, quite honestly.
225
00:13:35,780 --> 00:13:38,660
Yeah, it's almost like a prompt injection, right?
226
00:13:38,660 --> 00:13:41,380
Like I have a reverse prompt injection we're seeing everywhere, right?
227
00:13:41,540 --> 00:13:45,580
It truly is with a cord that I hold up in front of my body, right?
228
00:13:45,580 --> 00:13:47,260
Like, yeah, it's wild.
229
00:13:49,330 --> 00:13:51,890
Mobile apps are just part of everyday life now.
230
00:13:52,250 --> 00:13:55,410
Banking, health care, shopping, entertainment, you name it.
231
00:13:55,410 --> 00:13:59,170
And with that comes a lot of trust because users are putting
232
00:13:59,170 --> 00:14:01,890
their personal data directly into your app.
233
00:14:02,170 --> 00:14:03,290
But here's the reality.
234
00:14:03,290 --> 00:14:05,130
Mobile apps are a growing target.
235
00:14:05,450 --> 00:14:09,410
A recent survey found that 72% of organizations experienced
236
00:14:09,410 --> 00:14:15,730
a mobile app security incident last year and 92% say threats are only increasing.
237
00:14:15,890 --> 00:14:19,370
And the way attackers are going after apps is pretty sophisticated.
238
00:14:19,490 --> 00:14:23,370
They're reverse engineering them, modifying them and redistributing
239
00:14:23,370 --> 00:14:28,770
fake versions through phishing campaigns, side loading and even third party app stores.
240
00:14:29,170 --> 00:14:33,570
So from a user's perspective, everything can look completely legitimate.
241
00:14:33,850 --> 00:14:37,850
That's why taking a proactive approach to mobile app security really matters.
242
00:14:38,010 --> 00:14:41,970
You want to stay ahead of these threats, not react after the damage is done.
243
00:14:42,290 --> 00:14:44,210
This is where Guard Square comes in.
244
00:14:44,210 --> 00:14:47,770
They provide advanced protection for both Android and iOS apps,
245
00:14:48,050 --> 00:14:52,250
along with automated security testing to catch vulnerabilities early
246
00:14:52,570 --> 00:14:57,090
and real time threat monitoring so you can actually see what's happening out there.
247
00:14:57,170 --> 00:15:00,890
If your mobile app is critical to your business, and it probably is,
248
00:15:01,170 --> 00:15:03,410
this is something worth paying attention to.
249
00:15:03,570 --> 00:15:08,450
You can learn more at GuardSquare.com, that's GuardSquare.com.
250
00:15:10,610 --> 00:15:13,570
I think one of the big questions that our listeners are going to have is,
251
00:15:13,570 --> 00:15:18,050
can I now go out and buy this magic invisibility cloak
252
00:15:18,050 --> 00:15:22,250
that will prevent any AI camera to detect who I am?
253
00:15:22,410 --> 00:15:25,730
Is that a possibility or are there still challenges
254
00:15:25,730 --> 00:15:28,170
depending on the cameras, depending on all these other things?
255
00:15:28,850 --> 00:15:31,730
So the answer to that is no, like period, right?
256
00:15:31,730 --> 00:15:33,250
And I want to be very, very clear.
257
00:15:33,250 --> 00:15:36,850
So so it's been funny as this has been, you know,
258
00:15:37,290 --> 00:15:39,690
people are starting to read my research and those kind of things.
259
00:15:39,690 --> 00:15:42,130
I get two questions, you know, like, one,
260
00:15:42,130 --> 00:15:46,210
have you talked with Ben Jordan, who is a YouTuber that's been targeting Flock?
261
00:15:46,210 --> 00:15:49,410
And and two, like, are you enabling crime?
262
00:15:49,450 --> 00:15:51,130
Right? Like, no.
263
00:15:51,130 --> 00:15:53,170
So I want to be very, very clear, right?
264
00:15:53,170 --> 00:15:58,130
So I'm only attacking the detection model, right?
265
00:15:58,130 --> 00:16:01,170
If you go commit a crime at 9 p.m.
266
00:16:01,170 --> 00:16:05,610
and there is a CCTV monitoring that parking lot or whatever you're doing,
267
00:16:06,090 --> 00:16:10,570
the only thing that a pattern or whatever that adversarial action
268
00:16:10,570 --> 00:16:14,010
you took upon that camera was only around the detection, right?
269
00:16:14,010 --> 00:16:16,210
So you're still recorded, right?
270
00:16:16,210 --> 00:16:20,570
You're still on camera, a person monitoring the screens, whatever.
271
00:16:20,810 --> 00:16:22,810
We'll still see you, right?
272
00:16:22,810 --> 00:16:25,290
All of those things still occur, right?
273
00:16:25,290 --> 00:16:28,450
So just to be one, it's not an invisibility cloak.
274
00:16:28,450 --> 00:16:30,690
We're only targeting the detection.
275
00:16:31,210 --> 00:16:36,450
And then second, the most effective adversarial patterns
276
00:16:37,210 --> 00:16:41,570
are very dependent on which detection model you're targeting, right?
277
00:16:41,570 --> 00:16:43,450
So let me make sure that I say that correctly.
278
00:16:43,450 --> 00:16:45,410
Right now, I'm testing 11 models.
279
00:16:45,970 --> 00:16:50,290
So five person detectors, four face detectors,
280
00:16:50,450 --> 00:16:52,650
two facial recognition systems.
281
00:16:52,970 --> 00:16:55,130
And so let's stay with the person detector sites
282
00:16:55,130 --> 00:16:57,610
on testing out five different models.
283
00:16:58,330 --> 00:17:03,210
What's effective on one does not mean it's effective on five, right?
284
00:17:03,450 --> 00:17:10,170
And so while I am very heavily targeting patterns that are effective
285
00:17:10,170 --> 00:17:12,290
or somewhat effective across all of them,
286
00:17:12,290 --> 00:17:17,330
if another model that I've never even tried is what's running on that camera,
287
00:17:17,330 --> 00:17:19,210
I have no idea if that would be effective or not.
288
00:17:19,370 --> 00:17:21,010
Yeah, that makes total sense.
289
00:17:21,010 --> 00:17:24,850
And so you could have a piece of adversarial clothing
290
00:17:24,850 --> 00:17:27,290
and, you know, depending on the camera system,
291
00:17:27,330 --> 00:17:31,650
depending on all those things, like it may or may not detect you,
292
00:17:31,850 --> 00:17:36,410
but it's not like one size fits all type of you wear this shirt.
293
00:17:36,530 --> 00:17:37,650
It works for everything.
294
00:17:37,650 --> 00:17:40,210
Like that's not the case here from the get go.
295
00:17:40,210 --> 00:17:41,690
And I mean, I just want to be very clear.
296
00:17:41,690 --> 00:17:43,730
I had no idea how a camera worked, right?
297
00:17:43,770 --> 00:17:45,330
Like I had to go learn that.
298
00:17:45,330 --> 00:17:49,170
And the way the detection models work is it's confidence, right?
299
00:17:49,170 --> 00:17:51,570
So what they do is they kind of shrink down the image
300
00:17:51,890 --> 00:17:53,650
and they overlay a grid over it.
301
00:17:53,650 --> 00:17:56,930
And then they ask each square in that grid,
302
00:17:56,930 --> 00:17:58,850
do you see something? Right?
303
00:17:58,850 --> 00:18:00,410
Yes or no, it's binary.
304
00:18:00,410 --> 00:18:01,850
Do you see something?
305
00:18:01,850 --> 00:18:04,010
And then if yes, make a guess, right?
306
00:18:04,410 --> 00:18:09,530
And so what my adversarial patterns do is just lower the confidence of that guess
307
00:18:09,690 --> 00:18:11,490
lower to where.
308
00:18:11,490 --> 00:18:13,370
So whatever the bar is, right?
309
00:18:13,370 --> 00:18:17,250
So let's generally on a person detectors around seventy five percent
310
00:18:17,730 --> 00:18:19,890
lower and below that seventy five percent.
311
00:18:20,050 --> 00:18:24,210
So that that camera may still be saying, I think I still see a person,
312
00:18:24,650 --> 00:18:26,810
but I'm only twenty five percent confident.
313
00:18:26,850 --> 00:18:29,570
And so because it's below that that bar,
314
00:18:29,610 --> 00:18:31,530
yeah, it doesn't identify you.
315
00:18:31,530 --> 00:18:33,610
And you've all seen it when you see a camera,
316
00:18:33,610 --> 00:18:38,570
it's got like a red or green bounding box drawn around the person that tracks them.
317
00:18:38,930 --> 00:18:42,810
What I'm doing is I'm lowering that confidence rate around that decision.
318
00:18:42,810 --> 00:18:45,650
So that bounding box is never drawn around you.
319
00:18:46,770 --> 00:18:47,970
That makes sense.
320
00:18:47,970 --> 00:18:51,210
OK, that's a good way to visually understand,
321
00:18:51,210 --> 00:18:52,730
I think, what you've been researching.
322
00:18:52,730 --> 00:18:55,730
And it does ring a bell with me of like,
323
00:18:55,730 --> 00:18:59,090
yeah, that's the detection piece that you're going after.
324
00:18:59,130 --> 00:19:03,450
So what does this mean for the vendors in this space,
325
00:19:03,450 --> 00:19:06,730
police, policymakers, like all of those things?
326
00:19:06,730 --> 00:19:09,410
Because we've seen everything going on with flock recently.
327
00:19:09,410 --> 00:19:12,010
I mean, there's people cutting cameras down,
328
00:19:12,010 --> 00:19:15,930
city council meetings are just filled with people across the whole country.
329
00:19:15,930 --> 00:19:18,090
Now this is becoming a major thing.
330
00:19:18,090 --> 00:19:21,330
And I think the research that you're doing just fits perfectly
331
00:19:21,850 --> 00:19:24,570
into what's going on in this country right now.
332
00:19:24,770 --> 00:19:27,370
What does this all mean for this movement right now?
333
00:19:27,650 --> 00:19:32,210
Well, first and foremost, I hold myself to a very high ethical bar.
334
00:19:32,210 --> 00:19:35,250
Right. And so I don't want anybody out committing crimes.
335
00:19:35,570 --> 00:19:39,530
I have my own opinions about flock and the police state and surveillance state.
336
00:19:39,530 --> 00:19:43,570
I have very strong opinions there, but we should be handling this at a policy level.
337
00:19:43,570 --> 00:19:45,770
But, you know, power to the people, too.
338
00:19:45,770 --> 00:19:47,970
But we should go about this the right way.
339
00:19:48,050 --> 00:19:51,410
But, you know, my answer to that question gets a little bit deeper.
340
00:19:51,410 --> 00:19:53,850
I think that privacy is a fundamental right.
341
00:19:53,850 --> 00:19:59,690
I think that when you walk down the street and you are facially recognized
342
00:19:59,690 --> 00:20:04,730
like facial recognition done to you when you walk into a grocery store
343
00:20:04,730 --> 00:20:09,330
or a big box store where they're analyzing how much they think you're going to spend.
344
00:20:09,330 --> 00:20:11,250
I never opted into that, right?
345
00:20:11,250 --> 00:20:13,610
Like it's just we've gone too far.
346
00:20:13,890 --> 00:20:19,810
I think that tech will always improve and that bleeding edge will always continue to push.
347
00:20:19,810 --> 00:20:21,890
We're seeing that with a lot of things right now.
348
00:20:21,890 --> 00:20:25,850
Just LLMs, AI, everything, everywhere.
349
00:20:26,290 --> 00:20:30,250
But I do think it's up to the people and specifically I do think it's up to the hackers
350
00:20:30,250 --> 00:20:36,410
to be that counterbalance to those things to show that, hey, like hacking's not magic, right?
351
00:20:36,410 --> 00:20:38,090
And I never opted in.
352
00:20:38,090 --> 00:20:40,330
So I'm going to create the opt out, right?
353
00:20:40,330 --> 00:20:45,170
And I do know that when I release patterns and when I release those
354
00:20:45,170 --> 00:20:49,890
kind of things that they probably will go in to their training models to tune out.
355
00:20:50,210 --> 00:20:55,090
It's OK, it's going to be an arms race that, you know, like I've got better ones,
356
00:20:55,090 --> 00:20:58,170
you know, they're coming to right, you know, so that's right.
357
00:20:59,090 --> 00:21:01,370
Yeah, so that's kind of how I feel about that.
358
00:21:01,370 --> 00:21:05,610
This podcast has been focused on privacy for years and we've always said
359
00:21:05,610 --> 00:21:09,650
privacy is human rights and we are all entitled to privacy.
360
00:21:09,650 --> 00:21:15,890
And when companies and these organizations and the technology feels invasive to people,
361
00:21:15,890 --> 00:21:19,770
it is always interesting to me that the hacker community always steps up.
362
00:21:19,930 --> 00:21:23,090
To try find ways to opt yourself out.
363
00:21:23,090 --> 00:21:25,090
And I love the way that you phrased that.
364
00:21:25,090 --> 00:21:29,170
One thing I did want to cover is your Kickstarter because talking about the
365
00:21:29,170 --> 00:21:32,930
patterns and clothing, what was the idea for the Kickstarter?
366
00:21:32,930 --> 00:21:36,570
Because you've raised a hundred and thirty five dollars on this Kickstarter.
367
00:21:36,770 --> 00:21:39,650
It was one of those things that I wanted to raise somewhere around five
368
00:21:39,650 --> 00:21:43,090
to six thousand dollars so that I could move my research to the next level.
369
00:21:43,090 --> 00:21:44,530
Buy some more cameras.
370
00:21:44,530 --> 00:21:48,410
Yeah. So the cameras that I want to target are like fifteen hundred bucks each.
371
00:21:48,450 --> 00:21:52,490
And you know, I'm like, I've been fronting this myself for the year.
372
00:21:52,490 --> 00:21:55,810
And just to move it to the next level, I was like, well, I'm going to
373
00:21:55,810 --> 00:22:01,370
hopefully raise six K to buy some nerd stuff and and it exploded.
374
00:22:01,410 --> 00:22:05,530
Right. So I did talks at both that Black Hat and Def Con this year.
375
00:22:05,730 --> 00:22:10,410
And so that the Def Con talk will be posted publicly when Def Con posts us.
376
00:22:10,410 --> 00:22:13,850
And I really highly encourage anybody interested in this topic
377
00:22:13,850 --> 00:22:16,330
to watch it because I show how I show the math, right?
378
00:22:16,370 --> 00:22:18,610
Go into how this works and all of those kind of things.
379
00:22:18,850 --> 00:22:21,250
But the Kickstarter has been insane, right?
380
00:22:21,250 --> 00:22:24,650
So what that proves to me is that people care about their privacy, right?
381
00:22:24,650 --> 00:22:27,890
So what I'm releasing is basically three garments.
382
00:22:27,890 --> 00:22:31,610
I'm releasing a T-shirt, a hoodie, and I don't know if you've ever watched
383
00:22:31,610 --> 00:22:35,410
a show, Survivor, but yeah, Buff, like a tube of fabric.
384
00:22:35,410 --> 00:22:38,330
You can either wear the headband or over your face.
385
00:22:38,850 --> 00:22:41,050
And each one of them target different things.
386
00:22:41,050 --> 00:22:45,810
So the T-shirt and the hoodie target the object model, the person object model.
387
00:22:45,810 --> 00:22:51,370
So if you are wearing this T-shirt or hoodie, you are not identified as a person, right?
388
00:22:51,370 --> 00:22:54,810
And what I mean by that is that little bounding box is not drawn.
389
00:22:54,810 --> 00:22:56,370
They don't know what you are.
390
00:22:56,370 --> 00:23:00,570
Yes. Well, and so it's so funny because on the back end, I get to see that.
391
00:23:00,610 --> 00:23:03,690
Listen, I don't, you know, the model will be like, something's there.
392
00:23:04,050 --> 00:23:05,450
No clue what, right?
393
00:23:05,450 --> 00:23:06,290
Like no clue what.
394
00:23:06,290 --> 00:23:07,690
Alien. Yeah.
395
00:23:07,690 --> 00:23:08,930
Yeah.
396
00:23:08,930 --> 00:23:14,090
And so there was this prior research that was done that gets brought up every once in a while.
397
00:23:14,090 --> 00:23:16,610
So you can make those models detect what you want.
398
00:23:16,610 --> 00:23:21,410
And so someone else did some research and said, if you're wearing this dress
399
00:23:21,410 --> 00:23:24,690
or whatever they had, you were identified as a giraffe, right?
400
00:23:25,210 --> 00:23:25,570
Awesome.
401
00:23:25,570 --> 00:23:29,810
While the hacker in me just absolutely loves that.
402
00:23:29,810 --> 00:23:33,530
But that is the wrong strategy for hiding, right?
403
00:23:33,530 --> 00:23:36,970
Like if you've been alert that there is a giraffe in the crowd,
404
00:23:36,970 --> 00:23:39,690
that's going to be where the people are going to look, right?
405
00:23:39,730 --> 00:23:43,690
So my patterns, what they do is they drop that object detection to zero, right?
406
00:23:43,690 --> 00:23:48,410
And then the buff, the one that goes over your face targets the face models.
407
00:23:48,410 --> 00:23:53,650
And remember, if a face is never detected, facial recognition never happens, right?
408
00:23:53,970 --> 00:23:59,370
And so, so I'm breaking the face model with the buff is what I'm doing.
409
00:23:59,650 --> 00:24:02,050
And there's two versions that I have released.
410
00:24:02,050 --> 00:24:04,170
There's the one that everybody gets, right?
411
00:24:04,170 --> 00:24:10,130
So this will be a very effective pattern that's a little bit cheaper and everybody gets.
412
00:24:10,130 --> 00:24:14,330
And that's going to be the one that I think that the camera manufacturers
413
00:24:14,330 --> 00:24:15,810
will train on, right?
414
00:24:15,810 --> 00:24:16,250
Sure.
415
00:24:16,250 --> 00:24:20,010
Then I'm also doing runs one on one where I never show that pattern
416
00:24:20,010 --> 00:24:22,170
to anybody else other than you, right?
417
00:24:22,490 --> 00:24:26,890
You're the only person in the world that has seen that other than me, right?
418
00:24:26,890 --> 00:24:28,530
They have seen that pattern.
419
00:24:28,530 --> 00:24:31,810
And so you've never even made it into the training data set, right?
420
00:24:31,810 --> 00:24:34,210
So it should be effective for much longer.
421
00:24:34,290 --> 00:24:36,210
Yeah, yeah, that's awesome.
422
00:24:36,210 --> 00:24:38,330
Well, I mean, not only that, but I feel like this is you're
423
00:24:38,330 --> 00:24:41,210
starting a new fashion trend, right?
424
00:24:41,690 --> 00:24:42,050
Yeah.
425
00:24:42,050 --> 00:24:43,970
So there's been some comments about that.
426
00:24:44,130 --> 00:24:47,410
So Reddit, I did like a real mini AMA type thing.
427
00:24:47,410 --> 00:24:52,050
And someone was like, hey, can you make one that doesn't look like I glitched out
428
00:24:52,050 --> 00:24:56,050
on drugs or whatever fashion does evolve over time, right?
429
00:24:56,050 --> 00:24:59,490
So, you know, like maybe this will be the hot new trend next year.
430
00:24:59,490 --> 00:25:04,370
But I show some examples of patterns on my website, but never the good ones.
431
00:25:04,370 --> 00:25:06,930
But, you know, just so you can kind of get a sense of what
432
00:25:06,930 --> 00:25:08,090
the pattern is going to look like.
433
00:25:08,090 --> 00:25:15,170
And they're often high frequency repeating patterns that have circles and lines.
434
00:25:15,250 --> 00:25:18,650
It depends on what I'm targeting, object detector.
435
00:25:19,130 --> 00:25:22,090
So like the person right here, this is the hardest part.
436
00:25:22,130 --> 00:25:26,090
So your shoulder, that curve, there's a lot of contrast between your
437
00:25:26,090 --> 00:25:29,090
shoulder and your background, and it's an unnatural angle.
438
00:25:29,130 --> 00:25:32,730
And so the patterns really target that area.
439
00:25:33,610 --> 00:25:34,370
Interesting.
440
00:25:34,570 --> 00:25:35,010
Yeah.
441
00:25:35,210 --> 00:25:38,890
Well, we're going to have, in the show notes, we'll link to your Kickstarter.
442
00:25:38,890 --> 00:25:41,410
And, you know, when this episode is released, I think there'll be some
443
00:25:41,410 --> 00:25:43,170
more time on your Kickstarter as well.
444
00:25:43,170 --> 00:25:46,570
So people can still sign up and contribute to the projects.
445
00:25:46,570 --> 00:25:49,730
I think it's super important and to get cool, cool stuff.
446
00:25:49,850 --> 00:25:52,770
What I'd really like from your audience is, hey, if you have any
447
00:25:52,770 --> 00:25:54,890
comments, especially like the tough ones.
448
00:25:54,930 --> 00:25:59,410
So I publish all of my stats on no recognition or flash research.
449
00:25:59,410 --> 00:26:03,170
You can see what I'm grinding on right now, what my strategies are.
450
00:26:03,410 --> 00:26:06,850
If you have, especially the tough feedback, I'd love to hear it.
451
00:26:06,850 --> 00:26:10,210
So I've already had a few that have come in that somebody just
452
00:26:10,210 --> 00:26:13,330
burning me down and I had responses for most of it.
453
00:26:13,330 --> 00:26:16,250
But some of it was like, you're absolutely right, and I'm going
454
00:26:16,250 --> 00:26:18,130
to change the way that I'm doing this.
455
00:26:18,130 --> 00:26:21,410
So let me have it if you have, if you have comments, for sure.
456
00:26:21,530 --> 00:26:21,770
Yeah.
457
00:26:21,770 --> 00:26:25,770
And we'll have all of Bill's contact info and the websites and all
458
00:26:25,770 --> 00:26:28,730
of that if you want to give Bill feedback.
459
00:26:28,810 --> 00:26:31,570
Like I said, he appreciates the direct feedback.
460
00:26:31,850 --> 00:26:32,930
Yeah, all taken.
461
00:26:32,930 --> 00:26:35,890
I mean, as even when I was doing security research and all of
462
00:26:35,890 --> 00:26:39,490
that, I always appreciated direct feedback, positive, negative.
463
00:26:39,490 --> 00:26:40,850
Just, just bring it all to Bill.
464
00:26:41,130 --> 00:26:41,810
He can handle it.
465
00:26:41,850 --> 00:26:42,410
I'll take it.
466
00:26:42,410 --> 00:26:43,650
Yeah, that's right.
467
00:26:44,250 --> 00:26:46,610
Even if it's, even if it's Bill, you're ugly.
468
00:26:46,650 --> 00:26:47,770
Like, yeah, I mean, it was cool.
469
00:26:48,610 --> 00:26:49,890
I don't like your hat, Bill.
470
00:26:50,210 --> 00:26:51,650
Well, thanks, man.
471
00:26:52,610 --> 00:26:53,730
Well, this has been awesome.
472
00:26:53,730 --> 00:26:55,090
Great to catch up with you.
473
00:26:55,090 --> 00:26:57,250
And I love the research that you're doing.
474
00:26:57,250 --> 00:27:00,970
I think it is so important in the privacy and security space.
475
00:27:01,010 --> 00:27:05,170
And I really believe this is what hackers are supposed to do.
476
00:27:05,290 --> 00:27:07,810
Like this is exactly our calling right here.
477
00:27:07,810 --> 00:27:11,050
And I'm really excited about everything you've been doing.
478
00:27:11,050 --> 00:27:14,090
The Kickstarter and I wish you, of course, nothing but the best.
479
00:27:14,090 --> 00:27:15,450
So thanks, buddy.
480
00:27:15,450 --> 00:27:16,610
I appreciate you having me on.
481
00:27:16,610 --> 00:27:17,690
Thanks for your welcome.
482
00:27:17,690 --> 00:27:18,130
Doing this.
483
00:27:18,490 --> 00:27:18,850
All right.
484
00:27:18,850 --> 00:27:20,290
Thanks, everyone, for listening.
485
00:27:20,290 --> 00:27:24,490
And until next time, stay safe, stay secure and stay private.
486
00:27:24,570 --> 00:27:26,130
Thank you for listening or watching.
487
00:27:26,330 --> 00:27:29,810
If you liked this episode, hit subscribe, share it with your
488
00:27:29,850 --> 00:27:34,330
friends and colleagues or jump into our community at sharedsecurity.net
489
00:27:34,330 --> 00:27:36,930
slash supporter to keep the conversation going.
490
00:27:37,050 --> 00:27:41,730
Thanks again, and we'll see you next week for another episode of Shared Security.