Different ways to trouble the machine.

An anonymously operated shop selling hoodies, shirts and masks it describes as carrying engineered adversarial patterns, citing published techniques including Expectation over Transformation and the ImageNet-Patch dataset. It claims effects on face recognition, object detection and multi-object tracking, which is the widest claim set among comparable sellers. No test results, target models or imagery of a detector failing are published, and the shop discloses no company name, location or team.

A hands-on workshop titled “Face/Off: Adversarial Drag in the Age of Capture”, run within the Queer and Feminist Informatics Network at the University of Amsterdam. It uses drag technique and adversarial makeup against both facial and automated gender classification, treating the binaries encoded in classifiers as part of what is being contested. The network presents it as pedagogy and creative research and makes no claim of effectiveness against a named system.

Kate Bertash printed garments covered with plausible vehicle number plates so that automated licence plate readers would capture, timestamp and record them alongside real vehicles. The mechanism is data injection rather than evasion: the plates only need to be accepted by a reader, not to defeat a classifier, and the target is the integrity of plate-reader databases rather than any face system. Demonstrated at DEF CON 27 against OpenALPR and commercial mobile readers; the garments have not been sold since around 2023.

Open-source code from the EAVISE group at KU Leuven that generates a printable patch optimised against a person detector's own objectness loss, so that a person holding it produces no detection proposal. Published results against YOLOv2 on the INRIA test set report recall falling from 100 per cent to 26.5 per cent with the best patch, at a patch of roughly 40 centimetres held facing the camera. The authors note that patches transfer poorly to different detector architectures; because it is a generator rather than a fixed pattern, it can be retrained against a current model.

An online shop selling garments, gaiters and masks printed with patterns the seller describes as chosen to disrupt computer-vision systems. The shop's own wording is that the images are “thoughtfully crafted, designed, and selected”, and its founder told the Mozilla Foundation that the designs are tested informally against a TensorFlow model and that he is “not saying it will always work”. In Mozilla's hands-on review the garments avoided a consumer camera's human-detection alert but did not defeat a pose-estimation model.

A Milan-based fashion company producing knitted garments whose adversarial patterns are intended to confuse automated person and object detectors. The clothing acts upstream of face matching: it tries to stop a camera system from classifying the wearer as a person in the first place.

Adam Harvey's foundational computer-vision camouflage project uses makeup, hairstyling, occlusion, and asymmetry to break the facial structure expected by a detector. The original looks targeted Viola-Jones Haar cascades and are historical examples, not current protection recipes for modern neural networks.

Sterling Crispin used genetic algorithms driven by face detection and recognition systems to evolve forms those systems read as maximally face-like, then 3D-printed them as wearable masks. The series is presented as a way to show the machine what it is looking for rather than as a countermeasure; Crispin states directly that defeating face recognition is not the goal, since covering a face with a hand already achieves non-detection. Produced between 2013 and 2015 and exhibited internationally.

Michelle Tylicki and Lauri Love turn anti-surveillance makeup into an interactive salon for teaching, designing, and testing a look. The touring work connects collective experimentation with model feedback, although its public documentation does not provide a complete reproducible benchmark.

Simon Weckert's wearable installation turns an adversarial pattern developed against YOLO person detection into a shirt and public artwork. It exposes the fragility of automated seeing; the artist explicitly does not promise anonymity or effectiveness against a particular government system.

Zach Blas's workshops aggregate participants' facial data into amorphous collective masks that cannot be reduced to one individual portrait. The project opposes biometric classification and its social biases through collective masking, performance, and public discussion.

A 2015 collection of five retroreflective garments by the clothing brand Betabrand with the musician Chris Holmes, using fabric coated with glass nanospheres that return a camera flash to the lens. It was conceived to disrupt press photography rather than recognition systems, and made no claim about face detection or matching. The collection was crowdfunded, shipped, and is no longer sold.

Nick Bild's open-source build sews 940-nanometre infrared LEDs into a hat to overwhelm the photodiodes of infrared-sensitive cameras. The 940-nanometre choice produces almost no visible glow, so the wearer does not appear conspicuous to onlookers, which the project states as a design goal for protest use. Code, schematic and parts list are published; like all infrared flooding it depends on the camera passing near-infrared, so a daytime infrared-cut filter removes the effect.

Adam Harvey and Hyphen-Labs developed a textile covered with machine-readable false faces, redirecting a detector toward decoys around the wearer. Its first version was specific to OpenCV Haar cascades, was never sold, and was not tested against modern deep face detectors.

Ewa Nowak's brass face jewellery hooks behind the ears and places two discs below the eyes and a rectangle between them, positioned to disturb the facial landmarks a detector locates. The designer's only reported test was uploading photographs to Facebook and observing that its tag suggestion did not appear, which is a single consumer-platform check on frontal stills rather than a measurement. It was made as a prototype and has not been produced commercially.

Hand-built caps sold from the Czech Republic with a nine-LED infrared strip in the brim, powered by two AAA cells for twelve to fourteen hours. They were intended to wash out the wearer's face for cameras sensitive to near-infrared in low light, and no wavelength, radiant power or test data was ever published. The maker's domain ceased to be associated with the product in November 2019; the listing survives as a product record and unbranded copies circulate on marketplaces.

Bill Swearingen's project uses an evolutionary process to search for adversarial patterns that can be printed on ordinary fabric. Presented at DEF CON as an experiment about whether clothing can defeat a complete recognition pipeline, it is now moving from conference prototype toward a crowdfunded garment.

A National Institute of Informatics research programme that explored active infrared emitters and later passive reflective or absorbing eyewear. The visor aims to suppress the eye-region contrast used by some face-analysis pipelines; NII now lists it as a past project.

Simone C. Niquille printed T-shirts with celebrity impersonators and highly circulated stock faces to introduce false identities into social-media recognition and tagging. The shirts do not hide the wearer's face; they explore privacy through misidentification, duplication, and database noise.

Commercial privacy eyewear combining infrared-blocking lenses with reflective frames. Different models target infrared illumination, eye tracking, or depth-based face mapping; the effect therefore depends on the camera spectrum and acquisition system rather than providing universal invisibility.

An American eyewear brand selling frames with what it describes as passive optical filtering of specific infrared wavelengths. The stated aim is to reduce the accuracy and consistency of camera-based face recognition rather than to prevent it; the company's published evidence is that iPhone Face ID “did not consistently unlock” in its own internal testing. Several of the uses it names, such as retail and event scanning, are visible-light systems that an infrared filter would not be expected to affect.

Adam Harvey's 2013 garment series used silver-plated, thermally reflective fabric to reduce the wearer's thermal signature in long-wave infrared imaging. It addresses aerial and thermal observation rather than face detection or matching, and is frequently miscited as anti-face-recognition clothing. The pieces were sold briefly through Harvey's Privacy Gift Shop and are now sold out.

Dutch designer Jip van Leeuwenstein made a transparent moulded mask at the Utrecht School of the Arts in 2017 that bends and refracts light across the face, with the stated aim of preventing a camera from recovering accurate facial geometry while people can still read the wearer's expressions. The designer hedges the claim to “some forms of facial recognition” and publishes no test, target system or material specification. Snopes rated the widely shared claim that it blocks recognition from all angles as “Mixture”, finding it unclear whether the mask was ever produced or remained a thought experiment.

Mac Pierce's open DIY garment places high-power infrared emitters around the hood and uses a tuned strobe to disturb night-vision exposure around the head. It targets IR-sensitive cameras rather than directly changing a face descriptor, and its effect varies with the camera, distance, light, and exposure controls.

A London collective that used CV Dazzle walks, workshops, films, and public interventions to make surveillance infrastructure visible and discussable. Its contribution is a repeatable social and workshop practice rather than a controlled claim of recognition evasion.

A retroreflective scarf by Saif Siddiqui whose woven reflective elements return a camera flash toward its source, overexposing the wearer in the resulting photograph. The product targets flash photography on consumer devices and the brand makes no face-recognition claim; it has no effect on ambient-light photography, on closed-circuit cameras or on any recognition pipeline. A retroreflective surface also increases the wearer's visibility to infrared-illuminated cameras at night.

A 2016 prototype by Becca Ricks and Shir David placing 22 infrared LEDs around the bill of a baseball cap, with a potentiometer to vary brightness, to saturate a camera sensor over the wearer's face. The makers ran surveillance footage through the Google Cloud Vision API and reported that the wearer went undetected while an unprotected face in the same frame was detected. It was a single informal trial with no stated distances or light levels, and no build files were released.

A Leipzig privacy-fashion label selling Faception garments covered with face-like signals, alongside reflective anti-photography clothing and Faraday accessories. Its face-pattern collection aims to make automated systems detect faces where no face exists, increasing ambiguity around the wearer.

Leonardo Selvaggio distributed photorealistic prosthetic and paper masks of his own face so that many wearers would present the same identity to cameras. URME replaces one identity with another rather than attempting invisibility, turning biometric substitution into a collective artwork.

Privacy sunglasses sold by an undisclosed operator, built around a lens the company calls GLX or Green Light Lens technology. The marketing claims disruption of infrared recognition, visible-light recognition and thermal imaging; only the infrared claim has a conventional physical basis, since a tinted lens leaves the jaw, nose and head geometry fully imaged by a daylight camera and does not change the thermal emission of skin. No wavelength data, rejection curve or test results are published.

Jing-cai Liu's 2017 bachelor project at the Utrecht School of the Arts mounts a small projector on the head to cast a different appearance over the wearer's face. It is a speculative design rather than a tested countermeasure: the project page states that most of the designs in the series are not working products, and no optical specification or test result is published. It is frequently misattributed to Jip van Leeuwenstein, who was one of five collaborators on the wider series.

A Montreal print-on-demand shop run by Jennifer Wu, selling apparel and accessories marketed to privacy and anti-surveillance audiences. Unlike comparable sellers it makes no technical claim about how its prints affect any system, presenting the range as protest and gift merchandise. Mozilla's review found the garments avoided a consumer camera's human-detection alert but not a pose-estimation model.

A lens coating sold by the mass-market optician Zenni, which the company says reflects up to 80 per cent of near-infrared light between 700 and 1050 nanometres. It targets the acquisition stage of infrared-based systems such as phone face unlock and infrared-illuminated cameras, not visible-light face matching. Zenni states that it does not guarantee anonymity or total protection, and independent testing by 404 Media found the lenses block infrared while leaving an ordinary daylight photograph fully usable for matching.