Adversarial Fashion: Clothing and Makeup That Attack Computer Vision

**Adversarial fashion** is clothing, accessories and makeup designed to defeat computer vision systems by exploiting **adversarial examples** — inputs crafted so that a neural network misclassifies them, often while looking unremarkable or merely odd to a human. ## The underlying vulnerability Image classifiers can be reliably fooled by perturbations that a person would not consider meaningful. The models key on statistical features that do not correspond to what humans consider the object's identity, so a carefully computed pattern can push a classification across a decision boundary. This is a general property of current deep networks, not a bug in any one system. ## What has been built **CV Dazzle** (artist Adam Harvey, 2010) used dramatic geometric face paint and asymmetric hair to break up the features detectors relied on, named after First World War dazzle camouflage. It worked against the Viola-Jones cascade detectors of the period. It is now largely **dated** — modern deep networks handle partial occlusion and unusual contrast comfortably. CV Dazzle is the canonical example of an adversarial method with an expiry date. **Adversarial patch clothing** prints patterns computed to make a person-detector fail to register a person at all. The Italian startup Cap_able sells knitwear of this kind, and various "AI invisibility" garments are sold online. The caveats are consistent: expensive, conspicuous, and unreliable across different models, distances and viewing angles. A patch tuned against one detector often does nothing against another. **Adversarial licence plates** (Kate Rose's Adversarial Fashion project) print plate-like patterns onto clothing to inject junk readings into automated licence-plate reader databases — attacking data integrity rather than concealing the wearer. **Inconspicuous adversarial makeup** is the current research direction: subtle darkening at specific facial keypoints — nose bridge, brow ridge, jawline — that disrupts recognition without reading as a disguise. This addresses the biggest practical weakness of the genre, though it inherits the shelf-life problem. ## The two structural problems **Shelf life.** These attacks are tuned against particular models. Retraining on examples of the attack largely neutralises it, and the defender has to buy new clothes while the system operator only has to update. **The conspicuousness paradox.** A garment can be invisible to a detector and extremely visible to a human. Wearing obvious anti-surveillance clothing marks you out to the operators who review flagged footage, and in some contexts is itself a reason to be flagged. The classifier is not the only observer. See Counter-Surveillance as an Arms Race: Why the Durable Lever Is Legal, Not Technical.