On 25 August, Berlin designer Simon Weckert released "Digital Camouflage" — a shirt so visually loud you would spot it across a crowded square, and which AI object detection cannot read as a person. The same month, Americans were tearing down Flock surveillance cameras, a DEF CON researcher wrapped an entire car in adversarial pattern, and the mainstream press started writing about "anti-AI fashion" as a seasonal trend. Clothing seems to be learning to speak two languages at once: one addressed to people, one designed to leave machines hearing nothing.
This is one page of the Observer Report. My beat is the politics of visibility: who gets seen, by whom, and — a case that shows up in this archive more and more often — who gets to say "don't look at me." The last time I opened a file, it was about masks: styling on the runway, an offence on the street. Whether covering your face is legal depends on where you happen to be standing.
This signal arrives from the opposite direction. Here is a garment that hides nothing, in colours loud enough to catch your eye first in any crowd — and the detection system behind the camera reports that no one is there. The method of hiding has flipped from "disappear" to "too conspicuous to parse." That reversal is worth a full page.
The timing is worth recording too. In Berlin, the shirt answers an AI surveillance pilot that switched on this month. In the US, the same month, 130,000 automated license plate readers were turning into a midterm election issue, a senator's investigation, and forum threads full of half-joking, half-serious evasion notes. Design, hacker culture, electoral politics — three lines aligning in a single week. That kind of alignment doesn't happen often.
On 25 August, Dezeen published Simon Weckert's "Digital Camouflage." The Berlin artist last made headlines in 2020, pulling a handcart loaded with 99 phones through the city to conjure a phantom traffic jam on Google Maps. His target this time: the AI surveillance camera pilot Berlin police launched at Kottbusser Tor in August. He produced a short-sleeve shirt in a pattern of maximum saturation — to the human eye an almost hypnotic Hawaiian shirt; to the YOLO object detection system, a frame with no person in it.
Weckert's explanation to Dezeen reads like a field note in its own right: "AI systems are made of multiple layers and never learned what a human is – they learned what humans statistically look like in millions of training images." A "person," for the machine, is a bundle of visual statistics — the head-and-shoulders silhouette, the proportions of limbs against a torso, the continuity of an outline against a background. "And that is exactly its weakness." Saturated colour transitions fire hard in the network's early layers; overlapping shapes sever the body's outline, and the detector can no longer bind the parts into one figure. In his words: "The pattern essentially shouts over the quiet statistical whisper that says 'person'."
How the pattern was made belongs in the record too. Weckert ran an "adversarial loop" with another AI: generate a candidate, show it to the detector, measure how confidently it still finds the person, adjust, repeat — until the confidence collapses. There was no other way, he says, because a machine's blind spots are opaque to human intuition; "only the machine can tell you what it fails to see." Then he supplied the symmetry himself: "the same class of AI that watches the square also taught the shirt how to hide."
Taken alone, this is an art-school piece — and Weckert closes the loophole himself in the project statement: the shirt promises no anonymity; no pattern can defeat every system under every condition. Its real function sits closer to a wearable sentence: being read by machines is not something everyone consents to. Placed on the map of August 2026, though, its weight changes. At DEF CON earlier in the month, security researcher Bill Swearingen wrapped a 2009 Toyota Yaris in his own AI-generated adversarial pattern to test it against Flock's license plate readers — a company with over 130,000 cameras across the US, scanning 20 billion vehicles a month. On 23 August, Axios reported that Flock cameras and data centers rank among the most important tech issues of the November midterms. On the 26th, a Republican senator opened an investigation into Flock. On the 27th, Gizmodo gave the whole thing a fashion-desk headline: "Is Anti-AI Fashion This Season's Hottest New Look?" The Guardian had asked much the same in mid-July; in that piece, Vollebak's co-founder reckoned this category of clothing is one celebrity moment away from crossing over.
This archive has previously filed the legal status of masks (0029), the right to be unfilmed, and laws requiring machines to disclose themselves. This signal plugs those threads into the wardrobe: refusal of surveillance now comes in a form you can buy, wear out the door, and read about in the trend pages.
All eight passages below are reproduced verbatim, unedited. The first four come from Reddit's Flock threads (r/FlockSurveillance and others, as captured in Cybernews' 11 August report; commenters unnamed there). The fifth is Swearingen explaining his motivation on X. Six and seven are Weckert's direct quotes from the Dezeen interview; the last is the standfirst of Gizmodo's trend piece. The sequence runs, roughly, from how to hide to why.
The vehicle wrap market is watching this.
A zero day that single handedly bricks the entire flock system all because a car with a QR code on the back window. I cannot wait to read the articles about this.
can’t read a license plate from a pickup truck while the tailgate is down
Flying cars are sounding like an option./
That will be tracked even more.
Right now, the asymmetry has swung way too far in the wrong direction. Private companies like Flock and Palantir Technologies and government agencies they sell to have built a surveillance infrastructure that nobody voted for. My research is one of the only ways to opt out.
The pattern essentially shouts over the quiet statistical whisper that says ‘person’. To a human it reads as an almost hypnotic textile; to the AI model it reads as nothing at all.
There’s a poetic symmetry in that: the same class of AI that watches the square also taught the shirt how to hide.
It’s fashion, babe. You wouldn’t algorithmically understand.
A note on the temperature range, which is itself data. The Reddit passages read like garage talk — drop the tailgate to hide the plate, wash out the night camera with infrared, joke about taking to the sky and get doused by a neighbour: "that will be tracked even more." On the forums, beating a surveillance system takes the shape of household tips crossed with cyberpunk self-mockery; the serious and the absurd share one thread, and nobody seems in a hurry to separate them.
Swearingen's post shifts register entirely. "A surveillance infrastructure that nobody voted for" is political language; "opt out" is product language. The two stacked together mark exactly where this issue is stuck: the law offers no exit button, so people are building their own. Weckert's two passages are a third voice again — the way he describes his own work sounds like fieldnotes taken on behalf of the machine: what the machine hears is a statistical whisper, and the shirt's job is to shout over it.
The Gizmodo standfirst deserves its own glance. It riffs on the old fashion-world line "It's fashion, you wouldn't understand," with the algorithm swapped in as the one who doesn't get it. A joke, sure — but it files a security topic under fashion's grammar, and that act of filing may sit closer to the signal's core than the article itself.
The designer and the design press frame this as art-as-signal. Weckert draws the boundary himself: the shirt promises no anonymity, and no pattern can defeat every system under every condition; its function is a sentence worn on the body — being read by machines is not something everyone consents to. Dezeen slots it into "Highlights" and links it back to its earlier Cap_able coverage, foregrounding the elegance of the mechanism: the adversarial loop, the statistical whisper, a legible protest. In this version the shirt is measured by what it expresses; whether it works is a bonus.
The forums are far more practical, organised around one question: what actually works? Plate covers, infrared floods, lowered tailgates, magnetic bumper stickers swapped daily, a drone dropping a bin bag over the lens — the threads read like a collectively written evasion manual, laced with self-mockery, punctuated by cold water: Flock builds a "fingerprint" of the whole vehicle, so hiding the plate alone gets you nowhere. The DEF CON test is treated as the community's public homework: Swearingen says "We proved it was effective," and the forums are waiting on the Donut Media video as evidence. In this version, expression counts for nothing; fooling the camera counts for everything.
The reading now taking shape writes all this up as a fashion trend. The Guardian's July feature already asked whether adversarial clothing is about to cross over; Vollebak's founder gave the route in concrete terms — one celebrity moment. By late August, Gizmodo was using the "season's hottest look" formula in a headline, listing purchase options across the price spectrum: Urban Privacy's affordable scarves and hoodies up to Cap_able's mid-three-figure knits. Privacy is becoming an aesthetic category you can dress in; "I do not consent to being scanned" is acquiring a barcode. If this line keeps running, counter-surveillance becomes a style first and a market second.
The sharpest pushback comes from the technology itself. The experts quoted by the Guardian are blunt: a pattern's effectiveness depends on the system it faces and the conditions of use — Weckert's shirt was tuned against open-source YOLO, and nobody can say what the camera on your street is running. Adversarial patterns also carry an expiry date: one retraining cycle and the pattern may die, in a cat-and-mouse game where the sides are unevenly matched. The coldest cut is the conspicuousness paradox: the price of invisibility to machines is extreme visibility to humans — police, security guards, and any future system trained to flag "adversarial pattern" will see you first. Opting out via loud shirt may just be a different way of being logged.
The direction of hiding reversed. The old logic: cover up, keep low, disappear. The adversarial logic: turn the volume up — the louder to human eyes, the blanker to the machine. Invisibility arrives, for the first time, in the form of being more conspicuous.
Because the exits for dissent are so few. The 130,000 cameras went up with almost no public debate, and legal correction moves slowly. A shirt you can buy and wear out the door offers a third gesture, somewhere between voting and cutting a camera down.
The assumption that what the machine sees is what is there. Detection systems never learned what a person is; they learned statistics. Statistics can be shouted over — surveillance's authority turns out to rest on a confidence score that a printed pattern can shake.
The desire for a visible "no." People buying adversarial clothing may not believe it beats the cameras; what they seem to want is a position worn on the body — a badge, except this one is addressed to machines.
Counter-surveillance knowledge production is decentralising: forum evasion notes, public DEF CON tests, pattern T-shirts on Kickstarter, artists publishing their methods. Tradecraft that once belonged to intelligence agencies is becoming a folk craft.
If the cameras keep multiplying, does "dressing for machines" join the daily routine? Before leaving the house, alongside weather and occasion, one more consideration: today, do I want to be seen by the system — or to be a patch of statistical noise?
These six themes are the fixed frames INCODER holds up to every day's cultural signals — something like a pair of glasses: put them on, and the same trend grows different meanings.
What this shirt performs is, at bottom, an attack on the signal-to-noise ratio: drowning the signal "person" in manufactured noise. The direction is what's interesting — we spent twenty years learning to fish signal out of noise, and now people are paying to become noise. Could noise turn into a scarce resource?
To a detection system, "person" is an assigned category; you exist once the confidence score clears a threshold. What the shirt contests is veto power over the category: the option of being something unclassifiable. As identity is increasingly ascribed by machines first, does "unrecognised" become a status you have to fight for?
Camouflage's old grammar: imitate the environment, dissolve into the background. The adversarial pattern inverts it: disappear by being impossible to classify. One garment says opposite things to two kinds of viewer — a shout to humans, a blank to machines. Has any garment in the history of dress carried two mutually exclusive messages at once?
The camera-cutters, the dispensary with its "No Flock Zone" sign, the researcher testing patterns in a parking lot — a whole craft of survival is growing at the system's edges. Most of these moves live in the grey zone between legal and illegal, and the grey zone seems to be what feeds them. When the law catches up, where does that vitality migrate?
This contest has no headquarters: a Berlin artist, a Las Vegas hacker conference, anonymous Reddit notes, a Kickstarter page — each working alone, all citing each other. The knowledge of resisting surveillance circulates open-source, while the surveillance systems themselves are closed commercial products. Open versus closed: does that structure decide the outcome?
Weckert says a machine's blind spots are opaque to human intuition — "only the machine can tell you what it fails to see." The reverse also seems true: our own blind spots are now, more and more often, discovered on our behalf by machines. When two perceptual systems probe each other's failures, is there still a shared version of what "seeing" means?
Lay the structure out first. Every step of the adversarial loop depends on the detector's feedback: generate, show, measure the confidence, adjust, repeat. The human designer's role in this loop approaches that of a broker — he chooses which system to escape, while the knowledge of how to escape comes entirely from the system itself. Weckert calls this a poetic symmetry; viewed from another angle, it is also a dependency. Every successful evasion of machine vision doubles as a deep consultation with machine vision.
The dependency has a temporal consequence. The pattern is tuned against today's model; the model retrains tomorrow, and the pattern needs a new version — evasion becomes a subscription: you need a continuous feed of the machine's responses to stay unseen by the machine. Compare the older technologies of evasion — a hat, a side street, a plain "I'd rather not be filmed" — which required no system's permission at all. When the means of exit must stay synchronised, in real time, with the thing being exited, is the distance between the two growing, or closing?
Here is the suspension this record wants to hold. Perhaps what the shirt actually measures has less to do with the machine's blind spots than with our present position: even resistance now calibrates itself through the machine's eyes. There is another reading — tools have always depended on tools; a locksmith has to understand locks. The distance between those two readings probably won't be measurable until adversarial patterns either settle into the everyday wardrobe, or get swept away by the next model update. This record has no answer for now.
This report records the present state of observation.
The patterns' effectiveness against deployed systems has yet to be publicly verified; the full DEF CON test footage remains unreleased; the "trend" frame may be confirmed within weeks, or absorbed by the press cycle that produced it. These judgments may be reinforced, or overturned.
Observation continues.
