Research & Development
Investigating vulnerabilities in computer vision systems and developing material countermeasures for the urban surveillance environment.
dUZ Urban Systems maintains an internal research programme at the intersection of computer vision security, materials science, and adversarial machine learning. Our work is grounded in published academic literature and validated through independent testing against production-grade surveillance systems. We publish select findings openly in the interest of advancing public understanding of surveillance infrastructure vulnerabilities.
The following is a summary of our primary research domains. Full technical papers and test methodologies are available upon request from qualified researchers and institutions.
Adversarial Clothing
Adversarial examples in the image domain were first systematically characterised by Szegedy et al. (2013), who demonstrated that imperceptible perturbations to input images could cause deep neural networks to misclassify with high confidence. Subsequent work extended this concept to the physical world—Kurakin et al. (2016) showed that printed adversarial patches remained effective when photographed, and Athalye et al. (2018) developed expectation over transformation (EOT) methods to produce robust physical-world adversarial examples.
Our research extends these foundations into the textile domain. Unlike rigid adversarial patches applied to static surfaces, clothing must contend with non-rigid deformation, occlusion, variable lighting, and multi-angle observation. We have developed a class of textile-optimised adversarial patterns that maintain efficacy under the full range of real-world conditions encountered in urban environments.
Key findings from our adversarial textile programme include:
- Spatial frequency engineering: Patterns designed to cluster energy in frequency bands that CNN pooling layers are structurally incapable of resolving produce consistent detection failures across architecture families.
- Chromatic adversarial optimisation: Adversarial colour palettes selected through differentiable rendering pipelines outperform greyscale approaches by 23–41% in person-detection suppression, particularly in models trained on ImageNet-derived surveillance datasets.
- Pose-invariant patterning: By training against articulated body models with randomised joint configurations, our patterns maintain efficacy across the full range of human postures and movement velocities.
Computer Vision System Vulnerabilities
Modern surveillance computer vision pipelines are built on deep convolutional neural network architectures. The most widely deployed systems—YOLO (Redmon et al., 2016–2023), Detectron2 (Facebook AI Research, 2020), and various proprietary implementations—share architectural characteristics that introduce exploitable failure modes.
Architecture-specific vulnerabilities. One-stage detectors (YOLO, SSD) perform dense anchor-box sampling at multiple scales. Two-stage detectors (Faster R-CNN, Detectron2) employ region proposal networks (RPNs) followed by classification heads. Each architecture family exhibits distinct failure modes under adversarial perturbation. Our testing has identified that one-stage detectors are particularly susceptible to global texture-level perturbations, while two-stage detectors show greater sensitivity to localised high-confidence suppression patches.
Temporal exploitation. Video-based surveillance systems employ tracking algorithms—DeepSORT, ByteTrack—that depend on frame-to-frame consistency of detection features. By designing patterns that produce inconsistent detection outputs across adjacent frames, it is possible to trigger tracker fragmentation while maintaining aggregate undetectability.
Multi-modal fusion gaps. Modern systems increasingly fuse optical, thermal, and depth data. Our research indicates that each modality has distinct adversarial vulnerabilities and that cross-modal fusion mechanisms themselves introduce exploitable latency and confidence-weighting asymmetries.
Surveillance Capitalism & the Urban Sensorium
Zuboff (2019) defined surveillance capitalism as an economic system built on the unilateral extraction of human experience as raw material for behavioural prediction markets. The urban environment constitutes the most dense and consequential site of this extraction. Unlike digital surveillance, which requires active participation in networked platforms, physical surveillance is ambient—it operates regardless of consent, awareness, or participation.
The surveillance-as-a-service model, wherein cities contract with private vendors for camera infrastructure, analytics platforms, and data storage, creates a structural misalignment between public interest and commercial incentive. Camera networks are deployed not because they improve public safety outcomes—the evidence for which remains equivocal (Welsh & Farrington, 2009)—but because the data they generate has commercial value in insurance, advertising, and predictive policing markets.
dUZ's position is not that all surveillance is malevolent. It is that ambient surveillance deployed without meaningful consent, oversight, or opt-out mechanisms constitutes an assault on personal autonomy. Material countermeasures—adversarial clothing, passive signature management—represent the only form of opt-out that cannot be legislated away.
AI Recognition System Countermeasures
Modern AI recognition systems extend beyond simple person detection to include re-identification (ReID), gait analysis, emotion classification, demographic profiling, and behavioural anomaly detection. Each of these tasks relies on distinct feature extraction pipelines and is vulnerable to different classes of adversarial perturbation.
Re-identification evasion. Person ReID systems (Zheng et al., 2015; Luo et al., 2019) learn embedding spaces that map images of the same individual to proximate vectors. Our research demonstrates that clothing-based adversarial perturbations can push ReID embeddings beyond standard matching thresholds, dropping top-1 retrieval accuracy from 89% to below 12% in controlled trials using the Market-1501 and DukeMTMC-ReID benchmarks.
Gait obfuscation. Gait recognition systems analyse spatiotemporal patterns of human movement. We have developed garment-integrated passive disruptors—subtle asymmetries in hem length and fabric drape—that introduce structured variance in gait signatures without impeding natural movement. Trials against silhouette-based (GaitSet) and skeleton-based (PoseGait) systems show a 47% reduction in cross-view identification accuracy.
Thermal recognition countermeasures. Thermal face recognition and body-heat signature analysis are increasingly deployed in high-security environments. Our multi-layer textile systems, incorporating micro-encapsulated phase-change materials and aerogel-infused panels, can reduce thermal facial feature distinction below the matching thresholds of commercial thermal recognition systems operating in the 7.5–14 µm LWIR band.
The arms race between detection and evasion is continuous and asymmetrical. Surveillance infrastructure is centralised, capital-intensive, and slow to update. Adversarial countermeasures are distributed, low-cost, and rapidly iterable. dUZ's research prioritises this asymmetry, developing countermeasures that target architectural invariants—features of recognition systems that are expensive and disruptive to change.
Academic & Institutional Access
Full research papers, test methodologies, and datasets are available to verified academic researchers, journalists, and human rights organisations. Contact our research division with your institutional affiliation and area of inquiry.
Request Access