Security1 distinct publisher3 min readPublished
Simon Weckert optimized a printed pattern against an open-source YOLO model until the detector stopped boxing him as a person. Berlin police will not say what runs on their new Kottbusser Tor cameras, so the transfer is untested.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
The success criterion is the giveaway. Weckert says that when his local YOLO install returns 100 percent confidence, he knows the pattern has failed [7]. Rather than fool a human reviewing footage, he is driving one class score below a detection threshold, with the model on his own machine, the confidence readout visible on every frame, and no limit on attempts. YOLO is a family of open source detectors, and many image recognition cameras run a variation of it [6]. That combination, published weights plus unlimited queries, is the cheapest condition an adversarial-example attack can run under.
Scope, stated plainly. The pattern suppresses the person class on a YOLO model running on Weckert's own camera [5], but the cameras that prompted the project remain an open question. Weckert says the police will not disclose which algorithm the Kottbusser Tor system uses, so he claims only YOLO coverage, not coverage of that deployment [8]. He has tested one model family, and the actual deployment stays untested [10].
The deployment detail that matters for buyers is the order of operations. These cameras classify people, vehicles, animals, bicycles and other objects [2], and the product category layers behavior rules on top: someone lying down, loitering, fighting, an abandoned package, any of which can generate a police response [4]. Weckert's stated concern is that a person on the ground reads as an alertable event, which puts homeless people in front of a dispatch trigger [9]. Those rules only fire on objects the detector actually emits. Suppression at the class layer takes the whole chain with it, which is why a stock open-source model in an operational alerting pipeline is a different risk than the same model in a lab.
The counter-history sits in the same reporting. Prints designed to hide faces from facial recognition, and shirts covered in nonsense license plates, largely stopped working as the models improved [11]. Weckert expects his to age the same way and plans a new pattern for each YOLO release, an "every YOLO edition" [12]. That sets the exchange rate: the defense is a model refresh. The answer to a model refresh is simply one more optimization run against the new public weights [14]. His previous project in this register was a fake Google Maps traffic jam produced by walking GPS-enabled phones through Berlin in a red wagon [13], and he describes the shirt as a teaching device as much as an evasion tool [15].
For an operator, the narrow version of this story has nothing to do with the garment. A buyer who cannot name the detector behind their cameras cannot test a published pattern against it, and the first police-run object recognition system in Berlin [3] is in that position by the choice of the force running it [8].
Ranked by verification strength, evidence, and original report placement.
A 404 Media reporter standing in front of a camera whose image recognition drew a green box labeled "PERSON" around him saw the box and the label disappear when he held Weckert's patterned button-down shirt in front of himself, and reappear when he pulled it away.
Weckert designed the digital camouflage shirt as a response to the proliferation of AI-powered surveillance cameras that detect people, vehicles, animals, bicycles and other objects in their field of view.
Police recently deployed object recognition cameras outside Kottbusser Tor, a popular Berlin subway stop; they are the first police-run object recognition surveillance cameras in the city.
Weckert installed YOLO on his own camera and iterated on random patterns, rotating parts of the pattern, changing colors and flipping it, using gradient ascent to move away from the person category until the algorithm no longer detected him as a person.
YOLO (You Only Look Once) is a family of open source image recognition algorithms, and many image recognition cameras run a variation of it.
Weckert said that when YOLO returns 100 percent confidence, he knows the pattern is not working.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · September 1, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
product
An $88 Hawaiian shirt stops Berlin's camera pilot at the bounding box1 distinct publisher
invest
A Connecticut judge just priced prompt injection: no fine, no e-filing2 distinct publishers
security
NPS Bought Flock. Internal Paper Says License Plate Reader; Public Statement Says Traffic Counts1 distinct publisher
security
Audit logs caught a Florida deputy's Flock searches only after his ex-girlfriend complained1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Witnessed once, documented barely
The core effect was seen rather than asserted — the reporter watched the box drop off his own chest and come back — which is worth more than a press claim and far less than a measurement. Around that demonstration sits a single artist's account of his own method with no patch image, model version or hit rate, and a description of what municipal cameras can detect that no vendor, contract or police statement anchors.
One shirt, one camera, one wearer
Uptake is essentially a demonstration. The pattern exists on a garment the artist owns, tested against a detector he installed himself; nothing in the reporting suggests anyone else has one, or can get one. The only deployment with real scale in this story belongs to the other side — the cameras at Kottbusser Tor, which the shirt has never been put in front of.
Headline outruns the bench, but the caveat is in the room
"Confuses AI-powered surveillance cameras" is a plural promise built on one open-source detector on the artist's own rig. What keeps the overreach modest is that the correction comes from Weckert himself, unprompted and quoted at length: he will vouch for YOLO and not for the Berlin cameras. The gap that remains is the one nobody names — a pattern tuned by gradient ascent against specific weights is expected to be brittle, and the story leaves that unsaid.
A launch story for an artist with a launch record
Weckert makes work designed to travel — the outlet says so itself, recalling the wagon of phones that faked a Google Maps jam — and this is the debut of his next piece, described entirely by him. The publication's beat runs toward surveillance and resistance to it, so the framing and the project point the same way. Most consequentially, the party with an interest in rebutting the claim stays silent: police opacity about the algorithm removes the only counterparty who could deflate the demo.
Sure about the room, unsure about the street
We are confident in the narrow fact and in the shape of the limitation, because both are firsthand and both are stated plainly. Everything wider — how many cameras really run YOLO variants, what Berlin bought, how the pattern behaves at fifteen meters or in motion — rests on a single outlet's paraphrase with no independent voice anywhere in the story.