A security researcher has developed an algorithm that can generate patterns that hide people, faces and vehicles from the recognition systems of surveillance cameras. The discovery raises important questions about how reliable the security systems protecting public and private spaces in Italy and around the world really are.
The work is based on adversarial pattern techniques, that is, visual configurations designed specifically to confuse artificial intelligence algorithms. Unlike traditional concealment methods, these patterns do not aim to physically hide a person, but to fool the machine-learning model underlying a smart camera, leaving it unable to detect the object or face.
The research is a test bed for understanding just how fragile the AI-based security chain is. If an algorithm can be "confused" by a visual pattern, it means that video surveillance systems built on deep learning are not as watertight as is often assumed. In Italy, where urban surveillance is on the rise, this raises concrete questions: how do you protect airports, railway stations and public spaces if detectors can be systematically bypassed?
How adversarial patterns work
Adversarial algorithms exploit a fundamental property of machine-learning models: their tendency to read certain visual patterns as signs of false positives or false negatives. In other words, the AI does not see what a human would see, but what its training has taught it to see.
The researcher built a system that generates these patterns digitally, making it possible to test them on a range of surveillance detectors. The method relies on iterative optimisation: it starts from a random pattern and keeps refining it until the recognition system stops detecting the object or person in question. It is rather like a game of "guess who's right", in which the neural network keeps getting it wrong, again and again.
What makes the work significant is its scalability. This is not a manual trick that only works in the lab: the algorithm can be adapted to different AI models, different lighting conditions and different detector architectures. It shows that the robustness of computer-vision security still has plenty of room for improvement.
What it means for security in 2026
In 2026, smart surveillance has become critical infrastructure. Airports, banks, railway stations and many Italian cities rely on AI systems to recognise suspicious faces and vehicles. Research like this is not an academic curiosity, but a record of the current limits of that infrastructure.
The implications cut both ways. On the one hand, it is good news that researchers uncover these vulnerabilities in controlled environments, because it allows security vendors to strengthen their systems. On the other, the same research, if made public, could hand a manual to anyone wanting to evade recognition. It is the classic tension between scientific transparency and responsible disclosure.
For those who run surveillance systems in Italy—from law enforcement to private companies—the message is clear: do not rely on a single layer of AI. Modern systems should combine facial recognition, behavioural analysis, pattern recognition over time and, where possible, human oversight. A smart camera is not an infallible sentry; it is a tool that works well within a wider system.
The privacy and security debate
The ability to make yourself "invisible" to smart cameras raises thorny ethical questions. On the one hand, for most citizens the idea of moving around without being tracked is seen as a form of freedom or of resistance to pervasive surveillance. On the other, the same mechanism could be used by criminals to evade scrutiny.
In Italy, where the debate on smart cameras and facial recognition is still relatively fragmented, this research arrives at a delicate moment. Cities are starting to install facial-recognition systems, often without any real public consultation or clear rules on how effective they are and where their limits lie. Finding out that these systems have known vulnerabilities should prompt more serious thought about how and where to use them.
The question is not whether the technology is perfect—it is not, and never will be—but whether those who deploy it have a duty to tell citizens what it can and cannot do. A system that promises 99% accuracy in facial recognition but can be defeated by a pattern is not a security solution; it is a false sense of security.
The security researcher's work is not a manual for breaking into cameras. It is rather a reminder that security through technology only works if we are aware of its limits. In 2026, with investment in surveillance AI continuing to grow, it would be prudent for the competent authorities—from the Data Protection Authority to the Ministry of the Interior—to require independent robustness tests before approving new systems in cities. Otherwise, we will end up with expensive infrastructure that offers only illusory protection.
Taken from: TechCrunch
Translated from the Italian original. Read in Italian
