CV Dazzle (original) (raw)

NEW CV Dazzle Looks N°6, N°7. Developed for Designs for a Different Future 2020 to break convolutional neural network face recognition. © Adam Harvey 2020.

CV Dazzle is a form of camouflage from computer vision created in 2010 as my masters thesis at New York University’s Interactive Telecommunications Program. Unlike traditional camouflage, such as disruptive-pattern material, that hides the wearer from human observation, CV Dazzle is designed to break machine vision systems while still remaining perceptible to human observers. It is the first documented camouflage technique to successfully attack a computer vision algorithm.

In this proof of concept research project from 2010 the technique was used to break the widely-used (at the time) Viola-Jones face detection algorithm by using bold patterning to break apart the expected features of the face detection profiles (haarcascades). This algorithm gradually become deprecated in security around 2013-2016 and is no longer used, therefore the original patterns (designed between 2010-2013) are no longer active looks. But until then it was the only face detection algorithm and therefore created a single point of failure when broken, cascading throughout the security industry. All of sudden a key technology in the previously infallible post 9/11 security apparatus could be foiled by makeup and hairstyles.

CV Dazzle Look 5. Commission for the New York Times Op-Art. 2013. © Adam Harvey 2013.

This page is an overview of the project concepts, motivation, and initial tests. More technical information about reverse engineering and visualizing the vulnerabilities in the haarcascade and other computer vision algorithms may be published here in the future.

Updates

• March 1, 2023: cvdazzle.com now redirects to this page where I maintain update and accurate information about the project. Tested using new 3D rendering workflow.
• September 2020: Two new 3D-designed CV Dazzle looks presented at Designs forDifferent Future Walker Center of Art (scroll down to related media)

How It Works#

The initial CV Dazzle designs work by altering the expected dark and light areas of a face (or object) according to the vulnerabilities of a specific computer vision algorithm. In the image above (Look #5), the design targets the Viola-Jones face detection algorithm, a popular (at the time of development) and open source face detector that is included with the OpenCV computer vision framework. But CV Dazzle is not a specific design or pattern. CV Dazzle is a camouflage strategy to evade computational vision systems that evolves, as camouflage does, alongside the technology it aims to subvert. Patterns and designs are always specific to the wearer, algorithm, and environmental conditions.

Designs can be created using only hair styling, makeup, and fashion accessories, which could be customized to any wearer’s style and are low-cost or free, and accessible to a wide audience. Newer forms of a CV Dazzle approach could target other algorithms, such as deep convolutional neural networks, but would require finding vulnerabilities in these algorithms. Because computer vision is a probabilistic determination, finding the right look is about finding how to appear one step below the threshold of detection.

To guide the development of the initial looks for the project, a genetic algorithm was used to find the optimal faces hidden within the algorithm. For over a decade, since the development of the Viola-Jones algorithm in 2003, these were the prototypical face appearances used to detect the human face in security videos. The key observations are the heavy reliance on the dark areas around the eyes, the symmetry, the stability of the nosebridge, and the darkness under the nose. By using makeup and hairstyling the dark and light areas can be reversed to lower the probability of detection through the various stages of the haarcascade profile, a multi-stage detector that uses around 20-25 stages of scoring during the detection process. A visualization of process is shown in thisresearch video.

Haarcascade frontalface reverse face

Haarcascade frontalface-alt-tree reverse face

Haarcascade frontalface-alt reverse face

Haarcascade frontalface-alt2 reverse face

Since face detection is the first step in any automated facial recognition system, blocking the detection stage also blocks any subsequent facial analysis including recognition and emotional analysis. Therefore, CV Dazzle could be used to block facial recognition by blocking face detection using only hair styling and makeup. This is the strategy used for the looks on this page, which all target the Viola-Jones haarcascade face detection algorithm. If a face is not detected by the algorithm, it effectively blocks the subsequent recognition algorithms. Often these two algorithms are conflated, but they are entirely different, each with its own set of vulnerabilities.

Many community and activist uses of CV Dazzle have targeted face recognition, instead of detection. This is also a valid approach just not the approach used for the proof-of-concept. Face recognition, like detection, merely computes a probability for how much one face looks like others, typically using a cosine similarity metric with a 512, 1024, or 2048 length feature vector describing the face. Adding facial coverings, makeup, or prosthetic will affect this score to varying degrees.

Look Book#

The first design (Look #1) was created in 2010 as a proof of concept for my masters thesis at ITP NYU. The subsequent 5 looks were created in collaboration with DIS Magazine (Looks 2-4) and for a commission for the New York Times (Looks 5-6). The goal of of these test looks was to investigate the potential for a style that was functional but still within the margins of conceptual fashion.

CV Dazzle Look 1. 2010. Hair byPia Vivas Model:Jen Jaffe Original look for CV Dazzle thesis at NYU. Photo: ©Adam Harvey

CV Dazzle Look 2. For DIS Magazine Creative direction by Lauren Boyle and Marco Roso. Model: Irina. 2010. Hair byPia Vivas. Photo: ©Adam Harvey

CV Dazzle Look 3. For DIS Magazine. Creative direction by Lauren Boyle and Marco Roso. Model: Jude. 2010. Hair byPia Vivas. Photo: © Adam Harvey

CV Dazzle Look 4. For DIS Magazine Creative direction by Lauren Boyle and Marco Roso. 2010. Hair byPia Vivas. Photo: ©Adam Harvey

Evaluation#

To verify the results below, the images can be tested against each of the OpenCV haarcascade profiles to demonstrate their effectiveness. Use the code below to verify the results in the table.

import cv2 as cv
im = cv.imread(filepath)
im_gray = cv.cvtColor(im, cv.COLOR_BGR2GRAY)
cascade = cv.data + "haarcascade_frontalface_default.xml"
classifier = cv.CascadeClassifier(cascade)

faces = classifier.detectMultiScale(
    im_gray,
    scaleFactor=1.05,
    minNeighbors=3,
    minSize=(50, 50)
)

print("Found {} face candidates".format(len(faces))

# Draw rectangles over faces
for (x, y, w, h) in faces:
    cv.rectangle(im, (x, y), (x+w, y+h), (0, 255, 0), 3)

cv.imshow("Result" ,im)
cv.waitKey(0)
cv.destroyAllWindows()

Results for haarcascade_frontalface_default.xml, haarcascade_frontalface_alt.xml, haarcascade_frontalface_alt2.xml, and haarcascade_frontalface_profileface.xml:

Another way to visualize the effectiveness is to use a saliency (heat) map to show which areas of the facial region are missed or activated by the face detection algorithm. The saliency map is generated by separating each stage of the haarcascade classifier and measuring the confidence score computed for that stage, then merging the sliding window regions to produce a heat map.

Saliency map for Look 5. Model: Bre. Saliency evaluation from New York Times Op-Art photoshoot. © Adam Harvey 2014.

Saliency map for CV Dazzle Look 6. Model: Jason. Saliency evaluation from New York Times Op-Art photoshoot. © Adam Harvey 2014.

The results illustrate and prove that hair and makeup alone can be used to lower the wearer’s probability below the threshold of detection for most of the OpenCV Haarcascade detection profiles. There are important limitations to keep in mind though.

First, these looks were designed to work against the Viola-Jones Haarcascade face detector in 2D still-images in the visible light spectrum with the pretrained Haarcascade detection profiles. Other face detection algorithms including Lineary Binary Pattern (LBP), Histogram of Oriented Gradients (HOG), Covolutional Neural Networks (CNN), multi-camera 3D-based systems, and multi-spectral imaging systems would require a different strategy. These looks are solely based on the Viola-Jones Haarcacade classifiers.

Second, lighting conditions will cause the results to vary. The pose and illumination in these photos is similar to a biometric enrollment (passport style) photo. Overhead or more direct lighting will change the intensity and location of shadows which will change the detection outcome.

Style Tips#

The tips below apply only to the Viola-Jones haarcascade method for face detection. For the best performance a CV Dazzle look is highly specific to the situation, unique to the wearer, designed for specific algorithm and never replicated.

1. Makeup Avoid enhancers. They amplify key facial features. This makes your face easier to detect. Instead apply makeup that contrasts with your skin tone in unusual tones and directions: light colors on dark skin, dark colors on light skin.
2. Nose Bridge Partially obscure the nose-bridge area. The region where the nose, eyes, and forehead intersect is a key facial feature. This is especially effective against OpenCV’s face detection algorithm.
3. Eyes Partially obscure one or both of the ocular regions. The symmetrical position and darkness of eyes is a key facial feature.
4. Masks Avoid wearing masks as they are illegal in some cities. Instead of concealing your face, modify the contrast, tonal gradients, and spatial relationship of dark and light areas using hair, makeup, and/or unique fashion accessories.
5. Head Research fromRanran Feng and Balakrishnan Prabhakaran at University of Texas, shows that obscuring the elliptical shape of a head can also improve your ability to block face detection. Link: Facilitating fashion camouflage art. Use hair, turtlenecks, or fashion accessories to alter the expected elliptical shape.
6. Asymmetry Face detection algorithms expect symmetry between the left and right sides of the face. By developing an asymmetrical look, you can decrease your probability of being detected.

Commissions#

In December 2013 theNew York Times commissioned a new look (Look #5) for an Op-Art feature about facial recognition, introducing the concept to a large audience and proving that face detection and face recognition are not as powerful as agencies claim.

Produced by John Niedermeyer and James Thomas. Photo © Adam Harvey, Modeling By Bre Lembitz, Hair By Pia Vivas, Makeup By Giana DeYoung

Background#

This project began in 2010 as my masters thesis at NYU ITP as a challenge to the growing power asymmetries in computer vision and, in particular, widespread deployment of facial recognition technology.

The name of the project was inspired by WWI ship camouflage called Dazzle that used cubist-inspired designs to break apart the visual continuity of a battleship in order to conceal its orientation and size. Similarly, CV Dazzle, short for Computer Vision Dazzle, uses bold, graphic designs that break apart the visual continuity of a face. While the end result is still visible to human observers, CV Dazzle degrades the visual comprehension of computer vision systems.

This ongoing project is motivated by a need to reclaim privacy in a world of increased visual surveillance and data collection. Computer vision poses new challenges that otherwise did not exist in human observation; it is scalable, remote, networked, magnified, and multi-spectral.

Ideally, there would be a way to appear visible to human observers but less visible to computer vision surveillance systems. This is the goal of CV Dazzle; to mitigate the risks of remote and computational visual information capture and analysis under the guise of fashion. Since beginning this project in 2010, the concerns of a widespread facial recognition have only become more urgent and apparent and hopefully this project will continue to develop.

Responses#

There has been a surprisingly positive response to the CV Dazzle project since first publishing it 2010. Activist and art groups have done workshops to explore and expose the vulnerabilities of biometric recognition systems. Both adults and children have done makeup parties. Fashion designers, musicians, political activists, and hackers have modified or borrowed concepts and taken the original ideas into weird new places. It’s encouraging to see how concepts spread over distance and time, and to see a steadily growing resistance to face recognition.

There have been some confusing representations of the project and many questions. Although the project is from 2010, I’ll continue to update this page with responses and new looks when available. Unfortunately, there is a lot of copy-paste journalism these days without sufficient fact checking.

FAQ and Fact Check#

When was CV Dazzle created?

There is a Wikipedia page about this project that contains some inaccurate second-hand journalism and derivative crowd-sourced information. CV Dazzle was created for my thesis project at New York University’s Interactive Telecommunications Program in 2010 under the advisement of Despina Papadopolous.

Does CV Dazzle still work?

Several articles make the claim that CV Dazzle “doesn’t work” for them. Most likely it doesn’t work because an outdated pattern was used on a newer algorithm.

Looks 1 - 5 were all designed for the Viola-Jones Haarcascade algorithm, which has been unofficially deprecated since around 2016, and probably deprecated between 2013-2016 in security systems. All face recognition systems, which rely on face detection as the first step, now use convolution neural networks. To be clear, this site has advised against using looks 1-5 since 2016. As with all camouflage tactics there is a window of opportunity and that window has passed for looks 1 - 5. Please reference thew new looks 6 and 7 for advice on breaking CNN-based face recognition, which requires breaking the key geometric relationships of facial components.

The key point is that CV Dazzle is not a specific pattern. Consider disruptive pattern material (DPM)camouflage, and how there are many different variations for different terrain. DPM is a technique, not a specific pattern. CV Dazzle is a also a technique, not a specific pattern.

Will there be an updated version?

The main goal of this project was to develop a proof-of-concept that showed how faces could exist in a dual perceptual state: visible to humans but invisible to machines. This is now well established and there are many other approaches, including adversarial attacks, that achieve the same result on neural networks.

The value of camouflage against computer vision and also the brittleness of many algorithms is now well established, even within intelligence agencies. For example,here’s a video of the former director of the United States Intelligence Advanced Research Projects Activity (IARPA) in 2017 (7 years after CV Dazzle was published) describing his interest in “fairly easy ways to spoof facial recognition” by “you know, taking a magic maker and putting a couple dots on your forehead.” The tactic of using makeup-based camouflage to break facial recognition systems, of which face detection is the first step, has been well studied by intelligence communities around the world, including references to this project.

Face detection and face recognition are not the same thing

The second misconception is that the original CV Dazzle designs were supposed to break face recognition. As noted above, the original CV Dazzle designs targeted “face detection” algorithms, not “face recognition”.

Face detection and face recognition are completely different algorithms, though they are often conflated by non-technical writers. It is possible to design a look against face detection or face recognition, but they are different algorithms and require a different design. It would also be possible to design a pattern against emotional recognition, age estimation, cardiopulmonary analysis, iris recognition, gait recognition, gender estimation, body pose estimation, and any other biometric computer vision algorithm. But that algorithm should be clearly specified to a reader to prevent further misunderstandings. Any article failing to mention a specific algorithm should be dismissed.

Academics critical of counter-surveillance

Another occasional criticism is that CV Dazzle, and by extension any personal act of resistance, is too individualistic. This perspective should be avoided because it discourages experimenting and probing opaque algorithmic systems. It’s important to question these systems, attempt to break them, and explore them on one’s own terms. More effort is needed to counter mass surveillance from both individuals and groups. Supporting one does not negate other. Collective action can emerge from shared personal affinities and encouragement instead of academic cynicism.

A strong response to mass surveillance should include both legal and technical counter-surveillance tools.