Notes on notes 9: how to become invisible-ish

  • September 30, 2013

 Camouflage made out of QR codes and barcodes and faces and social networking logos.

Camouflage made out of QR codes and barcodes and faces and social networking logos.

Has this been done already?

At the time, I was likely thinking of something like the following projects:

These projects all start with the idea that omnipresent computer vision and facial recognition, whether live or after-the-fact through social network tags and such, is avoidable. It could be distracted in much the same way as a police dog may have its concentration broken by a nice, fresh steak. I think this concept treats the situation as an arms race at best: face recognition technology constantly improves, so even with more effective countermeasures, any attempt to hide is still just providing more data for the computer vision methods to work with. If there’s a face, they’ll find it, or they’ll certainly make an educated guess. A sufficiently advanced method may also notice attempts to conceal someone or something.

Evading face recognition continues to be an active subject in art and design. Maybe visual artists are best equipped to hide from face recognition due to their particular aesthetic pursuits. Here are some more recent projects:

Why hide?

If we’re going to treat this idea as something more than graphic design or fashion (not that there’s anything inherently wrong with those fields - I just think there are some interesting technical concepts here as well), we will need to define who may want to hide and what they may want to hide from. We need to do some threat modeling. How and where are we most likely to have our image captured? Who will be doing it? Will it be fully automated, or will there be a human involved? What are we hiding from, anyway?

We likely won’t be able to design a fully effective solution for hiding in every conceivable situation (at that point, we’re talking about an invisibility cloak, a subject of ongoing efforts from multiple groups) but we can address some of the above questions. The ubiquity of cell phone cameras suggests that most individuals in public places are likely to be photographed by personal devices much more often than by automated surveillance systems. Even in places like Beijing with their wide surveillance camera coverage, cameras are rarely at face level and are generally conspicuous in their placement. They can be partially avoided with simple solutions like hats, especially ones with a few LED modifications. Practically anyone with a phone can take direct, clear, surreptitious photos of your face, however, at which point face recognition algorithms like those used by Google and Facebook do the challenging identification work.

As for what we’re trying to avoid, let’s assume we simply don’t want our image to be used without our knowledge. Misrepresentation is all too easy: imagine a situation where you’re photographed walking out of a restaurant later determined by conspiracy theorists to be a hub of salacious activity. An ideal preventative measure will decrease your likelihood of being photographed while also making it more difficult for face recognition methods to identify you.

Surveillance is still a concern, but not one I believe will be easily addressed through garment-based means. For one thing, it seems likely that much of the visual data collected by authorities is kept until it’s useful. Images are collected and stored under the pretense that they’ll eventually be useful for the next generation of face recognition or because it’s supposedly too complicated to erase them. Face recognition using these data can have a staggeringly high false positive rate (interestingly, some police departments employ “super-recognizers” highly skilled at matching faces to photos, so they’re often better at their jobs than automated methods). It’s difficult to anticipate how to avoid a method which isn’t even working as intended, so unfortunately the best solution for avoiding surveillance systems may be to avoid public places and events. This strategy won’t help as much for avoiding personal cameras, for the reasons I’ve mentioned.


What can we do?

With a threat model involving human camera operators and their algorithmic accomplices, we can start to assemble a basic approach to evading both. Traditional camouflage works well for hiding from people, so we can work with its strengths while adapting them to the particulars of automated face recognition. Many of its strengths will apply to both humans and algorithmic approaches anyway.

Camouflage doesn’t make its wearers invisible, just harder to distinguish from their environment. This means we need to remain cognizant of the surroundings where our new patterns may be used. A universal solution is beyond our reach. Based on our threat model of “somebody with a cameraphone”, urban environments with crowds and direct lighting are most likely. We should also avoid pattern elements with noticeably different appearances from their surroundings, so the bar codes and QR codes and logos and such from my initial idea may not work well. They’re also too easy to identify by automated methods.

The concept of pareidolia may work well. It’s the tendency to see faces where there are none. Humans and face recognition systems are both susceptible to it. The HyperFace pattern linked above plays with this idea, and while it’s difficult to determine if it contributes much to evading face recognition (i.e., if a system sees many false faces near a real face, does it ignore them all?), it seems like a fine starting point.

Computer vision algorithms can be fooled outright. There’s a whole field of adversarial work exploring the cases where image classifiers mistake one type of image for another:

These examples are contingent on special cases, potentially where the image data used to train an otherwise powerful and human-like neural network just doesn’t contain many examples of a given item, or that item looks kind of strange anyway. You can probably tell the difference between a photo of a cat and one of guacamole, but a close-up of the latter could look like all kinds of things. Let’s try it out:

 I zoomed in on the most feline-appearing part.

I zoomed in on the most feline-appearing part.

The local environment remains important, too. Barack Obama’s face doesn’t just show up at crowds at random, nor do large globs of guacamole, unless there’s been a burrito accident. We can’t perfectly anticipate the local environment beyond what we’ve assumed already, nor can we know the perfect adversarial conditions at all times. Instead, we can attempt to create a pattern likely to produce incidental adversarial conditions. Or, essentially produce pareidolia for faces and all kinds of other shapes.

I think it’s crucial to note at this point that most face recognition methods are still terrible at recognizing faces unlike those in their training data (e.g., anyone who isn’t a white man). Obviously “change your sex and/or ethnicity” isn’t a good solution for addressing how well a system may or may not recognize you, especially if the underlying system is already being employed in a biased way (and more or less every system is, so feel free to argue with me about that). This may just be additional evidence that ubiquitous photography and face recognition are to be avoided on the grounds of personal safety.

I believe a new camouflage pattern should be designed with a threefold strategy:

  • Overwhelm - not just by repeating easily detected patterns, but by using strange combinations and adversarial design

  • Obfuscate - combine the properties of traditional camo patterns with patterns automated methods have difficulty with due to limitations in their training data

  • Overlay - accentuate details that are likely to look like the surrounding space, or at least don’t differ from nearby patterns noticeably (again, much like traditional camo)

Accordingly, I’ll name this project camOOO, after those three O’s. It should be pronounced like cam-oooh, or like Albert Camus.

What can we start with?

Here are a few visual starters:

One of the patterns I’d suspect image classifiers would have the most trouble with is the Polish wz. 68 “moro”. It looks like a rainy puddle reflecting some variety of exotic predatory cat. Or, like this:

Google’s Cloud Vision tools aren’t immediately fooled:

 “Tree” is on the list. We can work with that.

“Tree” is on the list. We can work with that.

For comparison, here’s some modern digital camouflage:

The results are fairly obvious - this looks like camouflage. It’s probably widely recognizable to people, too.

 Perfect for hiding in a uniform factory.

Perfect for hiding in a uniform factory.

What I’d like to start with, then, is a way to generate that Polish pattern in a variety of muted greys and greens. The famous Disney “go away green” is a good color philosophy.


Is it time to build something yet?

Almost!

Here’s what I want a pattern to incorporate:

  1. A background camo texture, colored blandly but contrastingly

  2. Details more like an urban environment

  3. Potentially adversarial content

  4. Almost obvious matches from training data, chosen at random, and overlapping with Step 2


Ideally I will create and combine these elements in a generative manner. Processing seems like a good set of tools for approaching this set of requirements.

Also potentially of use:

Progress so far

Here’s what I have thus far - it doesn’t look like much, but it’s largely generative rather than just a bunch of bitmaps glued together. More code details later once things have congealed.

 Still too dark.

Still too dark.

Needs more faces, I think, or maybe animals, without getting too DeepDream-y.

camOOO-test-1-dd1.jpg

Oops, too much!



Notes on notes 8

  • December 6, 2013

note8.png

Most randomly-generated numbers are, in fact, the results of pseudorandom processes. This is because it's fundamentally easier to generate random numbers with purely deterministic, software-defined methods, plus these methods are conceptually simple to replicate. Given the same input (a random seed), the pseudorandom number generator will provide the same output. So when the output absolutely has to be random (or, at least, far more difficult to replicate), random numbers are generated based on stochastic processes in nature. There are dedicated hardware products, Geiger counter-driven approaches, and fancy quantum methods for the task. There was also Lavarand, a random number generator based on a camera pointed at a lava lamp. It was such an effective method that it's still in use by multi-purpose internet company Cloudflare. I think it's more fun to observe other features of the world around us.

I suggest using kittens. A random number generator should depend upon a rapidly-changing, generally unpredictable (within the bounds of our measurement, at least) but otherwise consistently occurring phenomenon. Kittens are consistently popular, to the point that it's nearly an inarguable law of nature. Given the right measurement, we can take advantage of stochasticity in this process to produce random values.

 We're gonna need a lot more of these little fuzzballs.

We're gonna need a lot more of these little fuzzballs.

In truth, this is likely a terrible idea and would never be suitable for any security purposes. Using news sources alone also creates some limitations, so in order to make this more fun while still disavowing any suitability for real-world applications whatsoever, we could use results from social media instead. This will have to be a project for a different day. For now, something like quantumrandom will provide true random numbers, though without all the kitten counting.

Notes on notes 7

  • February 4, 2014

"Knitted with a hot needle" is a translation of the German expression "mit heißer Nadel gestrickt", an idiom used to refer to something done haphazardly due to an impending deadline. My PhD adviser introduced me to it. The dict.leo forums suggest "quick and dirty" may also be an acceptable translation. 

See also:

"Der Schuster hat die schlechtesten Schuhe", or "the cobbler has the worst shoes". That is, the one working the hardest on a particular task may fail to take care of themself.

And also:

Analogous Proverbs in Ten Languages by E. B. Mawr, 1885.

Notes on notes 6

  • September 4, 2013
note6.png

It's a simple enough idea, or in question form: is there a smell only perceptible by some people but not others? There's one obvious example in excreted asparagus compounds. A wonderful 2016 study by Markt et al found that ~40% of those surveyed were able to detect the (for them, at least) distinctive odor of asparagus urine. Don't miss the wild tongue-in-asparagus-filled-cheek speculation by the authors in their Discussion section.

Are there other scents in this category? Are there some which are more rarely perceived, perhaps by only 10 or 1 percent of the global population? This may be a difficult question to answer unless the sensory difference correlates with something medically relevant, like a concurrent loss of some other ability or function. We could start with schizophrenia: individuals with this condition frequently experience olfactory disruption. There doesn't appear to be any particular odor that's easier for schizophrenia patients to sense. Other conditions, including Parkinson's* and Huntington's disease, have also been found to impact patients' senses of smell.

*Though the supporting results may vary wildly across geographic locations due to different cultural familiarity with types of smells.

 

Notes on notes 5

  • September 4, 2015
note5.png

OK, so I'm not working in perfect chronological order here, but this is a particular piece of media I think about often. It's an episode of Johnathan Goldstein's long-running Wiretap podcast, and like most episodes, it's a bit of an audio collage. The episode is "This Magic Moment", originally aired December 2014. It's unfortunately not available online in its full form anywhere other than iTunes, as far as I can tell, but the part of this podcast which really sticks with me is a segment performed by multi-talented musician and many-other-creative-title-er Joseph Keckler; the piece ("How Did We Make You") starts as an unassuming recollection but briskly drops off a ledge into an unforeseen existential void. Luckily, that piece is here.

Jonathan Goldstein finished the second season of his podcast Heavyweight last year. Heavyweight maintains Wiretap's emphasis on placing people in emotionally awkward situations, especially through Goldstein's own experiences, with varying degrees of exaggeration. I think the first season's second episode, featuring Moby and regret, is a standout.

Joseph Keckler has a music project called Train With No Midnight, but if you want to hear any of it, you'll apparently need a copy of the 25th issue of the art magazine ESOPUS. He's on YouTube, too.