Simon Weckert hands me a shirt with blurred pink and green patterns. In front of a camera running image recognition, the familiar green box with the word PERSON disappears. When I move the shirt away, the box reappears. It looks like an artist's trick, but it is a targeted attack on one of the blind spots of algorithmic surveillance: the dependence on local models that classify people without citizens knowing exactly how they work.

The project originated in Berlin, where police installed object recognition cameras at the Kotbusser Tor station. They are the first operated directly by police in the city. Weckert explains that the system can detect a person lying on the ground and trigger a response, with potentially disproportionate consequences, for example toward homeless people. The issue is not only surveillance, but the automatic classification of behaviors considered anomalous.

Weckert does not know the exact algorithm used by Berlin's cameras. Many commercial cameras run variants of YOLO, a family of open source object recognition algorithms. The artist installed YOLO on his own camera and iterated random patterns. At each step he asked the system how likely it was to classify the pattern as a person. Then he changed colors, rotations, and orientation, using gradient ascent to move away from the 'person' category.

The most relevant aspect is not the shirt itself, but the asymmetry it reveals. Police can deploy a surveillance system based on computer vision models without disclosing version, architecture, or training logic. Weckert can demonstrate that the camouflage works on public YOLO, but cannot verify whether it is effective on the real cameras. This opacity turns security into a black box: citizens cannot know whether a countermeasure is valid or just creating a false sense of protection.

There is also a deployment issue. When inference runs directly on the camera, the model operates on edge hardware, often with limited resources. Adversarial evasion does not require physical access to the device: knowing the model is enough. For those designing or authorizing local systems, data control does not automatically mean operational transparency. In fact, the lack of public documentation shifts the verification cost onto those who are under surveillance.

Finally, the update cycle. Weckert compares his patterns to seasonal fashion collections: each new YOLO version will correspond to a new camouflage. This signals that the effectiveness of a local surveillance system depends not only on hardware, but on the ability to document and update the model. Without a verification chain, every update can make existing countermeasures obsolete, but can also introduce new classification errors.