Anti-Facial-Recognition Accessories: Most of Them Do Not Work

Face detection is not face recognition

Nearly every error in coverage of this subject collapses three different computer-vision tasks into one phrase.

• Face detection asks whether there is a face in the frame, and where. It does not know whose face it is.
• Face recognition asks whose face it is, comparing it against a stored template or a gallery.
• Person detection asks whether there is a human body in the frame at all. That is pedestrian detection, not faces.

The distinction decides what a garment can achieve. Breaking a face detector can stall a pipeline that starts with detection, but only that detector. Breaking a person detector achieves neither: a pattern that stops a body being boxed as a pedestrian has not touched facial recognition. Harvey puts it directly on the CV Dazzle page: "Face detection and face recognition are completely different algorithms, though they are often conflated by non-technical writers. Any article failing to mention a specific algorithm should be dismissed."

CV Dazzle and makeup: the designer's own verdict

CV Dazzle began in 2010, using bold patterning to break the Viola-Jones face detection algorithm by disrupting its haarcascade detection profiles. Its project page, last substantively revised on March 1, 2023, retires those designs without hedging: "Looks 1 - 5 were all designed for the Viola-Jones Haarcascade algorithm, which has been unofficially deprecated since around 2016", and "All face recognition systems, which rely on face detection as the first step, now use convolution neural networks." It adds that "this site has advised against using looks 1-5 since 2016".

Harvey's caveat is about method, not efficacy: where articles report failure, "Most likely it doesn't work because an outdated pattern was used on a newer algorithm." (Source) The only test data the page publishes is a binary detected/not-detected result against four legacy OpenCV Haar cascade files: not an error rate over a dataset, not a convolutional network, not recognition.

Looks 6 and 7, added in September 2020, are described as "Developed for Designs for a Different Future 2020 to break convolutional neural network face recognition." (Source) No test data for them was found in the sources checked, from Harvey or anyone, so treat them as untested. The peer-reviewed IEEE Symposium on Security and Privacy 2023 survey "SoK: Anti-Facial Recognition Technology" lists CV Dazzle in Table 1 as never tested against a real-world face-recognition system.

A December 2024 preprint by Noever and McKee, venue unconfirmed, finds that in the CV Dazzle case "they all fail to hide from a modern facial recognition system", naming betafaceapi.com: one figure, no sample size, and the same authors propose a competing method.

Infrared: a narrow effect, thinly evidenced

The most visible consumer product is Reflectacles. The vendor site states that "Reflectacles are designed to fool facial recognition systems that use infrared for illumination and systems using 3D infrared mapping/scanning." That scope is narrower than the popular understanding of such glasses. It is a vendor claim, and no independent test of the product was found in the sources checked.

Laboratory work uses infrared differently. Zhou and colleagues, in an arXiv preprint from March 2018 with an unconfirmed venue, report that "attackers have a very high success rate with a over 70% success rate for finding such an adversarial example that can be implemented by infrared". That 70% measures how often an optimisation search found a workable pattern, not a field defeat rate, and the method needs an active, computer-controlled infrared pattern projected onto one specific face rather than a wearable.

Earlier work by Yamada and colleagues is described secondhand in the ACM CCS 2016 paper below: light-emitting glasses exploiting camera sensors' sensitivity to near-infrared, adding image noise to evade face detection, which those authors call effective for evading detection but neither inconspicuous nor deniable (PDF). Detection, not recognition; the original paper was not located in the sources checked. The widely repeated claim that daylight cameras filter out near-infrared has no primary source among those checked, so it is left unconfirmed.

Adversarial patterns: what the research actually targeted

This is where the confusion does most damage. The peer-reviewed IEEE Symposium on Security and Privacy 2023 survey by Wenger, Shan, Zheng and Zhao classifies the most celebrated adversarial-clothing papers in its Table 1 as attacks on YOLO-family person and object detectors, not face recognition:

• Xu and colleagues, Adversarial T-shirt! (ECCV 2020), targets YOLOv2.
• Wu and colleagues, Making an Invisibility Cloak (ECCV 2020), targets YOLOv2.
• Zolfi and colleagues, The Translucent Patch (2020), targets YOLOv5, and is a camera-lens sticker rather than clothing.

Those papers were not fetched directly here; the classification comes through the peer-reviewed survey. A YOLO person detector is pedestrian detection, with nothing to do with identity: a garment that hides a body from one has not defeated facial recognition.

The survey counts how little of this literature is tested where it matters: "only 12 out of the 30 proposals have tested the AFR effectiveness against at least one real-world FR system", and "7 out of 30 proposals assume a 'white-box' access to F's FR pipeline, which is often unrealistic in practice" (survey). White-box access means knowing the model's internals, which nobody facing an unknown camera has.

HyperFace

Harvey's HyperFace textile (2013, prototyped in 2016 with Hyphen-Labs, shown at 33c3 in 2016) is often cited as working camouflage. Its undated page says otherwise: "HyperFace will not make you invisible from face recognition, it acts as a decoy against a specific face detection algorithm." The patterns are "only applicable to the Viola-Jones Haar Cascade algorithm", and it was never sold.

The two attacks that did work

Accessorize to a Crime (Sharif, Bhagavatula, Bauer and Reiter, ACM CCS 2016) is the strongest positive result here. Printed eyeglass frames "permitted three subjects (specifically, the first three authors) to succeed at least 80% of the time when attempting dodging against state-of-the-art FRS models", and impersonation across demographic lines succeeded 87.87%, 88% and 16.13% of the time for three pairs. (PDF)

Those are physical rates against a 39-layer convolutional face-verification model the authors trained and had white-box access to, with three subjects: a genuine deep network, not a Viola-Jones cascade. A black-box sub-experiment against the commercial Face++ service reports that "All attempted impersonations succeeded." (PDF) That covered four identity pairs, with the glasses digitally simulated rather than worn. The work is 2016-vintage, and no re-testing against current commercial services was found in the sources checked.

AdvHat (Komkov and Petiushko, arXiv August 2019, ICPR 2021) is a paper sticker off a colour printer, stuck to a hat. The authors state it "confuses the state-of-the-art public Face ID model LResNet100E-IR, ArcFace@ms1m-refine-v2 and is transferable to other Face ID models." The survey classifies it as white-box, physical, untargeted and untested against any further real-world commercial system. No success percentage was captured in the sources checked, and the transferability claim is the authors' own.

Masks: the one category with measured effect

Masks are the genuine exception, though both NIST studies below used digitally synthesised masks on photographs, not physical masks on real faces, and that caveat carries into every number here. NISTIR 8311 (FRVT Part 6A, July 2020, pre-pandemic algorithms) measured false non-match rate at a fixed false match rate of 0.00001, over roughly 6.2 million images of about 1 million people, across 89 one-to-one verification algorithms. On border crossing images the most accurate algorithms failed to authenticate about 0.3% of people unmasked, rising to about 5% with the highest-coverage mask, which occluded around 70% of the face. But "many algorithms are much less tolerant": some competitive on unmasked faces "fail to authenticate between 20% and 50% of images", and the median algorithm's error rose by factors of around 10, 25 and 36 for low, medium and high nose coverage. (PDF)

Note the base. One-to-one verification is the border-gate case, matching a person against their own document; most street surveillance is one-to-many search against a gallery, which these figures do not measure.

NISTIR 8331 (FRVT Part 6B, November 2020) tested post-pandemic submissions. Some developers cut false rejection rates by as much as a factor of 10 against their own pre-pandemic algorithms, but in the best cases masked false rejection still rose from 0.3%-0.5% unmasked to 2.4%-5% masked. Its summary: "The current performance of face recognition with face masks is comparable to the state-of-the-art on unmasked images in mid-2017." (PDF) It did not address eye-glasses or eye-protection. It is the most recent NIST mask report located here; whether a newer one exists was not established, as NIST's live tracking page was not readable in this pass.

Two independent studies sit alongside. The IJCB 2021 masked face recognition competition (arXiv, June 2021, proceedings status unconfirmed) is the only source found here using real masks, on a private multi-session dataset: 10 of 18 submitted solutions beat a top-performing academic baseline on masked verification accuracy, with no figures captured. The MLFW benchmark (preprint, September 2021), on synthetic masks, reports state-of-the-art accuracy declining 5%-16% against the original images, without saying whether that is percentage points or relative percent.

Christian Rathgeb of Hochschule Darmstadt told Digital Trends in June 2020 that deep face recognition systems have been shown to hold up well against occlusion and masking. The NIST figures qualify that: real degradation, but vendors closing the gap within months.

Anti-flash and thermal: different threat models entirely

Two frequently cited items are category errors. CamoFlash, a prototype from NYU ITP in 2008 with a functional version in 2010, is an anti-paparazzi device. Its page describes it: "It works by detecting a camera flash (xenon bulb only) and responding in less than .1 milliseconds with a 12,000 lumen LED pulse that overexposes the targeted camera's sensor." It never left prototype stage.

Stealth Wear (autumn 2012, presented in London in January 2013) is thermal camouflage: garments whose "silver-plated fibers reflect and diffuse thermal radiation emitted by a body which reduces the wearer's thermal signature", tested with a FLIR long-wave infrared camera at 640x480 (page). Long-wave infrared senses body heat, a different modality from the visible-light and near-infrared cameras face recognition runs on. No general-purpose retroreflective anti-CCTV or anti-facial-recognition wearable with published test data was found in the sources checked.

What the field says as a whole

The IEEE survey closes on the point, writing F for the entity running the recognition system and P for the person avoiding it: "most current AFR tools are not designed to withstand this level of scrutiny" from a determined operator, and "If F makes a more targeted effort to identify P, such as hiring a private investigator, current AFR tools will likely fail." (Survey)

• Makeup built for Viola-Jones was retired by its designer, and never aimed at recognition.
• Printed adversarial clothing mostly trades on research that targeted person detectors.
• Both attacks with real physical results assumed white-box access, and neither has been shown to work on current systems.
• Infrared eyewear rests on a vendor claim with no independent test found, and thermal or anti-flash gear addresses different sensors entirely.
• Masks measurably raise error rates, and that advantage is shrinking.

Legal restrictions on face coverings vary by jurisdiction. No statute text or legal analysis meeting this site's sourcing standard could be retrieved, so this guide makes no claim about them.