A Berlin artist is selling a roughly $88 shirt covered in loud pink, orange and green shapes that he says makes the wearer vanish from the open-source AI pedestrian detector YOLO, and the timing is not a coincidence. Simon Weckert “Digital Camouflage,” listed on his site as an installation and wearable begun in 2025 and still ongoing, lands the same week Berlin police started wiring up behavior-scanning cameras at the Kottbusser Tor plaza in Kreuzberg, the first deployment of its kind in the city’s public squares.
Across the Atlantic the cameras are on the way out. An Oakland-based advocacy group counted 93 U.S. cities and counties that canceled their contracts with the surveillance-camera maker Flock Safety in August 2026 alone, a fourfold jump from July. Sen. Josh Hawley opened a federal investigation into the same network; Florida Gov. Ron DeSantis called the cameras “out of control.” Both continents are deciding in real time what kind of automatic watching is acceptable in a public square, and Weckert’s shirt is the loudest single-object argument against one of those systems yet.
Weckert built the print the way an attacker would: by running an adversarial loop against a detector. “Generate a candidate, show it to the detector, measure how confidently it still finds the person, adjust, repeat — until the confidence collapses,” he told Dezeen. The result is a saturated tile of pink, orange and green shapes that, on the body of a passer-by, confuses the model the surveillance stack leans on first. To a human eye it reads as an almost hypnotic textile. To the AI, the demo shows nothing.
“AI systems are made of multiple layers and never learned what a human is,” Weckert said. “They learned what humans statistically look like in millions of training images. A “”person,” for the machine, is a bundle of visual statistics, and that is exactly its weakness.” The same saturated transitions that fire the network’s early layers also, he says, break the body’s outline so the model can no longer bind head, torso and limbs into one figure. The point of the print is the dispute, not the disguise.
Weckert documented the garment on site at Kottbusser Tor in photo and video, and Dexerto reports he successfully walked it in front of a live, operational surveillance camera there in June 2026. Weckert’s own page is more careful: “The work makes no claim about any specific government system. That is precisely the point: no one outside can test them.” The demonstrations run on the generic YOLO object-detector, the same model used by most research teams and a useful baseline for whether an attack works at all.
For this fight, the print matters more than the demo does. Berlin police began installing about 30 Axis cameras at Kottbusser Tor in late August 2026 and plan to wire them to behavior-analysis software from Adesso SE, an IT consultancy headquartered in Dortmund that won the public tender (PolBln 057_26). Officials describe stick-figure motion scans meant to flag fights or a person on the ground, not facial identification. Interior Senator Iris Spranger (SPD) has said responders will see only skeleton motions, never faces. Planned follow-on sites include Warschauer Brücke, Alexanderplatz, Görlitzer Park and the Wrangelkiez. Budget figures from the Berlin Interior Administration, cited by RBB and DPA, run about €2.47 million in capital costs and €2.13 million in operating costs through 2030.
That detail — “we know the budget, but we cannot test what it bought” — is the throughline of Weckert’s project, and it is the part of the conversation most outlets covering the rollout skipped. The technology going up over Kottbusser Tor is the same class of system U.S. cities have spent the last two summers running public meetings about: stick-figure behavior detection made by vendors who refuse or limit independent testing, sold to municipalities under tight procurement timelines and installed before a court anywhere has ruled on whether the resulting automatic logging is constitutionally reasonable. One U.S. man is already suing over a wrongful facial-recognition arrest. Germany’s revised Allgemeines Sicherheits- und Ordnungsgesetz from December 2025 created the legal basis for automated video analysis; in the U.S., no equivalent federal frame exists. The contracts Weckert’s shirt is publicly about exist on both sides of the same argument.
As it happens, the United States is also where the pushback has already started. The U.S. cancellations of Flock Safety’s networked cameras this August — 93 jurisdictions, roughly three a day — are the same shape of backlash as the one taking shape in Kreuzberg: voters telling their councils that networked video with searchable, warrantlessly-queryable databases is too much. Weckert’s own site draws the line explicitly: “In the United States, automated surveillance arrived years ago: well over a hundred thousand networked cameras log vehicles and movements across thousands of towns, their data flowing into databases that police — and federal agencies — can search without a warrant.” That paragraph reads like a U.S. surveillance debate talking point because it is one. The 93 jurisdictions canceling Flock in August and one Hawaiian-shirt-wearing pedestrian in Berlin are arguing the same case, in different clothes, with different cameras.
Which is a model-specific fight that is not actually about shirts. Attacks like this one are known to fail when the lighting shifts, a sleeve wrinkles the print, a camera gets within two feet of a fold, or a new training run sweeps the pattern into a tolerance. Face, gait, depth, thermal, multi-camera correlation: any of those can hand the algorithm something else to lock onto even when the torso print beats one detector. The independent variable is no longer “can it break a demo”; it is “can the closed systems already switched on in Berlin be tested from outside,” which is a different and much harder question. The artists who ask the second question usually lose the first.
The print itself comes from peer-reviewed science. Weckert cites Zhanhao Hu and colleagues’ 2022 paper on adversarial texture for fooling person detectors in the physical world, published at CVPR 2022 under the title “Adversarial Texture for Fooling Person Detectors in the Physical World.” The method, called TC-EGA, generates a tileable pattern that survives folds and viewing angles. Designboom reports the production run is manufactured in Latvia on a 65-percent-recycled-polyester blend. The art piece is also a research demonstrator wearing a tourist-souvenir costume.
Weckert’s name is already familiar in this corner of the German art world. Born 1989 in Karl-Marx-Stadt (now Chemnitz), based in Berlin, a Chaos Computer Club member since 2020 and a teacher at the University of Arts in Linz since 2024. The project that put him on international press lists was Google Maps Hacks in 2020, the 99-secondhand-phones-in-a-handcart stunt that briefly convinced Google Maps that a Berlin side street was gridlocked, and won him an Award of Distinction at the Prix Ars Electronica. Digital Camouflage keeps the same playbook: find a sensor that claims to see the city, then poke it.
Where does the shirt leave this story? The garment is shipping from simonweckert.com; part of each sale, Weckert says, goes to organizations fighting the expansion of automated surveillance in public space. The pattern will not break every system under every condition, and he is direct about that on the page. The point he wants to argue in public is older and sharper: cities are putting in machines the public cannot test; the same class of machine that does the watching can sometimes be undone by a piece of fabric; the gap between those two facts is the part that needs a court, not a coder.
What does “drop off AI detectors” actually mean in Weckert’s demo? The shirt targets the open-source YOLO object detector, the model most object-detection tutorials still run. In the project’s video, generic YOLO labels every nearby pedestrian as “person” and skips the wearer. Weckert’s own page does not claim the same effect against the closed Berlin system, which has not been independently tested.
Has a real state camera ever been defeated? Not in any verifiable test. Closed deployments like Berlin’s Adesso stack, Flock Safety in the U.S., or similar behavior-analysis systems in Mannheim and Hamburg have not been independently audited. Weckert’s argument is that this opacity is the problem, not that his shirt solves it.
What happens to the attack when the dress code changes? Saturated patterns that fool a detector on a folded cotton shirt can fail on synthetic fabric, at waist-down angles, under street lighting, after a re-trained model swallows the new print, or against face, gait or thermal channels that read the wearer regardless of torso texture. Adversarial clothing is model-specific, lighting-specific, and time-limited.
Is wearing the shirt legal? There is no law in Germany or in any U.S. state that bans prints designed to confuse a pedestrian detector. The legal fight is on the install side: whether the cameras themselves are permitted, whether the logged data is subject to warrants, and whether the producer must allow independent audits.
How long will this particular pattern work? Unknown. If the print becomes common enough to appear in training data, the next model update may eat it. The shirt is sold as a wearable piece of opposition and a conversation starter, not as a long-term technical fix.
Petapixel’s photo essay on Digital Camouflage, the Ars Technica report on U.S. Flock contract cancellations, and the Ars Electronica 2025 festival page on Digital Camouflage are the cleanest follow-up reads. Netzpolitik’s field-level writeup of the Berlin installation is the German-language version of the same story. A Tennessee grandmother was jailed for five months after a facial recognition mismatch — the same kind of automated misread Digital Camouflage is built against. A Virginia woman found a Flock camera pole outside her home, the American argument in its own words. Beeple’s algorithmic-influence robot dogs at Art Basel are the art-world cousin of Weckert’s gesture: the same weapon, aimed at the same machine, from a different studio. A photographer’s “Not Made With AI” badge and the U.S. Supreme Court declining to review AI-generated-art copyright are the cultural and legal edges of the same overlap, and the stakes there will outlast any one print.
