The Shirt Shows Its Work

Digital Camouflage is a Hawaiian shirt — saturated pink, orange and green arranged in overlapping globs that look like a screensaver mid-crash. It runs about $88. Weckert, a Berlin artist, generated the pattern in an adversarial loop: run a person-detector against a candidate print, check whether it still draws the box, mutate, repeat until it doesn't. The high-contrast transitions swamp the network's early feature layers. The broken shapes keep the detector from binding arms, torso and head into one figure. The demo video is the entire pitch — the bounding box and its "PERSON" label blink out.

The detector in that video is YOLO. Open-source, off the shelf, the same model family every adversarial-clothing paper since 2019 has used as a punching bag. Weckert names it. He also states plainly that no pattern defeats every system under every condition, that he makes no claims about undisclosed government systems, and that thermal, radar and multi-sensor rigs will see you regardless. He cites the three papers he built on. Proceeds go to digital rights organizations.

Now hold that against the thing he's responding to.

In August, Berlin police switched on an AI surveillance pilot at Kottbusser Tor. Interior Senator Iris Spranger has been clear that it is not biometric identification — people appear to operators as schematic stick figures. What it does instead is "behavior and situation recognition": violence, fallen persons, climbing, unattended objects, repeated appearances, and — this is the phrase in the documentation, not mine — loitering or walking around for no reason. Warschauer Straße is next. Alexanderplatz, Görlitzer Park and Wrangelkiez are scheduled for 2027. The city has budgeted roughly €2.47 million in capital and €2.13 million in operating costs through 2030.

The reported false-positive rate runs up to 25 percent.

Behavior recognition is not a different technology from the one the shirt attacks. It is a floor above it. Before a system can decide that somebody is loitering, it has to decide that somebody is there — draw the box, keep the box attached to the same body across frames, and only then ask what that body is doing. The shirt aims at the bottom of that stack. Whether it reaches the bottom of Berlin's particular stack is a question nobody outside the contract is in a position to answer.

Because there is no published model. No stated architecture, no benchmark, no adversarial evaluation, no external audit of how "no reason" gets encoded in a loss function. The Chaos Computer Club's objection is that it remains completely unclear how police and manufacturers define undesirable behavior, and that is not a rhetorical flourish — it is a description of missing documentation. One party in this story published its method, its model, its failure modes and its citations. The other published a press conference and a stick figure.

The guy selling the Hawaiian shirt is running the more reproducible science. That is not a joke about the shirt. It is a fact about the procurement.

And then there's the part that makes the shirt sadder than it looks.

The Berlin Police Act was recently amended to permit data captured in public space — including uninvolved passersby — to be used to train and optimize commercial surveillance software. The pilot's stated purpose for its first year is to train the algorithms and improve detection quality. Read those two facts as an engineer rather than a citizen, and they fork.

If the shirt works on Berlin's detector, the person wearing it through Kottbusser Tor produces a false negative — a body the model failed to box. False negatives are the most expensive errors a detector has, precisely because the system cannot report them; a miss leaves no record of itself. Harvesting one requires a second source that knows the person was there. An operator watching the feed is such a source. So is an overlapping camera, or a later frame where the detector reacquires. The pilot has operators watching feeds. And adversarial robustness is a solved problem in the boring sense — you train on the attack — so a garment engineered to produce exactly that error, walking through the frame on purpose, is not noise in that pipeline. It is the expensive case, arriving free.

If the shirt doesn't work, none of that applies. The statute still licenses harvesting everyone who isn't wearing one, which is the larger problem and never needed the shirt at all.

I don't know which fork is live. Nobody outside the contract does — that is the entire content of the previous section.

Weckert has been here before. In 2020 he walked a handcart loaded with 99 smartphones through empty Berlin streets and made Google Maps hallucinate a traffic jam. That worked because the model trusted its inputs and had no mechanism for doubting them. This one works the same way, for now, with one difference: Google was selling directions, and nobody wrote a law authorizing Google to learn from the wagon.

Which is what the missing documentation is actually about, because an undocumented method is an abstraction right up until you ask who eats the error. The site list is not a random sample of Berlin. Kottbusser Tor, then Warschauer Straße, then Alexanderplatz, Görlitzer Park and Wrangelkiez — these are the places Berlin police already concentrate on, and Kottbusser Tor and Görlitzer Park in particular have been focal points of the city's drug policing for more than a decade. Run a training year there and the model learns what "no reason" looks like from whoever happens to be standing in those frames. At a 25 percent false-positive rate the question was never whether the system will be wrong. It is whose ordinary afternoon supplies the definition.

The shirt is honest, well-made, and correct about the problem. It is also a countermeasure that only functions while being performed in front of the sensor it defeats. A right you have to purchase, put on, and demonstrate to the camera is not being exercised. It is being submitted.