That's a viable approach so long as three things are true. First, you can continue to do so in a way that your adversaries cannot follow your stream of novel changes. If they can follow they can adjust as you do and your novel ways fail upon arrival. Think Star Trek Borg.
Second, this approach works so long as novel ways can continuously be found and the systems you are attacking are continuously vulnerable to incremental attacks. In other words, this approach requires that the recognition you are attacking never generalize in any way beyond addressing your attacks. As others have noted, human brains can recognize past many kinds of distortion, including novels ones. This implies that computers can learn to do the same.
Third, and perhaps most concerning, this approach is only really useful if your adversaries never have, use, or find value in performing recognition on stored imagery. Stored imagery in the hands of your adversaries cannot be subject to ongoing novel distortions. It's fixed and can therefore be subject to recognition that has adapted at a later date. In short, for a novel approach to be useful it needs to stand up to attack for a sufficient amount of time as to not be useful for the attacker.
Using a continuous stream of novel distortions is an intriguing idea! It's a type of polymorphic attack. I think it's worth considering in the context of the traits that would make it most useful: an unpredictable and unfollowable stream of mutations, an un-generealizable approach, and resisting attack for long periods of time.
Second, this approach works so long as novel ways can continuously be found and the systems you are attacking are continuously vulnerable to incremental attacks. In other words, this approach requires that the recognition you are attacking never generalize in any way beyond addressing your attacks. As others have noted, human brains can recognize past many kinds of distortion, including novels ones. This implies that computers can learn to do the same.
Third, and perhaps most concerning, this approach is only really useful if your adversaries never have, use, or find value in performing recognition on stored imagery. Stored imagery in the hands of your adversaries cannot be subject to ongoing novel distortions. It's fixed and can therefore be subject to recognition that has adapted at a later date. In short, for a novel approach to be useful it needs to stand up to attack for a sufficient amount of time as to not be useful for the attacker.
Using a continuous stream of novel distortions is an intriguing idea! It's a type of polymorphic attack. I think it's worth considering in the context of the traits that would make it most useful: an unpredictable and unfollowable stream of mutations, an un-generealizable approach, and resisting attack for long periods of time.