After-hours trespasser alerts at apartments fail in their first week. The fix is not better motion detection, it is an intent layer on the DVR.

Why night breaks the alert channel that worked during the day

The same DVR motion detector that fires a manageable number of daytime alerts produces a wall of false events between 10 PM and 6 AM. The mechanism is camera physics, not bad software. Three things change after dark, and all three push pixel-delta motion algorithms into a sustained alert stream.

First, the camera switches to IR illumination. The IR LEDs around the lens cone of every outdoor security camera are bright in the near-infrared band that insects can see. Moths, midges, and small beetles fly toward the IR cone and land directly on the lens housing, where they occupy a saturated, high-contrast region of the frame. Each insect produces a high-confidence motion event because the pixel they sit on is fully white against a near-black scene. Spiders walk across the lens at night, hang webs, and leave 60-second false alert sequences as the web sways in air currents.

Second, color leaves the frame. The camera switches to monochrome to use the IR-sensitive part of the sensor. Without color, the motion detector loses its main cue for separating moving foliage from a moving body. A swaying branch with a leaf the size of a hand reads, in mono, like a person walking past at the wrong distance. Wind in a 25-camera property fires the same kind of event across every perimeter camera at once.

Third, the sensor gain climbs. To expose anything in the dark, the camera pushes ISO up by three or four stops. The shot noise that was below the motion threshold during the day is now above it. The motion detector starts firing on the noise floor itself, with no real subject in the frame. Some camera firmwares mask this by tightening the motion threshold at night, which then makes the camera miss a real human walking through the same frame.

All three failure modes are happening in parallel on every IR-illuminated camera on the property at once. The DVR sees them all, fires alerts for all of them, and the on-call manager wakes up to a phone full of motion notifications that contain no information. By the end of week one, alerts are silenced. The system that should catch a trespasser is in the off position when the trespasser arrives.

What an intent classifier looks at instead of pixel delta

An intent classifier is not a fancier motion detector. It is a layer one step above the motion detector that takes a pixel-delta event as input and runs four independent checks on it before deciding whether to issue a label. The four checks are subject type, zone, dwell, and time-of-day. The output is a single label per event, not a probability vector.

Subject type. A nano-class detection model runs on the camera tile that triggered the motion event and assigns the bounding box one of about a dozen labels: person, vehicle, animal, foliage, lighting change, insect-on-lens, spider-web, noise. The insect and spider-web cases are the two that matter most after dark; both are common enough at apartment properties to need their own label rather than being lumped under generic "animal."

Zone. Each camera tile has been pre-tagged with zone polygons drawn at install time: prohibited (pool deck, rooftop, vacant unit, maintenance closet), perimeter (fence line, gate, secondary exit), common (parking lot, front walk, lobby). The zone label is part of the property's stated security policy, not a guess. A person in a common zone after hours is informational. A person in a prohibited zone after hours is the alert.

Dwell. The bounding box must persist for a configurable minimum across consecutive frames before the event is allowed to escalate. The dwell threshold is what kills the spider-on-lens failure mode, because a spider walks across the lens in under a second and any single-frame confidence spike during that walk is rejected by the dwell check. Dwell also separates a delivery driver walking through the front walk from a trespasser loitering at the gate.

Time-of-day. Every zone has its own operating hours. The pool deck might be open until 10 PM, the parking lot is always accessible to residents, the rooftop is always prohibited. The classifier reads the current clock against the per-zone operating hours and applies the right threshold. The same person in the same zone produces a different label at 9:30 PM than at 2 AM because the zone is governed by a different rule at each hour.

What the overnight log actually looks like

This is a representative slice of one apartment property's overnight alert log, with the classifier output for each motion event. Most events drop. The one that survives is the one the manager hears about at 2 AM.

The 2 AM workflow when the alert is real

The classifier is one half of the system. The other half is what happens after a HIGH THREAT label fires. Operators who have been through a real trespass event after hours know that the ten minutes between the alert and the response are the only minutes that matter. The workflow is built to compress that window without any human in the loop until the very last step.

Why the escalation chain matters more than the alert itself

A trespasser alert at 2 AM is useless if it reaches a human who is asleep with their phone on silent. Every apartment property that runs this kind of system runs it on top of a three-tier escalation chain, not a single notification.

Tier one is the on-call property manager. The first hit is an SMS with a thumbnail and a one-line description ("person in prohibited zone, pool deck, dwell 22s"). If the SMS is unacked in 30 seconds, the system calls the same number with a synthesized voice playing the description until the call is answered or rejected.

Tier two is the regional manager or a second on-call rotation. The system pages tier two if tier one is unacked for two minutes. The point of tier two is not to wake the regional manager every night; it is to guarantee that any genuine HIGH THREAT event has a path to a human even if the on-call manager is in a hotel with bad reception or had their phone die in the night.

Tier three is the pre-arranged external response. For some properties this is a contracted virtual monitoring service; for others it is the local police non-emergency line dispatched from the property's address record. Tier three exists so that no HIGH THREAT event ever goes unanswered, no matter what is happening with the property staff that night.

The escalation chain is the difference between a system that catches the event and a system that does something about it. LOW THREAT and INFORMATIONAL labels never enter the chain; they write to the morning digest, the same way a Ring doorbell logs porch activity. The chain runs only on HIGH THREAT, which is why the classifier has to be conservative about which events earn that label.

How the overlay attaches to the existing DVR without rewiring anything

The mechanism that makes the overlay practical on existing apartment buildings is the HDMI composite output of the DVR. Every DVR and NVR built in the last decade paints a 1920x1080 mosaic of all its cameras to a wall monitor in the back office. That signal exists whether anyone is watching it. The overlay device taps that HDMI port through a small capture board, runs one inference pass per frame on the full composite, and maps detected bounding boxes back to per-tile coordinates.

At a 4x4 grid each camera tile is 480x270 pixels. At a 5x5 grid each tile is 384x216. Both are inside the working range of nano-class object detection models, which were trained at input tensors of 224x224 to 416x416. One inference pass per frame at roughly 5 frames per second covers all 16 to 25 cameras simultaneously. The DVR keeps recording, the cameras keep painting the wall monitor, and the overlay device watches what a guard would have watched if the property had a guard.

There is no per-camera RTSP credential to recover (these are typically lost on installs that are more than five years old). There is no PoE switch reconfiguration. The DVR firmware is not updated. The property network does not need any new ports opened beyond outbound HTTPS for the management dashboard. Install at a typical apartment property runs under 30 minutes once on site.

This is the architectural reason the after-hours alert problem can be fixed for $450 upfront and $200 per month, instead of $50,000 to $100,000 for a Verkada or Rhombus rip-and-replace. The same cameras and the same recorder do the same job they did yesterday. The new layer is software watching the same signal a wall monitor was already showing.

What this does and does not replace

The overlay is a video-only layer. It watches the cameras the property already owns. It does not replace door and window sensors, smoke and carbon monoxide alarms, glass-break detectors, or any other environmental sensor. Those sensors detect things video does not see; they remain part of the stack. The overlay also does not replace the DVR itself; the DVR continues to record to disk, and that recording is what investigators subpoena later if an incident becomes a legal matter.

What the overlay does replace is the human watcher. Most apartment properties never staffed a watcher in the first place, which is the failure mode this layer addresses. A few properties pay a live night guard who watches the wall monitor and patrols every two hours; on those properties, the overlay does not replace the guard, but it does extend the guard's coverage from one-camera-at-a-time to all-cameras-always, and lets the guard physically respond to alerts instead of trying to scan a 16-tile grid by eye.

The overlay does not replace access control, intercoms, or alarms. The honest architecture for an apartment in 2026 is access control plus intercoms plus cameras plus alarms plus a recorder plus an analytics overlay on the recorder. Five existing layers plus one new one. Subtracting any of the first five produces a different failure mode that the sixth cannot patch over.

What to run as a 14-day pilot before rolling out to a portfolio

The honest test is one property for two weeks. Pick a Class B or Class C apartment in your portfolio that has had after-hours incidents in the last six months. Install the overlay on the DVR HDMI output. Configure the prohibited zones with the property manager (pool deck, rooftop access, vacant units, maintenance closet, perimeter gate). Set the on-call escalation chain to the existing manager rotation. Leave it running for 14 nights.

At the end of two weeks, measure three things. First, how many HIGH THREAT alerts fired across 14 nights and what fraction of them were real trespass events. Second, how many real trespass events happened on the property in those 14 nights (cross-checked against tenant reports and any incident logs). Third, what the false-positive rate looks like compared to the stock DVR motion alert stream over the same window, so you can show your regional manager the delta in concrete terms.

If the alert quality is what the rest of this page describes, the case for the rest of the portfolio writes itself. If it is not, you have a one-property install to remove and nothing else to clean up. Pilot risk is bounded; the upside if the architecture works is that every apartment in the portfolio has the same after-hours coverage that a $3,000-per-month guard would have given you on one of them.