Abstract:Following the principle of to set one's own spear against one's own shield, we study how to design adversarial completely automated public turing test to tell computers and humans apart (CAPTCHA) in this article. We first identify the similarity and difference between adversarial CAPTCHA generation and existing hot adversarial example (image) generation research. Then, we propose a framework for text-based and image-based adversarial CAPTCHA generation on top of state-of-the-art adversarial image generation techniques. Finally, we design and implement an adversarial CAPTCHA generation and evaluation system, called aCAPTCHA, which integrates 12 image preprocessing techniques, nine CAPTCHA attacks, four baseline adversarial CAPTCHA generation methods, and eight new adversarial CAPTCHA generation methods. To examine the performance of aCAPTCHA, extensive security and usability evaluations are conducted. The results demonstrate that the generated adversarial CAPTCHAs can significantly improve the security of normal CAPTCHAs while maintaining similar usability. To facilitate the CAPTCHA security research, we also open source the aCAPTCHA system, including the source code, trained models, datasets, and the usability evaluation interfaces.
automation & control systems,computer science, cybernetics, artificial intelligence
What problem does this paper attempt to address?
### Problems the paper attempts to solve
This paper aims to solve the problem of the balance between security and usability in existing text - and image - based CAPTCHAs. Specifically:
1. **Security challenges**:
- Existing CAPTCHA schemes are vulnerable to various attacks, especially those based on deep learning. For example, Optical Character Recognition (OCR) technology can easily break text - based CAPTCHAs, and Deep Neural Networks (DNN) have made significant progress in image classification and recognition, making many image - based CAPTCHAs vulnerable as well.
- With the development of machine learning technology, especially the progress of deep learning, the security of CAPTCHAs is constantly under new threats. To counter these attacks, existing CAPTCHAs usually add more distortion and confusion, but this will affect their usability.
2. **Usability challenges**:
- Improving the security of CAPTCHAs often requires adding more complexity and interference, which will lead to a decline in user experience. For example, overly distorted text - based CAPTCHAs may be difficult for users to recognize, and complex image - based CAPTCHAs may require users to spend more time and effort to complete.
- It is difficult for designers to ensure the usability of CAPTCHAs while maintaining high security. Especially for image - based CAPTCHAs, generating images with specific semantic meanings is very time - consuming and difficult.
### Solutions
To address the above challenges, the paper proposes a new CAPTCHA generation method based on adversarial learning, namely **adversarial CAPTCHA**. The specific objectives are as follows:
1. **Security**:
- The generated adversarial CAPTCHA can effectively defend against various existing attacks, especially powerful attacks based on deep learning.
2. **Usability**:
- The generated adversarial CAPTCHA should maintain a high user experience in practical applications and will not significantly affect the user's experience due to the addition of security measures.
3. **Compatibility**:
- The proposed CAPTCHA generation scheme should be compatible with the existing deployment and application of text - and image - based CAPTCHAs.
### Methods and contributions
1. **Framework design**:
- A framework based on existing adversarial sample generation techniques is proposed for generating text - and image - based adversarial CAPTCHAs. Specifically, it includes four text - based adversarial CAPTCHA generation methods and four image - based adversarial CAPTCHA generation methods.
2. **System implementation**:
- A comprehensive adversarial CAPTCHA generation and evaluation system, called aCAPTCHA, is designed and implemented. This system integrates 12 image pre - processing techniques, nine CAPTCHA attack methods, four baseline adversarial CAPTCHA generation methods and eight new adversarial CAPTCHA generation methods.
3. **Performance evaluation**:
- An extensive security and usability evaluation of the generated adversarial CAPTCHA has been carried out. The results show that the generated adversarial CAPTCHA improves security while maintaining usability similar to that of ordinary CAPTCHAs.
4. **Open - source contribution**:
- The aCAPTCHA system, including the source code, training models, data sets and usability evaluation interfaces, is open - sourced to promote the development of CAPTCHA security research.
Through these methods and contributions, the paper successfully solves the problem of the balance between security and usability in existing CAPTCHAs and provides new ideas and tools for future CAPTCHA design.