Abstract:The development of deep learning techniques has significantly increased the ability of computers to recognize CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), thus breaking or mitigating the security of existing captcha schemes. To protect against these attacks, recent works have been proposed to leverage adversarial machine learning to perturb captcha pictures. However, they either require the prior knowledge of captcha solving models or lack adaptivity to the evolving behaviors of attackers. Most importantly, none of them has been deployed in practical applications, and their practical applicability and effectiveness are unknown. In this work, we introduce advCAPTCHA, a practical adversarial captcha generation system that can defend against deep learning based captcha solvers, and deploy it on a large-scale online platform with near billion users. To the best of our knowledge, this is the first such work that has been deployed on international large-scale online platforms. By applying adversarial learning techniques in a novel manner, advCAPTCHA can generate effective adversarial captchas to significantly reduce the success rate of attackers, which has been demonstrated by a large-scale online study. Furthermore, we also validate the feasibility of advCAPTCHA in practical applications, as well as its robustness in defending against various attacks. We leverage the existing user risk analysis system to identify potential attackers and serve advCAPTCHA to them. We then use their answers as queries to the attack model. In this manner, advCAPTCHA can be adapted/fine-tuned to accommodate the attack model evolution. Overall, advCAPTCHA can serve as a key enabler for generating robust captchas in practice and providing useful guidelines for captcha developers and practitioners.

Effect of Adversarial Examples on the Robustness of CAPTCHA

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

Robust Text CAPTCHAs Using Adversarial Examples

Robust CAPTCHAs Towards Malicious OCR

A Survey of Adversarial CAPTCHAs on its History, Classification and Generation

Adversarial CAPTCHAs

Seeing Through the Mask: Rethinking Adversarial Examples for CAPTCHAs

blessing in disguise: Designing Robust Turing Test by Employing Algorithm Unrobustness

Text Captcha is Dead? A Large Scale Deployment and Empirical Study.

Applying Visual Cryptography to Enhance Text Captchas

Captcha Attack: Turning Captchas Against Humanity

TICS: Text–image-Based Semantic CAPTCHA Synthesis Via Multi-Condition Adversarial Learning

Using Generative Adversarial Networks to Break and Protect Text Captchas

An End-to-End Attack on Text-based CAPTCHAs Based on Cycle-Consistent Generative Adversarial Network

The Robustness of a New 3D CAPTCHA

Towards Evaluating the Security of Real-World Deployed Image CAPTCHAs

A machine learning attack against variable-length Chinese character CAPTCHAs

Vulnerability analysis of captcha using Deep learning

How Secure is Your Website? A Comprehensive Investigation on CAPTCHA Providers and Solving Services

On the Effect of Adversarial Training Against Invariance-based Adversarial Examples

How Can We Deal with Adversarial Examples?