Abstract:The development of deep learning techniques has significantly increased the ability of computers to recognize CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), thus breaking or mitigating the security of existing captcha schemes. To protect against these attacks, recent works have been proposed to leverage adversarial machine learning to perturb captcha pictures. However, they either require the prior knowledge of captcha solving models or lack adaptivity to the evolving behaviors of attackers. Most importantly, none of them has been deployed in practical applications, and their practical applicability and effectiveness are unknown. In this work, we introduce advCAPTCHA, a practical adversarial captcha generation system that can defend against deep learning based captcha solvers, and deploy it on a large-scale online platform with near billion users. To the best of our knowledge, this is the first such work that has been deployed on international large-scale online platforms. By applying adversarial learning techniques in a novel manner, advCAPTCHA can generate effective adversarial captchas to significantly reduce the success rate of attackers, which has been demonstrated by a large-scale online study. Furthermore, we also validate the feasibility of advCAPTCHA in practical applications, as well as its robustness in defending against various attacks. We leverage the existing user risk analysis system to identify potential attackers and serve advCAPTCHA to them. We then use their answers as queries to the attack model. In this manner, advCAPTCHA can be adapted/fine-tuned to accommodate the attack model evolution. Overall, advCAPTCHA can serve as a key enabler for generating robust captchas in practice and providing useful guidelines for captcha developers and practitioners.

The robustness of behavior-verification-based slider CAPTCHAs

CAPatch: Physical Adversarial Patch against Image Captioning Systems

Robust Text CAPTCHAs Using Adversarial Examples

Towards Evaluating the Security of Real-World Deployed Image CAPTCHAs

The Robustness of a New 3D CAPTCHA

Robust CAPTCHAs Towards Malicious OCR

A Survey of Adversarial CAPTCHAs on its History, Classification and Generation

Adversarial CAPTCHAs

A machine learning attack against variable-length Chinese character CAPTCHAs

blessing in disguise: Designing Robust Turing Test by Employing Algorithm Unrobustness

A survey of CAPTCHA technologies to distinguish between human and computer

Text Captcha is Dead? A Large Scale Deployment and Empirical Study.

Applying Visual Cryptography to Enhance Text Captchas

A Comprehensive Analysis of Cognitive CAPTCHAs Through Eye Tracking

Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2

An Empirical Study & Evaluation of Modern CAPTCHAs

ImCAPTCHA: Imperceptible CAPTCHA Based on Cursor Trajectories

How Secure is Your Website? A Comprehensive Investigation on CAPTCHA Providers and Solving Services

CAPTCHA Types and Breaking Techniques: Design Issues, Challenges, and Future Research Directions

An End-to-End Attack on Text-based CAPTCHAs Based on Cycle-Consistent Generative Adversarial Network

Diff-CAPTCHA: An Image-based CAPTCHA with Security Enhanced by Denoising Diffusion Model