# Adversarial CAPTCHAs

arXiv: https://arxiv.org/abs/1901.01107 · HTML: https://mlsanity.com/paper/1901.01107/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 4 Jan 2019.

## Built on by (most cited first, 16 of 16)

- [Seeing is Living? Rethinking the Security of Facial Liveness Verification in the Deepfake Era](https://mlsanity.com/paper/2202.10673/) (2022)
- [Unrestricted Black-box Adversarial Attack Using GAN with Limited Queries](https://mlsanity.com/paper/2208.11613/) (2022)
- [Navigation Turing Test (NTT): Learning to Evaluate Human-Like Navigation](https://mlsanity.com/paper/2105.09637/) (2021)
- [AVA: Inconspicuous Attribute Variation-based Adversarial Attack bypassing DeepFake Detection](https://mlsanity.com/paper/2312.08675/) (2023)
- [Boosting the Adversarial Transferability of Surrogate Models with Dark Knowledge](https://mlsanity.com/paper/2206.08316/) (2022)
- [Adversarial Machine Learning for Social Good: Reframing the Adversary as an Ally](https://mlsanity.com/paper/2310.03614/) (2023)
- [Robust Text CAPTCHAs Using Adversarial Examples](https://mlsanity.com/paper/2101.02483/) (2021)
- [Exploring Robust Features for Improving Adversarial Robustness](https://mlsanity.com/paper/2309.04650/) (2023)
- [Defensive Adversarial CAPTCHA: A Semantics-Driven Framework for Natural Adversarial Example Generation](https://mlsanity.com/paper/2506.10685/) (2025)
- [Aura-CAPTCHA: A Reinforcement Learning and GAN-Enhanced Multi-Modal CAPTCHA System](https://mlsanity.com/paper/2508.14976/) (2025)
- [Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle](https://mlsanity.com/paper/2608.04314/) (2026)
- [Attacks as Defenses: Designing Robust Audio CAPTCHAs Using Attacks on Automatic Speech Recognition Systems](https://mlsanity.com/paper/2203.05408/) (2022)
- [Jailbreaking Commercial Black-Box LLMs with Explicitly Harmful Prompts](https://mlsanity.com/paper/2508.10390/) (2025)
- [VIPER Strike: Defeating Visual Reasoning CAPTCHAs via Structured Vision-Language Inference](https://mlsanity.com/paper/2601.06461/) (2026)
- [HLL: Can Agents Cross Humanity's Last Line of Verification?](https://mlsanity.com/paper/2606.02449/) (2026)
- [A Survey of Adversarial CAPTCHAs on its History, Classification and Generation](https://mlsanity.com/paper/2311.13233/) (2023)

## Abstract (arXiv)

Following the principle of to set one's own spear against one's own shield, we study how to design adversarial CAPTCHAs in this paper. We first identify the similarity and difference between adversarial CAPTCHA generation and existing hot adversarial example (image) generation research. Then, we propose a framework for text-based and image-based adversarial CAPTCHA generation on top of state-of-the-art adversarial image generation techniques. Finally, we design and implement an adversarial CAPTCHA generation and evaluation system, named aCAPTCHA, which integrates 10 image preprocessing techniques, 9 CAPTCHA attacks, 4 baseline adversarial CAPTCHA generation methods, and 8 new adversarial CAPTCHA generation methods. To examine the performance of aCAPTCHA, extensive security and usability evaluations are conducted. The results demonstrate that the generated adversarial CAPTCHAs can significantly improve the security of normal CAPTCHAs while maintaining similar usability. To facilitate the CAPTCHA security research, we also open source the aCAPTCHA system, including the source code, trained models, datasets, and the usability evaluation interfaces.