# Gotta CAPTCHA 'Em All: A Survey of Twenty years of the Human-or-Computer Dilemma

arXiv: https://arxiv.org/abs/2103.01748 · HTML: https://mlsanity.com/paper/2103.01748/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Mar 2021.

## Built on by (most cited first, 10 of 10)

- [Machine Generated Text: A Comprehensive Survey of Threat Models and Detection Methods](https://mlsanity.com/paper/2210.07321/) (2022)
- [Bot or Human? Detecting ChatGPT Imposters with A Single Question](https://mlsanity.com/paper/2305.06424/) (2023)
- [Captcha Attack: Turning Captchas Against Humanity](https://mlsanity.com/paper/2201.04014/) (2022)
- [Predictive Response Optimization: Using Reinforcement Learning to Fight Online Social Network Abuse](https://mlsanity.com/paper/2502.17693/) (2025)
- [VIPER Strike: Defeating Visual Reasoning CAPTCHAs via Structured Vision-Language Inference](https://mlsanity.com/paper/2601.06461/) (2026)
- [BounTCHA: A CAPTCHA Utilizing Boundary Identification in Guided Generative AI-extended Videos](https://mlsanity.com/paper/2501.18565/) (2025)
- [On the Internet, Nobody Knows You're an LLM Bot: Unmasking Web Agents with Multi-Layer Fingerprinting](https://mlsanity.com/paper/2606.30119/) (2026)
- [Breaking Darknet CAPTCHAs with general purpose LLM](https://mlsanity.com/paper/2608.28794/) (2026)
- [Invisible in Space, Visible in Time: Motion Vision CAPTCHA against GUI Agents](https://mlsanity.com/paper/2609.27461/) (2026)
- [DarKnight: Retrieval-Guided Agentic Framework for Breaking Dark Web CAPTCHA Gates](https://mlsanity.com/paper/2610.19830/) (2026)

## Abstract (arXiv)

A recent study has found that malicious bots generated nearly a quarter of overall website traffic in 2019 [100]. These malicious bots perform activities such as price and content scraping, account creation and takeover, credit card fraud, denial of service, etc. Thus, they represent a serious threat to all businesses in general, but are especially troublesome for e-commerce, travel and financial services. One of the most common defense mechanisms against bots abusing online services is the introduction of Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA), so it is extremely important to understand which CAPTCHA schemes have been designed and their actual effectiveness against the ever-evolving bots. To this end, this work provides an overview of the current state-of-the-art in the field of CAPTCHA schemes and defines a new classification that includes all the emerging schemes. In addition, for each identified CAPTCHA category, the most successful attack methods are summarized by also describing how CAPTCHA schemes evolved to resist bot attacks, and discussing the limitations of different CAPTCHA schemes from the security, usability and compatibility point of view. Finally, an assessment of the open issues, challenges, and opportunities for further study is provided, paving the road toward the design of the next-generation secure and user-friendly CAPTCHA schemes.