Research on Text-Based Adversarial CAPTCHA

doi:10.3778/j.issn.1002-8331.2206-0359

Abstract

Abstract: The development of deep learning techniques such as image recognition has made traditional text CAPTCHAs less secure. It is of great significance to enhance the security of text-based CAPTCHAs by using adversarial examples, the defects of deep neural networks. This paper generates text adversarial CAPTCHAs by applying multiple adversarial example generation algorithms to text CAPTCHA and measures the actual effectivenessin terms of multiple aspects such as time consumption, disturbance size, black and white box recognition rate. Based on the characteristics of the application scenario with high frequency of CAPTCHA generation, a scheme of applying universal adversarial perturbation to text CAPTCHAs is screened. In applying the fast universal adversarial perturbation（fast-UAP） algorithm, the I-FUAP（initialized-FUAP） algorithms is proposed to overcome the instability of Fast-UAP by using universal adversarial perturbation for initialization. Experiments show that the improved algorithm can generate UAP faster than the original Fast-UAP. The generation time is reduced by about 30.22% without significantly affecting the perturbation success rate and the effectiveness of the adversarial example attack.

Key words: deep learning, completely automated public turing test to tell computers and humans apart（CAPTCHA）, adversarial attack, universal adversarial perturbation

摘要： 图像识别等深度学习技术的发展使得传统的文本验证码安全性下降，利用对抗样本这一深度神经网络存在的缺陷来增强文本验证码的安全性具有重要研究意义。通过将多种对抗样本生成算法应用到文本验证码上，生成文本对抗验证码，并从耗时、扰动大小、黑白盒识别率等多个方面衡量生成的对抗验证码的实际效果。基于验证码生成频率较高的应用场景特点，筛选出将通用对抗扰动应用到文本验证码上的方案；在应用快速通用对抗扰动（Fast-UAP）算法时，为了克服Fast-UAP的不稳定性，提出了I-FUAP（initialized-FUAP）算法，通过利用通用对抗扰动来进行初始化，实验表明，在不显著影响扰动成功率和对抗样本攻击效果的前提下，改进后的算法相比于原来的Fast-UAP能更快地生成通用对抗扰动，生成耗时减少约30.22%。

关键词: 深度学习, 验证码, 对抗攻击, 通用对抗扰动

LI Jianming, YAN Qiao. Research on Text-Based Adversarial CAPTCHA[J]. Computer Engineering and Applications, 2023, 59(21): 278-286.

李剑明, 闫巧. 文本对抗验证码的研究[J]. 计算机工程与应用, 2023, 59(21): 278-286.

References

[1] FIDAS C A，VOYIATZIS A G，AVOURIS N M.On the necessity of user-friendly CAPTCHA[C]//Proceedings of the SIGCHI Conference on Human Factors in Computing Systems，2011：2623-2626.
[2] LECUN Y，BOTTOU L，BENGIO Y，et al.Gradient-based learning applied to document recognition[J].Proceedings of the IEEE，1998，86（11）：2278-2324.
[3] 刘欢，邵蔚元，郭跃飞.卷积神经网络在验证码识别上的应用与研究[J].计算机工程与应用，2016，52（18）：1-7.
LIU H，SHAO W Y，GUO Y F.Research on captcha recognition with convolutional neural networks[J].Computer Engineering and Applications，2016，52（18）：1-7.
[4] SINGH V P，PAL P.Survey of different types of CAPTCHA[J].International Journal of Computer Science and Information Technologies，2014，5（2）：2242-2245.
[5] GAFNI R，NAGAR I.CAPTCHA-security affecting user experience[J].Issues in Informing Science and Information Technology，2016，13：63-77.
[6] SZEGEDY C，ZAREMBA W，SUTSKEVER I，et al.Intriguing properties of neural networks[J].arXiv：1312. 6199，2013.
[7] GOODFELLOW I J，SHLENS J，SZEGEDY C.Explaining and harnessing adversarial examples[J].arXiv：1412.6572，2014.
[8] KURAKIN A，GOODFELLOW I，BENGIO S.Adversarial examples in the physical world[J].arXiv：1607.02533，2016.
[9] MADRY A，MAKELOV A，SCHMIDT L，et al.Towards deep learning models resistant to adversarial attacks[J].arXiv：1706.06083，2017.
[10] XIE C，ZHANG Z，ZHOU Y，et al.Improving transferability of adversarial examples with input diversity[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition，2019：2730-2739.
[11] MOOSAVI-DEZFOOLI S M，FAWZI A，FROSSARD P.Deepfool：a simple and accurate method to fool deep neural networks[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition，2016：2574-2582.
[12] CARLINI N，WAGNER D.Towards evaluating the robustness of neural networks[C]//2017 IEEE Symposium on Security and Privacy，2017：39-57.
[13] PAPERNOT N，MCDANIEL P，JHA S，et al.The limitations of deep learning in adversarial settings[C]//2016 IEEE European Symposium on Security and Privacy（EuroS&P），2016：372-387.
[14] CHEN P Y，ZHANG H，SHARMA Y，et al.Zoo：zeroth order optimization based black-box attacks to deep neural networks without training substitute models[C]//Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security，2017：15-26.
[15] DONG Y，LIAO F，PANG T，et al.Boosting adversarial attacks with momentum[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition，2018：9185-9193.
[16] XIAO C，LI B，ZHU J Y，et al.Generating adversarial examples with adversarial networks[J].arXiv：1801.02610，2018.
[17] YANG B，XU K，WANG H，et al.Random transformation of image brightness for adversarial attack[J].Journal of Intelligent & Fuzzy Systems，2022：1-12.
[18] 王志勇，邢凯，邓洪武，等.基于小样本学习和因果干预的ResNeXt对抗攻击[J].计算机工程与应用，2022，58（7）：68-76.
WANG Z Y，XING K，DENG H W，et al.Adversarial attack against ResNeXt based on few-shot learning and causal intervention[J].Computer Engineering and Applications，2022，58（7）：68-76.
[19] SARKAR S，BANSAL A，MAHBUB U，et al.UPSET and ANGRI：Breaking high performance image classifiers[J].arXiv：1707.01159，2017.
[20] PHAN H，XIE Y，LIAO S，et al.Cag：a real-time low-cost enhanced-robustness high-transferability content-aware adversarial attack generator[C]//Proceedings of the AAAI Conference on Artificial Intelligence，2020：5412-5419.
[21] MOOSAVI-DEZFOOLI S M，FAWZI A，FAWZI O，et al.Universal adversarial perturbations[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition，2017：1765-1773.
[22] 舒乐，戴佳筑.基于通用对抗扰动的图像验证码保护方法[J].计算机工程与应用，2021，57（18）：135-141.
SHU L，DAI J Z.Image-based CAPTCHA’s protection method based on universal adversarial perturbations[J].Computer Engineering and Applications，2021，57（18）：135-141.