Completing CAPTCHA puzzles is tedious, but using them as (imperfect) shields against malicious bots made sense — at least until now. Artificial intelligence can now solve such puzzles every time, according to a new study from ETH Zurich. CAPTCHA, an acronym for “Completely Automated Public Turing test to tell Computers and Humans Apart,” is used on a huge variety of websites.
However, the tool's name may need to be changed depending on how well the AI model created by the Swiss researchers handled the security measure's word and object identification problems.
The AI puzzle solver is based on a widely used AI model for processing images called You Only Look Once (YOLO). The scientists tuned YOLO to support Google’s popular reCAPTCHAv2 version of CAPTCHA. You’ll immediately recognize reCAPTCAv2 from every time you’ve had to click on a car, bike, bridge, or traffic light to prove your humanity.
However, with 14,000 labeled street photos as training data and a little bit of time, the scientists were able to teach YOLO to recognize objects as well as any human. Exactly as well as a human, in fact, since the AI didn’t solve every puzzle perfectly the first time. But, you might remember that you get more than one chance, assuming you don’t totally screw up the puzzle. YOLO was able to perform well enough that even if it made a mistake on one puzzle, it would make up for it and succeed on another CAPTCHA puzzle.
Narrowing the scope of objects that users need to identify (often just 13 categories, such as traffic lights, buses, and bicycles) allowed for easier integration between websites.
However, this very focus on a narrow set of object types is what made it easier for the YOLO-based AI model to beat the system. According to the ETH Zurich team, the simplicity of the system worked in the AI’s favor, allowing it to master image-based challenges without much difficulty. Despite attempts to make CAPTCHA more sophisticated by incorporating factors like mouse movement and browser history (known as device fingerprinting), the AI’s success rate remained unchanged.
The rise of AI to solve CAPTCHAs
The fact that an AI system can now bypass CAPTCHA systems with a perfect success rate is a wake-up call for the cybersecurity community. CAPTCHA systems are a critical component of web security, designed to prevent bots from engaging in activities such as sending spam, creating fake accounts, or launching distributed denial-of-service (DDoS) attacks. If these systems are compromised, websites could become more vulnerable to automated attacks and other malicious activities.
The YOLO model’s success in solving CAPTCHA systems is not an isolated case. In recent years, AI models have demonstrated increasing proficiency in tasks previously considered the exclusive domain of humans. CAPTCHA puzzle solving is just the latest milestone in AI advancements that have redefined expectations around machine learning and automated systems.
Implications for everyday users
For the average person, CAPTCHA games are an everyday occurrence, whether logging into an online account, submitting a form, or making an online purchase. The security of these interactions depends on the CAPTCHA’s ability to keep bots out. With this latest advancement in artificial intelligence, there is a real risk that the CAPTCHA will no longer serve its original purpose as an effective gatekeeper.
An immediate concern is that if CAPTCHA systems become outdated or easy for bots to bypass, it could result in an increase in automated activities such as spam or malicious bot-driven campaigns. For example, CAPTCHA systems are often employed to prevent bots from creating thousands of fake accounts or automatically posting spam content on social media platforms. If bots can easily bypass the CAPTCHA, it could lead to an increase in fraudulent activity on websites.
Furthermore, as CAPTCHA technology becomes more and more defeated, websites and service providers will be forced to explore more robust security mechanisms. Some of the alternatives being explored include more sophisticated behavioral analysis techniques, such as tracking user interaction patterns, and biometric-based verification systems that rely on fingerprints or facial recognition.
Am I AI?
Proving that you are not a robot is no longer as easy as it used to be, but that doesn't mean you have to panic about being replaced in the near future. It's simply proof that cybersecurity needs to take into account the rapidly evolving capabilities of AI models. The CAPTCHA could end up being replaced by other puzzles to prove your humanity.
It would have to be something more intensive than just choosing the right image. A security setting might have to monitor your behavior when solving a puzzle, such as how quickly and well you type and scroll. Or it might require a combination of multiple tests and checks. In other words, cybersecurity will have to be tightened, though hopefully without slowing down web browsing too much. If things get really tough, maybe we'll all have to shed a tear after watching Mufasa die in The Lion King.