# A Survey on Adversarial Perturbations and Attacks on CAPTCHAs
## 4 Adversarial CAPTCHAs
### Techniques for Generating Adversarial CAPTCHA  
There are several techniques used for generating the adversarial CAPTCHAs. Each technique carries several different aspects. In the data analysis from [15], it can be seen that humans and algorithms demonstrate different vulnerabilities to visual distortions. That is, adversarial perturbation is considerably bothersome to an algorithm yet friendly to a human. Since a normal adversarial noise is not enough to achieve a secure CAPTCHA scheme, a study in [3] introduced immutable adversarial noise (IAN) that is resistant to the removal attempts. The results showed that this IAN offers a good security and usability levels. In 2018, the influence of adversarial examples on CAPTCHA robustness is analyzed in [13] using two generation algorithms: FGSM and UAPM. The former is fast, convenient and widely used, whereas the latter attempts to discover a universal perturbation vector by aggregating atomic perturbation vectors that guide the successive data points to the decision boundary of the classifier. In 2020, an attempt to design secure CAPTCHA questions that are smoothly solvable to humans is introduced in [15]. Specifically, while analyzing the data, it observes that adversarial perturbation is meaningfully annoying to the algorithm yet friendly to humans. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt}} \hline \hline
**Dataset** & **Characteristics** \\ \hline Real CAPTCHA & A collection of real CAPTCHA set \\ \hline ILSVRC-2012 & The ImageNet Large Scale Visual Recognition Challenge (ILSVRC) is used to evaluate algorithms for image classification at large scale. It contains more than 1.25 million training images and 50 thousand validation images. \\ \hline ImageNet & It is used to evaluate algorithms for image classification at large scale. It contains more than 14 million images and 20,000 categories. \\ \hline Caltech-200 bird & It includes more than 11,000 images for bird species, and 200 bird categories. \\ \hline MNIST & The Modified National Institute of Standards and Technology (MNIST) is a large database of handwritten digits that can be used for different image processing system. \\ \hline EMNIST & It extends the MNIST dataset by including much data and has a set of handwritten digits with a \(28\times 28\) format. \\ \hline LibriSpeech & It is a large-scale database of roughly 1000 h of 16 kHz read English speech \\ \hline Google Speech Commands & It has 65,000 one-second-long utterances of 30 short words by various people. \\ \hline ISOLET Spoken Letter & It contains two samples of each English letter being spoken by 75 males and 75 females of varying ages. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Characteristics of used Datasets. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline \multirow{2}{*}{**Study**} & \multicolumn{4}{c}{**Datasets**} \\ \cline{2-5}  & **Real CAPTCHA** & **Image-Based** & **Text-Based** & **Audio-Based** \\ \hline
[18] & - & & - & - \\ \hline
[13] & - & ImageNet & - & - \\ \hline
[16] & - & - & MNIST \& EMNIST & - \\ \hline
[17] & - & Caltech-200 bird & - & - \\ \hline
[37] & - & - & - & LibriSpeech \\ \hline
[38] & - & - & - & LibriSpeech, Google Speech Commands and LDC: ISOLET Spoken Letter \\ \hline \hline \end{tabular}
\end{table} 
Table 3: _Cont._Four modules of multi-target attacks are proposed to address the characteristics of the character-based CAPTCHA cracking. The results demonstrated the effectiveness of the proposed solution. An approach to synthesize a robust CAPTCHA generator that is resistant and cannot be easily attacked by such recognition algorithms is proposed in [14]. Additionally, a practical adversarial CAPTCHA generation system is introduced in [6] that can defend against DL-based CAPTCHA solvers, and apply it on a comprehensive online platform with close to a billion users.