# Enhancing Security of Online Interfaces: Adversarial Handwritten Arabic CAPTCHAs Generation
## 2 Literature Review
### Adversarial CAPTCHAs  
Adversarial examples, first formalized by [PERSON] et al. [41; 42] in their seminal work, are inputs intentionally perturbed to mislead machine learning models while remaining indistinguishable to humans. These perturbations exploit the high-dimensional linearity of neural networks, where small, carefully crafted changes in input space can cause significant shifts in model predictions. For CAPTCHAs, adversarial techniques introduce noise or distortions that degrade automated recognition systems' accuracy while preserving human readability. For instance, gradient-based attacks like the Fast Gradient Sign Method (FGSM) generate perturbations by maximizing the model's loss function, as shown in:  
\[\delta=\epsilon\cdot sign(\
abla_{x}L(x,y))\]  
where \(\delta\) is the perturbation, \(\epsilon\) controls magnitude, and \(\
abla_{x}L\) is the gradient of the loss with respect to the input. Such methods have been pivotal in exposing model vulnerabilities and informing defenses like adversarial training. In CAPTCHA design, adversarial perturbations exploit these vulnerabilities to create \"human-readable, but machine-resistant\" challenges, as demonstrated in this work. Following this groundbreaking work, researchers have explored various techniques for generating adversarial examples and evaluating their impact on different machine learning applications, including image recognition, natural language processing, and security-critical systems like CAPTCHAs [43; 44; 45; 46]. These studies highlight the importance of developing robust machine learning models that can withstand adversarial attacks, which is a key focus of the current research. [PERSON] et al. [43] presented an adversarial CAPTCHA that stays visible but blocks machine learning classifiers. [PERSON] et al. [44] created Deep CAPTCHA, which utilizes adversarial noise to improve security. Adversarial noise is a type of noise intentionally added to a system, like a CAPTCHA, in order to increase its resistance to machine learning model attacks while maintaining its human solvability. [PERSON] et al. [45] employed a combination of techniques to create more secure character-based CAPTCHAs. They utilized adversarial perturbations, which involve making small changes to images to confuse machine learning models. Additionally, they employed a multi-target attack, generating multiple diverse examples to fool models. Furthermore, they used ensemble adversarial training, which involves training models on multiple adversarial examples to improve robustness. Finally, they applied image preprocessing techniques, modifying images to make them more resistant to attacks. By combining these techniques, they were able to take advantage of the differences in how humans and algorithms respond to visual distortions, ultimately creating more secure CAPTCHAs. [PERSON] et al. [46] combined adversarial examples and neural style transfer to enhance CAPTCHA security. [PERSON] et al. [8] explored both text-based and image-based adversarial CAPTCHA generation systems. In the domain of audio CAPTCHAs, [PERSON] et al. [47] developed Generative-Adversarial Network (GAN) technology for synthetically generating noise and adversarial examples, which substantially decreased the recognition accuracy achievable by automated models. Their approach exemplifies ongoing research into more robust adversarial techniques across different CAPTCHA modalities. Two models, D-GAN and C-GAN, were proposed for generating CAPTCHA images by incorporating distance values or combining multiple source images to enhance protection against CAPTCHA solvers [48]. Advances in creating adversarial CAPTCHAs enhance security defenses and user experience, contributing to the ongoing effort to protect online systems from malicious attacks. Prior studies on adversarial CAPTCHAs in non-Arabic scripts provide critical context:  
* Latin Script: [PERSON] et al. [8] developed adversarial text CAPTCHAs using gradient-based perturbations, achieving 85% resistance against OCR models. [PERSON] et al.