# Enhancing Security of Online Interfaces: Adversarial Handwritten Arabic CAPTCHAs Generation
## 3 Methodology
### Adversarial Techniques Used
* Scaled Gaussian Translation with Channel Shifts (SGTCS) SGTCS is a targeted adversarial perturbation technique that aims to incorrectly classify an input image as belonging to a particular target class. To create an imperceptible disturbance, it applies scaled Gaussian noise to each channel of the image. The attack takes in an original correctly classified image, a target class label, and a pretrained convolutional neural network (CNN) model. It first generates randomly
sampled Gaussian noise with a zero mean and unit variance for each channel of the image. Next, a small hyperparameter (\(\epsilon\) = 0.1) that controls the perturbation's magnitude scales the noise values. Next, each channel of the original image has the scaled noise added to it element-by-element. As a result, each color channel in the disturbed image has indistinguishable noise added to it. The predictions are then observed after the perturbed image has been run through the pretrained CNN model. By creating an adversarial example, the attack is successful if the model incorrectly labels the image as belonging to the target class. Otherwise, the noise scaling factor is increased, and this process is repeated until misclassification occurs or a maximum number of iterations is reached. This allows for stronger perturbations until the model's decision boundary is crossed. The SGTCS method targets all three dimensions of translation invariance: spatial, color, and instance translations. By adding scaled Gaussian noise individually to each color channel, it breaks the color translation invariance of CNNs. This forces the model to rely more on spatial and instance-based cues for classification. SGTCS generates a targeted adversarial perturbation by adding scaled Gaussian noise to each color channel of the input image. Mathematically, let x be the original input image. SGTCS computes the perturbation \(\delta=\epsilon*N\), where N is a tensor of Gaussian noise with zero mean and unit variance, and \(\epsilon\) is a small hyperparameter controlling the perturbation magnitude. The perturbed image is then created as \(x^{\prime}=x+\delta\), where the noise is added element-wise to each color channel of \(x\). The goal is to find the minimum \(\epsilon\) that causes the model to misclassify the perturbed image \(x^{\prime}\) as the target class. Attacking spatial invariance is additionally helped by the randomness of noise. The aim is to create a minimal perturbation that induces misclassification in a selected target class while being difficult for the model to detect. This is what the SGTCS method attempts to accomplish by simultaneously perturbing all translation dimensions. We show the design of SGTCS in Algorithm 2. * Rationale for Selection. SGTCS was chosen for three reasons: 1. CAPTCHA-Specific Weaknesses: many CAPTCHAs rely on color/texture invariance for automated solving; SGTCS tests whether minor channel shifts can break this assumption. 2. Controlled Perturbations: unlike untargeted noise attacks, SGTCS iteratively adjusts \(\epsilon\) to find the minimal perceptible perturbation, mimicking real-world adversarial constraints. 3. Diagnostic Value: by isolating failures in color/spatial invariance, SGTCS reveals which CAPTCHA features (e.g., hue consistency, edge alignment) are over-relied on by models. * Non-grid-aligned characters (breaking spatial invariance). - High-contrast, non-RGB color spaces (e.g., CMYK patterns, disrupting channel-wise attacks). * Initial Perturbation: \(\epsilon\) = 0.1, scaled by +0.05 per iteration. - Noise Distribution: \(N\)(0,1) sampled independently per channel. * Termination Conditions:
* Maximum iterations: 50
* Success threshold: \(\epsilon\leq 0.3\) (normalized pixel range). * Model Constraints: inputs clipped to [0,1] post-perturbation to maintain valid pixel ranges.