# Enhancing Security of Online Interfaces: Adversarial Handwritten Arabic CAPTCHAs Generation
## 3 Methodology
### 4. Immutable Adversarial Noise (IAN):  
IAN is a training technique that aims to add imperceptible perturbations (known as adversarial noise) to inputs in order to fool deep learning models while maintaining the original prediction. This helps to make the models more robust against adversarial attacks. The fundamental goal of IAN is to identify small perturbations that can be added to inputs to alter model predictions while maintaining the inputs' perceived meaning by humans. There are two main steps to achieving this:  
1. Perturbation Computation: IAN firstly feeds a clean input through the model to obtain the original prediction. It then computes an adversarial perturbation based on the gradient of the loss with respect to the input, which can change the prediction when added to it. This perturbation is computed so that it is imperceptible to humans. 2. Adversarial Training: The computed perturbation is then combined with the clean input to generate an adversarial example. This perturbed input is fed into the model, which produces a different prediction to the clean input. The perturbation is interpreted as the \"correct\" or \"target\" output. This set up is an adversarial training example that can be used to fine-tune the model weights. IAN aims to find a small perturbation \(\delta\) that can be added to the input \(x\) to alter the model's prediction while maintaining the original meaning of the input as perceived by humans. Mathematically, IAN first computes the gradient \(\
abla_{x}L(x,y)\) of the loss \(L\) with respect to the input \(x\), where \(y\) is the true label. The perturbation \(\delta\) is then defined as Section 2.4, where \(\epsilon\) is a hyperparameter controlling the perturbation magnitude. The perturbed input \(x^{\prime}=x+\delta\) is then used as an adversarial training example to fine-tune the model, with the goal of making the model robust to the computed perturbation. IAN aims to train models that are robust to imperceptible perturbations by repeating the above process on multiple inputs from the training dataset. Using perceptual loss functions, the perturbations are limited to remain small and imperceptible. This enables IAN to produce adversarial examples that do not change significantly how humans interpret inputs. We show the design of IAN in Algorithm 4. * Rationale for Selection. IAN was chosen for two reasons: 1. Human-Readable Perturbations: unlike standard adversarial training, IAN's \(\epsilon\)-bounded noise ensures CAPTCHA legibility post-perturbation. 2. Defense-Aware Evaluation: by training models with IAN, we test whether CAPTCHA recognition systems can resist perturbations without degrading human usability. * Contribution to CAPTCHA Security: IAN reveals that CAPTCHA models trained without adversarial robustness fail catastrophically when perturbed, even with imperceptible noise. * Perturbation Budget: \(\epsilon=0.03\) (normalized pixel range), incrementally increased to \(\epsilon=0.1\). ```
1:Input:
2:Original image \(x\)
3:Epsilons \(\epsilon\)
4:Compute perturbation:
5:Sample noise \(N\)
6:Perturbation \(=N\cdot\epsilon\)
7:Create adversarial example: \(x^{\prime}=x+\text{perturbation}\)
8:Output: Adversarial image \(x^{\prime}\)
```  
**Algorithm 4** IAN Adversarial Generation. The CTC model represents an adversarial perturbation. CTC is a type of neural network architecture widely used in sequence labeling tasks such as speech recognition and handwriting recognition, where the input and output sequences are of different lengths. The main components of CTC are the following:  
1. Recurrent Neural Network (RNN): CTC employs an RNN as the primary component for encoding the input sequence. There are several possible forms for the RNN, including a simple RNN, LSTM network, or GRU network. The RNN reviews the input sequence in order, saving a hidden state to remember information from previous time points. 2. Softmax Output Layer: A softmax layer that provides a probability for each possible label in each step is present in the RNN's output layer.