# Enhancing Security of Online Interfaces: Adversarial Handwritten Arabic CAPTCHAs Generation
## 3 Methodology
### Adversarial Techniques Used
```
1:Input:
2:Original image \(x\)
3:Epsilons \(\epsilon\)
4:Step size \(\alpha\)
5:Number of iterations
6:Initialization:
7:Perturbation \(\delta\gets 0\)
8:for\(i=1\)to number of iterations do
9:Iteration\(i\):
10:Compute gradient: \(\
abla L\leftarrow\frac{\partial L}{\partial x}\)
11:Update perturbation: \(\delta\leftarrow\delta+\alpha\cdot\text{sgn}(\
abla L)\)
12:Clip perturbation: \(\delta\leftarrow\text{clip}(\delta,-\epsilon,\epsilon)\)
13:Generate adversarial image: \(x^{\prime}\gets x+\delta\)
14:Clip image values: \(x^{\prime}\leftarrow\text{clip}(x^{\prime},0,1)\)
15:Predict on adversarial image: \(p\leftarrow\arg\max S(F(x^{\prime}))\)
16:endfor
17:Output:Adversarial image \(x^{\prime}\)
```  
**Algorithm 2** SGTCS Adversarial Generation. 3. Jacobian-based Saliency Map Attack (JSMA): An iterative, greedy algorithm called JSMA is used to create adversarial examples. The way that JSMA operates is by calculating an image's Jacobian matrix with respect to the logits of the model. The matrix shows how sensitive each pixel's changes are to the model's predictions. A saliency map is created as a matrix to determine which pixels have the greatest influence over the model's predictions. Firstly, a target class \(t\) is chosen by the algorithm to incorrectly classify the image. The original clean image is then initialized to represent the adversarial image. The algorithm calculates the Jacobian of the current adversarial image with respect to the logits for each iteration. From the Jacobian, it computes a saliency map, which assigns each pixel a value indicating how much modifying that pixel would affect the predicted probability of class t versus the original predicted class. In an attempt to raise the probability of class t, it then greedily changes the two pixels with the highest absolute saliency values, iteratively calculating the Jacobian/saliency map. The modification of pixels continues until the model classifies the image as class t or until a predetermined modification budget is exhausted. With relatively few pixel modifications, JSMA generates targeted adversarial perturbations by iteratively identifying the most influential pixels, based on the current predictions of the model. Mathematically, let x be the original input image and y be the true class label. The goal of JSMA is to find a small perturbation \(\delta\) that can be added to x to create an adversarial example \(x^{\prime}=x+\delta\), such that the model incorrectly classifies \(x^{\prime}\) as a target class y\({}^{\prime}\). The JSMA algorithm calculates the Jacobian matrix J of the model's output with respect to the input \(x\), where \(J[i,j]=\partial F(x)[i]/\partial x[j]\), and \(F(x)\) represents the model's output logits. From the Jacobian matrix, a saliency map S is computed, where  
\(S[i,j]=max(0,\partial F(x)[t]/\partial x[i]*-\partial F(x)[y]/\partial x[j])\) and t is the target class. This saliency map identifies the pixels that have the greatest influence on increasing the probability of the target class t while decreasing the probability of the true class y. The JSMA algorithm then iteratively modifies the two pixels with the highest saliency values, updating the Jacobian and saliency map at each step, until the model classifies the image as the target class or a predetermined perturbation budget is exhausted.We show the design of JSMA in Algorithm 3. * Rationale for Selection. JSMA was chosen for three reasons: 1. Targeted Attack Capability: unlike untargeted attacks, JSMA forces misclassification to a specific class, mimicking real-world CAPTCHA bypass scenarios. 2. Minimal Perturbations: by modifying only critical pixels, it tests whether CAPTCHAs are vulnerable to imperceptible alterations. 3. White-Box Relevance: as CAPTCHA defenses often rely on obfuscation, JSMA's reliance on model gradients highlights weaknesses in systems assuming attackers lack model knowledge.