Diff-CAPTCHA: An Image-based CAPTCHA with Security Enhanced by Denoising Diffusion Model

TL;DR

This paper introduces Diff-CAPTCHA, a new image-based CAPTCHA that uses diffusion models to generate complex, diverse images, significantly improving security against automated attacks while remaining user-friendly.

Contribution

The paper proposes a novel CAPTCHA scheme leveraging diffusion models to generate more secure and diverse images, strengthening resistance against machine learning-based attacks.

Findings

Diff-CAPTCHA outperforms baseline schemes in security tests.

Diffusion-based generation increases CAPTCHA diversity and complexity.

Human usability remains high despite enhanced security.

Abstract

To enhance the security of text CAPTCHAs, various methods have been employed, such as adding the interference lines on the text, randomly distorting the characters, and overlapping multiple characters. These methods partly increase the difficulty of automated segmentation and recognition attacks. However, facing the rapid development of the end-to-end breaking algorithms, their security has been greatly weakened. The diffusion model is a novel image generation model that can generate the text images with deep fusion of characters and background images. In this paper, an image-click CAPTCHA scheme called Diff-CAPTCHA is proposed based on denoising diffusion models. The background image and characters of the CAPTCHA are treated as a whole to guide the generation process of a diffusion model, thus weakening the character features available for machine learning, enhancing the diversity of character features in the CAPTCHA, and increasing the difficulty of breaking algorithms. To evaluate the security of Diff-CAPTCHA, this paper develops several attack methods, including end-to-end attacks based on Faster R-CNN and two-stage attacks, and Diff-CAPTCHA is compared with three baseline schemes, including commercial CAPTCHA scheme and security-enhanced CAPTCHA scheme based on style transfer. The experimental results show that diffusion models can effectively enhance CAPTCHA security while maintaining good usability in human testing.