AIセキュリティポータル K Program
Oedipus: LLM-enchanced Reasoning CAPTCHA Solver
Share
Abstract
CAPTCHAs have become a ubiquitous tool in safeguarding applications from automated bots. Over time, the arms race between CAPTCHA development and evasion techniques has led to increasingly sophisticated and diverse designs. The latest iteration, reasoning CAPTCHAs, exploits tasks that are intuitively simple for humans but challenging for conventional AI technologies, thereby enhancing security measures. Driven by the evolving AI capabilities, particularly the advancements in Large Language Models (LLMs), we investigate the potential of multimodal LLMs to solve modern reasoning CAPTCHAs. Our empirical analysis reveals that, despite their advanced reasoning capabilities, LLMs struggle to solve these CAPTCHAs effectively. In response, we introduce Oedipus, an innovative end-to-end framework for automated reasoning CAPTCHA solving. Central to this framework is a novel strategy that dissects the complex and human-easy-AI-hard tasks into a sequence of simpler and AI-easy steps. This is achieved through the development of a Domain Specific Language (DSL) for CAPTCHAs that guides LLMs in generating actionable sub-steps for each CAPTCHA challenge. The DSL is customized to ensure that each unit operation is a highly solvable subtask revealed in our previous empirical study. These sub-steps are then tackled sequentially using the Chain-of-Thought (CoT) methodology. Our evaluation shows that Oedipus effectively resolves the studied CAPTCHAs, achieving an average success rate of 63.5\%. Remarkably, it also shows adaptability to the most recent CAPTCHA designs introduced in late 2023, which are not included in our initial study. This prompts a discussion on future strategies for designing reasoning CAPTCHAs that can effectively counter advanced AI solutions.
Yet Another Text Captcha Solver: A Generative Adversarial Network Based Approach
Ye, G., Tang, Z., Fang, D., Zhu, Z., Feng, Y., Xu, P., Chen, X., Wang, Z.
Published: 2018
The end is nigh: Generic solving of text-based CAPTCHAs
E. Bursztein, J. Aigrain, A. Moscicki, J. C. Mitchell
Published: 2014
How secure is your website? a comprehensive investigation on captcha providers and solving services
R. Jin, L. Huang, J. Duan, W. Zhao, Y. Liao, P. Zhou
Published: 2023
An object detection based solver for google’s image recaptcha v2
M. I. Hossen, Y. Tu, M. F. Rabby, M. N. Islam, H. Cao, X. Hei
Published: 2021
A captcha design based on visual reasoning
H. Wang, F. Zheng, Z. Chen, Y. Lu, J. Gao, R. Wei
Published: 2018
Research on the security of visual reasoning CAPTCHA
Y. Gao, H. Gao, S. Luo, Y. Zi, S. Zhang, W. Mao, P. Wang, Y. Shen, J. Yan
Published: 2021
Extended research on the security of visual reasoning captcha
P. Wang, H. Gao, C. Xiao, X. Guo, Y. Gao, Y. Zi
Published: 2023
Pre-train, prompt, and predict: A systematic survey of prompting methods in natural language processing
Pengfei Liu, Weizhe Yuan, Jinlan Fu, Zhengbao Jiang, Hiroaki Hayashi, Graham Neubig
Published: 2023
Chain-of-thought prompting elicits reasoning in large language models
J. Wei, X. Wang, D. Schuurmans, M. Bosma, B. Ichter, F. Xia, E. Chi, Q. Le, D. Zhou
Published: 2023
When and how to develop domain-specific languages
M. Mernik, J. Heering, A. M. Sloane
Published: 2005
Deep-CAPTCHA: a deep learning based CAPTCHA solver for vulnerability assessment
Zahra Noury, Mahdi Rezaei
Published: 6.15.2020
What’s up captcha? a captcha based on image orientation
R. Gossweiler, M. Kamvar, S. Baluja
Published: 2009
Survey of different types of captcha
V. P. Singh, P. Pal
Published: 2014
Re: CAPTCHAs—Understanding CAPTCHA-Solving services in an economic context
M. Motoyama, K. Levchenko, C. Kanich, D. McCoy, G. M. Voelker, S. Savage
Published: 2010
Automated captcha solving: An empirical comparison of selected techniques
M. Korakakis, E. Magkos, P. Mylonas
Published: 2014
PentestGPT: An LLM-empowered Automatic Penetration Testing Tool
Gelei Deng, Yi Liu, Víctor Mayoral-Vilches, Peng Liu, Yuekang Li, Yuan Xu, Tianwei Zhang, Yang Liu, Martin Pinzger, Stefan Rass
Published: 8.13.2023
Large language model guided protocol fuzzing
R. Meng, M. Mirchev, M. Böhme, A. Roychoudhury
Published: 2024
Recent advances of captcha security analysis: a short literature review
N. T. Dinh, V. T. Hoang
Published: 2023
A systematic survey on captcha recognition: types, creation and breaking techniques
M. Kumar, M. Jindal, M. Kumar
Published: 2022
Theoremqa: A theorem-driven question answering dataset
W. Chen, M. Yin, M. Ku, P. Lu, Y. Wan, X. Ma, J. Xu, X. Wang, T. Xia
Published: 2023
Attention is all you need
A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, I. Polosukhin
Published: 2023
Chatgpt is not enough: Enhancing large language models with knowledge graphs for fact-aware language modeling
L. Yang, H. Chen, Z. Li, X. Ding, X. Wu
Published: 2023
Designing human friendly human interaction proofs (hips
K. Chellapilla, K. Larson, P. Simard, M. Czerwinski
Published: 2005
Captcha: Using hard ai problems for security
L. Von Ahn, M. Blum, N. J. Hopper, J. Langford
Published: 2003
Share