i

157

An interactive 3D CAPTCHA with semantic information C. Winter-Hjelm, M. H. Kleming, R. H. Bakken

Abstract As spammers often seem to be one step ahead of human interactive proofs, there is a need for new ideas on how to counter this. In this paper we outline our proposal for an interactive 3D CAPTCHA that makes use of semantic information and commonsense knowledge. We review a selection of exisisting CAPTCHA methods and describe why we believe our method is superior. We also give a brief idea of how we intend to evaluate our method and where we wish to go next.

Introduction

Completely Automated Public Turing Tests to Tell Computers and Humans Apart (CAPTCHAs) are in widespread use on the world wide web as a measure for preventing free email services from being used to distribute spam, and fora and blogs from being ooded with irrelevant postings, but could concievably be used in any situation where it is desirable to ensure that the user is actually a human. The earliest CAPTCHAs in use asked the user to enter a word or code from a distorted image. With improved character recognition and segmentation algorithms a lot of focus has been on nding new ways of distorting the text. Current CAPTCHAs based on distorted text suer from two problems: (1) researchers keep coming up with image processing algorithms that can crack them [6, 9, 10, 12], and (2) the image distortion makes it increasingly hard for human users to recognise the text, causing usability issues [11]. Novel CAPTCHAs based on recognition of animals (separate kittens from other animals)1 , animation [2], and rotated 3D objects [5] have been proposed, but they have not gained widespread use. In this paper we propose a new CAPTCHA method based on interaction with a 3D environment and interpretation of semantic information. Our solution has a number of aspects that would make more dicult for a computer to crack, while still being highly usable for a human. The rest of the paper is structured as follows: section 2 describes some related research, while we detail our proposed solution in section 3. In section 4 we present some thoughts on how to evaluate our solution, and we conclude the paper in section 5. This paper was presented at NAIS-2009; see http://events.idi.ntnu.no/nais2009/.
1

http://kittenauth.com

158

C. Winter-Hjelm, M. H. Kleming, R. H. Bakke

Related Work

The concept of using human interactive proofs on websites was rst described by Naor [7], while the term CAPTCHA was coined and made popular by von Ahn and Blum [1]. The rst CAPTCHAs were based on images of distorted characters, where the characters were legible to humans, yet illegible to computers. An increasing amount of distortion has been added to these CAPTCHAs to combat the rapid evolution of image processing algorithms, in some cases resulting in the text being illegible to humans [11], but legible to computers [6, 9, 10, 12]. Recently, alternatives to this method have been proposed. Text based CAPTCHA [4] is based on sentence analysis. A problem with this method is that clever algorithms can predict the likelihood of a given word occuring in a sentence, given the two previous words as context. When using plain text there is no challenge in reading the text and analyze it with a well written OCR algorithm. Another recently developed CAPTCHA method can be found at the YUNiTi2 website. The user is given the challenge of identifying three rotated 3D objects presented from from a list of objects viewed from dierent angles. The size of the set of objects is limited and all models are grayscale, so it is not impossible for novel object recognition techniques to recognize the objects [3].

Our proposed method

A key element of a successful CAPTCHA is that it necessitates a demonstration of intelligence. General intelligence is a multi-faceted feature present in humans, but, to this day, not in computers. Our general idea is to exploit four such facets that are very weak in current AI - visual interaction, semantic understanding, commonsense knowledge and object recognition. Our proposed CAPTCHA consists of an empty space containing several dierent 3D objects, which can all be manipulated using the mouse, to rotate, move and resize. They have dierent colors, textures, shapes and sizes, and some of them share one or more of these features. The features are chosen randomly in order to make the scene less predictable. The source of light also moves and changes color, causing further diculties for object recognition AI. There are techniques in existence that, with high probability, recognize 3D objects where only change in color and rotation is utilized for occlusion [3], making existing 3D CAPTCHAs vulnerable as they are usually grayscale or dont use alternating textures. The user is asked to identify a small selection of objects based on a semantic description (see gure 1). Each object has its own list of descriptions pertaining to that object only, many of which are based on commonsense knowledge. As an example, a dog could be either mans best friend, pet canine, quadruped hunting partner or any other contextually understandable description. The full description will eventually include the other features mentioned above, for instance the large, green, polka-dot pet canine. The order in which the features are printed out is semi-random. Each object carries a letter or a short string of letters or other symbols possible to reproduce (henceforth known as symbols) placed somewhere on its surface, ideally where its initially not visible to the user. Thus, the user needs to rotate and possibly resize the objects to reveal these symbols. Its possible to program a bot to interact
2

http://yuniti.com

An interactive 3D CAPTCHA with semantic information

159

Figure 1: A mockup of our proposed CAPTCHA method, showing a typical task given to the user. In the nal application, the objects will have textures.

with a 3D environment in this manner, but this has only been marginally fruitful, for instance in MMORPGs [8]. The symbols are then to be typed into a text input eld in the correct order and submitted for verication, as one would in a traditional CAPTCHA.

Evaluation

Providing a quantitative evaluation of the probability of an AI solving our CAPTCHA appears to be dicult, but has not been a priority as of yet. Unless the AI is able to identify the objects from their descriptions (dicult to quantify), one would have to assume the best tactic to be a sequential traversal of the scene and subsequently guessing which symbols to submit and in which order. Success using this tactic seems somewhat improbable, but this is yet to be investigated. We intend to do extensive usability tests on a diverse population. A selection of our test subjects will also be given a questionnaire where they can provide specic, qualitative feedback, so as to give us an idea of how the CAPTCHA is perceived and how we can improve both the visual presentation and its functions.

Conclusion

Despite advances in AI development, computers can at present be programmed to have only rudimentary cognitive abilities, not suited for general problem solving. With our CAPTCHA, we exploit this on several levels. Whereas traditional CAPTCHAs rely on AI inability to recognize text patterns through various types of clutter, ours, as described in section 3, relies on its inability to solve semantically dened visual problems, relating to both object recognition and commonsense knowledge, which we believe to be a more foolproof approach, considering the amount of work currently being done on text pattern recognition. While we are condent in our method, we nonetheless feel theres still much work to be done. In the continuation of our eort, we will seek to improve its security

160

C. Winter-Hjelm, M. H. Kleming, R. H. Bakke

and make it more user friendly and adaptive to varying needs. There are also plans to expand on the idea and build dierent types of challenges for the user, to make it less predictable, yet still easy for a human to solve. It is also our intention to eliminate the need for text input.

References
[1] L. V. Ahn, M. Blum, and J. Langford. Telling humans and computers apart automatically. Communications of the ACM, 47(2):57, 2004. [2] E. Athanasopoulos and S. Antonatos. Enhanced CAPTCHAs: Animation to Tell Humans and Computers Apart. LNCS, 2006. Using

[3] A. Diplaros, T. Gevers, and I. Patras. Combining Color and Shape Information for Illumination-Viewpoint Invariant Object Recognition. IEEE Transactions on Image Processing, 2006. [4] P. Godfrey. Text-based captcha algorithms. Interactive Proofs, 2002. First Workshop on Human

[5] M. Hoque, D. Russomanno, and M. Yeasin. 2D Captchas from 3D Models. Proceedings of the IEEE SoutheastCon, 2006. [6] G. Moy, N. Jones, C. Harkless, and R. Potter. Distortion Estimation Techniques in Solving Visual CAPTCHAs. IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 2004. [7] M. Naor. Verication of a human in the loop or identication via the turing test. Unpublished Manuscript, 1996. [8] J. Yan. Bot, Cyborg and Automated Turing Test. Technical Report, University of Newcastle upon Tyne, 2006. [9] J. Yan and A. E. Ahmad. Breaking Visual CAPTCHAs with Na ve Pattern Recognition Algorithms. Proc. of the 23rd Annual Computer Security Applications Conference (ACSAC07), pages 279291, 2007. [10] J. Yan and A. E. Ahmad. A Low-cost Attack on a Microsoft CAPTCHA. Proceedings of the 15th ACM CCS, 2008. [11] J. Yan and A. E. Ahmad. Usability of CAPTCHAs Or usability issues in CAPTCHA design. Proceedings of the 4th SOUPS, 2008. [12] J. Yan and S. Yu. Streamlining Attacks on CAPTCHAs with a Computer Game. IJCAI, 2009.