NGCaptcha: A CAPTCHA Bridging the Past and the Future
Ziqi Ding, Shangzhi Xu, Wei Song, Yuekang Li
TL;DR
The paper tackles the diminishing effectiveness of traditional CAPTCHAs against AI and automated abuse by proposing NgCaptcha, a hybrid system that tethers a lightweight client-side proof-of-work to an AI-resistant image-selection task. The two-phase design first imposes computational cost via a hash-based PoW, then presents an illusion-based grid image challenge that remains hard for current AI to solve. Findings indicate low server overhead, meaningful obstruction of automated attacks, and usability on par with common CAPTCHAs, with privacy advantages due to self-hosted verification. This defense-in-depth approach offers a practical path toward more robust, privacy-preserving bot protection on the web, while acknowledging limitations and directions for future work.
Abstract
CAPTCHAs are widely employed for distinguishing humans from automated bots online. However, current vision based CAPTCHAs face escalating security risks: traditional attacks continue to bypass many deployed CAPTCHA schemes, and recent breakthroughs in AI, particularly large scale vision models, enable machine solvers to significantly outperform humans on many CAPTCHA tasks, undermining their original design assumptions. To address these issues, we introduce NGCAPTCHA, a Next Generation CAPTCHA framework that integrates a lightweight client side proof of work (PoW) mechanism with an AI resistant visual recognition challenge. In NGCAPTCHA, a browser must first complete a small hash based PoW before any challenge is displayed, throttling large scale automated attempts by increasing their computational cost. Once the PoW is solved, the user is presented with a human friendly yet model resistant image selection task that exploits perceptual cues current vision systems still struggle with. This hybrid design combines computational friction with AI robust visual discrimination, substantially raising the barrier for automated bots while keeping the verification process fast and effortless for legitimate users.