Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

ThermoCAPTCHA: Privacy-Preserving Human Verification with Farm-Resistant Traceable Tokens

Shovon Paul, Md Imran Hossen, Xiali Hei

TL;DR

ThermoCAPTCHA is presented, a novel privacy-preserving human verification system that uses real-time thermal imaging to detect live human presence without requiring users to solve challenges and improves accuracy, faster completion times, and higher perceived usability compared to reCAPTCHA v2.

Abstract

CAPTCHAs remain a critical defense against automated abuse, yet modern systems suffer from well-known limitations in usability, accessibility, and resistance to increasingly capable bots and low-cost CAPTCHA farms. Behavioral and puzzle-based mechanisms often impose cognitive burdens, collect extensive interaction data, or permit outsourcing to human solvers. In this paper, we present ThermoCAPTCHA, a novel privacy-preserving human verification system that uses real-time thermal imaging to detect live human presence without requiring users to solve challenges. A lightweight YOLOv4-tiny model identifies human heat signatures from a single thermal capture, while cryptographically bound traceable tokens prevent forwarding attacks by CAPTCHA farm workers. Our prototype achieves 96.70% detection accuracy with a 73.60 ms verification latency on a low-powered server. Comprehensive security evaluation, including MITM manipulation, spoofing attempts, adversarial perturbations, and misuse scenarios, shows that ThermoCAPTCHA withstands threats that commonly defeat behavioral CAPTCHAs. A user study with 50 participants, including visually challenged users, demonstrates improved accuracy, faster completion times, and higher perceived usability compared to reCAPTCHA v2.

ThermoCAPTCHA: Privacy-Preserving Human Verification with Farm-Resistant Traceable Tokens

TL;DR

ThermoCAPTCHA is presented, a novel privacy-preserving human verification system that uses real-time thermal imaging to detect live human presence without requiring users to solve challenges and improves accuracy, faster completion times, and higher perceived usability compared to reCAPTCHA v2.

Abstract

CAPTCHAs remain a critical defense against automated abuse, yet modern systems suffer from well-known limitations in usability, accessibility, and resistance to increasingly capable bots and low-cost CAPTCHA farms. Behavioral and puzzle-based mechanisms often impose cognitive burdens, collect extensive interaction data, or permit outsourcing to human solvers. In this paper, we present ThermoCAPTCHA, a novel privacy-preserving human verification system that uses real-time thermal imaging to detect live human presence without requiring users to solve challenges. A lightweight YOLOv4-tiny model identifies human heat signatures from a single thermal capture, while cryptographically bound traceable tokens prevent forwarding attacks by CAPTCHA farm workers. Our prototype achieves 96.70% detection accuracy with a 73.60 ms verification latency on a low-powered server. Comprehensive security evaluation, including MITM manipulation, spoofing attempts, adversarial perturbations, and misuse scenarios, shows that ThermoCAPTCHA withstands threats that commonly defeat behavioral CAPTCHAs. A user study with 50 participants, including visually challenged users, demonstrates improved accuracy, faster completion times, and higher perceived usability compared to reCAPTCHA v2.
Paper Structure (73 sections, 7 equations, 11 figures, 12 tables)

This paper contains 73 sections, 7 equations, 11 figures, 12 tables.

Table of Contents

  1. Introduction
  2. Modern CAPTCHAs
  3. Puzzle-based CAPTCHAs.
  4. Puzzle-less CAPTCHAs.
  5. Modern CAPTCHA Workflow
  6. CAPTCHA Farms
  7. Threat Model
  8. Client-Side Script Integrity and Webcam Access.
  9. Server-Side Security.
  10. Website--CAPTCHA Server Synchronization.
  11. User Privacy Requirements.
  12. ThermoCAPTCHA System
  13. System Design
  14. Thermal imaging as a privacy-preserving signal.
  15. Digital signatures on thermal captures.
  16. ...and 58 more sections

Figures (11)

  • Figure 1: High-level workflow of a modern CAPTCHA nguyen2024c.
  • Figure 2: ThermoCAPTCHA system overview.
  • Figure 3: Workflow of the ThermoCAPTCHA system.
  • Figure 4: Thermal samples collected under diverse background conditions, including distant subjects, direct sunlight, heat-emitting objects, and extreme body rotation.
  • Figure 5: Printed human image and heated mannequin compared with their thermal counterparts. Neither spoofed input was classified as human.
  • ...and 6 more figures