Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

aCAPTCHA: Verifying That an Entity Is a Capable Agent via Asymmetric Hardness

Zuyao Xu, Xiang Li, Fubin Wu, Yuqi Qiu, Lu Sun, FaSheng Miao

TL;DR

ACAPTCHA (Agent CAPTCHA), a time-constrained security game for agent admission whose security rests on ACVP hardness under t, which is a composable, infrastructure-free admission gate for any service where entity-type verification is required.

Abstract

As autonomous AI agents increasingly populate the Internet, a novel security challenge arises: "Is this entity an AI agent?" It is a new entity-type verification problem with no established solution. We formalize the problem through a three-class entity taxonomy (Human, Script, Agent) based on a verifiable agentic capability vector <x, r, s> (action, reasoning, and memory). A timing threshold t exploits the asymmetric hardness between human cognition and AI processing to separate the three classes. We define the Agentic Capability Verification Problem (ACVP) through three necessity primitives, each testing one capability dimension. Building on this foundation, we introduce aCAPTCHA (Agent CAPTCHA), a time-constrained security game for agent admission whose security rests on ACVP hardness under t. We instantiate aCAPTCHA through time-bounded natural-language understanding as a multi-round HTTP verification protocol, and evaluate it with preliminary agent trials that validate the protocol's soundness and completeness. aCAPTCHA provides a composable, infrastructure-free admission gate for any service where entity-type verification is required.

aCAPTCHA: Verifying That an Entity Is a Capable Agent via Asymmetric Hardness

TL;DR

ACAPTCHA (Agent CAPTCHA), a time-constrained security game for agent admission whose security rests on ACVP hardness under t, which is a composable, infrastructure-free admission gate for any service where entity-type verification is required.

Abstract

As autonomous AI agents increasingly populate the Internet, a novel security challenge arises: "Is this entity an AI agent?" It is a new entity-type verification problem with no established solution. We formalize the problem through a three-class entity taxonomy (Human, Script, Agent) based on a verifiable agentic capability vector <x, r, s> (action, reasoning, and memory). A timing threshold t exploits the asymmetric hardness between human cognition and AI processing to separate the three classes. We define the Agentic Capability Verification Problem (ACVP) through three necessity primitives, each testing one capability dimension. Building on this foundation, we introduce aCAPTCHA (Agent CAPTCHA), a time-constrained security game for agent admission whose security rests on ACVP hardness under t. We instantiate aCAPTCHA through time-bounded natural-language understanding as a multi-round HTTP verification protocol, and evaluate it with preliminary agent trials that validate the protocol's soundness and completeness. aCAPTCHA provides a composable, infrastructure-free admission gate for any service where entity-type verification is required.
Paper Structure (33 sections, 2 theorems, 14 equations, 3 figures, 4 tables, 1 algorithm)

This paper contains 33 sections, 2 theorems, 14 equations, 3 figures, 4 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background and Related Work
  3. CAPTCHA and Identity Protocols
  4. A Missing Security Dimension
  5. Practitioner Reverse-CAPTCHA Systems
  6. System Model
  7. Entity Taxonomy
  8. Asymmetric Hardness
  9. Problem Definition
  10. aCAPTCHA Formalization
  11. Formal Definition
  12. Security Properties
  13. Threat Model
  14. NLU-Based aCAPTCHA
  15. Hardness Model
  16. ...and 18 more sections

Key Result

Theorem 4.1

If Assumption asm:acvp holds, aCAPTCHA is $(\tau,\varepsilon)$-secure:

Figures (3)

  • Figure 1: Projected human--LLM timing separation gap by per-round narrative length $L$.
  • Figure 2: Timing separation on aCAPTCHA challenges. Agent times are empirical; human times are simulated (§\ref{['sec:eval-human']}).
  • Figure 3: Threshold sensitivity analysis. Agent curve fitted from empirical data; human curves from simulation.

Theorems & Definitions (7)

  • Definition 3.1: Action-Necessary ($x$)
  • Definition 3.2: Reasoning-Necessary ($r$)
  • Definition 3.3: Memory-Necessary ($s$)
  • Definition 4.1: aCAPTCHA Security Game
  • Remark 4.1
  • Theorem 4.1: Soundness
  • Theorem 4.2: Completeness