No Bot Expects the DeepCAPTCHA! Introducing Immutable Adversarial Examples, With Applications to CAPTCHA Generation
No Bot Expects the DeepCAPTCHA! Introducing Immutable Adversarial Examples, With Applications to CAPTCHA Generation
复制标题
DOI：
10.1109/tifs.2017.2718479
复制
发表时间：
2017-06
影响因子：
6.8
通讯作者：
Margarita Osadchy;Julio Hernandez-Castro;S. Gibson;O. Dunkelman;Daniel Pérez-Cabo
中科院分区：
文献类型：
--
作者：
Margarita Osadchy;Julio Hernandez-Castro;S. Gibson;O. Dunkelman;Daniel Pérez-Cabo
深度学习 (DL) 的最新进展可以解决过去被认为非常困难的复杂人工智能问题。虽然这一进展推动了许多领域的发展，但对于区分计算机和人类的全自动公共图灵测试（CAPTCHA）来说，这被认为是个坏消息，因为其安全性取决于某些学习问题的难度。在本文中，我们介绍了 DeepCAPTCHA，这是一种基于对抗性示例的新型安全验证码方案，这是当前深度学习网络的继承局限性。这些对抗性示例是构建的输入，要么从头开始合成，要么通过向正确分类的项目添加称为对抗性噪声的小且特定的扰动来计算，从而导致目标深度学习网络对它们进行错误分类。我们证明，普通的对抗性噪声不足以实现安全的验证码方案，这导致我们引入不可变的对抗性噪声——一种无法消除尝试的对抗性噪声。在本文中，我们实现了一个概念验证系统，其分析表明，与现有的最佳验证码相比，该方案提供了高安全性和良好的可用性。
Recent advances in deep learning (DL) allow for solving complex AI problems that used to be considered very hard. While this progress has advanced many fields, it is considered to be bad news for Completely Automated Public Turing tests to tell Computers and Humans Apart (CAPTCHAs), the security of which rests on the hardness of some learning problems. In this paper, we introduce DeepCAPTCHA, a new and secure CAPTCHA scheme based on adversarial examples, an inherit limitation of the current DL networks. These adversarial examples are constructed inputs, either synthesized from scratch or computed by adding a small and specific perturbation called adversarial noise to correctly classified items, causing the targeted DL network to misclassify them. We show that plain adversarial noise is insufficient to achieve secure CAPTCHA schemes, which leads us to introduce immutable adversarial noise—an adversarial noise that is resistant to removal attempts. In this paper, we implement a proof of concept system, and its analysis shows that the scheme offers high security and good usability compared with the best previously existing CAPTCHAs.