[Paper Review] Deep-CAPTCHA: a deep learning based CAPTCHA solver for vulnerability assessment

Zahra Noury, Mahdi Rezaei|arXiv (Cornell University)|Jun 15, 2020

User Authentication and Security Systems5 citations

TL;DR

This paper proposes Deep-CAPTCHA, a custom Convolutional Neural Network (CNN) that achieves 98.94% accuracy in cracking numerical CAPTCHAs and 98.31% for alphanumerical ones by leveraging a dataset of 500,000 synthetic CAPTCHA images. The model uses parallel Softmax layers for multi-character recognition and reveals critical vulnerabilities in existing CAPTCHA generators, enabling improved robustness through adversarial analysis.

ABSTRACT

CAPTCHA is a human-centred test to distinguish a human operator from bots, attacking programs, or other computerised agents that tries to imitate human intelligence. In this research, we investigate a way to crack visual CAPTCHA tests by an automated deep learning based solution. The goal of this research is to investigate the weaknesses and vulnerabilities of the CAPTCHA generator systems; hence, developing more robust CAPTCHAs, without taking the risks of manual try and fail efforts. We develop a Convolutional Neural Network called Deep-CAPTCHA to achieve this goal. The proposed platform is able to investigate both numerical and alphanumerical CAPTCHAs. To train and develop an efficient model, we have generated a dataset of 500,000 CAPTCHAs to train our model. In this paper, we present our customised deep neural network model, we review the research gaps, the existing challenges, and the solutions to cope with the issues. Our network's cracking accuracy leads to a high rate of 98.94% and 98.31% for the numerical and the alpha-numerical test datasets, respectively. That means more works is required to develop robust CAPTCHAs, to be non-crackable against automated artificial agents. As the outcome of this research, we identify some efficient techniques to improve the security of the CAPTCHAs, based on the performance analysis conducted on the Deep-CAPTCHA model.

Motivation & Objective

• To identify and analyze vulnerabilities in visual CAPTCHA systems using automated deep learning-based cracking.
• To develop a robust, scalable deep learning model capable of recognizing both numerical and alphanumerical CAPTCHAs under realistic distortions.
• To generate a large-scale, diverse dataset of 500,000 synthetic CAPTCHAs to train and evaluate the model effectively.
• To improve the security of CAPTCHA generation by identifying design flaws that make them susceptible to AI-based attacks.
• To provide actionable insights for designing more resilient CAPTCHAs resistant to automated adversarial agents.

Proposed method

• A custom deep CNN architecture was designed with parallel Softmax layers for multi-character output prediction, improving accuracy over single-output models.
• The model was trained on a synthetic dataset of 500,000 CAPTCHA images generated using controlled distortions, including noise, rotation, and font variations.
• Image preprocessing included normalization and augmentation to enhance generalization across diverse CAPTCHA styles.
• The network architecture was optimized using batch normalization and ReLU activation functions to accelerate convergence and improve training stability.
• The model was evaluated on both numerical (5-digit) and alphanumerical (mixed letters and digits) CAPTCHA types, with separate accuracy metrics per category.
• Ablation studies compared performance with Sigmoid-only output layers, demonstrating the superiority of parallel Softmax for multi-character recognition.

Experimental results

Research questions

• RQ1 How effective is a custom CNN architecture in cracking modern visual CAPTCHAs with complex distortions?
• RQ2 What level of accuracy can be achieved by a deep learning model trained on a large synthetic dataset of CAPTCHAs?
• RQ3 How do parallel Softmax layers improve multi-character recognition in CAPTCHA solving compared to single-output approaches?
• RQ4 What are the key vulnerabilities in current CAPTCHA generation systems that make them susceptible to automated deep learning attacks?
• RQ5 To what extent can the proposed model generalize to CAPTCHAs with variable character length and complex character sets?

Key findings

• The proposed Deep-CAPTCHA model achieved a test accuracy of 98.94% on numerical CAPTCHA images, significantly outperforming previous SOTA methods on comparable benchmarks.
• For alphanumerical CAPTCHAs, the model achieved 98.31% accuracy, demonstrating strong generalization across mixed character sets.
• The use of parallel Softmax layers improved recognition performance by over 8% compared to a baseline model using only Sigmoid activation for multi-character output.
• The model's high accuracy on a large-scale synthetic dataset (500,000 samples) indicates strong generalization, even when tested on unseen distortions.
• Despite high performance, the model struggled with CAPTCHAs containing ambiguous characters (e.g., '0' vs 'O', 'l' vs 'I'), highlighting a persistent design flaw in CAPTCHA generators.
• The study reveals that current CAPTCHA systems remain vulnerable to deep learning-based attacks, necessitating more robust design principles to resist automated cracking engines.