Why are captcha so complicated

Proving that you are not a robot is becoming increasingly difficult.

At some point last year, the constant demands from Google to prove that I am a man, began to seem more and more aggressive. More and more often, for a simple and a little too cute button “I am not a robot,” demands to prove it began to appear - by selecting all traffic lights, transitions or showcases in the grid of images. Soon the traffic lights began to hide in the foliage, the transitions were distorted and go around the corner, and the store signs became blurred and switched to Korean. There is something very disappointing in the unsuccessful attempts to find a fire hydrant in the image.

These tests are called CAPTCHA - an acronym for "a fully automatic public Turing test designed to distinguish between people and computers," and once they have reached a similar level of illegibility. In the early 2000s, simple images with text were enough to stop most spam bots. Ten years later, and after Google bought the program from researchers at Carnegie Mellon University and used it to digitize in the Google Books project, the texts had to be distorted and hidden more and more to overtake the improved OCR software - the very programs who helped to improve the very people who had to solve all these captcha.

Since CAPTCHA is an elegant tool for training AI, any invented test can last only for a while, which is also recognized by its inventors. With all these researchers, scammers, and ordinary people solving billions of problems on the verge of what is possible for AI, at some point the machines simply had to overtake us. In 2014, Google strained its best algorithm for guessing the most distorted texts and people: the computer correctly recognized the text in 99.8% of cases, and people were only 33% .

After that, Google switched to NoCaptcha ReCaptcha, watching the behavior of people and collecting their data, which allows some of them to go further just by clicking on the “I'm not a robot” button, and to others it gives out tasks to search for images, which we are seeing today. But cars overtake us again. All these sheds, which may or may not be shop windows, are the final stage of the arms race of people and machines.

Jason Polakis, a computer science professor at the University of Illinois at Chicago, is personally responsible for the recent complication of captcha. In 2016, he published a paper in which he used off-the-shelf image recognition programs, including Google’s own image search, to solve captchas with an accuracy of 70%. Other researchers coped with the recognition of audio captcha from Google with the help of speech recognition software from the company itself.

Machine learning is no worse than people coping with the recognition of simple texts, images and voices, says Polakis. Algorithms may even do it better: “We have reached the moment when the complexity of tasks for software leads to the fact that tasks become too complex for people. We need an alternative, but there is no clear plan yet. ”

The literature on captcha is full of false starts and strange attempts to find something other than text and images, which all people do well and machines do poorly. The researchers tried to offer users to sort the images of people by expression, gender and ethnicity (you can imagine how it went). There were proposals to organize captchas with quizzes, captchas based on lullabiescommon in places where the user is supposed to have grown. Such culturally linked captchas are aimed not only at robots, but also at people from other countries who decide captchas for pennies. People tried to drive the image recognition algorithms to a dead end, prompting the user to identify, for example, a pig, but at the same time drawn in sunglasses. Researchers studied options such as inviting users to recognize objects in a kaleidoscope mix . In one of the interesting options in 2010, researchers suggested using captcha for sorting ancient petroglyphs - computers do not cope well with recognizing sketches or images of deer on the walls of caves.

Recently there have been attempts to develop game captchaswhere the user needs to rotate objects at certain angles or move puzzle pieces, with instructions for solving the captcha not given as text, but as symbols, or implied by the context of the playing field. Hope that people will understand the logic of the riddle, and computers without clear instructions will stumble. Other researchers tried to use the fact that people have bodies, and used camera devices or augmented reality to interactively confirm the presence of a person.

With many of these tests, the problem is not that the robots are too smart, but that people do not cope well with them. And the thing is not that people are stupid; they just vary greatly in language, culture and experience. Having got rid of all this, in order to make a test that anyone can pass without training and much deliberation, we are left with such rude tasks as image recognition - and this is exactly what specially AI specifically handles for this.

“Tests are limited to human capabilities,” says Polakis. - It's not just about physical abilities - you need to find something intercultural, interlingual. We need a task that works well with a person from Greece, a person from Chicago, a person from South Africa, Iran and Australia at the same time. And it should not depend on cultural nuances and differences. We need a task that the average person copes well with, it should not be limited to a certain subgroup of people, and it should be difficult for a computer. All this greatly limits the choice of options. And it must also be something that people cope with quickly, and that is not very annoying. ”

Attempts to solve these puzzles with blurry pictures quickly transfer a person to philosophical rails: is there any universal human quality that can be demonstrated to the machine and which the machine cannot imitate? What does it mean to be human?

Maybe our humanity is measured not by how we perform tasks, but by how we behave when we move through the world — or, in this case, through the Internet. Game captchas, video caps, any caps that you can think of will eventually be hacked, says Shuman Ghosemajumder, who was involved in Google in the fight against automated clicks, and then became the technology director of the robot recognition company Shape Security. He is leaning towards "permanent authorization" instead of individual tests - to monitor the user's behavior and search for signs of automation. “A real person does not control motor skills very well and cannot move the mouse in the same way many times during several interactions, even if he tries to do this,” says Gosmahumder. The robot will interact with the page,

Google’s own captcha team works in a similar direction. Latest version of reCaptcha v3, the output of which was announced at the end of last year, uses “adaptive risk analysis” to assess traffic for suspicion; Site owners may suggest tasks to suspicious users, such as entering a password or two-factor authentication. Google does not report what factors are taken into account in the assessments, except that the company assesses how good traffic looks on the site and uses this information to filter out the bad traffic, according to Cy Khormaee, product manager from the team Captcha Security researchers say this is probably a mixture of cookies, browser attributes, traffic patterns, and other factors. One drawback of the new robot recognition model is that navigating the web while trying to minimize user observations can be a bit annoying because things like

Aaron Malenfant, lead engineer of the CAPTCHA team at Google, says that a shift away from Turing tests should help to bypass the competition that people lose all the time. "The more we invest in machine learning, the more difficult these tasks will be for people, and, in particular, that is why we launched CAPTCHA V3 - to get ahead of this curve." Malenfant says that in 5-10 years the tasks in the captcha will not make sense at all. Most of the web will depend on the constant hidden Turing test running on the background.

In his book, The Most Humane Man, Brian Christian [Brian Christian] takes part in the Turing test as a decoy duck and realizes that it is very difficult to prove one’s humanity in conversations. On the other hand, the developers of the bots found that these tests are easy to pass without pretending to be an eloquent or intellectual interlocutor, but answering questions with illogical jokes, making typos, or, as in the case of the bot that won the Turing competition in 2014, declaring that you are a 13-year-old Ukrainian boy who speaks little English. After all, it is human to err. It is possible that such a future awaits the captcha, the most common Turing test in the world - the new arms race will not create robots that surpass people in image sorting and text parsing, but robots who make mistakes that miss tabs that distract and switch tabs. “I think the people are beginning to understand that there are areas of use for simulating the average human user ... or stupid people,” says Gosmahumder.

Captchas can be preserved in this world. Amazon registered a patent in 2017on a scheme that uses optical illusions and logical puzzles that are hard for people to cope with. This test is called “the Turing test through an error,” and the only way to pass it is to give the wrong answer.