Explainers

Adversarial AI,

CAPTCHAs people can read and bots can't

1. A smarter wrong answer

Random target 4.81 steps
A class it already confuses 2.85 steps

2. Noise only where it counts

Classic gradient attack 67.7
Our precise method 47.2
Left: steps an attack needs before EfficientNet-B7 sees the wrong class. Right: total noise (L2 distance) added to fool EfficientNet-B4. Shorter is better in both: a cleaner image for people that still fools the bot. From our AAMAS 2026 paper.

Image CAPTCHAs (“select every picture with a bus”) were meant to be easy for people and hard for machines. Modern image classifiers changed that. One defence is the adversarial CAPTCHA: add carefully computed noise that a person barely notices but that makes the classifier see something else. Earlier methods paid for this with visible noise that annoys people, and some of it could be removed by a simple image filter.

Our work with Meir Litman improves both halves. First, a smarter target: instead of pushing the bot toward a random wrong class, we push it toward a class it already confuses with the right one, chosen from how models actually mix up classes or from the image’s own ranked predictions. Reaching that target takes fewer steps, about 41% fewer for EfficientNet-B7 in one setting.

Second, precise noise: a version of the classic gradient attack that weighs each pixel by how much it matters, plus a step that spreads the noise so a median filter cannot simply wipe it out. Across six image models, from MobileNet to a Vision Transformer, the result needs 20–40% less noise.