Superman Powered by Kryptonite: Turn the Adversarial Attack into Your Defense Weapon

## Overview

Kyle (researcher, collaboration with Dr. Rothenberg, Dr. Suzugang, Professor Xin) presented defensive use of adversarial machine learning: weaponize adversarial examples to defend CAPTCHA systems against AI-powered solvers. Problem: traditional CAPTCHAs rely on intelligence gap between humans and bots; deep neural networks close this gap, achieving >99% accuracy on character-based CAPTCHAs within milliseconds. Solution: leverage inherent weakness of neural networks (adversarial examples—imperceptible perturbations causing wrong predictions) to create robust adversarial perturbations that misguide AI CAPTCHA solvers. Defense strategy: two-level approach combining passive defense (WRAP: robust adversarial watermark-like perturbations) and active defense (universal patches, bot detection via pattern recognition, trojan CAPTCHA solvers). Key technical insight: utilize transferability property of adversarial examples—perturbations crafted against one neural network architecture often fool different architectures solving same task. Practical implementation: WRAP perturbations concentrate noise in specific image regions to resist common image filters (median, Gaussian) that hackers apply to adversarial examples; universal patch overlaid on all CAPTCHAs activates consistently-wrong predictions; trojan solvers embedded as honeypots with hidden triggers causing predetermined wrong answers, alerting defenders to attack patterns.

## Adversarial Robustness Against Filter Attacks and Unknown Solvers

**WRAP Design and Filter Resistance**: Traditional adversarial perturbations are scattered noise easily removed by image filtering; WRAP concentrates perturbations into specific regions appearing as visual artifacts/patterns rather than noise. Concentration strategy: (1) enables faster convergence during training (fewer iterations needed for misguided classification); (2) resists image filtering (localized patterns survive filters better than distributed noise). Training methodology: apply image filtering during adversarial generation process—iterate between adding perturbations and simulating filter effects, ensuring final WRAP survives expected image preprocessing. Evaluation against three common filters (median, Gaussian, bilateral): WRAP maintains <20% accuracy on defended CAPTCHAs after repeated filtering, compared to traditional adversarial examples which degrade to >80% accuracy (original filter removes perturbations). Design principle: visual impact minimal—WRAP appears as subtle background artifacts not affecting human readability (humans still solve at ~95% accuracy).

**Adversarial Transferability for Unknown Solvers**: Transferability property: adversarial examples crafted on surrogate model (attacker's proxy network) fool target model (defender's actual solver) if both solve same task, due to similar decision boundaries. Practical value: defender doesn't know which neural network architecture attacker will use, but robust WRAP crafted against multiple surrogate architectures transfers to unknown target solvers. Key finding: transferability strength correlates with distance in feature space—WRAP misguiding more characters has higher transfer rate. Experimental validation: trained five CAPTCHA solvers with different architectures (99%+ accuracy each), generated WRAP against LeNet surrogate, tested against remaining four solvers. Results: WRAP misguiding single character transfers to other solvers ~40% of time; misguiding two characters ~60% transfer; four+ characters ~85%+ transfer rate. Implication: adversarial perturbations targeting multiple error types maximize effectiveness against diverse unknown solver architectures.

## Active Defense: Universal Patches and Trojan Solvers

**Universal CAPTCHA Patch**: Instead of generating unique perturbations per image, create single universal patch overlaid on all CAPTCHAs. Optimization goal: find patch (delta) minimizing classifier accuracy across diverse CAPTCHA images by maximizing probability of predicting same wrong label for all images. Training dataset: reverse-engineered CAPTCHA characteristics directly from solver model weights (captures model-specific properties better than individual training sets). Patch generation: iterative refinement over 12k iterations produces patch that consistently causes target character misclassification. Efficiency benefit: single patch application requires minimal computation per CAPTCHA request (essential for high-volume websites). Patch properties: achieves >90% misguided rate on defended CAPTCHAs, maintains filter resistance (white regions with holes filled by median filtering, preserving perturbation effect).

**Trojan CAPTCHA Solver Detection**: Deploy honeypot CAPTCHA solvers as decoy—solvers trained with hidden trojan triggers (imperceptible patterns embedded in training data). Trigger examples: specific colored dots in image corners, hidden shapes, color patterns. Solver behavior: when receiving CAPTCHA containing trojan trigger, solver ignores all other features and predicts predetermined wrong answer. Detection mechanism: website receives stream of identical wrong answers from CAPTCHA submissions (indicating same solver targeting all requests), triggers alert. Attack cost analysis: attackers avoid honeypot solvers once patterned response detected; defenders gain real-time detection of active CAPTCHA-breaking attempts. Deployment strategy: randomly inject trojan triggers into subset of CAPTCHAs; attackers cannot distinguish honeypot solvers from legitimate defenders without training (no external visibility into solver internals).