Anyone who has been surfing the web for a while is probably used to clicking through a CAPTCHA grid of street images, identifying everyday objects to prove that they’re a human and not an automated bot. Now, though, new research claims that locally run bots using specially trained image-recognition models can match human-level performance in this style of CAPTCHA, achieving a 100 percent success rate despite being decidedly not human.

ETH Zurich PhD student Andreas Plesner and his colleagues’ new research, available as a pre-print paper, focuses on Google’s ReCAPTCHA v2, which challenges users to identify which street images in a grid contain items like bicycles, crosswalks, mountains, stairs, or traffic lights. Google began phasing that system out years ago in favor of an “invisible” reCAPTCHA v3 that analyzes user interactions rather than offering an explicit challenge.

Despite this, the older reCAPTCHA v2 is still used by millions of websites. And even sites that use the updated reCAPTCHA v3 will sometimes use reCAPTCHA v2 as a fallback when the updated system gives a user a low “human” confidence rating.

  • mosiacmango@lemm.ee
    link
    fedilink
    English
    arrow-up
    95
    arrow-down
    7
    ·
    edit-2
    2 months ago

    This is actually a good sign for self driving. Google was using this data as a training set for Waymo. If AI is accurately identifying vehicles and traffic markings, it should be able to process interactions with them easier.

    • iAmTheTot@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      69
      ·
      2 months ago

      As I understand it, the point of those captchas was never really “bots can’t identify these things” (though you’re right on that it was used to train). They use cursor movement, clicks, and other behaviours while you’re solving it to detect if you are a bot or not.

      • Takumidesh@lemmy.world
        link
        fedilink
        English
        arrow-up
        11
        ·
        edit-2
        2 months ago

        It’s a combination.

        Most captchas goals generally aren’t 100% prevention, it’s to put a workload in front, this makes spamming the site cost money, a bankrolled attempt could just as easily outsource the captchas to real humans.

        • Anivia@feddit.org
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 month ago

          a bankrolled attempt could just as easily outsource the captchas to real humans.

          Exactly. I’ve been using 2captcha for that for over a decade now

      • Mushroomm@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        9
        ·
        2 months ago

        Since I started getting good at yosu and that fishing mini game in farmrpg I’ve been failing more captchas. I wonder if they’re related knowing this

    • grue@lemmy.world
      link
      fedilink
      English
      arrow-up
      31
      arrow-down
      1
      ·
      2 months ago

      The annoying thing is that they held us hostage for our free labor, but the results are proprietary for Google’s benefit only.

      That training data ought to be forced to be made freely available to the public, since we’re the ones who actually created it.

    • crusa187
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      1
      ·
      2 months ago

      Afaik this is precisely what the captcha data was intended for - training AI models. Originally leveraged machine learning. LLMs are a slightly different paradigm but same purpose and results here.

    • Arthur BesseA
      link
      fedilink
      English
      arrow-up
      6
      arrow-down
      6
      ·
      2 months ago

      i hope you’re joking. please, tell me you’re joking?

      • mosiacmango@lemm.ee
        link
        fedilink
        English
        arrow-up
        13
        arrow-down
        1
        ·
        edit-2
        2 months ago

        Its never been confirmed by Google, so I may be wrong. It still tracks that the data harvesting company with a AI self driving car project would use free human labor to identify road hazards.

        • Arthur BesseA
          link
          fedilink
          English
          arrow-up
          4
          arrow-down
          12
          ·
          edit-2
          2 months ago

          I was referring to the “This is actually a good sign for self driving” part of their comment.

          The captcha circumvention arms race has been going on for over two decades, and every new type of captcha has and will continue to be broken as soon as it’s widely deployed enough that someone is motivated to spend the time to.

          So, the notion that an academic paper about breaking the current generation of traffic-related captchas (something which the captcha solving industry has been doing for years with a pretty high success rate already) is “good news” for the autonomous vehicle industry (who has also been able to identify such objects well enough to continue existing and getting more regulatory approval for years now) is…

          fry not sure meme template, no text

          • mosiacmango@lemm.ee
            link
            fedilink
            English
            arrow-up
            15
            ·
            edit-2
            2 months ago

            Not really. I’m not even sure what you’re disagreeing with based on the above comment.

            My point is that if bog standard AI can accurately identify all of the road information from pictures, that is good news for self driving.

            What was once a nearly impossible task for computers is now mundane, and can be used to improve safety/utility for self driving, especially for FOSS projects like comma.ai

  • communism
    link
    fedilink
    English
    arrow-up
    76
    ·
    2 months ago

    And yet I can’t beat the CAPTCHAs because reCAPTCHA doesn’t like VPNs lol

    • Draconic NEO@lemmy.world
      link
      fedilink
      English
      arrow-up
      26
      ·
      2 months ago

      Captcha these days isn’t even really a CAPTCHA in the traditional sense since most of the work it does is based on filtering of IP and browser fingerprinting, with a certain level of gamification because the goal is not just to keep out the people they fight against, but to waste their time, would work great if it didn’t waste normal people’s time, while real bad actors have easy ways to get around it.

    • unconsciousvoidling@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      10
      ·
      2 months ago

      I was going to say I’ve straight up just left whatever website I was trying to access because I was stuck in some endless loop of clicking on street crossings, buses, bikes, and street lights.

  • pixxelkick@lemmy.world
    link
    fedilink
    English
    arrow-up
    44
    arrow-down
    3
    ·
    2 months ago

    Well yeah, I’d hope so, that’s the entire point.

    Catcha’s data collection always was with the intent for training ai on these skills. That’s “the point” of them.

    It’s reasonable to expect that the older version of captchas can now be beaten by modern ai, because they’re often literally trained on that exact data to beat it.

    Captcha effectively is free to use on websites as a tool because the data collection is the “payment”, they then license that data out to people like OpenAI to train with for stuff like image recognition.

    It’s why ai is progressing so fast, captchas are one of humanity’s long term collected data silos that are very full now.

    We are going to have to keep progressing the complexity of catches as it will be the only way to catch modern AIs, and in turn it will collect more data to improve it.

    • MIDItheKID@lemmy.world
      link
      fedilink
      English
      arrow-up
      12
      ·
      2 months ago

      Yeah, my understanding is that these capchas were made to harvest data to use for AI/Autopilot driven cars. That’s why they are always having you identify motorcycles, bycicles, crosswalks, stoplights, busses, etc. It’s all stuff that automatic driving cars have had a hard time identifying.

    • UltraGiGaGigantic
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      1
      ·
      edit-2
      2 months ago

      We are going to have to keep progressing the complexity of catches as it will be the only way to catch modern AIs, and in turn it will collect more data to improve it.

      I wanted to use 4chan alot before I came here, but FUCK that slider capcha. I bailed after the first time I didn’t pass.

  • Blackmist@feddit.uk
    link
    fedilink
    English
    arrow-up
    41
    arrow-down
    1
    ·
    2 months ago

    Aren’t these Captchas designed to get training data for AI models anyway?

    “System does what it was designed to do” doesn’t feel that surprising…

    • aidan@lemmy.world
      link
      fedilink
      English
      arrow-up
      9
      arrow-down
      4
      ·
      2 months ago

      Aren’t these Captchas designed to get training data for AI models anyway?

      Yes and no, the captchas are just meant to be hard for computers to solve but easier for humans. People saw that, and thought that “if we’re making people do this might as well have them do something useful” not meant to be malevolent- and the purpose is still stopping bots, training them is a side-effect.

    • ripcord@lemmy.world
      link
      fedilink
      English
      arrow-up
      24
      ·
      2 months ago

      Or, like, “there’s the bottom 10% of a traffic light in this one. Do I click that box? Ia that supposed to count?”

      • toddestan@lemm.ee
        link
        fedilink
        English
        arrow-up
        8
        ·
        2 months ago

        What they are doing is comparing your answer and seeing if it is consistent with how it has been answered previously. They realize that not everyone is going to give the exact same answer, so as long as you answer it in a way that enough other people have answered it, it should let you in.

        I’ll usually go with the minimum number of clicks that I think will get me through, since I’m lazy and it’ll also at times slow down how fast you can click which is annoying.

        I’ll also answer them wrong if I think it’s a mistake that enough other people will make. “Yes… that RV over there is a bus…”

        • Echo Dot@feddit.uk
          link
          fedilink
          English
          arrow-up
          4
          ·
          2 months ago

          They are also overly US centric.

          One of the questions asks you to click on only the school buses. I had to Google how you tell the difference between a school bus and not a school bus.

          Also is it a crosswalk if it’s at an intersection or is it only a crosswalk if it’s in the middle of a road somewhere?

          The questions either need to be not cultural or they need to be adapted for where they detect the user is coming from, the first option seems easier.

          • AA5B@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            arrow-down
            1
            ·
            2 months ago

            Interesting. Do you not have school buses, or are school buses not distinctly marked? How do kids get to school when it’s beyond walking distance?

            • Echo Dot@feddit.uk
              link
              fedilink
              English
              arrow-up
              2
              arrow-down
              1
              ·
              1 month ago

              They are just buses.

              I guess the British government just assume that school children are smart enough to get on the right bus without them being individually distinct.

              I knew school buses are yellow but I did not realize that they are always yellow. I did not realize that the yellow color meant school. I just assumed that the yellow color was a color busses could be.

              • AA5B@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                1 month ago

                Maybe it’s lack of transit in the us, I don’t know. Almost every public school district I’m familiar with, uses standard yellow school buses to bring kids to and from school. However Boston city schools give the kids an MBTA pass - I don’t know if that differed by age - and I imagine that’s true of other downtown schools where there’s transit

              • TachyonTele@lemm.ee
                link
                fedilink
                English
                arrow-up
                1
                arrow-down
                1
                ·
                edit-2
                1 month ago

                The size of the UK verses the exponentially larger size of the US probably has a lot to do with it.

                And if you knew school busses where yellow… Where’s the problem?

          • TachyonTele@lemm.ee
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            1
            ·
            2 months ago

            School busses and regular busses look completely different. What do those look like in your country?

            • Echo Dot@feddit.uk
              link
              fedilink
              English
              arrow-up
              1
              arrow-down
              1
              ·
              1 month ago

              Well here in, not the United States of America land, we just have busses. I was not aware that busses required a special magic paint job.

              I suppose the paint job prevents school shooters wasting their time.

              • TachyonTele@lemm.ee
                link
                fedilink
                English
                arrow-up
                1
                ·
                1 month ago

                So if your regular bus is shown next to a bus that’s not “just a bus”, and you’re asked which one is a school bus… What would you answer?

              • TachyonTele@lemm.ee
                link
                fedilink
                English
                arrow-up
                1
                ·
                1 month ago

                So if you see a picture that obviously a regular bus, alongside a different bus, what would you infer from that when asked which bus is not the same as “any bus”?

                • Kusimulkku@lemm.ee
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  arrow-down
                  1
                  ·
                  1 month ago

                  How would you know what is a regular bus and what is not a regular bus for a given country?

      • thisNotMyName@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        ·
        2 months ago

        Does the backside of a traffic light even count? What about these strange traffic lights that have more boarder than light?

    • dumbass@leminal.space
      link
      fedilink
      English
      arrow-up
      12
      ·
      2 months ago

      I had one with one of those Motorcycles with the long handles, apparently they aren’t part of the bike, but the dudes foot holding it up is.

      • Echo Dot@feddit.uk
        link
        fedilink
        English
        arrow-up
        2
        ·
        2 months ago

        I think the reason AI are better than humans is that the AI is just as stupid as the image classifier.

    • Excrubulent@slrpnk.net
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 month ago

      If you’re using a personal api from google, is that a way that google can track you? Part of using a VPN, noscript and adblock for me is to prevent that kind of tracking.

      • tarius
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        1 month ago

        Nothing is truly free with Google. So ya, most likely they are tracking. If you dont want to use Google, there are other options on their wiki

        https://github.com/dessant/buster/wiki

        If not, you can use a dummy account just for this.

  • superkret@feddit.org
    link
    fedilink
    English
    arrow-up
    29
    arrow-down
    2
    ·
    edit-2
    2 months ago

    Wait, so if a visitor fails the v3 Captcha, v2 is used as a fallback?
    That makes absolutely no sense.

  • Yer Ma@lemm.ee
    link
    fedilink
    English
    arrow-up
    23
    ·
    2 months ago

    But, I cannot pass those 50% of the time… what does that mean?

  • GoofSchmoofer@lemmy.world
    link
    fedilink
    English
    arrow-up
    19
    arrow-down
    1
    ·
    2 months ago

    I can see a future where the Internet is completely run by bots and AI to the point where no human actually uses the Internet anymore.

    It’s like an island that gets overrun with rats - there are just too many to deal with so you leave.

    • SynopsisTantilize@lemm.ee
      link
      fedilink
      English
      arrow-up
      6
      ·
      2 months ago

      I’m already doing that now. If Lemmy starts showing signs of fuckery I’m out. I’ll switch back to magazines.

      • nexusband@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        ·
        2 months ago

        I already did… There’s some subscription stuff where you can read pretty much all available magazines and papers, it’s been a long time since I’ve been reading that much “news” and reports

    • yamanii@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 month ago

      Basically Cyberpunk, people only interact with the night city intranet because the global internet has been taken over by AIs.

    • nikaaa@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 month ago

      Yeah, I predict that in the future, you can’t expect that content on the internet is written by humans. If you go to the internet, then it will probably not be to connect to other humans. Maybe you want to know something that a bot can tell you or you have some administrative task to fulfill, like filing a form.

    • sin_free_for_00_days@sopuli.xyz
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 month ago

      It seems like every other captcha I get has a picture of a moped and asks to click for a motorcycle. When I don’t click on the moped it says I’m wrong. Pisses me off.

        • Lost_My_Mind@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          2 months ago

          leaves plastic banana under your bed

          You’ll find that, months from now, and you won’t know where it came from, or why it’s there.

    • geneva_convenience
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      1
      ·
      2 months ago

      Bots are answering them wrong. Google takes the most submitted answer as truth.

    • seaQueue@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      arrow-down
      1
      ·
      2 months ago

      Greetings fellow human!

      01001000 01101111 01110111 00100000 01100100 01101111 00100000 01111001 01101111 01110101 00100000 01100100 01101111 00111111

  • TommySoda@lemmy.world
    link
    fedilink
    English
    arrow-up
    13
    ·
    2 months ago

    I mean, we literally train them by completing the CAPTCHAs. Why do you think you were picking things like bikes, traffic lights, cars, and busses? The only question now is what’s next…

  • madjo@feddit.nl
    link
    fedilink
    English
    arrow-up
    12
    ·
    edit-2
    1 month ago

    Meanwhile I sometimes fail those. I have been locked out of applications because I missed a square of a bus, or perhaps because I like to be efficient in my mouse cursor movements. I ducking hate CAPTCHAs.