arXiv CSopen access

A Usable and Secure Bengali CAPTCHA

A Usable and Secure Bengali CAPTCHA MD NEYAMUL ISLAM SHIBBIR∗ , The University of Texas at El Paso, USA MD HASIBUR RAHMAN∗ , Shahjalal University of Science and Technology, Bangladesh FARIDA CHOWDHURY, BRAC University, Bangladesh MD SADEK FERDOUS, BRAC University, Bangladesh Text-based CAPTCHAs (Completely Automated Public Turing test to tell Computers and Humans Apart) have traditionally been a

arXiv:2606.29077v1 [cs.CR] 27 Jun 2026

simple, affordable, lightweight, yet very effective security mechanism to distinguish human users from automated bots on the web, serving as a preventive measure against many cyberattacks. However, the dependence on the English script creates usability issues for non-native speakers, limiting accessibility for regional communities where English is not widely understood. In this work, we have proposed and implemented a text CAPTCHA mechanism with 6 variants on the Bengali language, designed specifically for native Bengali-speaking users, which is the first of its kind to the best of our knowledge. Our proposed Bengali CAPTCHA exhibits robust security against automated OCR-based attacks, limited to only 0–20% average character recognition rate across 6,000 challenges (1,000 per variant approx.). Furthermore, our design demonstrates high human usability, evaluated with 110 participants, achieving success rates of 56.25% to 90.29% and average response times of 6.69 to 9.9 seconds across all six variants, thereby standing out among text-based CAPTCHA benchmarks. CCS Concepts: • Security and privacy → Web application security; Usability in security and privacy. Additional Key Words and Phrases: CAPTCHA, Bengali CAPTCHA, CAPTCHA Security, CAPTCHA Usability, Image Processing

1 Introduction The Human Interaction Proofs (HIP) is often regarded as the most widespread security defense mechanism against automated bots, providing reliable assurance that the a client accessing remote services is a human being rather than bot mimicking human behavior [16, 22]. Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) [67] is one type of HIPs that tests agents by providing problems which are easily solvable by humans, but will be very difficult to solve for bots. CAPTCHA tests are considered valid and successful if the tests can be solved by humans with a success rate over 90% and the success rate of automated software or bots less than 0.1% [18]. CAPTCHA plays a decisive role in websites nowadays. Nevertheless, it also comes with various security concerns. Most existing CAPTCHA systems are primarily available in English, which limits accessibility for users from regional communities with limited proficiency in English. To address this gap, we propose a secure and usable Bengali CAPTCHA designed for regional websites targeting Bengali speakers. The proposed Bengali CAPTCHA is intended for Bengali-first digital services where users interact primarily in Bengali script. In such contexts, using a Bengali CAPTCHA can make the verification process more familiar and consistent with the rest of the interface. This is especially relevant for local government portals, educational platforms, banking services, regional e-commerce websites, and other Bengali-oriented online services, where presenting the CAPTCHA in the same language as the surrounding content may improve user convenience and accessibility. The research challenge is not only translating an English ∗

Both authors contributed equally to this research.

Authors’ Contact Information: Md Neyamul Islam Shibbir, [email protected], The University of Texas at El Paso, El Paso, Texas, USA; Md Hasibur Rahman, [email protected], Shahjalal University of Science and Technology, Sylhet, Bangladesh; Farida Chowdhury, farida.chowdhury@ bracu.ac.bd, BRAC University, Dhaka, Bangladesh; Md Sadek Ferdous, [email protected], BRAC University, Dhaka, Bangladesh.

1

2

MNI Shibbir et al.

CAPTCHA into Bengali, but adapting the CAPTCHA design space to the linguistic and technical properties of Bengali script. Bengali contains visually similar characters, vowel diacritics, conjunct forms, and input-method constraints that directly affect both human readability and automated recognition. Therefore, designing a Bengali-native CAPTCHA requires script-aware character selection, exclusion of confusing or difficult-to-render characters, and evaluation of how Bengali-specific visual forms interact with common CAPTCHA distortions. Although this study does not directly measure the failure rate of English CAPTCHAs among Bengali-speaking users, the large Bengali-speaking population and the growing number of Bengali-first digital services motivate the need for localized verification mechanisms. The proposed system therefore provides an initial empirical baseline for Bengali-native CAPTCHA design rather than claiming to replace English CAPTCHAs in all contexts. According to Statista [57], Bengali is the seventh most spoken language in the world with 284.3 million speakers. Furthermore, no prior CAPTCHA system has been developed in Bengali, there is a clear need for such mechanisms. To a certain extent, the use of a regional language introduces a linguistic barrier for automated bots, as breaking such CAPTCHAs requires advanced Bengali OCR capabilities. This approach leverages the current limitations of Bengali OCR systems in accurately recognizing Bengali texts. However, CAPTCHA design inherently involves balancing security and usability, and identifying an optimal trade-off between the two. In this article, we introduce a novel text-based CAPTCHA for Bengali users that achieves both security and usability. Contributions: The major contributions of this article are:

• We have designed and implemented a secure and usable CAPTCHA scheme for Bengali language leveraging appropriate methods and elements of Bengali linguistics and state-of-the-art of image processing tools and techniques. • We have analyzed and tested the security of the implemented CAPTCHA scheme using a recently developed evaluation framework for text-based CAPTCHAs [53]. • We have conducted an IRB-approved usability study with 110 native Bengali speakers and introduced a normativecomparison methodology that ranks CAPTCHA variants against an ideal usability profile using RMSE and correlation. 2 Background CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a widely adopted mechanism designed to distinguish human users from automated bots accessing online services. Introduced in 2000 [18], CAPTCHA systems present tasks that are easily solvable by humans but challenging for computers, typically relying on human cognitive skills such as visual perception and pattern recognition [18, 22]. Originally conceptualized as reverse Turing tests [8, 18], CAPTCHAs automate the process of verification where the computer judges whether the user is human based on their ability to complete specific tasks. Various forms of CAPTCHA have been developed, including text-based, image-based, audio, and game-based types [32, 41, 56, 71]. Text-based CAPTCHAs remain one of the most prevalent due to their intuitive design and ease of automation [25, 71]. However, with rapid advancements in artificial intelligence and computer vision, such CAPTCHAs face increasing threats from sophisticated algorithms capable of bypassing traditional challenges. This has resulted in an ongoing arms race between CAPTCHA developers and attackers, with continued research focusing on enhancing security without compromising user experience [21, 22]. According to [18] there are three important factors to consider while designing a CAPTCHA mechanism:

A Usable and Secure Bengali CAPTCHA

3

• Security: The security element defines the process to protect the CAPTCHA from being attacked, • Usability: The usability element defines the solvability of CAPTCHAs by the human users, • Practicality: Finally, the practicality element defines the feasibility of the mechanism to be implemented on a website. To enhance CAPTCHA security, researchers can incorporate numerous security characteristics, such as deformation, color variation, rotation, blurring, warping, multi-level structure, overlapping characters, and noisy backgrounds, to make them more challenging to crack [53]. For example, text CAPTCHAs typically use distorted words to increase security. However, using certain letters in the English language is discouraged. These letters include 6/G, b/5, S/s, O/0, Z/z, nn/m, w/vv, d/cl and others since they can be difficult for real humans to recognize and separate after being distorted [7, 70]. Even so, typical text CAPTCHAs can easily be broken using OCR (Optical Character Recognition) techniques [29]. Examples of some text CAPTCHAs are Gimpy [42], EZ-Gimpy [34], Baffle Text [10] and Pessimal Print [47].

3 Related Work To the best of our knowledge, there are no Bengali CAPTCHAs at the time of this research. However, linguistic CAPTCHAs are not uncommon in the research field. Kumar et al. [39] broke the existing 20 Hindi Text CAPTCHAs and came up with a more secure and usable Hindi CAPTCHA. In addition, the authors recommended some techniques and features that must be kept in mind while developing a text CAPTCHA in any language. Furthermore, the authors in [36] used specific Arabic font types to develop an Arabic Text CAPTCHA, exploiting the limitations of Arabic OCR techniques. They tested their CAPTCHA against Arabic OCRs but failed to recognize the CAPTCHA text. Lastly, they conducted a user study that showed that their developed CAPTCHA is also user-friendly. Banday et el. [13] reviewed the existing CAPTCHA schemes in Indian regional languages and then proposed a scheme that can generate Hindi, Punjabi, Urdu and English languages CAPTCHAs. Nevertheless, no usability study was conducted on the work. In [28], the authors proposed and developed an Urdu text CAPTCHA. Their proposed system challenges users with single, double, meaningless, and meaningful words having text lengths from 4 to 8. They reported that increasing security features inversely reduces the response time. A CAPTCHA scheme in Malay language is discussed in [69]. The authors suggested employing the Jawi script for CAPTCHA and more especially, the digraphia feature, which combines two characters to represent a single linguistic sound. Trong et al. [64] used a combination of deep learning and cognition on text-based CAPTCHAs. They claim that this process remarkably increases the security of the proposed CAPTCHA scheme. However, they did not provide any usability data or studies to point out how usable the CAPTCHA scheme is to the users. Work on designing a text CAPTCHA that is both secure and usable is still limited. Kaur et al. [35] provided an algorithm to secure text CAPTCHAs, but the usability of the CAPTCHA is not discussed there either. On the other hand, there are some works focusing only on the usability aspects of CAPTCHAs. A three-dimensional framework was developed consisting of Distortion, Content and Presentation of CAPTCHAs to measure the Usability [71]. However, the real user input was not considered in that usability study. User inputs were mostly taken by a set of questionnaires in the design and development of another innovative CAPTCHA [24]. Brodic et al. [19] used advanced statistical analysis named association rule mining to perform usability analysis that points out relevant information for creating new CAPTCHAs.

4

MNI Shibbir et al.

4 Designing a Secure and Usable Bengali CAPTCHA The goal of designing a CAPTCHA is to present challenges that are easily solvable by humans but difficult for automated bots. Among various CAPTCHA types, text-based CAPTCHAs are the simplest and the most widely used on the Internet [25, 43], due to their accessibility, simplicity, effectiveness, and user familiarity [54]. Designing a text-based CAPTCHA requires careful consideration of factors such as character selection, fonts, background patterns, and noise. A critical challenge is maintaining an appropriate balance, as excessive noise reduces human usability, while insufficient complexity increases vulnerability to automated attacks. In the following, we discuss key aspects of designing a secure and usable Bengali CAPTCHA. 4.1

Character Set

The set of characters to be chosen is the key issue while developing a text CAPTCHA. For clarity and implementation considerations, we must pick the right characters from the whole Bengali character set (as presented in Table 1). We have selected 30 characters, based on some important factors discussed below, from the Bengali language and Bengali numbers, as shown in Table 2.

• The Bengali script consists of vowels, vowel diacritics, consonants, consonant conjuncts, diacritical and other symbols, numbers, and punctuation marks (Table 1). There are 47 letters and 10 digits in the Bengali script. The letters are broadly categorized into vowels and consonants. Vowel diacritics are special marks used when a vowel follows a consonant. In such cases, the vowel is not written separately; instead, it is represented as a diacritical mark placed around the consonant—often before or attached to it. Consonant conjuncts (also known as conjunct letters or clusters) are formed when two consonants appear together without a vowel in between. In Bengali, as well as in some other Indic scripts, these combinations are merged into a single, visually distinct character. Conjuncts are very common in Bengali writing and are essential to the script’s structure and pronunciation. Among these characters, those that resemble one another after applying distortion, causing confusion, are excluded. We have shown the confusing and excluded letters in Table 2. • Many keyboards are used to write Bengali texts, some of which accept English letters as input and output Bengali Unicode characters. Others present Bengali Unicode letters on the keyboard, and the user can click these letters to type any Bengali text. Some popular keyboards are the Avro Keyboard [46], Bijoy Bayanno [1], and Ekushey [6]. Most Bengali users prefer the keyboard that lets them type English letters as input and get Bengali letters in the output. However, certain characters are more difficult and lengthy to write in English letters. For example, if we want to type ঞ, ঙ, ঋ, ঔ, ঐ, we need to input these English letters NG, Ng, rri, OU, OI respectively, which is considered difficult and lengthy. Also, the letters (ঔ, ঋ, ঐ, ঊ, ৎ, ◌ং, ◌ঃ, ◌ঁ, ঞ, ঙ, ঈ) are scarcely used by Bengali users in texting, as their frequency is quite low in Bengali online contents [9]. So, we have removed these letters to improve usability. • During the generation of the CAPTCHA texts, we discovered that most of the vowel diacritics do not match the input text in the output text-image (Table 4). Therefore, the user will get an invalid or wrong answer if this CAPTCHA is employed. That is why we have omitted these vowel diacritics from our CAPTCHA texts. • We have also eschewed the use of diphthongs or compound letters since their depiction breaks apart during image transformation (Table 5). Furthermore, we were unable to utilize (`(েরফ), ◌্ (হষন্ত)) as diacritics since they get mixed with other noises.

A Usable and Secure Bengali CAPTCHA

5

Category

Subtype (Count)

Characters

Letters

Consonants-36 Vowels-11

ক, খ, গ, ঘ, ঙ, চ, ছ, জ, ঝ, ঞ, ট, ঠ, ড, ঢ, ণ, ত, থ, দ, ধ, ন, প, ফ, ব, ভ, ম, য, র, ল, শ, ষ, স, হ, ড়, ঢ়, য়, ৎ অ, আ, ই, ঈ, উ, ঊ, ঋ, এ, ঐ, ও, ঔ

Diacritics

Vowel signs-10 Consonant signs-7

◌া, ি◌, ◌ী, ◌ু, ◌ূ, ◌ৃ, ে◌, ৈ◌, ে◌া, ে◌ৗ ◌ং, ◌ঃ, ◌ঁ, ◌্, ◌য্, ◌র্, `

Conjuncts

Examples

ন্ধ, ন্ড, ন্দ, ন্ত, ন্ঠ, দ্দ, ক্ল, ত্ন, ন্তৰ্, গ্ধ, … Table 1. Overview of Bengali script components [5]

Type

Reason / Subtype

Characters

Used

Chosen letters and digits (30)

ক, খ, গ, ঘ, চ, ছ, জ, ঝ, প, ফ, ঠ, ভ, ম, ল, শ, স, হ, ষ, অ, আ, ই, উ, এ, ও, ১, ২, ৫, ৬, ৭, ৯

Excluded

Confusing (Table 3) Rare / hard to type Blends with noise Invalid diacritics (Table 4) Invalid conjuncts (Table 5)

(ত,৩), (র,ব), (ড,ড়), (ঢ়,ঢ,ট), (য,য়), (০,0), (৪,8) ঔ, ঋ, ঐ, ঊ, ৎ, ◌ং, ◌ঃ, ◌ঁ, ঞ, ঙ, ঈ ◌্ (হসন্ত), ` (েরফ) ি◌, ◌ী, ◌ু, ◌ূ, ◌ৃ, ে◌, ৈ◌, ে◌া, ে◌ৗ, ◌র্, ◌য্, ◌া ক্ষ, ঙ্ক, ঙ্গ, জ্ঞ, ঞ্চ, ঞ্ছ, ঞ্জ, ত্ত, ষ্ণ, হ্ম, ণ্ড, …

Table 2. Selected and excluded Bengali characters for CAPTCHA generation

Confusing Letters

Sample 1

Sample 2

(ড, ড়) (ঢ, ঢ়) Table 3. Examples of confusing letters in CAPTCHA

Vowel Diacritics Input Text Transformation in Image "ে◌া"

েগা

"ে◌"

েগল

Table 4. Examples of Image Transformation Problem with Vowel Diacritics

4.2 CAPTCHA Background In our scheme, we have built two CAPTCHA types with six variants, each with a unique combination of security and usability characteristics. We have used five different (BG1, BG2, BG3, BG4, BG5) background images in all six variants (Figure 1). These are:

• BG1 Background is for variant 1 CAPTCHA, a PIL-generated [26] white noise image, and it is static for every CAPTCHA in Variant 1 (Figure 1 (a)).

6

MNI Shibbir et al. Input Text Transformation in Image

Conjuncts "ন" + "দ" = "ন্দ"

মন্দ

"ন" + "ন" = "ন্ন"

অন্ন

Table 5. Examples of Image Transformation Problem with Consonant Conjuncts

• Next, BG2 Background is for variant 2 and variant 3 CAPTCHA, which is based on noisy structures as presented in [65]. Afterwards, we have cropped the image and constructed the CAPTCHA background dynamic, with each CAPTCHA having a different cropped part of the image for each sample of the variant (Figure 2 (a)(b)(c)(d)). • BG3 Background is for variant 4 CAPTCHA, a combination of BG1 and BG2. It is dynamic like BG2 (Figure 1 (c) and Figure 2 (e)(f)(g)). • BG4 (Figure 1 (d)) Background is for variant 5 CAPTCHA, another PIL-generated noisy static image like BG1. • BG5 (Figure 1 (e)) Background is used in variant 6. Similar to BG3, this too is a combination of two different images, the first one, selected based on the noisy structures in it, is blended with BG1. We also applied the same cropping technique in this, making it a dynamic CAPTCHA like BG2 (Figure 2 (i)(j)(k)).

(a) BG1: Variant 1

(b) BG2: Variants 2 & 3

(c) BG3: Variant 4

(d) BG4: Variant 5

(e) BG5: Variant 6 Fig. 1. CAPTCHA Backgrounds.

4.3

Use of Color

The use of color in text-based CAPTCHAs enhances resistance to automated attacks by increasing the difficulty of character segmentation and recognition. Random color variation disrupts color-based thresholding and segmentation

A Usable and Secure Bengali CAPTCHA

7

(a) Image for BG2

(b) Random BG2 cropped part

(c) Random BG2 cropped part

(d) Random BG2 cropped part

(e) Random BG3 cropped part

(f) Random BG3 cropped part

(g) Random BG3 cropped part

(h) Image for BG5

(i) Random BG5 cropped part

(j) Random BG5 cropped part

(k) Random BG5 cropped part

Fig. 2. Random cropping of BG2, BG3, and BG5

techniques commonly used in automated CAPTCHA attacks [38]. At the same time, appropriate color variation can improve human readability, enabling users to solve CAPTCHAs more efficiently. Our approach is discussed below.

• Except for BG5, all other backgrounds were black, white, or silver. Although this may seem weak, maintaining similar background and text colors is a reliable security feature against automated bot attacks [53]. We applied this criterion in BG1, BG4, and BG5, and omitted it in the other variants to maintain diversity. • For variants 2, 3, and 4, we applied high-saturation, eye-catching colors on each character, randomly selected from a palette of RGB values spanning reds, oranges, yellows, greens, blues, purples, and dark tones. We deliberately avoided colors that could blend with the background or noise, as well as pale or low-saturation tones, to maintain human readability while preventing obscured letters [37, 48]. The broad hue spread and per-letter randomization disrupt color-based clustering and segmentation algorithms commonly used by automated CAPTCHA solvers, while high contrast and luminance variability preserve usability, achieving an effective balance between security and legibility [30, 72]. Following is the color list in RGB: (248, 112, 187),

8

MNI Shibbir et al. (74, 80, 171), (137, 83, 5), (237, 88, 78), (1, 85, 20), (71, 215, 108), (222, 46, 60), (25, 67, 222),(113, 88, 74), (220, 31, 243),(140, 15, 5), (168, 16, 42), (250, 70, 7), (115, 90, 30), (115, 90, 30), (16, 9, 22), (19, 4, 155), (101, 93, 3), (67, 10, 103), (247, 133, 20), (49, 81, 224), (139, 208, 9), (134, 1, 39),

4.4

Morphing of Letters

Morphing purposefully warps or distorts the characters in a CAPTCHA such that they are still identifiable to humans but more difficult for computers to decipher. Characters can be stretched, bent, twisted, blurred, or warped as part of morphing, among other changes. With each CAPTCHA, a different modification may be applied; it may be randomized or decided by a particular algorithm. We have applied morphing in variants 1, 2, and 4 (Table 6). Variants 1 and 4 have the same kind of morphing which is stretched, bent, and blurred, however, variant 2 mainly uses warping which we have classified as CAPTCHA rotation and discussed in Section 4.5. Before Morphing

After Morphing

Before Rotation

After Rotation

Table 6. Examples of morphing and rotation transformations of letters in CAPTCHA.

4.5

Rotation

The characters in text CAPTCHAs are are purposefully rotated so that they are still identifiable to humans but more difficult for computers to decipher [17, 18]. Rotation can take many different forms, such as rotating the characters at a certain angle or randomly choosing each characters rotational orientation. With each CAPTCHA, a different modification may be applied; it may be randomized or decided by a particular algorithm. Also, since the letters may appear in unanticipated orientations, the rotation might make it more difficult for attackers to create templates or models for recognizing CAPTCHAs. CAPTCHA Rotation: In CAPTCHA variant 2, we have used CAPTCHA rotation (Figure 3) meaning we have rotated every content in that particular CAPTCHA with the same amount. In this case, it is performed using sine and cosine curves which causes a wave-like rotation of the background. It skews the background and creates some more room. Also, we can allow the newly opened region to be automatically assigned a color, in this case, white. Letter Rotation: In CAPTCHA variant 2, 3, and 5, we have applied letter rotation while pasting that letter on the background. 4.6

Other Noises

Adding noises to text CAPTCHAs is a common technique used to make them more difficult for automated programs to solve. In a noisy CAPTCHA, additional elements are added to the image to make it harder for a computer to accurately segment the characters from the background [17, 18].

A Usable and Secure Bengali CAPTCHA

9

(a) Before CAPTCHA rotation

(b) After CAPTCHA rotation

Fig. 3. Effects of CAPTCHA rotation

To increase the difficulty and effectiveness of CAPTCHAs, we incorporated various types of noise which are discussed below:

• Line noise: The characters are disguised by adding arbitrary curves or lines to the image background. • Dot noise: To add visual clutter, arbitrary dots or speckles are added to the image. • Distortion noise: The characters are slightly distorted or warped, making it harder for a computer to recognize them. • Blurriness: Blurring a text CAPTCHA can make it more difficult for bots. However, the amount of additional security this provides can vary depending on how the blurring is done. Although noise might be useful in preventing automated assaults, it is important to keep the CAPTCHA readable and friendly for human users. Certain users, especially those with visual impairments or cognitive problems, may find it challenging to read the characters when there is too much background noise. Because of this, it is crucial to test CAPTCHAs with a variety of users and ensure that it stays usable by everyone while providing enough protection against automated assaults. Depending on the specific implementation and intended level of difficulty, several types and levels of noise may be employed as discussed next: 4.6.1 Lines. We have used two types of lines in CAPTCHA variants 1, 4, 5, and 6. One is just some general noisy lines around the text, and the other one is called a Hollow scheme, noisy line(s) that go through the text. Line noise was applied only to selected variants to preserve diversity among the six CAPTCHA designs and to evaluate its effect on both security and usability. If all variants contained the same line-based distortion, it would be difficult to isolate the contribution of this feature to recognition difficulty and user performance. 4.6.2 Dotted Like Shape. In CAPTCHA variants 3 and 5, we employed noise in the form of dotted shapes.This noise was applied selectively to avoid excessive visual clutter and to maintain readability across variants. Several rotations of various shapes, including circles, squares, and diamonds, were employed. Then, we reduced their size to that of a dot and randomly scattered about 100 of them over the text image, selecting from a variety of shapes automatically. Figure 4 presents the type of noise adopted in our scheme and their effects on the CAPTCHA image is illustrated in Figure 5.

Fig. 4. Dotted Shape Noises

10

MNI Shibbir et al.

Fig. 5. Dotted shape noise on Background

4.6.3

Blurriness. We applied a filter module from the PIL package named ImageFilter along with the GaussianBlur

method [27] in CAPTCHA variants 2, 3, and 5. We used radius, a standard deviation of the Gaussian kernel, a value ranging from 0.5 to 1.2 (Figure 6a and Figure 6b). We used letter morphing in CAPTCHA variants 1, 4, and 6, which also caused the texts to become blurry, as presented in Figure 6c and Figure 6d.

(a) Before gaussian blur

(b) After gaussian blur

(c) Before morphing blur

(d) After morphing blur

Fig. 6. Different Blurring Effects

4.6.4

Distortion. The distortion or morphing process primarily involves making letters and/or numbers that are dis-

torted, misaligned, or uneven in the text. This is one of the anti-recognition techniques employed to make image processing more difficult. Here, we used letter morphing in CAPTCHA variants 1, 4, and 6, which also caused the texts to become blurry, as presented in Figure 6c and Figure 6d. 5 Developing CAPTCHA Variants We have developed the Bengali CAPTCHA having six variants with different sets of security features as discussed in Section 4. The six variants were developed as an initial exploratory set of Bengali text-CAPTCHA prototypes, not as an exhaustive exploration of all possible designs. We selected six variants to balance design diversity, Bengaliscript rendering constraints, and participant workload, since each participant solved three samples per variant. The variants were grouped into two broad families: CAP_1 variants use rotated characters and Gaussian blur, while CAP_2 variants use letter morphing, morphing-induced blur, and multi-structure text. Therefore, the six variants should be interpreted as representative exploratory prototypes for comparing major Bengali CAPTCHA design choices rather than as a complete coverage of the entire design space. Table 7 lists the security features employed in each variant. In the following, we discus different implementation aspects of our proposed Bengali CAPTCHA. We implemented the Bengali CAPTCHA using the Pillow [26] and OpenCV [3] libraries. and by extending the codebase of an open-source Github repository [40]. We used the implementation structure of the codebase as a starting point rather than coding entirely from the scratch. Then, we extended it to incorporate our security principles, and

A Usable and Secure Bengali CAPTCHA

11

Table 7. Security features employed in different CAPTCHA types and their variants Type

Common Features

Var. Variant Creation V2

CAP_1

No letter morphing; rotated letters; single font; Gaussian blur Letter morphing blur; multi-structure text; multiple fonts

V1 V4

CAP_2

V3 V5

V6

Variants

V1

V2

V3

V4

V5

V6

Example

Dynamic BG2; blur (0.5–0.8); char. rot. (11–30∘ ); CAPTCHA curve rot.; multicolor text Dynamic BG2; blur (0.8–1.2); char. rot. (18–45∘ ); multi-color text; dotted shapes Static BG4; blur (0.5–0.8); char. rot. (18–45∘ ); hollow lines (3–5); fixed color Static BG1; letter morphing; hollow lines (3–5); morphing blur Dynamic BG3; hollow lines (3–5); multi-color text; letter morphing; morphing blur Dynamic BG5; similar BG; text color; hollow lines (3–5); letter morphing; morphing blur

Anti-Preprocess Textured Background, Noisy Background, Same colored Character and Background, Rotation, Distortion Multi-Struct, Warping Textured Background, Random Background, Rotation, Distortion, Multi-Colored Text, Warping Textured Background, Noisy Background, Random Background, Rotation, Distortion, Multi-Colored Text, Warping Textured Background, Noisy Background, Random Background, Rotation, Distortion, Multi-Colored Text, Multi-Struct, Warping Textured Background, Noisy Background, Random Background, Same Colored Character and Background, Rotation, Distortion Warping Textured Background, Noisy Background, Random Background, Same Colored Character and Background, Rotation, Distortion Multi-Struct, Warping

Anti-Segmentation

Anti-Recognition

Vulnerabilities

Background Blurring

Rotation, Distortion, Multi-Struct

Constant Font Binary Background

Background Blurring, Overlapping Chars, Deformation

Rotation, Distortion

Constant Font

Background Blurring, Overlapping Chars, Deformation

Rotation, Distortion

Constant Font

Background Blurring

Rotation, Distortion, Multi-Struct

-

Background Blurring, Overlapping Chars, Deformation

Rotation, Distortion

Constant Font

Background Blurring, Deformation

Rotation, Distortion, Multi-Struct

-

Table 8. Security and vulnerability features of the Bengali CAPTCHAs

Bengali language specific design requirements. We did this way to speed up the implementation with a stable codebase, so we could focus on our proposed new security features. Now, let us elaborate on the implementation procedures in detail.

12

MNI Shibbir et al. (i) Generate a random text string: We used the Python random module to produce a random Bengali text string. (ii) Generate a blank image: For each CAPTCHA, we began by generating a blank image using the Pillow module. The image dimensions were selected to ensure that the entire text string could be accommodated without truncation. Once the base image was created, the characters were rendered onto it, followed by the application of noise, distortions, and other visual effects. (iii) Use a background image: For CAPTCHA variants 1 and 5, we used two static background images, BG1 and BG4 (Figure 1). These images were resized according to the blank image size and applied directly as the background. For the other variants (2, 3, 4, and 6), a random window from the background image was selected each time a CAPTCHA was generated (Figure 2). (iv) Draw the text string: The characters from the randomly generated text string were drawn onto the blank image. The font type and size were adjusted according to the design specifications. (v) Random blur addition to the CAPTCHA: One technique to add random blur to the CAPTCHA is to use a filter from the Python image package Pillow. Random blur was applied using the GaussianBlur method from Python Pillow’s ImageFilter module. The blur radius was randomly selected within the range specified for each variant. (vi) Random distortion addition to the CAPTCHA: We applied several types of distortions based on the following design criteria. (a) Transformation: We added three kinds of transformations to our CAPTCHA: background and line transformation and character morphing (with values ranging approximately from 0.2 to 0.8). (b) Rotation: We rotated the characters in some CAPTCHAs by a random angle between 11 and 45 degrees. Different angle ranges were tested, and this range provided a good balance between security and usability [31]. (vii) Random lines addition to the CAPTCHA: Random lines were added to make it harder for automated programs to detect the characters.

(viii) Use of color: Images are represented in Pillow as a two-dimensional grid of pixels. Each pixel can have a color represented by a tuple of red, green, and blue (RGB) values ranging from 0 to 255. Pillow also supports other color modes, such as grayscale and CMYK. We can adjust brightness, contrast, and color balance to refine the CAPTCHA appearance.

We note that not all security features used in the variants are unique to Bengali script. Features such as blur, rotation, background noise, and color variation are common in text-CAPTCHA design. The Bengali-specific contribution lies in adapting these mechanisms to Bengali script constraints, including character similarity, Bengali input methods, font rendering behavior, exclusion of problematic diacritics and conjuncts, and the usability-security trade-off for Bengalispeaking users.

6 Security Evaluation This section discusses the security aspects of the Bengali CAPTCHA we developed by demonstrating its level of security with the aid of an Evaluation Framework presented in [53].

A Usable and Secure Bengali CAPTCHA

13

6.1 Evaluation Framework In [53], the authors devised an evaluation framework based on two aspects, namely: Security and Vulnerability features. Both security features (anti-preprocessing, anti-segmentation, and anti-classification) and vulnerability features (pre-processing, segmentation, and classification) can be understood across three stages. The preprocessing stage refers to initial image handling, such as noise reduction, binarization, or smoothing, which aims to simplify attacks or resist them. The segmentation stage involves separating characters from the background or from each other, where robust CAPTCHAs seek to make such separation difficult. The classification stage involves the recognition and labeling of characters, typically using machine learning models, where security mechanisms introduce distortions and obfuscations to hinder accurate classification. In this work, we utilized the evaluation framework to assess the security and vulnerability features (Table 8) of the developed Bengali CAPTCHA. Using the evaluation framework, we can predict the security level of the CAPTCHA variations using two equations:

Δ𝐷𝐶𝑖 = ∑(𝑆𝐹𝐶 ) − ∑(𝑉 𝐹𝐶 )

(1)

Δ𝐷𝐶𝑖 ≤ 0 ⎧Vulnerable ⎪ 𝐶𝑖 = Moderately Secure 0 < Δ𝐷𝐶𝑖 ≤ 6 ⎨ ⎪ Δ𝐷𝐶𝑖 > 6 ⎩Secure

(2)

Equation 1 represents the difference (denoted with Δ𝐷 ) between the total number of security features (denoted as

𝑆𝐹 ) and vulnerability features (denoted as 𝑉 𝐹 ) for a particular CAPTCHA 𝐶 belonging to a variation 𝑖. We can divide all text CAPTCHAs into three categories, as shown in Equation 2, based on the numerical differences between security features and vulnerability features. The threshold values of the Vulnerable, Moderately Secure and Secure in Equation 2 are adopted from the work of CAPTCHA evaluation framework [53] used in this study. These thresholds provide a heuristic categorization based on the difference between security and vulnerability features. We acknowledge that this framework-based classification is not a substitute for attack-based validation; therefore, we further evaluated the CAPTCHA variants using reak world attacks. Based on this evaluation, we predicted the security levels of our CAPTCHA. In Table 9, we present the difference between the security and vulnerability features of each of our developed Bengali CAPTCHA variants and the predicted security level associated with it. We can see that all the CAPTCHA variants are predicted as Secure. V

SF

VF

D

SL

V1 V2 V3 V4 V5 V6

11 11 12 12 12 13

2 1 1 0 1 0

9 10 11 12 11 13

Secure Secure Secure Secure Secure Secure

Table 9. Our assumptions on the level of security of Bengali CAPTCHAs based on the Evaluation Framework. Here V = Variants, SF = Security Features, VF = Vulnerability Features, D = Differences, SL = Security Level.

14

MNI Shibbir et al.

6.2

Threat Model

The real world attack in this work considers an automated adversary attempting to solve the proposed Bengali CAPTCHA without human assistance. The adversary is assumed to have access to the CAPTCHA image and may apply standard image-processing operations such as binarization, blurring, erosion, dilation, noise removal, segmentation, OCR, and post-processing. The adversary may also use publicly available or pre-trained Bengali OCR models. The adversary is not assumed to have access to the server-side CAPTCHA solution, the random generation seed, or the internal challenge-generation parameters at runtime. We also do not consider attacks based on compromising the server, stealing session tokens, bypassing the web application logic, or using human CAPTCHA-solving farms. These attacks are important in practice but are outside the scope of a text-recognition-based CAPTCHA evaluation. 6.3

Security Performance

To validate the security of the proposed Text-Based Bengali CAPTCHA against traditional bots, We have generated 1000 samples for our each CAPTCHA variants (6000 in total) and performed attack on them by the configurations of this work [53]. This attack employs a standard three-stage approach consisting of pre-processing, optical character recognition (OCR), and post-processing. In the pre-processing stage, multiple noise-removal and enhancement techniques were applied to isolate character information. With the processed images, we assessed 8 pre-trained recognition models for Bengali language [2, 33, 58–60, 62, 63, 66] to identify the optimal configuration for Bengali text recognition. Despite exhaustive pre-processing attempts, the embedded security features prevented effective character segmentation. Consequently, OCR failed to produce meaningful recognition results across all models. Post-processing techniques, which rely on identifiable patterns in recognized text, were therefore infeasible. This attack-based evaluation confirms that the developed CAPTCHA scheme remains resistant under realistic automated attack conditions. Table 10 presents the results of our security analysis. The average recognition rate is defined as the mean percentage of characters correctly identified by the attack algorithm. A higher average prediction rate indicates a more effective attack and, consequently, weaker CAPTCHA robustness. It is clear from the table that not a single full CAPTCHA was broken by the attack. The highest average recognition rate observed for the proposed CAPTCHA mechanism was 19.86% (Variant 6) by this pretrained model [33]. The maximum average recognition rates for all variants can be seen in Table 10. Across 6,000 CAPTCHA samples, two pretrained models [61, 66] were able to fully recognize only one sample. Furthermore, since no variation yielded a recognition rate exceeding 20% (see Table 10), we can conclude that all developed CAPTCHA variants demonstrate significant robustness against the tested attacks. Additional information about the attack can be found in the Section A. 6.4

Preliminary Probe Against Vision-Language Models

Recent vision-language models (VLMs) [49] and browser-based AI agents introduce an attack vector not captured by the OCR-centric pipeline A. To estimate exposure, a preliminary probe was conducted using the Comet browser agent [68] against samples from each of the six variants. The agent was prompted with the natural-language instruction to read the Bengali text in the displayed image. Across the probed samples, no full CAPTCHA was correctly solved. Owing to the rapid pace of VLM development and the broad space of prompting strategies, this probe is reported as preliminary evidence rather than a formal security claim. A systematic evaluation against frontier multimodal models under controlled prompting protocols is identified as a primary direction for future work, and is necessary before the proposed scheme can be claimed to resist a fully modern adversary.

A Usable and Secure Bengali CAPTCHA

15

Table 10. Attack results on Bengali Text-based CAPTCHAs

Total Characters

Recognized Characters

Average Recognition Rate

1

3985

659

16.54%

2

3482

195

5.60%

3

3472

2

0.06%

4

3984

3

0.08%

5

3477

271

7.79%

6

4021

799

19.87%

Variation

Example

Preprocessed

Table 11. Comparison of security and vulnerability features across CAPTCHA processing stages Pre-process

Segmentation

Classification

Security Features Textured, noisy, random background; color variation; Overlapping characters; con- Rotation; wrapping; distortion multi-layer structure; hollow scheme; rotation; warping; nected characters; deformation; multi-colored text blurring Vulnerability Features Constant background; binary color

Aligned characters

Letters/numbers only; fixed case; constant font; dictionary words

7 Usability Evaluation Real human users may have trouble reading and solving CAPTCHAs if complex security features are employed in a CAPTCHA. Therefore, to test the ease and effectiveness with which users can complete any newly proposed CAPTCHA, it is important to test the usability of CAPTCHA. Hence, we conducted a usability evaluation of our proposed CAPTCHA which is presented in this section. 7.1 Usability Study Methodology As per [45], any user-centred interaction design relies on usability testing to evaluate products from a user’s perspective. This also applies to the newly proposed CAPTCHA scheme. The methods we followed during our usability study are presented in Figure 7. 7.2 Web application deploying the Bengali CAPTCHA scheme A web application was developed in which the proposed CAPTCHA scheme was deployed. The application serves two main purposes. Firstly, we wanted to test the practicality of our CAPTCHA in a real-world application. Secondly,

16

MNI Shibbir et al.

Bengali CAPTCHA Web application Development

Usability Comparison

Survey Questionnaire for Usability Study

Data Analysis

Participants recruitment

Conducting expriments

Fig. 7. Methods to follow for Usability Study

we used the web application for conducting usability testing to evaluate the usability of our Bengali CAPTCHA. The application provides a real-world experience for users, recording the time they take to solve each CAPTCHA sample. The web application was deployed online within a public domain 1 . The application is compatible with any device with an internet connection, including PCs, smartphones, tablets, and more. The participant used their own device to access the web application. Using the participants’ own devices has a great advantage in usability measures. As the user uses his/her device daily, our CAPTCHA will get an accurate, user-friendly judgment on the own device of a user. Also, different users possess different devices. Therefore, it will be tested on the maximum number of devices. The application dynamically generates CAPTCHAs with various levels of randomness to enhance security. These features include random numbers of characters, lines, hollow schemes, background textures, morphing, and rotation. Consequently, every time a user encounters a CAPTCHA, a new one is generated dynamically on the web application’s backend. The application also records whether the user successfully solves the CAPTCHA. After solving three CAPTCHA samples successfully for each variant, a survey questionnaire is provided to gather user feedback for that variant. 7.3

Survey questionnaire

As we developed six CAPTCHA variants, it is essential to ask the right questions in order to determine which CAPTCHA achieves a better balance between security and usability. To evaluate usability, we designed a structured questionnaire. The survey questionnaire was developed based on usability dimensions commonly discussed in prior CAPTCHA studies [19, 24, 39], including readability, distortion, confidence, confusion, time consumption, annoyance, and comfort. However, the questionnaire is not claimed to be a standardized psychometric instrument. Future work may adopt or validate a standardized usability scale specifically for CAPTCHA evaluation. The questions are presented on Table 12. The answer to every question from Q2 to Q9 has five options: Never, Seldom, Sometimes, Often, and Always, which are mapped to the numerical values ranging from 1 to 5 respectively. The questionnaire was used as a subjective usability instrument to complement objective measures such as success rate and response time. Each participant answered the questionnaire after interacting with multiple CAPTCHA samples from a given variant, not after viewing 1

https://captcha.pythonanywhere.com/

A Usable and Secure Bengali CAPTCHA

17

only a single CAPTCHA image. Therefore, frequency-based responses such as Never, Seldom, Sometimes, Often, and Always refer to the participant’s experience across that variant. No. Q1 Q2 Q3 Q4 Q5 Q6 Q7 Q8 Q9 Q10

Questions How confident were you in your ability to solve previous CAPTCHA variant? (1 = Least confident, 5 = Most confident Was the CAPTCHA text distorted badly? Was the CAPTCHA readable? Was the CAPTCHA prone to dictionary attack? Was the CAPTCHA variant solvable? Was the CAPTCHA variant confusing? Was the CAPTCHA time consuming to understand? Was the CAPTCHA annoying? Was the CAPTCHA interesting to solve? How much comfortable you are of this CAPTCHA variant on the scale of 1 to 5? (1 = Least comfortable, 5= Most comfortable)

Ideal Response 5 Never (1) Always (5) Never (1) Always (5) Never (1) Seldom (2) Sometimes (3) Always (5) 5

Table 12. Survey questions and their ideal responses for the standard variation

7.4 Participant recruitment We recruited 110 participants for the usability study. Recruitment was conducted both online, through social media announcements and university mailing lists, and in person on the campus of Shahjalal University of Science and Technology, Sylhet, Bangladesh [52] and through participants’ personal networks. The study was reviewed and approved by the Institutional Review Board of Shahjalal University of Science and Technology [52]. All participants were native Bengali speakers, were at least 18 years of age, and provided informed consent through an in-application consent form before account creation. Participation was voluntary and no monetary compensation was offered. Participants were informed that the data collected interaction logs, and survey responses, would be anonymized and used solely for research purposes. No personally identifiable information was retained in the analysis dataset. None of the participants were students or direct collaborators of the research team. The sample comprised 86 male and 24 female participants. 7.5 Usability Study During the study, when a user accesses the web application, a simple GUI is presented with all the instructions to carry out the required steps in both English and Bengali Language. Then, the user would need to complete the following steps: (i) Signup and login: To access the web application, users would need to sign up by providing different information, including their email address, username, and password, as well as demographic details such as age, gender, internet experience, and education level on a web form. Next, the user would need to login by providing the login credentials such as username and password. (ii) CAPTCHA challenge: After logging in, users are presented with CAPTCHAs, as discussed previously. We have used six different CAPTCHA variants. Each participant instructed to solve three CAPTCHA samples successfully for each variant, in total solving 18 CAPTCHA to complete the study. (iii) Survey questionnaire: After successfully solving CAPTCHAs from a variant, a survey form is shown to the participant with 10 questions, as discussed in Section 7.3, regarding their experience with that variant. A

18

MNI Shibbir et al. CAPTCHA sample of the same variant will appear until a user solves three CAPTCHA samples of that variant. So, in total of 6 survey forms are filled by the participants to complete the study. (iv) Choice list: Finally, at the end of the study for each participants, they would be required to choose a CAPTCHA from the six variants to select the variant they were most comfortable with. This is an effort to collect important subjective preference data that complements the objective metrics we gathered earlier. By asking participants to select the CAPTCHA they felt most comfortable with, we can obtain a more comprehensive view of the overall user experience. This qualitative choice offers valuable insights into user acceptance and the potential for real-world adoption. From Table 15, we can observe the distribution of participants’ choices across the different CAPTCHA variants.

7.6

Data Analysis

After all participants completed the study, we analyzed the collected data in different ways. We present out analysis In the following. 7.6.1

Response time. The time it takes for a user to complete a CAPTCHA challenge successfully is defined as the

response time. The less time it takes for a user to solve a CAPTCHA, the more usable the CAPTCHA is and vice versa. Our application recorded the response time for each CAPTCHA sample of each variation of the CAPTCHA. From Table 13, we can see the average response time for each variant. V

S

NS

SR

RT (s)

V1 V2 V3 V4 V5 V6

279 345 372 253 171 273

217 47 40 74 28 36

56.25% 88.01% 90.29% 77.37% 85.93% 88.35%

8.2581 7.7420 9.9462 9.1186 6.6901 8.1832

Table 13. Success rate and response time of different variants (V: Variation, S: Solved by human, NS: Not Solved by human, SR: Success Rate, RT: Response Time)

7.6.2

Success rate. The success rate refers to the percentage of the ratio between successfully solved CAPTCHAs and

the total number of attempts [39]. The success rate is crucial as a low success rate can prevent legitimate users from accessing the website or application. Conversely, a higher success rate makes a CAPTCHA more usable. However, the success rate of CAPTCHA solving can vary depending on the type of CAPTCHA, the difficulty of the challenge, and the user’s knowledge and experience. Generally, more complex CAPTCHAs have lower success rates. Table 13 shows that Variant 3 achieved the highest success rate of 90.29%, while Variant 5 achieved the lowest average response time of 6.69 seconds. Most variants achieved success rates above 80%, except Variant 1 and Variant 4 7.7

Usability Performance: Normative Comparison

Normative comparison involves evaluating something based on an ideal or standard that is considered the norm or the best possible variation. Normative comparisons are often used in quality control, product development, and performance evaluation to determine the degree to which an item meets a predetermined norm [50].

A Usable and Secure Bengali CAPTCHA

19

For the normative comparison, we have hypothesized an ideal CAPTCHA that is most usable by any standard. It is called the Standard CAPTCHA Variation. We have idealized this CAPTCHA by setting the set of survey questions answers in the best possible way so that the usability of the CAPTCHA becomes maximum by any measure possible. The best possible answers to the questions are in Table 12. The selection for the best answer has been made with extensive background study on CAPTCHA usability [15, 71].

V1 (RMSE=1.59) V2 (RMSE=0.62) V3 (RMSE=0.40)[Closer] V4 (RMSE=0.94) V5 (RMSE=0.65) V6 (RMSE=0.47) Standard

Q1 5

Q10

Q2

4 3

Q9

Q3

2 1

Q8

Q4

Q7

Q5 Q6

Fig. 8. Spider chart of standard responses and six variations across ten questionnaire items

We can consider the CAPTCHA variant that is closest to the Standard CAPTCHA as the most usable. To calculate this ‘closeness’, we collected numerical values from the answers (Table 12) to each question in the Bengali CAPTCHA variations (V1-V6) and computed the mean score for each question. These mean values are reported in Table 14 alongside the corresponding Standard CAPTCHA values. Questions

V1

V2

V3

V4

V5

V6

STC

Q1 Q2 Q3 Q4 Q5 Q6 Q7 Q8 Q9 Q10

3.47 3.15 2.94 1.10 3.15 2.93 2.95 2.70 2.42 3.37

4.53 1.88 4.09 1.14 4.39 1.78 1.75 1.64 2.51 4.47

4.80 1.35 4.68 1.06 4.66 1.31 1.28 1.29 2.45 4.58

4.11 2.38 3.79 1.09 4.08 2.15 2.27 2.01 2.43 3.99

4.52 1.82 4.07 1.15 4.32 1.82 1.76 1.74 2.46 4.36

4.61 1.57 4.44 1.10 4.53 1.55 1.58 1.51 2.47 4.59

5 1 5 1 5 1 2 3 5 5

Table 14. Numerical mean of survey response answers and Standard CAPTCHA (STC) answers

20 7.7.1

MNI Shibbir et al. Root Mean Squared Error (RMSE). For this analysis, we treated the 10 mean values (Q1-Q10) of each variant as a

10-dimensional vector and compared it to the Standard response vector using Root Mean Squared Error (RMSE). The purpose of this RMSE comparison is to assess how closely our CAPTCHA variants resemble the Standard CAPTCHA. Lower RMSE with a variant means it is closer to the standard CAPTCHA. We plotted the radar chart (Figure 8 on the standard response profile of (Standard CAPTCHA) with six variations (V1-V6) across ten questionnaire items (Q1– Q10). The Standard condition is highlighted in red, while the closest matching variation (V3) computed by the lowest RMSE with the standard is highlighted in blue. Metric Distribution of Participant Choices Correlation Coefficient with Ideal Response (𝜌 ) Success rate Response Time (in seconds) RMSE (With Standard Questions)

V1

V2

V3

V4

V5

V6

4 0.5127 56.25% 8.2581 1.59

32 0.9746 88.01% 7.7420 0.62

8 0.9839 90.29% 9.9462 0.40

19 0.9362 77.37% 9.1186 0.94

24 0.9734 85.93% 6.6901 0.65

23 0.9837 88.35% 8.1832 0.47

Table 15. Summary of participant choices, correlation with the ideal response for six CAPTCHA variants.

7.7.2

Correlation Coefficient. We can measure the similarity between each variant (V1-V6) using the correlation coef-

ficient [11]. The correlation coefficient of each of the Variants with the hypothetical Standard CAPTCHA is presented in Table 15. The correlation coefficient results indicate that Variant 3 (𝜌 = 0.9839) achieves the highest correlation, closely followed by Variant 6 (𝜌 = 0.9837), suggesting that these two variants align most strongly with the ideal response. Variants 5 (𝜌 = 0.9734) and 2 (𝜌 = 0.9746) also demonstrate high levels of consistency with the standard, while Variant 4 (𝜌 = 0.9362) performs moderately. In contrast, Variant 1 (𝜌 = 0.5127) shows the weakest correlation, indicating a considerable deviation from the expected response and consequently poorer usability. If we compare the two methods (RMSE and correlation coefficient) used to evaluate closeness to the Standard CAPTCHA and identify the most usable variant in Table 15, both approaches yield consistent results, indicating that Variation 3 (V3) is the most usable CAPTCHA among the 6 variants. 7.7.3

User Preference for Reduced Interaction Time. Although statistical analysis indicated that variant V3 was the most

usable, the majority of participants (32) expressed a preference for V2 (see Table 15). Data from Table 15 shows that V2 had a lower mean response time of 7.74 seconds compared to V3 having a mean response time of 9.94 seconds. However, V3 achieved a higher success rate of 90.29%, surpassing V2’s success rate of 88.01%. This highlights an interesting gap between performance and user preference. It appears that users prioritize minimizing the time to solve the challenge and resume their primary workflow over slightly better accuracy, as they preferred the version that saved them time, even if it meant experiencing a few more failures. 7.7.4

Comparative analysis with established usability benchmarks. To the best of our knowledge, this work is the first

to design and implement a text CAPTCHA for Bengali language and to evaluate its usability through a user study. Consequently, no directly comparable benchmark or baseline exists for Bengali CAPTCHAs. Therefore, an exact comparison is not possible. Nevertheless, we compare our results with prior state-of-the-art usability studies of English text-based CAPTCHAs, given the similarities in task structure and interaction. As shown in Table 16, our Bengali

A Usable and Secure Bengali CAPTCHA

21

CAPTCHA outperforms the reported baselines for text-based CAPTCHAs, achieving a lower response-time range and a higher success rate. Baseline Chellapilla et al.[21] Bursztein et al. [20] Baecher et al. [12] Brodic et al. [18] Searles et al. [51] Bengali CAPTCHA

Response Time (s)

Success Rate

10 - 15 9.8- 28.4 Not reported 13.38 - 22.95 9 - 15.3 6.69 - 9.9

87.5% 84% 70-87% 0-77%2 50-84% 56.25 -90.29%

Table 16. Response time and success rate of human participants reported by other usability studies

8 Conclusion In this work, we presented the first secure and usable Bengali Text CAPTCHA Scheme. It has six variants, each with distinct security properties. We implemented this design as a publicly accessible web application. We evaluated its security using an automated attack framework [53], which combined image de-noising and OCR. The attack achieved a maximum average character recognition rate of only 20% (Variant 6), confirming the substantial robustness of the scheme. We conducted a usability study with two complementary analyses. The conventional success-rate metric yielded a 90.29% overall success rate. Furthermore, we introduced a Normative Comparison method, which evaluated each variant by aligning its response distribution with an ideal usability profile. This analysis ranked Variant 3 as the most usable, a result consistent with its high success rate. We therefore conclude that Variant 3 represents the most secure and user-friendly text-based Bengali CAPTCHA, which can be successfully deployed for public use. Limitations and Future Work: The current system has some limitations due to the complexities of rendering Bengali scripts. First, vowel and consonant conjuncts could not be incorporated, as the Python image library used would incorrectly segment them. Second, to keep randomized characters distinct and prevent automatic conjunct formation, participants had to enter a space after each character, which may have affected usability. Furthermore, the security of the proposed scheme should be interpreted in the context of current OCR-based attack capabilities. As Bengali OCR models improve, the robustness of the proposed CAPTCHA may change. However, the scheme does not depend exclusively on OCR limitations; it also incorporates multiple anti-preprocessing, anti-segmentation, and anti-recognition features. References [1] 2022. Bijoy Bayanno Keyboard. https://bijoybayannowin.com/api/v1 [2] 2022. OCR using pytesseract (Bengali & English). https://www.kaggle.com/code/ggck43/ocr-using-pytesseract-bengali-english/data?select= Bengali.traineddata [Online; accessed 2022-11-09]. [3] 2022. OpenCV-python tutorials. https://docs.opencv.org/4.x/d6/d00/tutorial_py_root.html [Online; accessed 2022-11-09]. [4] 2022. Traineddata files for version 4.00 +. https://tesseract-ocr.github.io/tessdoc/Data-Files [Online; accessed 2022-11-09]. [5] 2023. Bengali alphabet. https://en.wikipedia.org/wiki/Bengali_alphabet [6] 2023. Ekushey Keyboard. https://ekushey.org/ 2

User under 35 years age 77% probability and User over 35 were not able to solve any Text CAPTCHAs

22

MNI Shibbir et al.

[7] S M Izaz Ahmmed, Muhammad Minhazul, Haque Bhuiyan, Md Khan, and Research Publications. 2014. A Survey on Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA). SSRN Electronic Journal 1 (03 2014), 187–193. [8] Luis von Ahn, Manuel Blum, Nicholas J Hopper, and John Langford. 2003. CAPTCHA: Using hard AI problems for security. In International conference on the theory and applications of cryptographic techniques. Springer, 294–311. [9] Aysha Akther, Md. Shymon Islam, Hafsa Sultana, A. K. Z. Rasel Rahman, Sujana Saha, Kazi Masudul Alam, and Rameswar Debnath. 2022. Compilation, Analysis and Application of a Comprehensive Bangla Corpus KUMono. IEEE Access 10 (2022), 79999–80014. doi:10.1109/ACCESS.2022.3195236 [10] Walid Aribi. 2016. A Survey of Current Research on CAPTCHA. International Journal of Computer Science & Engineering Survey 7 (06 2016), 1–21. doi:10.5121/ijcses.2016.7301 [11] Agustin Garcia Asuero, Ana Sayago, and AG González. 2006. The correlation coefficient: An overview. Critical reviews in analytical chemistry 36, 1 (2006), 41–59. [12] Paul Baecher, Marc Gordon Lior Fischlin, Robert Langenberg, Michael Lützow, and Dominique Schröder. 2010. Captchas: the good, the bad, and the ugly. In Sicherheit 2010. Sicherheit, Schutz und Zuverlässigkeit. Gesellschaft für Informatik eV, 353–365. [13] M Tariq Banday and Shafiya Afzal Sheikh. 2013. Design of CAPTCHA script for Indian regional websites. In Security in Computing and Communications: International Symposium, SSCC 2013, Mysore, India, August 22-24, 2013. Proceedings 1. Springer, 98–109. [14] Abhay Bansal, Divye Garg, Anup Gupta, and Anand Gupta. 2008. Breaking a Visual CAPTCHA: A Novel Approach using HMM. In Proceedings of the. [15] Seyed Mohammad Reza Saadat Beheshti and Panos Liatsis. 2015. CAPTCHA Usability and Performance, How to Measure the Usability Level of Human Interactive Applications Quantitatively and Qualitatively?. In 2015 International Conference on Developments of E-Systems Engineering (DeSE). 131–136. doi:10.1109/DeSE.2015.23 [16] Marios Belk, Christos Fidas, Panagiotis Germanakos, and George Samaras. 2015. Do human cognitive differences in information processing affect preference and performance of CAPTCHA? International Journal of Human-Computer Studies 84 (2015), 1–18. [17] Benjamin Boyter. 2015. All About CAPTCHA’s: Decoding CAPTCHA’s for Fun and Profit. Leanpub. https://leanpub.com/decodingcaptchas(visited 2022-08-08). [18] Darko Brodić and Alessia Amelio. 2019. The CAPTCHA: Perspectives and Challenges: Perspectives and Challenges in Artificial Intelligence. (2019). [19] Darko Brodić and Alessia Amelio. 2019. Exploring the usability of the text-based CAPTCHA on tablet computers. Connection Science 31, 4 (2019), 430–444. [20] Elie Bursztein, Steven Bethard, Celine Fabry, John C Mitchell, and Dan Jurafsky. 2010. How good are humans at solving CAPTCHAs? A large scale evaluation. In 2010 IEEE symposium on security and privacy. IEEE, 399–413. [21] Kumar Chellapilla, Kevin Larson, Patrice Simard, and Mary Czerwinski. 2005. Designing human friendly human interaction proofs (HIPs). In Proceedings of the SIGCHI conference on Human factors in computing systems. 711–720. [22] Kumar Chellapilla, Kevin Larson, Patrice Y Simard, and Mary Czerwinski. 2005. Computers beat Humans at Single Character Recognition in Reading based Human Interaction Proofs (HIPs).. In CEAS. [23] Jun Chen, Xiangyang Luo, Yanqing Guo, Yi Zhang, and Daofu Gong. 2017. A survey on breaking technique of text-based CAPTCHA. Security and communication networks 2017 (2017). [24] Geeta Chhabra Gandhi, Vijay Dhaka, and Manoj Kumar Agarwal. 2019. Design of Innovative CAPTCHA and Analysis of It’s Efficiency. International Journal of Advanced Studies of Scientific Research 4, 3 (2019). [25] Yang-Wai Chow, Willy Susilo, and Pairat Thorncharoensri. 2019. CAPTCHA design and security issues. Advances in Cyber Security: Principles, Techniques, and Applications (2019), 69–92. [26] Alex Clark. 2015. Pillow (PIL Fork) Documentation. https://buildmedia.readthedocs.org/media/pdf/pillow/latest/pillow.pdf [27] Jeffrey A. Clark and contributors. 2022. Pillow. https://pypi.org/project/pillow/ [Online; accessed 2022-11-09]. [28] Imtiaz Ahmed Dahar, Fizza Abbas Alvi, and Ubaidullah Rajput. 2020. Enhancing Security of Urdu Language Websites through Urdu CAPTCHA. International Journal of Computer Science and Network Security 20, 11 (2020), 142–151. [29] Line Eikvil. 1993. Optical character recognition. citeseer. ist. psu. edu/142042. html 26 (1993). [30] Ryan Fortune, Gary Luu, and Peter McMahon. 2005. CS229 Project Report: Cracking CAPTCHAs. Stanford University CS229 Project Report. [31] Rich Gossweiler, Maryam Kamvar, and Shumeet Baluja. 2009. What’s up CAPTCHA? A CAPTCHA based on image orientation. In Proceedings of the 18th international conference on World wide web. 841–850. [32] Carlos Hernández-Castro and Arturo Ribagorda. 2010. Pitfalls in CAPTCHA design and implementation: The Math CAPTCHA, a case study. Computers & Security 29 (02 2010), 141–157. doi:10.1016/j.cose.2009.06.006 [33] Indic-OCR. 2022. Tesseract Models for Indian Languages. https://indic-ocr.github.io/tessdata/. [34] Kiranjot Kaur and Sunny Behal. 2014. Captcha and its techniques: a review. International Journal of Computer Science and Information Technologies 5, 5 (2014), 6341–6344. [35] Kiranjot Kaur and Sunny Behal. 2015. Designing a Secure Text-based CAPTCHA. Procedia Computer Science 57 (2015), 122–125. doi:10.1016/j. procs.2015.07.381 3rd International Conference on Recent Trends in Computing 2015 (ICRTC-2015). [36] Bilal Khan, Khaled Alghathbar, Muhammad Khurram Khan, Abdullah M AlKelabi, and Abdulaziz Alajaji. 2013. Cyber security using arabic captcha scheme. Int. Arab J. Inf. Technol. 10, 1 (2013), 76–84. [37] Martin Kopp, Matej Nikl, and Martin Holena. 2017. Breaking CAPTCHAs with Convolutional Neural Networks.. In ITAT. 93–99.

A Usable and Secure Bengali CAPTCHA

23

[38] Mohinder Kumar, MK Jindal, and Munish Kumar. 2022. A systematic survey on CAPTCHA recognition: types, creation and breaking techniques. Archives of Computational Methods in Engineering 29, 2 (2022), 1107–1136. [39] Mohinder Kumar, Manish Kumar Jindal, and Munish Kumar. 2022. Design of innovative CAPTCHA for hindi language. Neural Computing and Applications (2022), 1–36. [40] Piotr Kuszaj. 2017. Kuszaj/claptcha: Simple Captcha Generator for Python. https://github.com/kuszaj/claptcha. GitHub repository. [41] Manar Mohamed, Niharika Sachdeva, Michael Georgescu, Song Gao, Nitesh Saxena, Chengcui Zhang, Ponnurangam Kumaraguru, Paul Oorschot, and Wei-Bang Chen. 2014. A three-way investigation of a game-CAPTCHA: automated attacks, relay attacks and usability. [42] G. Mori and J. Malik. 2003. Recognizing objects in adversarial clutter: breaking a visual CAPTCHA. In 2003 IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 2003. Proceedings., Vol. 1. I–I. doi:10.1109/CVPR.2003.1211347 [43] Nilobon Nanglae and Pattarasinee Bhattarakosol. 2015. Attitudes towards Text-based CAPTCHA from developing countries. In 2015 12th International Conference on Electrical Engineering/Electronics, Computer, Telecommunications and Information Technology (ECTI-CON). 1–4. doi:10.1109/ ECTICon.2015.7207116 [44] Meharuniza Nazeem, Anitha R, Navaneeth S, and Rajeev R. R. 2024. Open-Source OCR Libraries: A Comprehensive Study for Low Resource Language. In Proceedings of the 21st International Conference on Natural Language Processing (ICON), Sobha Lalitha Devi and Karunesh Arora (Eds.). NLP Association of India (NLPAI), AU-KBC Research Centre, Chennai, India, 416–421. https://aclanthology.org/2024.icon-1.48/ [45] Jakob Nielsen. 1994. Usability engineering. Morgan Kaufmann. [46] OmicronLab. 2023. Avro Keyboard. https://www.omicronlab.com/avro-keyboard-download.html [47] Brian M Powell, Adam C Day, Richa Singh, Mayank Vatsa, and Afzel Noore. 2010. Image-based face detection CAPTCHA for improved security. International Journal of Multimedia Intelligence and Security 1, 3 (2010), 269–284. [48] Xiao Qin and Yuqian Wu. 2011. An Algorithm for Segmentation of CAPTCHA Characters Based on Color-Clustering and Feedback Mechanism. 2011 International Conference on Internet Technology and Applications, iTAP 2011 - Proceedings (08 2011). doi:10.1109/ITAP.2011.6006257 [49] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. 2021. Learning Transferable Visual Models From Natural Language Supervision. In International Conference on Machine Learning (ICML). PMLR, 8748–8763. https://arxiv.org/abs/2103.00020 [50] Anthony C Redmond, Yvonne Z Crane, and Hylton B Menz. 2008. Normative values for the foot posture index. Journal of Foot and Ankle research 1 (2008), 1–9. [51] Andrew Searles, Yoshimichi Nakatsuka, Ercan Ozturk, Andrew Paverd, Gene Tsudik, and Ai Enkoji. 2023. An empirical study & evaluation of modern {CAPTCHAs}. In 32nd usenix security symposium (usenix security 23). 3081–3097. [52] Shahjalal University of Science and Technology. [n. d.]. Institutional Profile and Academics. https://sust.edu. Accessed: 2026-05-24. [53] Md Neyamul Islam Shibbir, Hasibur Rahman, Md Sadek Ferdous, and Farida Chowdhury. 2024. Evaluating the security of CAPTCHAs utilized on Bangladeshi websites. Computers & Security 140 (2024), 103774. [54] Ved Prakash Singh and Preet Pal. 2014. Survey of different types of CAPTCHA. International Journal of Computer Science and Information Technologies 5, 2 (2014), 2242–2245. [55] Ray Smith. 2007. An overview of the Tesseract OCR engine. In Ninth international conference on document analysis and recognition (ICDAR 2007), Vol. 2. IEEE, 629–633. [56] Oleg Starostenko, Claudia Cruz-Perez, Fernando Uceda Ponga, and Vicente Alarcon-Aquino. 2015. Breaking text-based CAPTCHAs with variable word and character orientation. Pattern Recognition 48 (04 2015). doi:10.1016/j.patcog.2014.09.006 [57] Statista. 2025. The most spoken languages worldwide 2025 | Statista. https://www.statista.com/statistics/266808/the-most-spoken-languagesworldwide [Online; accessed 2026-01-28]. [58] Tesseract OCR tessdata_best ben. 2022. Tesseract. https://github.com/tesseract-ocr/tessdata_best/blob/main/ben.traineddata. [Online; accessed 2022-11-09]. [59] Tesseract OCR. 2022. Tessdata best. https://github.com/tesseract-ocr/tessdata/blob/main/ben.traineddata. [60] Tesseract-Ocr. 2022. Tessdata/ben.traineddata at main · TESSERACT-OCR/tessdata. https://github.com/tesseract-ocr/tessdata/blob/main/ben. traineddata [Online; accessed 2022-11-09]. [61] Tesseract-Ocr. 2022. Tesseract-OCR Best (most accurate) trained LSTM models. https://github.com/tesseract-ocr/tessdata_best [Online; accessed 2022-11-09]. [62] Tesseract-OCR. 2022. Tesseract-OCR/tessdata_fast: Fast integer versions of trained LSTM models. https://github.com/tesseract-ocr/tessdata_fast. [63] Tesseract OCR Bengali Traindata. 2022. TessdocTable. https://github.com/tesseract-ocr/tessdoc/blob/main/Data-Files.md#data-files-for-version400-november-29-2016. [Online; accessed 2022-11-09]. [64] Nghia Dinh Trong, Thien Ho Huong, and Vinh Truong Hoang. 2023. New cognitive deep-learning CAPTCHA. Sensors 23, 4 (2023), 2338. [65] Vecteezy Contributors. 2023. Topographic Background and Texture Abstraction with Place for Text - Topo Backdrop Lines, Contour Geographic Grid, Modern Black and White Topographic Contours, Lines of Mountains, Topography Map Art. https://www.vecteezy.com/vectorart/18939191-topographic-background-and-texture-abstraction-with-place-for-text-topo-backdrop-lines-contour-geographic-grid-modernblack-and-white-topographic-contours-lines-of-mountains-topography-map-art Accessed: 2023-07-26. [66] VintaSoft. 2022. OCR: Prepare OCR engine for text recognition. https://www.vintasoft.com/docs/vsimaging-dotnet/Programming-OCR-Prepare_ OCR_engine_for_text_recognition.html.

24

MNI Shibbir et al.

[67] Wikipedia contributors. 2025. Captcha Wikipedia. https://en.wikipedia.org/wiki/CAPTCHA [Online; accessed 4-April-2025]. [68] Wikipedia contributors. 2026. Comet (browser) — Wikipedia, The Free Encyclopedia. https://en.wikipedia.org/w/index.php?title=Comet_(browser) &oldid=1336424809. [69] Hisaaki Yamaba, Ahmad Saiful Aqmal Bin Ahmad Sohaimi, Shotaro Usuzaki, Kentaro Aburada, Masayuki Mukunoki, Mirang Park, and Naonobu Okazaki. 2021. Proposal of Jawi CAPTCHA Using Digraphia Feature of the Malay Language. In Advances in Information and Computer Security: 16th International Workshop on Security, IWSEC 2021, Virtual Event, September 8–10, 2021, Proceedings 16. Springer, 119–133. [70] Jeff Yan and Ahmad Ahmad. 2008. Usability of CAPTCHAs or usability issues in CAPTCHA design. Proceedings of the 4th Symposium on Usable Privacy and Security, 44–52. doi:10.1145/1408664.1408671 [71] Jeff Yan and Ahmad Salah El Ahmad. 2008. Usability of CAPTCHAs or usability issues in CAPTCHA design. In Proceedings of the 4th symposium on Usable privacy and security. 44–52. [72] Bin B Zhu, Jeff Yan, Qiujie Li, Chao Yang, Jia Liu, Ning Xu, Meng Yi, and Kaiwei Cai. 2010. Attacks and design of image recognition CAPTCHAs. In Proceedings of the 17th ACM conference on Computer and communications security. 187–200.

A

Attacking Bengali CAPTCHAs

To validate the security claims of our developed Text-Based Bengali CAPTCHA, it was essential to go beyond theoretical evaluation and perform a practical, adversarial analysis. While the evaluation framework [53] estimates the strength of a CAPTCHA based on its security and vulnerability features, real world attackers do not rely on feature inspection they attempt to bypass the mechanism using automated tools systematically. Therefore, we deliberately attacked the system in a manner that closely resembles how modern bots operate in practice. This step was necessary to confirm whether the CAPTCHA, despite appearing secure under the framework, could still be compromised through realistic automated attacks. Such an attack-based validation ensures that the framework’s predictions are not only conceptual but also aligned with practical attack feasibility. To validate the security of our Text-Based Bengali CAPTCHA, we attacked with a three-stage [53] : (i) Pre-Processing (ii) OCR (iii) Post-Processing A.0.1

Pre-processing. Its primary goal is to exaggerate information about characters in a particular picture and to

reduce or erase interfering information [23]. The pre-processing stage is the most crucial stage because if a TextCAPTCHA is properly pre-processed, then the segmentation and recognition can be done easily with modern technologies [14]. We have tried all the best possible combinations for our developed CAPTCHA to cancel out all the noises from the CAPTCHAs. All the best-chosen methods are inadequate for removing the security features from our Bengali CAPTCHA as presented in Table 17. Next, we explain the different notations and parameters used in Table 17. They are described in detail in this work [53]

• T.B.(a) denotes the THRESH_BINARY operation. • T.B.INV(a) denotes the THRESH_BINARY_INVERSE operation. • OTSU denotes Otsu’s method • G.B.(a,b) denotes the Gaussian Blur operation where the values of a and b are the height and weight of the kernel respectively. • A.B.(a) denotes the Average Blur operation where a value is the same as G.B. • (a,b) means the kernel height is a and the weight is b. • B2G denotes BGR2GRAY, converting an Image to an Gray-scale Image.

A Usable and Secure Bengali CAPTCHA CAPTCHA

25

Binarization

Blurring

Erosion

Dilation

Gray-scale

T.B.(128)

A.B.(3,1)

(2,2)

(3,2)

B2G

OTSU(128)

A.B.(1,1)

(2,1)

(3,2)

B2G

T.B.(100)

G.B.(13,13)

–

(2,2)

B2G

T.B.(100)

G.B.(13,13)

–

(2,2)

B2G

T.B.INV(105)

M.B.(5)

(1,1)

(2,2)

B2G

T.B.(205)

G.B.(3,3)

(1,1)

(3,3)

B2G

P.P Output

Table 17. Pre-processing of selected CAPTCHA samples.

We utilize the specific parameter configurations defined in our implementation’s attack script.

Fig. 9. Command to execute attack script

Fig. 10. Best Result from the pretrained model benIndic [33]

Figure 11 illustrates that only a single sample in Variation 2 was successfully solved by the pretrained models [61, 66], However they are showing lower average recognision rate than the pretrained model [33]. A.0.2 OCR Selection. Tesseract OCR is regarded as one of the most precise open-source OCR engines available [44]. The software looks at an image and finds individual characters or groups of characters, which are then turned into texts. It recognizes several text types, including handwriting and varied typefaces. A complete and detailed explanation of the Tesseract OCR engine is available at [55]. Tesseract was initially designed for English but has been expanded to recognize 100 other languages, including Bengali [4]. The trained data file for each language is an archive file in a Tesseract-specific format. It contains several

26

MNI Shibbir et al.

Fig. 11. Only one Bengali CAPTCHA sample of variation 2 out of 6000 samples was solved by two pretrained models[61, 66]

uncompressed component files needed by the Tesseract OCR process. It is also called the Tesseract model. The official Tessaract repository provides three different kinds of trained data for each language. Now, for the Bengali Language, we must configure it with the Bengali pretrained data to recognize Bengali characters with this OCR for the Bengali language. The engine’s algorithms are particular to the English alphabet, making supporting other structurally similar scripts easy by simply training the character set with the new scripts. Bengali also follows the same pattern of character segmentation. There are many versions of Bengali language pretrained model available, ranging its performance and accuracy [2, 33, 58–60, 62, 63, 66]. A.1

Post-processing

Post-processing is a crucial stage in attacking CAPTCHAs as it refines the recognition results and improves the solution’s accuracy. As discussed in [53], the central aspect of post-processing is correcting recognition mistakes via error correction algorithms like pattern matching. Post-processing may accomplish this by comparing the recognized characters to a dictionary of known words, looking to the ground truth to find patterns, or using statistical models to anticipate the most probable nature based on the surrounding context. For our developed Bengali CAPTCHA, no post-processing is possible because the results after the recognition do not reveal any patterns, as the noises can not be removed with any standard noise removal techniques in the first place. Hence, recognition is not possible, resulting in no patterns. A.2

Attack Execution

Our attack implementation is available at (./Attack/captcha_attack_script.py) within our open science repository3 . From Figure 9, we can see how we execute the attack script. There, we have three primary environmental parameters:

• Input Directory (--input_dir): Specifies the path to the structured dataset containing six variations of the target captchas. • Model Path (--tessdata): Overrides system defaults by pointing to a localized trainedModels directory. This ensures the use of specific model versions and maintains environment consistency across different systems. • Language Specification (--lang): Designates the particular pretrained model, specifically targeting the Bengali language recognition file required for the attack execution. From Figure 9, we can see the benIndic[33] pretrained model was used for this command. 3

https://github.com/neyamul-sbr/ArtifactsBengaliCAPTCHA

A Usable and Secure Bengali CAPTCHA

27

We evaluated the attack across nine distinct pre-trained models. Our results, illustrated in Figure 10, indicate that while the benIndic model [33] outperformed all alternative configurations for Bengali CAPTCHA recognition, it failed to achieve a complete successful recognition of any single CAPTCHA sample. This highlights the inherent difficulty of the target samples even when utilizing optimized OCR models. A.3 Discussion We have generated 1000 samples for our each CAPTCHA variants (6000 in total) and performed attack on them by the Pre-processing configuration of Table 17. The best results we found for trying to break it with attacks are shown in Table 10, where we can see that the average recognition rate from our developed CAPTCHA mechanism is highest 19.87% for variation 2. The Average Prediction Rate is the percentage of an average number of characters recognized by performing the attack.