A Usable and Secure Bengali CAPTCHA
Source: arXiv:2606.29077 · Published 2026-06-27 · By Md Neyamul Islam Shibbir, Md Hasibur Rahman, Farida Chowdhury, Md Sadek Ferdous
TL;DR
This paper addresses the problem that text-based CAPTCHAs are predominantly designed for English script, posing usability challenges for non-English native speakers, particularly Bengali users. The authors present the first Bengali-language text CAPTCHA system designed to balance security and usability by adapting CAPTCHA design to the unique linguistic and visual properties of the Bengali script. They implement six CAPTCHA variants incorporating script-aware character selection, noise, distortion, color, and morphing techniques to thwart automated OCR attacks while maintaining human solvability.
The authors conducted a security evaluation using an established CAPTCHA evaluation framework and empirical OCR attacks, finding very low automated character recognition rates of 0-20% on approximately 6,000 CAPTCHA samples. Usability was tested with 110 Bengali-speaking participants, resulting in human success rates between 56.25% and 90.29%, with average solving times from 6.69 to 9.9 seconds. This demonstrates that their Bengali CAPTCHAs achieve a meaningful trade-off: significantly impeding automated attacks while preserving user accessibility for native Bengali speakers. Overall, the contribution fills a gap in localized CAPTCHA solutions for a large linguistic population, offering practical insights for designing secure and usable CAPTCHAs in non-Latin scripts.
Key findings
- The proposed Bengali CAPTCHA exhibits 0-20% average character recognition rates by automated OCR tools across 6,000 CAPTCHA samples (approximately 1,000 per variant).
- Human usability testing with 110 native Bengali speakers showed success rates ranging from 56.25% to 90.29% across the six CAPTCHA variants.
- Average human response times ranged from 6.69 seconds (fastest) to 9.9 seconds (slowest) depending on the variant.
- Six CAPTCHA variants use different combinations of backgrounds, noise types, letter morphing, rotation, color, and distortion to balance security and usability.
- Security evaluation based on [53] framework scores all CAPTCHA variants as "Secure" with security feature minus vulnerability counts between 9 and 13.
- Exclusion of confusing or rare Bengali letters, vowel diacritics, and conjuncts improved usability and prevented image rendering issues.
- Colorful character rendering with randomized per-letter hues improves resistance to segmentation and color-thresholding attacks while maintaining readability.
- Morphing and rotation transformations produce distortions that impede automated recognition but preserve human visual discrimination.
Threat model
The adversary is an automated bot attempting to bypass CAPTCHA challenges by using image preprocessing, segmentation, and optical character recognition (OCR) algorithms tailored for Bengali scripts. The adversary has access to the CAPTCHA images but cannot perfectly segment or classify distorted, noisy, and morphologically transformed Bengali characters due to limitations in existing Bengali OCR systems. The bot cannot circumvent the CAPTCHA using human intervention or contextual solutions. The model assumes no privileged access to backend CAPTCHA generation secrets.
Methodology — deep read
The authors begin by defining a threat model where adversaries are automated bots attempting to solve CAPTCHAs via OCR-based approaches but lack perfect Bengali OCR capabilities. They assume attackers can preprocess and segment images but struggle with distorted and noisy Bengali script.
The data comprises approximately 6,000 CAPTCHA instances distributed evenly across six designed CAPTCHA variants. Each text challenge is a string of randomly chosen Bengali characters (30-character subset) carefully selected to exclude visually confusing letters, rare characters, vowel diacritics, and conjuncts that cause rendering or input problems. This character set curation improves both usability and security.
The CAPTCHA generation pipeline uses Python’s Pillow and OpenCV libraries. Each CAPTCHA is created through several steps: generating random text, creating a blank image canvas of sufficient size, applying static or dynamically cropped background noise images, rendering characters with randomly chosen fonts and colors from a specified high-contrast palette, adding morphing transformations such as stretching, warping, rotating letters, and applying Gaussian blur. Additional noise includes random lines, dotted shapes, and background distortions. Six variants differ by the combination and intensities of these transformations and background types (static white noise, cropped noisy images, combined backgrounds).
Security features are broadly categorized as anti-preprocessing, anti-segmentation, and anti-classification, aiming to impede image binarization, character segmentation, and classification by automated software. Vulnerabilities like fixed font usage or constant backgrounds are identified and mitigated across variants.
The training of any classifier is not described here since the evaluation framework is applied externally. The security evaluation uses the framework from [53], where security and vulnerability features are counted and their difference (ΔDC) quantifies security level (secure if ΔDC > 6). Furthermore, OCR attack experiments are conducted to empirically measure character recognition success rates.
For usability, a study was conducted with 110 Bengali speakers, each solving multiple samples per variant. Usability metrics include human success rate per variant and average time to solution. A normative-comparison approach using RMSE and correlation ranks CAPTCHA variants relative to an ideal usability profile.
The entire experimental process is reproducible using the public CAPTCHA generation code base modified with Bengali linguistic adaptations, though some linguistic font rendering challenges are noted. No large-scale adversarial machine learning attacks or domain-shift tests were performed. The evaluation is principled but limited to current OCR methods and user samples.
Technical innovations
- Character set curation tailored to Bengali script excludes visually confusable letters, rare letters, vowel diacritics, and conjuncts that cause rendering or input issues, improving usability and security.
- Use of multi-variant CAPTCHA generation combining letter morphing, rotation, Gaussian blur, distinct static and dynamic background noise images, and randomized multi-color per-character rendering to disrupt automated segmentation and recognition.
- Application of a CAPTCHA evaluation framework [53] combining security and vulnerability feature counts to classify CAPTCHA variants' security level.
- An IRB-approved usability study with native Bengali speakers assessing success rates, response times, and deriving a normative-comparison usability ranking across six designed variants.
Datasets
- Internal Bengali CAPTCHA dataset — approx. 6,000 samples across six CAPTCHA variants (approx. 1,000 per variant) — not publicly released
Baselines vs proposed
- Automated OCR attack on proposed CAPTCHA variants: average character recognition rate 0-20% vs. typical English text CAPTCHAs often exceeding 50%+ under similar attacks
- Human usability: success rate 56.25%-90.29% vs. ideal CAPTCHA success rate benchmark >90%
- Security evaluation framework score (ΔDC): proposed variants scored 9 to 13, all classified as Secure (ΔDC > 6)
Figures from the paper
Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2606.29077.
Fig 1: CAPTCHA Backgrounds.
Fig 3: Effects of CAPTCHA rotation
Fig 4: presents the type of noise adopted in our scheme and their effects on the CAPTCHA image is illustrated in
Fig 5: Fig. 4. Dotted Shape Noises
Fig 6: Different Blurring Effects
Fig 6 (page 9).
Fig 7 (page 9).
Fig 8 (page 9).
Limitations
- No direct comparison to English CAPTCHAs on Bengali speakers in usability or security was conducted, so relative improvements are inferred but unquantified.
- Evaluation framework classifies CAPTCHA security heuristically; no adversarial attack simulations beyond OCR tested.
- User study limited to 110 native speakers, which may not cover wide demographic or accessibility variations.
- No testing against adversarial machine learning or OCR models trained specifically on distorted Bengali CAPTCHAs.
- CAPTCHA generator uses a fixed font set; expanding fonts or including more conjuncts could affect results but was not explored.
- The impact of CAPTCHA difficulty on accessibility for visually impaired or cognitively challenged users is unknown.
Open questions / follow-ons
- How do these Bengali CAPTCHA variants perform against more advanced adversarial OCR models or deep learning-based solvers trained on distorted Bengali script?
- Could incorporating conjunct characters or vowel diacritics with novel rendering techniques balance usability and increase security further?
- How does the proposed CAPTCHA design impact accessibility for visually impaired or elderly Bengali users?
- What is the real-world effect on user abandonment or bot-blocking performance if deployed on large Bengali language websites under diverse network and device conditions?
Why it matters for bot defense
Bot-defense engineers working on CAPTCHAs for non-English user bases, especially those using Indic or complex scripts, can draw valuable lessons from this paper’s systematic approach to adapting CAPTCHA design to script-specific linguistic and rendering challenges. It demonstrates the importance of character set curation tailored to regional scripts to mitigate OCR vulnerability while maintaining user usability. The multi-variant design testing different noise, color, and morphing configurations shows how security and usability trade-offs can be explicitly explored and quantified.
Practitioners should consider that leveraging the current immaturity of OCR in regional languages can provide practical security gains. However, user testing with native speakers is essential to avoid frustrating users with unfamiliar scripts or distorted characters. This work encourages further CAPTCHA research beyond Latin-based languages, supporting accessible bot defenses in growing global language communities.
Cite
@article{arxiv2606_29077,
title={ A Usable and Secure Bengali CAPTCHA },
author={ Md Neyamul Islam Shibbir and Md Hasibur Rahman and Farida Chowdhury and Md Sadek Ferdous },
journal={arXiv preprint arXiv:2606.29077},
year={ 2026 },
url={https://arxiv.org/abs/2606.29077}
}