Rendering on Real Silicon: GPU Render-Timing as a Passive, AI-Resistant CAPTCHA Signal

Source: arXiv:2607.23389 · Published 2026-07-25 · By David Noever, Forrest McKee

TL;DR

This paper addresses the growing ineffectiveness of conventional CAPTCHAs against modern AI solvers and behavioral biometric mimicry by introducing a novel, orthogonal classification signal based on the physical render timing behavior of a client's genuine GPU executing a controlled WebGL workload. Unlike WebGL fingerprinting—which identifies devices via hashed pixel outputs and persistent identifiers—this approach only classifies clients as human or automated based on transient timing dynamics without tracking. The authors first characterize the prevailing automated adversary in the wild as predominantly render-free (not executing WebGL workloads) through a 12-hour passive observation of unsolicited traffic to a public endpoint.

To distinguish human browsers from bots, they establish a single-endpoint methodology to collect GPU render timing samples labeled as positive class (real browsers on 13 distinct GPUs) and negative class (headless automation on multiple rendering backends including real GPUs and software renderers). Notably, software-rendered automation exhibits roughly 5x slower mean frame render time compared to genuine GPUs. Even harder negatives—headless browsers running on real GPUs—display distinctive timing signatures from interactive humans, differing by 75–106% on metrics like frame jitter, timer-quantization ratio, and coefficient of variation. Their pilot-scale study is currently limited to Intel integrated GPUs, with ongoing work to assess generalization across architectures. This timing-based signal acts as a passive, low-friction physical-layer CAPTCHA defense orthogonal to puzzle or behavior-based approaches.

Key findings

• 86% of unsolicited in-the-wild requests to the endpoint were automated and primarily render-free, failing HTTP header consistency checks.
• Software-rendered bots produce approx. 5.2× slower mean frame render time than genuine GPUs (26.3 ms vs. 5.1 ms), with higher jitter and timer quantization.
• In confound-controlled tests (Intel integrated GPUs, Chromium/ANGLE), headless automation on real hardware shows 75–106% higher frame jitter, timer-quantization ratio, and coefficient of variation versus interactive human sessions.
• The exact metrics for headless vs. human on Intel GPUs under matched engine are: quantization ratio 0.249 vs. 0.076 (106% separation), frame jitter 0.912 ms vs. 0.351 ms (89% separation), and coefficient of variation 0.247 vs. 0.112 (75% separation).
• Render timing differences persist even when adversaries run automation on real GPUs, challenging simple spoofing.
• A single render-timing threshold effectively filters the dominant render-free automated adversary in the wild.
• Render timing signals do not leak persistent identifiers, avoiding privacy concerns of fingerprinting.
• Headless browser execution lacks display compositor and refresh pacing, resulting in more timing 'roughness' rather than flatter render profiles.

Threat model

The adversary consists of automated web clients attempting to masquerade as real browsers. They may run headless browsers with software or GPU renderers or use software-only rendering stacks but do not possess the exact physical GPU silicon of genuine human users. They cannot forge the fine-grained physical render timing distribution of GPUs they do not physically have and generally do not execute WebGL rendering at all. The attack surface excludes adversaries with physical hardware access identical to the victim's or those capable of precisely simulating physical timing jitter.

Methodology — deep read

1. Threat model & assumptions: The adversary is primarily automated web clients that may claim to be browsers but often omit critical HTTP headers, indicating scripted or bot usage. The main adversarial classes include render-free bots that do not run WebGL at all (dominant in the wild), software rendering bots (headless browsers using software rasterizers), and headless automation running on real GPU hardware. The adversary cannot physically possess the exact real GPU being mimicked, nor can they precisely forge its render timing behavior.

2. Data collection: A public web endpoint hosted on commodity cloud infrastructure passively recorded 207 unsolicited requests during a 12-hour window to characterize the adversary (meta-data only). Positive samples (human class) were collected from consenting real visitors with 26 sessions involving 13 distinct GPUs, who interacted with a page running a fixed WebGL rendering harness. Negative samples were collected by scripted headless automation visiting the same endpoint under various browser engines (Chromium, Firefox, WebKit), rendering backends (hardware GPU, SwiftShader, CPU fallback), producing 273 software bot sessions and 20 hard negative real GPU headless sessions. Labels are reliable due to the usage of keyed secret for automation triggers and header consistency checks.

3. Architecture/algorithm: The core signal is the timing of WebGL frame render workloads. The render harness issues a deterministic fragment-shader-bound workload executed repeatedly for a fixed window after warm-up. Each frame forces pipeline completion with synchronous GPU read-back to ensure timing reflects actual GPU execution, not asynchronous queuing. Recorded data includes raw per-frame render times, platform metadata, unmasked GPU renderer string, and timer resolution.

4. Feature extraction: Offline, distributional timing statistics per session are derived, including mean and median render times, dispersion metrics (standard deviation, coefficient of variation, inter-quartile range), shape statistics (skewness, kurtosis), frame-to-frame jitter (mean absolute difference of adjacent frames), and timer quantization ratio (distinct timing values divided by frame count).

5. Training regime and evaluation: Classification models are evaluated with device-held-out splits, where all samples from specific GPUs are either in training or testing, preventing leakage that would inflate accuracy. This ensures testing on truly unseen hardware. Metrics and classifiers are not fully detailed, as results are reported mainly via pilot-scale statistical comparisons of feature distributions.

6. Negative class matrix: The negative automation class includes a spectrum of renderers from purely software (SwiftShader, CPU fallback) to headless browsers on real GPUs, isolating the confound that timing differences may result from hardware vs. software pipeline.

7. Ethical considerations: No third-party scanning or probing occurred. Positive samples were contributed by informed consent on a single public page. Negative samples arise from self-operated automation against the same endpoint. No identifying cookies or persistent trackers are involved, maintaining user privacy.

Concrete flow example: A consenting human visitor opens the page, the WebGL harness initiates the fragment-shader rendering loop while measuring per-frame GPU execution time after warm-up. The client posts collected timing data plus metadata back to the server. Simultaneously, automation clients visit the same page with headless browsers scripted to run the same rendering code. The system compares timing statistics of each session under device-held-out test splits to distinguish between human and automated renderers based on timing behavior and dispersion features.

Technical innovations

• Use of real-silicon GPU render timing dynamics under a controlled WebGL workload as a passive classification signal to distinguish humans from bots.
• Differentiation from WebGL fingerprinting by focusing on transient render timing rather than static pixel output hashes, avoiding persistent device identification and privacy issues.
• A single-endpoint methodology collecting timing samples labeled by consented browser sessions and keyed headless automation for ground-truth classes.
• Confound-controlled analysis separating headless automation on real GPUs from interactive human use based on higher jitter, timer quantization, and coefficient of variation features.
• Empirical characterization showing that dominant in-the-wild adversary traffic is render-free, thus a render-timed challenge effectively filters most automated bots upfront.

Datasets

• Pilot classification dataset—26 human sessions from 13 distinct GPUs—public endpoint user traffic with volunteered consent.
• Negative class dataset—273 software bot sessions from 4 software rendering backends (SwiftShader, SwANGLE, CPU fallback) run under Chromium, Firefox, WebKit headless browsers, and 20 hard-negative sessions from headless browsers on 2 real Intel GPUs.

Baselines vs proposed

• Software-rendered automation mean frame render time: 26.3 ms vs. genuine GPU: 5.1 ms (5.2× slower).
• Confound-controlled (Intel GPUs, Chromium/ANGLE): timer quantization ratio human 0.076 vs. bot 0.249 (+106%), frame jitter 0.351 ms vs. 0.912 ms (+89%), coefficient of variation 0.112 vs. 0.247 (+75%).
• Mean frame render time in confound-controlled split: human 5.78 ms, bot 8.25 ms (+35%).

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.23389.

Fig 1: CAPTCHA families organized by the property a client must reproduce to pass. Prior families verify cognition (visual puzzles),

Fig 2: Mean frame render time by class (log scale). Software

Fig 3: Per-feature distributions, Intel GPUs under matched en-

Fig 4: Two-feature space (jitter vs. quantization ratio). Humans

Limitations

• Data and analysis currently limited to a single GPU architecture: Intel integrated GPUs; no results yet on discrete NVIDIA/AMD or Apple Silicon hardware.
• Pilot-scale dataset is relatively small (26 human sessions, 20 hard negatives), insufficient for a fully trained classifier or comprehensive error characterization.
• Potential adversarial adaptation includes rendering on real hardware or injecting synthetic timing jitter, raising cost but not eliminating the signal.
• Impact of browser timer hardening (coarsening/jittering of JavaScript timers) on signal strength is not quantified at the population level.
• Cross-architecture generalization and robustness remain open questions pending collection on broader device families.
• The methodology does not address potential side-channel leakage from advanced spoofing or low-level GPU driver modifications.

Open questions / follow-ons

• Can the render timing classification signals shown on Intel integrated GPUs generalize to discrete GPUs from NVIDIA, AMD, and Apple Silicon architectures?
• What is the robustness of render-timing signals against sophisticated adversarial spoofing strategies such as injecting synthetic jitter or fine-grained timing manipulation?
• How does browser timer hardening and coarsening policies impact the fidelity and usefulness of render timing signals in real-world deployments?
• Can render timing signals be combined with behavioral biometrics and traditional puzzle CAPTCHAs into a multi-signal risk scoring system with practical deployment and acceptable user friction?

Why it matters for bot defense

For bot-defense practitioners, this work offers a promising complementary signal for bot classification beyond traditional puzzle-solving or behavioral biometrics. By exploiting physical GPU timing characteristics under WebGL rendering workloads, a CAPTCHA system can passively and quickly assess whether a client has authentic hardware execution properties, filtering out the large portion of render-free automatic bots in the wild. The absence of persistent device identifiers in this approach addresses privacy concerns associated with WebGL fingerprinting and cryptographic attestation frameworks.

However, practical integration requires further validation across GPU architectures and adaptation to potential adversarial jitter injection. The single-endpoint collection method described could be adapted for ongoing signal calibration and classifier retraining in production. Render timing adds a near-immediate, low-friction challenge that complements interactive behavioral signals and puzzle CAPTCHAs, enhancing robustness against increasingly capable AI and headless browser automation attacks.

Cite

@article{arxiv2607_23389,
  title={ Rendering on Real Silicon: GPU Render-Timing as a Passive, AI-Resistant CAPTCHA Signal },
  author={ David Noever and Forrest McKee },
  journal={arXiv preprint arXiv:2607.23389},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.23389}
}

Read the full paper

• arXiv:2607.23389 (abstract)
• arXiv:2607.23389 (PDF)