ShiftCAPTCHA — adversarial benchmark

Run: shiftcaptcha-bench-1778131187    Trials: 2,000 per class    Difficulty: medium    Engine: shift_captcha.cpython-313-x86_64-linux-gnu.so
sha256: ec08672d38faa864b92656b7c03491c9ecad000b09e7d993a65ec4b8939561a5   pubkey: 8c51880cd4713f7503a9687bc0370c1c
Worst-class result (read this first):
The attacker class with the highest pass rate is straight_segments at 47.65% of 2,000 trials, difficulty medium. Validiti publishes the worst number — not the best. The drift signature feed at signatures.validiti.com/captcha/feed.jsonl closes classes as they're identified; deployments running the receiver poll it every 60 s by default.
Attacker classTrialsPassedPass rate 95% CIMean scoreElapsed
naive_linear2,00000.00%0.00% – 0.19%0.5380.78s
straight_segments2,00095347.65%45.47% – 49.84%0.8250.98s
bezier_no_noise2,00000.00%0.00% – 0.19%0.7741.26s
bartimaeus_basic2,000462.30%1.73% – 3.05%0.8341.16s
bartimaeus_humanized2,00040620.30%18.59% – 22.12%0.8261.23s
wrong_order2,00000.00%0.00% – 0.19%0.6351.15s
replay_attack2,00000.00%0.00% – 0.19%0.6350.52s

How to read this

Every row is a synthetic attacker class generating CAPTCHA submissions in a different way and submitting them to the same sealed Validator that ships in every distribution shape. The validator returns a passed boolean plus a confidence score and a list of flags; this table aggregates pass rates across thousands of trials with Wilson-score 95% confidence intervals.

Known gaps

The validator weights timing realism more heavily than path-shape regularity. A bot that produces a perfectly-straight path with realistic inter-connection delays — the straight_segments class above — slips past at a meaningfully higher rate than the more-sophisticated bartimaeus_humanized. This is a known gap and is exactly why ShiftCAPTCHA ships a drift signature feed: classes identified in adversarial testing become signed signatures (matched on motor_entropy_max, solve_ms_max, idle_streak_min) and propagate to every customer instance within one poll interval.

Customers running their own threat-intel work can mint signatures against attack classes they observe in production and submit them to the public feed (paid drift-publishing tier, post-launch). Internal-only signatures (a customer's fleet only, never public) are also supported via a private feed URL.

Reproducing

git clone https://github.com/validiti/shiftcaptcha
cd shiftcaptcha
bash deploy/shiftcaptcha/dist/server/pack_runtime.sh
python3 deploy/shiftcaptcha/dist/benchmark/adversarial_harness.py \
    --trials 2000 --difficulty medium