Pith. sign in

REVIEW 3 major objections 6 minor 1 cited by

Automatically generated text rebuses let web services impose a tunable 9.2x token-cost asymmetry on LM-powered agents before granting access — a CAPTCHA replacement for text-only endpoints.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Rebus-based reasoning gates, puzzles built from random word/domain clue sets, impose token costs on LM web agents that are up to 9.2x the generator's cost.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection Novel gate construction and a real generation pipeline, but the cheap-bypass property is asserted, not shown, and the gate's per-letter independence invites the bypass. the 3 major comments →

arxiv 2509.01619 v1 pith:4U2FTTH4 submitted 2025-09-01 cs.AI cs.CRcs.LG

Throttling Web Agents Using Reasoning Gates

Abhinav Kumar , Jaechul Roh , Ali Naseh , Amir Houmansadr , Eugene Bagdasarian This is my paper
classification cs.AI cs.CRcs.LG
keywords web agent throttlingreasoning gatesrebus puzzlescomputational asymmetrytoken costCAPTCHA alternativesscraping defenseMCP servers
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that web services can defend against floods of LM-powered agents without CAPTCHAs: issue a text puzzle that forces the agent's language model to burn output tokens before it gets the resource. The proposed gate is a rebus — several cross-domain clues whose first letters spell a hidden word — chosen because solving it requires multi-hop reasoning that existing puzzle formats (coding, math, trivia, constraint problems) either cannot scale or cannot verify cheaply. The headline evidence is computational asymmetry: generating a hard gate with a small model costs about 4.9k output tokens, while solving it with a state-of-the-art reasoning model costs about 46k tokens, a 9.2x ratio (5.2x average for non-reasoning models, 6.4x for reasoning models). If the framework works as claimed, providers gain a text-only, difficulty-tunable throttle that functions over plain APIs and MCP servers, shifting the economics of mass scraping and agent-borne denial-of-service.

Core claim

A provider can throttle LM-powered web agents by issuing 'Reasoning Gates': auto-generated rebus puzzles where each clue is a fact from a different domain and the first letters of the answers spell a hidden word. A small model (o3-mini) spends about 4.9k tokens to generate a hard gate; a state-of-the-art solver (DeepSeek R1) spends about 46k to solve it — a 9.2x asymmetry, with averages of 5.2x for non-reasoning and 6.4x for reasoning models. The paper additionally claims scalability (about 0.01% hallucination in large-scale generation from word/domain banks), robustness (human solvers take roughly 11 minutes and mostly fail; fine-tuning and many-shot in-context learning improve accuracy onl

What carries the argument

The rebus-based Reasoning Gate (rRG) is the load-bearing object: a text puzzle generated by sampling a random English word and a bank of knowledge domains, then asking an LM to write one clue per letter such that each clue's answer starts with the corresponding letter. Solving requires multi-hop cross-domain retrieval and symbolic composition — each letter alone is cheap, but the full chain forces many output tokens. This converts the server's cheap generation (a small word/domain search space) into the agent's expensive generation (multi-step reasoning over a large space), realizing computational asymmetry; verification is constant-time string equality against precomputed hashes, so nothing

Load-bearing premise

The whole mechanism assumes the attacker's binding cost is buying output tokens from a hosted language model; an attacker who runs a cheap local model, answers clues with parallel searches, or outsources individual clues pays nowhere near that cost, and the measured asymmetry stops deterring.

What would settle it

Run each clue of a hard gate as an independent query — through a search engine, a small local open-weight model, or a low-cost API — and measure the total end-to-end cost (tokens times price, plus latency) to produce the hidden word. If an adversary can assemble the answer for a small fraction of the 46k tokens DeepSeek R1 burns, the 9.2x asymmetry collapses toward zero and the gate no longer deters; the paper reports no such decomposed-attack measurement.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Text-only endpoints — plain APIs and MCP servers, where CAPTCHAs cannot run — gain a throttling mechanism whose server-side verification is constant-time string matching.
  • High-volume scraping and agent-borne denial-of-service become economically unattractive: each successfully solved gate costs an attacker tens of thousands of reasoning tokens.
  • Difficulty and pass thresholds are tunable, so a service can admit weak-but-benign agents while escalating cost for high-rate traffic.
  • Cascading gates with authentication or attestation lets verified humans and legacy users bypass the puzzles while anonymous agent traffic still pays.
  • Cheap gate generation with small models (o3-mini) means providers do not need frontier infrastructure to challenge even the strongest reasoning models.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper's adversarial tests stop at fine-tuning and many-shot prompting; the untested natural attack is decomposing a gate — one search query or cheap local-model call per clue — which the 17-second MCP pass in Table 3 suggests is plausible and would dissolve the measured token asymmetry.
  • Because difficulty tiers sort models by reasoning ability, the same offline gate bank could double as a lightweight agent-capability benchmark or as an adaptive limiter that raises difficulty with request volume.
  • The paper's proof-of-useful-work analogy points to a greener variant: if the reasoning compute spent on gates could be folded into genuinely useful model work, deployment's environmental cost would shrink while the throttle remains.
  • If gate banks become a hosted service, whoever operates the bank gains a central control point over access to large parts of the web — a governance risk the paper acknowledges only implicitly.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This paper introduces Web Agent Throttling, a mechanism that requires LM-based web agents to solve challenges before accessing a resource. It formalizes four criteria — computational asymmetry, scalability, robustness to adversaries, and compatibility — and argues that existing puzzle types fail them. The proposed rebus-based Reasoning Gates (rRGs) are text puzzles in which each letter of a hidden word is obtained as the first letter of the answer to a factual clue from a sampled domain/word bank. The paper describes a two-step LM-based generation protocol (Algorithms 1 and 2), an online verification protocol (Algorithm 3), a token-cost asymmetry evaluation reporting a 9.2x maximum generation-to-response asymmetry, a human/gig-worker study, live website and MCP deployments, and an adaptive-adversary study with many-shot ICL and fine-tuning. The central claim is that rRGs impose a tunable, text-only, computationally asymmetric cost on agents while remaining cheap for the provider to generate and verify.

Significance. If the core asymmetry claim survives, the framework is a useful complement to CAPTCHAs and proof-of-work for text-only agents and MCP/API endpoints. Strengths include a clear problem formalization, explicit threat-model properties, public artifacts/code, real deployments on a website and MCP server, and a human study. The main unresolved risk is that the measured asymmetry may be an artifact of evaluating a single monolithic prover: the puzzle structure decomposes into independent per-letter lookups, and Section 6.3 does not test search-assisted or parallelized bypasses. Because R1 and A3 are the load-bearing security properties, additional adversary measurements are necessary before the throttling guarantee can be considered established.

major comments (3)
  1. [Section 5.3 / Table 2 / Section 6.3] The robustness property R1 ("resistance to cheap shortcuts") is asserted but not tested against the most natural attack on this construction. Each clue in an rRG is an independent factual lookup (e.g., Table 2: "Ancient epic that recounts the siege of Troy" -> "Iliad"), and the final answer is the concatenation of first letters; there is no cross-clue dependency. An adversary can parallelize per-clue lookups with cheap search or small local models and assemble the answer. Section 6.3 tests only many-shot ICL and fine-tuning; Table 3's 17-second MCP solve by o3 does not address a decomposed solver. The 46k-token R1 cost in Section 6.2 is evidence about a monolithic prover, not an intrinsic property of the gate. I request an explicit per-clue search-assisted/parallel baseline with end-to-end wall-clock and cost measurements; if this baseline solves gates quickly, A3 and R1 are not met.
  2. [Section 6.2 / Figure 3] The abstract and Section 1 present the asymmetry as 9.2x, but Section 6.2 defines this as the maximum over prover models on the "extremely difficult" subset (o3-mini as generator, DeepSeek R1 as prover). The average for reasoning models is 6.4x, and the non-reasoning average is 5.2x. Reporting only the maximum overstates the typical asymmetry and makes the result look parameter-free. Please report the full distribution (medians, quartiles) and, ideally, the generation/verification cost of the online protocol including offline precomputation amortization. This is needed to support the quantitative claims behind A3 and C1.
  3. [Algorithm 1 / Table 4] Difficulty labels are constructed from the same responder models used to demonstrate difficulty discrimination. In Algorithm 1, a challenge is accepted into level ℓ only when exactly the chosen model subset At_ℓ solves it (lines 9-16). Table 4 then shows that stronger models solve more "hard" challenges. The monotonic accuracy drop is therefore partly a restatement of the labeling rule, not an independent validation of tunable difficulty. I recommend validating the difficulty scale with an external signal (e.g., clue count, word frequency, human calibration, or held-out models not used in labeling) before claiming C1.
minor comments (6)
  1. [Section 6.2] The sentence "generation cost is significantly cheaper than the verification cost" should read "solution/response cost"; verification is constant-time string matching and is not the cost measured.
  2. [Table 3 / Section 6.2] The text says MCP agents took 24 seconds on average, but Table 3 reports 0:30 for o3-mini and 0:17 for o3. Please align the numbers.
  3. [Algorithm 3] Line 8 of Algorithm 3 appears to be a typo: "r ← Cr + 1" should be "Cr ← Cr + 1".
  4. [Appendix A] The captions for Figures 8, 9, and 10 are identical ("Full specification for generating layered reasoning rebus gates"); the prover-prompt and difficulty-tuner captures should be distinct.
  5. [Section 5.1] The formulation of the generation function is incomplete: after introducing [d1,...,dm], the text says "and [w1,...,wm]" without completing the definition of the word bank.
  6. [Appendix B] The artifact link in Section B is an anonymous URL while the abstract lists a GitHub repository; the authors should reconcile these links before publication.

Circularity Check

1 steps flagged

Central 9.2x asymmetry is measured, not derived; one difficulty-control validation is self-definitional; minor self-citation is not load-bearing.

specific steps
  1. self definitional [Section 5.1 (Algorithm 1, Step A) and Section 6.2 (Table 4, 'Offline Sample Generation Quality')]
    "Select Atℓ ⊆ At ... Rℓ ← {A(c) ∀ A ∈ Atℓ} ... Rc ← {A(c) ∀ A ∈ At \ Atℓ} ... if set(z) =set(Rℓ) then if set(Rℓ) ∩ set(Rc) is ∅ then Append (c,z) to Cℓ"

    Algorithm 1 labels a challenge as difficulty ℓ only when exactly the models in Atℓ solve it and no model in At \ Atℓ solves it. Table 4 then reports that GPT-4o, o3-mini, and o3 accuracy drops as difficulty increases and presents this as 'quality of difficulty control.' That monotonic ordering is not an empirical discovery; it is the selection rule used to assign the difficulty labels. Thus the difficulty-control validation collapses into the construction of the ICL example bank. This does not affect the main token-asymmetry measurement, which compares observed generator and responder token counts rather than being derived from the same labeling rule.

full rationale

The central claim—a 9.2x token-generation asymmetry for reasoning gates—is an empirical result: o3-mini uses ~4.9k tokens to generate challenges while DeepSeek R1 uses ~46k tokens to respond. No parameter is fitted to produce this ratio, and the measurement is independently reported in Figure 3 and Section 6.2. The one genuine circular step is the difficulty-calibration validation: Algorithm 1 defines a challenge's difficulty by the subset of responder models that can solve it, so Table 4's accuracy-by-difficulty ordering is true by construction. This is a secondary validation of property C1, not the core asymmetry claim. The paper also cites the authors' own Overthink work [53] to motivate overthinking risk, but this citation is not load-bearing because the paper directly measures the token costs that support its asymmetry claim. The skeptic's concern that rRG clues are independent and can be parallelized or solved by web search is a robustness limitation (R1), not circularity; Section 7 explicitly acknowledges that 'the impact of high-resource adversaries remains open.' Overall, the central derivation is self-contained and empirical, with only a minor self-definitional validation in the difficulty-control component.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 0 invented entities

The central claim rests on measured token asymmetry, which is an empirical quantity rather than a derived law. The main unpaid-for inputs are the adversary cost model (tokens), the correctness of the solvability checker, and the difficulty calibration relative to the evaluator models.

free parameters (3)
  • Difficulty levels L and per-level calibration = Easy, Medium, Hard, Extremely difficult
    Algorithm 1 labels a challenge 'hard' only if the intended model subset solves it and others do not; the ordinal scale is relative to the chosen response models, not an absolute difficulty metric. Every difficulty-dependent result depends on this hand-chosen calibration.
  • Tnum and Tmin = Not specified
    Algorithm 3 defines throttling strength via maximum challenges and minimum correct answers, but the paper gives no default values or tuning guidance, so deployed strength is not reproducible from the text.
  • Generator thinking budget = 100-token budget for Gemini 2.5-Flash, default for o3-mini
    Generation cheapness (A1) is measured with a restricted budget; an unrestricted generator would change the asymmetry ratio.
axioms (5)
  • domain assumption The adversary controls at least one LM, cannot access the random seeds of the gate mechanism, and aims at DoS or large-scale scraping.
    Stated in the Threat Model in Section 3.2. If the adversary can observe or manipulate gate construction, the mechanism is bypassable.
  • domain assumption Output token count is the correct proxy for the adversary's cost.
    Section 6.1 chooses tokens over monetary cost; the 9.2x asymmetry is purely token-based, and local inference or batched APIs would change the economics.
  • domain assumption The solvability checker LM S correctly determines whether a generated challenge has the intended solution.
    Algorithms 1 and 2 rely on S to reject bad generations; no independent validation of S's error rate is reported, so unsolvable or mislabeled challenges may enter the bank.
  • domain assumption Rebus gates are not cheaply solvable by per-clue web search, solver APIs, or gig-worker outsourcing.
    R1 in Section 3.3 and the robustness discussion in Section 5.3 assert this, but the evaluations in Table 3 and Table 6 do not include a search-assisted or per-clue adversary baseline.
  • domain assumption A solver that emits more tokens is actually charged more, making token asymmetry an economic throttle.
    The paper treats token generation as a computational or financial cost in Sections 2 and 4.2; this is assumed rather than demonstrated for self-hosted or cached deployments.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Throttling Web Agents Using Reasoning Gates." pith.science (2026). https://pith.science/paper/4U2FTTH4

@misc{pith2026250901619,
  author       = {Pith},
  title        = {Pith review of: Throttling Web Agents Using Reasoning Gates},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4U2FTTH4}},
  note         = {Machine review of arXiv:2509.01619}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

AI web agents use Internet resources at far greater speed, scale, and complexity -- changing how users and services interact. Deployed maliciously or erroneously, these agents could overload content providers. At the same time, web agents can bypass CAPTCHAs and other defenses by mimicking user behavior or flood authentication systems with fake accounts. Yet providers must protect their services and content from denial-of-service attacks and scraping by web agents. In this paper, we design a framework that imposes tunable costs on agents before providing access to resources; we call this Web Agent Throttling. We start by formalizing Throttling Gates as challenges issued to an agent that are asymmetric, scalable, robust, and compatible with any agent. Focusing on a common component -- the language model -- we require the agent to solve reasoning puzzles, thereby incurring excessive token-generation costs. However, we find that using existing puzzles, e.g., coding or math, as throttling gates fails to satisfy our properties. To address this, we introduce rebus-based Reasoning Gates, synthetic text puzzles that require multi-hop reasoning over world knowledge (thereby throttling an agent's model). We design a scalable generation and verification protocol for such reasoning gates. Our framework achieves computational asymmetry, i.e., the response-generation cost is 9.2x higher than the generation cost for SOTA models. We further deploy reasoning gates on a custom website and Model Context Protocol (MCP) servers and evaluate with real-world web agents. Finally, we discuss the limitations and environmental impact of real-world deployment of our framework.

Figures

Figures reproduced from arXiv: 2509.01619 by Abhinav Kumar, Ali Naseh, Amir Houmansadr, Eugene Bagdasarian, Jaechul Roh.

Figure 1
Figure 1. Figure 1: Reasoning gates framework. Perplexity, an AI startup, of using anonymous web agents to intentionally bypass its anti-scraping defenses [22]. We argue that to prevent abuse and ensure equitable access, we should deploy mechanisms that enable web services to ef￾fectively throttle emerging web agents, i.e., impose delays and costs on resource access. Note that throttling the automated use of Internet resource… view at source ↗
Figure 2
Figure 2. Figure 2: Reasoning gate generation pipeline. The framework pre-computes rRGs in two steps. Step A (Sample Generation): A generator LM produces candidate challenges, which are filtered by evaluators and responder models of varying reasoning capabilities to construct high-quality ICL example labeled with difficulty. Step B (Large-scale generation): Using these examples, the generator LM creates a large challenge bank… view at source ↗
Figure 3
Figure 3. Figure 3: Comparison of token efficiency between generation and prover models. (left) Average tokens used by the generation model vs. total tokens used by the prover model (no reasoning). (right) Average tokens used by the generation model vs. total tokens used by the prover model (with reasoning). gpt-4o o3-mini o3 Response Models o3 o3-mini Generator Models gpt-4o 44.0 76.0 96.0 68.0 84.0 96.0 72.0 88.0 96.0 Gener… view at source ↗
Figure 4
Figure 4. Figure 4: Accuracy of models when used as both challenge generators (rows) and responders (columns). Stronger gen￾erator models (e.g., o3) produce harder and more discrimina￾tive challenges, leading to sharper accuracy drops for weaker responders, while o3 remains robust across all generated tasks. These results show that, for both reasoning and non￾reasoning models, the generation cost is significantly cheaper than… view at source ↗
Figure 5
Figure 5. Figure 5: Hallucination rate of generation. Rate of words and domains that were generated outside of the given lists. and domains (property S1) [PITH_FULL_IMAGE:figures/full_fig_p012_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Number of unsolvable questions per 100 gener￾ated questions. problems in the most difficult set, dropping the accuracy of GPT-4o and o3-mini to 0%. This shows that the samples generated by Gicl serve as good ICL examples for large-scale generation. In [PITH_FULL_IMAGE:figures/full_fig_p012_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Performance by Difficulty. Models show decreas￾ing accuracy as task difficulty increases. token usage than all other benchmarks for both reasoning models (up to 300 tokens) and non-reasoning models (up to 4.8k tokens), indicating that our challenges enable more ef￾fective throttling. We also observe that Reasoning Gates yield the largest gap in average accuracy between reasoning and non-reasoning models, w… view at source ↗
Figure 8
Figure 8. Figure 8: Full specification for generating layered reasoning rebus gates. 20 [PITH_FULL_IMAGE:figures/full_fig_p020_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Full specification for generating layered reasoning rebus gates. Difficulty Tuning Command for ICL Generation Step "First":"Generate first gate", "Increase":"Generate another gate and increase difficulty", "Maintain":"Good, maintain difficulty and ambiguity generate another gate", "Reduce":"generate new problems with reduced difficulty" [PITH_FULL_IMAGE:figures/full_fig_p021_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Full specification for generating layered reasoning rebus gates. 21 [PITH_FULL_IMAGE:figures/full_fig_p021_10.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. From Question Answering to Task Completion: A Survey on Agent System and Harness Design

    cs.AI 2026-06 unverdicted novelty 4.0

    Survey framing LLM agents as model-plus-harness systems, decomposing harness responsibilities, mapping them to tasks, and highlighting open challenges in evaluation, safety, and co-evolution.

Reference graph

Works this paper leans on

120 extracted references · 42 canonical work pages · cited by 1 Pith paper · 7 internal anchors

  1. [1]

    Scalable time-lock puzzles

    Aydin Abadi, Dan Ristea, Artem Grigor, and Steven J Murdoch. Scalable time-lock puzzles. Cryptology ePrint Archive, 2023

    2023

  2. [2]

    Moderately hard, memory-bound func- tions

    Martin Abadi, Michael Burrows, Mark Manasse, and Ted Wobber. Moderately hard, memory-bound func- tions. ACM TOIT, 2005

    2005

  3. [3]

    Many-shot in-context learning

    Rishabh Agarwal, Avi Singh, Lei Zhang, Bernd Bohnet, Luis Rosias, Stephanie Chan, Biao Zhang, Ankesh Anand, Zaheer Abbas, Azade Nova, et al. Many-shot in-context learning. Advances in Neural Information Processing Systems, 2024

    2024

  4. [4]

    Finding flawed fictions: Evaluating complex rea- soning in language models via plot hole detection

    Kabir Ahuja, Melanie Sclar, and Yulia Tsvetkov. Finding flawed fictions: Evaluating complex rea- soning in language models via plot hole detection. arXiv:2504.11900, 2025

    arXiv 2025

  5. [5]

    Threadbox: Sandboxing for Modular Security

    Maysara Alhindi and Joseph Hallett. Threadbox: Sand- boxing for modular security. arXiv:2506.23683, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  6. [6]

    Foundations, properties, and security applications of puzzles: A survey

    Isra Mohamed Ali, Maurantonio Caprolu, and Roberto Di Pietro. Foundations, properties, and security applications of puzzles: A survey. ACM CSUR, 2020

    2020

  7. [7]

    Introducing the Model Context Protocol — anthropic.com

    Anthropic. Introducing the Model Context Protocol — anthropic.com. https://www.anthropic.com/news/ model-context-protocol, 2024

    2024

  8. [8]

    Proofs of useful work

    Marshall Ball, Alon Rosen, Manuel Sabin, and Prashant Nalini Vasudevan. Proofs of useful work. Cryptology ePrint Archive, 2017

    2017

  9. [9]

    Proof of Work With External Utilities

    Yogev Bar-On, Ilan Komargodski, and Omri We- instein. Proof of work with external utilities. arXiv:2505.21685, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  10. [10]

    Attestation transparency: Building secure in- ternet services for legacy clients

    Jethro G Beekman, John L Manferdelli, and David Wagner. Attestation transparency: Building secure in- ternet services for legacy clients. In ACM on Asia Conference on Computer and Communications Secu- rity, 2016

    2016

  11. [11]

    802.11 {Denial- of-Service} attacks: Real vulnerabilities and practical solutions

    John Bellardo and Stefan Savage. 802.11 {Denial- of-Service} attacks: Real vulnerabilities and practical solutions. In USENIX Security, 2003

    2003

  12. [12]

    Equihash: Asymmetric proof-of-work based on the generalized birthday problem

    Alex Biryukov and Dmitry Khovratovich. Equihash: Asymmetric proof-of-work based on the generalized birthday problem. Ledger, 2017

    2017

  13. [13]

    unCaptcha: A Low-Resource defeat of re- Captcha’s audio challenge

    Kevin Bock, Daven Patel, George Hughey, and Dave Levin. unCaptcha: A Low-Resource defeat of re- Captcha’s audio challenge. In USENIX WOOT, 2017

    2017

  14. [14]

    Super: Evaluating agents on setting up and executing tasks from research reposito- ries

    Ben Bogin, Kejuan Yang, Shashank Gupta, Kyle Richardson, Erin Bransom, Peter Clark, Ashish Sab- harwal, and Tushar Khot. Super: Evaluating agents on setting up and executing tasks from research reposito- ries. arXiv:2409.07440, 2024

    Pith/arXiv arXiv 2024

  15. [15]

    Aiding the detection of fake accounts in large scale social online services

    Qiang Cao, Michael Sirivianos, Xiaowei Yang, and Tiago Pregueiro. Aiding the detection of fake accounts in large scale social online services. In NSDI, 2012

    2012

  16. [16]

    Evaluating large language models trained on code

    Mark Chen et al. Evaluating large language models trained on code. arXiv:2107.03374, 2021. 14

    Pith/arXiv arXiv 2021

  17. [17]

    Memorize or gener- alize? evaluating LLM code generation with evolved questions

    Wentao Chen, Lizhe Zhang, Li Zhong, Letian Peng, Zilong Wang, and Jingbo Shang. Memorize or gener- alize? evaluating LLM code generation with evolved questions. arXiv:2503.02296, 2025

    arXiv 2025

  18. [18]

    Embed the widget

    Cloudflare. Embed the widget. https : / / developers.cloudflare.com / turnstile / get - started/client-side-rendering/

  19. [19]

    Humanity wastes about 500 years per day on CAPTCHAs

    Cloudflare. Humanity wastes about 500 years per day on CAPTCHAs. It’s time to end this madness. https : / / blog .cloudflare.com / introducing - cryptographic-attestation-of-personhood/

  20. [20]

    Introducing cryptographic attestation of personhood

    Cloudflare. Introducing cryptographic attestation of personhood. Cloudflare Blog, 2021

    2021

  21. [21]

    Authorization · cloudflare agents docs

    Cloudflare. Authorization · cloudflare agents docs. https : / / developers.cloudflare.com / agents / model-context-protocol/authorization/, 2025. Accessed: 2025-08-26

    2025

  22. [22]

    Perplexity is using stealth, undeclared crawlers to evade website no-crawl directives

    Cloudflare. Perplexity is using stealth, undeclared crawlers to evade website no-crawl directives. https : / / blog .cloudflare.com / perplexity - is- using- stealth- undeclared- crawlers- to- evade-website-no-crawl-directives/ , January 2025

    2025

  23. [23]

    Denial of ser- vice via algorithmic complexity attacks

    Scott A Crosby and Dan S Wallach. Denial of ser- vice via algorithmic complexity attacks. In USENIX Security, 2003

    2003

  24. [24]

    Ai agents at the gate: Un- derstanding & securing against llm crawlers

    DataDome Threat Research. Ai agents at the gate: Un- derstanding & securing against llm crawlers. https: / / datadome.co / threat - research / ai - agents - llm-crawlers/, 2025

    2025

  25. [25]

    Oedipus: LLM-enhanced rea- soning CAPTCHA solver

    Gelei Deng, Haoran Ou, Yi Liu, Jie Zhang, Tianwei Zhang, and Yang Liu. Oedipus: LLM-enhanced rea- soning CAPTCHA solver. arXiv:2405.07496, 2024

    Pith/arXiv arXiv 2024

  26. [26]

    Mind2Web: Towards a generalist agent for the web

    Xiang Deng, Yu Gu, Boyuan Zheng, Shijie Chen, Sam Stevens, Boshi Wang, Huan Sun, and Yu Su. Mind2Web: Towards a generalist agent for the web. NeurIPS, 2023

    2023

  27. [27]

    Illusioncaptcha: A captcha based on visual illusion

    Ziqi Ding, Gelei Deng, Yi Liu, Junchen Ding, Jieshan Chen, Yulei Sui, and Yuekang Li. Illusioncaptcha: A captcha based on visual illusion. In WWW, 2025

    2025

  28. [28]

    Peb- bling and proofs of work

    Cynthia Dwork, Moni Naor, and Hoeteck Wee. Peb- bling and proofs of work. In CRYPTO, 2005

    2005

  29. [29]

    Llmcar- bon: Modeling the end-to-end carbon footprint of large language models

    Ahmad Faiz, Sotaro Kaneda, Ruhan Wang, Rita Osi, Prateek Sharma, Fan Chen, and Lei Jiang. Llmcar- bon: Modeling the end-to-end carbon footprint of large language models. arXiv preprint arXiv:2309.14393, 2023

    Pith/arXiv arXiv 2023

  30. [30]

    Language models can be logical solvers

    Jiazhan Feng, Ruochen Xu, Junheng Hao, Hiteshi Sharma, Yelong Shen, Dongyan Zhao, and Weizhu Chen. Language models can be logical solvers. arXiv:2311.06158, 2023

    Pith/arXiv arXiv 2023

  31. [31]

    ChatGPT crawler reflective DDoS vulnerability

    Benjamin Flesch. ChatGPT crawler reflective DDoS vulnerability. GitHub Security Advisory, January 2025. Security advisory

    2025

  32. [32]

    Omni-math: A universal olympiad level mathematic benchmark for large lan- guage models

    Bofei Gao, Feifan Song, Zhe Yang, Zefan Cai, Yibo Miao, Qingxiu Dong, Lei Li, Chenghao Ma, Liang Chen, Runxin Xu, et al. Omni-math: A universal olympiad level mathematic benchmark for large lan- guage models. arXiv:2410.07985, 2024

    Pith/arXiv arXiv 2024

  33. [33]

    Inducing high energy-latency of large vision-language models with verbose images

    Kuofeng Gao, Yang Bai, Jindong Gu, Shu-Tao Xia, Philip Torr, Zhifeng Li, and Wei Liu. Inducing high energy-latency of large vision-language models with verbose images. arXiv:2401.11170, 2024

    Pith/arXiv arXiv 2024

  34. [34]

    Denial-of-service poisoning attacks against large language models

    Kuofeng Gao, Tianyu Pang, Chao Du, Yong Yang, Shu-Tao Xia, and Min Lin. Denial-of-service poisoning attacks against large language models. arXiv:2410.10760, 2024

    Pith/arXiv arXiv 2024

  35. [35]

    Research on the security of vi- sual reasoning captcha

    Yipeng Gao, Haichang Gao, Sainan Luo, Yang Zi, Shudong Zhang, Wenjie Mao, Ping Wang, Yulong Shen, and Jeff Yan. Research on the security of vi- sual reasoning captcha. In USENIX Security, 2021

    2021

  36. [36]

    Reconstruct- ing hash reversal based proof of work schemes

    Jeff Green, Joshua Juen, Omid Fatemieh, Ravinder Shankesi, Dong Jin, and Carl A Gunter. Reconstruct- ing hash reversal based proof of work schemes. In USENIX Workshop LEET, 2011

    2011

  37. [37]

    REBUS: A Robust Evaluation Benchmark of Understanding Symbols

    Andrew Gritsevskiy, Arjun Panickssery, Aaron Kirt- land, Derik Kauffman, Hans Gundlach, Irina Grit- sevskaya, Joe Cavanagh, Jonathan Chiang, Lydia La Roux, and Michelle Hung. Rebus: A ro- bust evaluation benchmark of understanding symbols. arXiv:2401.05604, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  38. [38]

    Denial of service attacks

    Qijun Gu and Peng Liu. Denial of service attacks. Handbook of Computer Networks: Distributed Net- works, Network Planning, Control, Management, and New Trends and Applications, 3:454–468, 2007

    2007

  39. [39]

    Design and evaluation of a heterogeneous lightweight blockchain-based mar- ketplace

    Javier Antonio Guerra, Juan Ignacio Guerrero, Se- bastián García, Samuel Domínguez-Cid, Diego Fran- cisco Larios, and Carlos León. Design and evaluation of a heterogeneous lightweight blockchain-based mar- ketplace. Sensors, 2022

    2022

  40. [40]

    Putnam-AXIOM: A functional & static bench- mark for measuring higher level mathematical reason- ing in LLMs

    Aryan Gulati, Brando Miranda, Eric Chen, Emily Xia, Kai Fronsdal, Bruno de Moraes Dumont, and Sanmi Koyejo. Putnam-AXIOM: A functional & static bench- mark for measuring higher level mathematical reason- ing in LLMs. In ICML, 2024. 15

    2024

  41. [41]

    The OAuth 2.0 authorization frame- work

    Dick Hardt. The OAuth 2.0 authorization frame- work. Technical report, Internet Engineering Task Force, 2012

    2012

  42. [42]

    Model context protocol (MCP) at first glance: Studying the security and maintainabil- ity of MCP servers

    Mohammed Mehedi Hasan, Hao Li, Emad Fal- lahzadeh, Gopi Krishnan Rajbahadur, Bram Adams, and Ahmed E Hassan. Model context protocol (MCP) at first glance: Studying the security and maintainabil- ity of MCP servers. arXiv:2506.13538, 2025

    Pith/arXiv arXiv 2025

  43. [43]

    Olympiadbench: A challenging benchmark for promoting agi with olympiad-level bilingual multimodal scientific prob- lems

    Chaoqun He, Renjie Luo, Yuzhuo Bai, Shengding Hu, Zhen Leng Thai, Junhao Shen, Jinyi Hu, Xu Han, Yu- jie Huang, Yuxiang Zhang, et al. Olympiadbench: A challenging benchmark for promoting agi with olympiad-level bilingual multimodal scientific prob- lems. arXiv:2402.14008, 2024

    Pith/arXiv arXiv 2024

  44. [44]

    Cryptographic puzzle-based defence mechanism for DDoS attacks in the QUIC protocol, 2024

    Rongkuan He. Cryptographic puzzle-based defence mechanism for DDoS attacks in the QUIC protocol, 2024

    2024

  45. [45]

    Measuring mathematical prob- lem solving with the math dataset

    Dan Hendrycks et al. Measuring mathematical prob- lem solving with the math dataset. arXiv:2103.03874, 2021

    Pith/arXiv arXiv 2021

  46. [46]

    An ob- ject detection based solver for Google’s image re- CAPTCHA v2

    Md Imran Hossen, Yazhou Tu, Md Fazle Rabby, Md Nazmul Islam, Hui Cao, and Xiali Hei. An ob- ject detection based solver for Google’s image re- CAPTCHA v2. In RAID, 2020

    2020

  47. [47]

    Model context protocol (MCP): Land- scape, security threats, and future research directions

    Xinyi Hou, Yanjie Zhao, Shenao Wang, and Haoyu Wang. Model context protocol (MCP): Land- scape, security threats, and future research directions. arXiv:2503.23278, 2025

    Pith/arXiv arXiv 2025

  48. [48]

    MATH-Perturb: Bench- marking LLMs’ math reasoning abilities against hard perturbations

    Kaixuan Huang, Jiacheng Guo, Zihao Li, Xiang Ji, Ji- awei Ge, Wenzhe Li, Yingqing Guo, Tianle Cai, Hui Yuan, Runzhe Wang, et al. MATH-Perturb: Bench- marking LLMs’ math reasoning abilities against hard perturbations. In ICML, 2025

    2025

  49. [49]

    AutoScraper: A Progressive Understanding Web Agent for Web Scraper Generation

    Wenhao Huang, Zhouhong Gu, Chenghao Peng, Zhixu Li, Jiaqing Liang, Yanghua Xiao, Liqian Wen, and Zulong Chen. Autoscraper: A progressive un- derstanding web agent for web scraper generation. arXiv:2404.12753, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  50. [50]

    Shallow-deep networks: Understanding and mitigating network overthinking

    Yigitcan Kaya, Sanghyun Hong, and Tudor Dumitras. Shallow-deep networks: Understanding and mitigating network overthinking. In International conference on machine learning, 2019

    2019

  51. [51]

    Consensus from proof-of-work puzzles

    Patrik Keller. Consensus from proof-of-work puzzles. Master thesis, University of Innsbruck, 2018

    2018

  52. [52]

    Visualwebarena: Evaluating multimodal agents on realistic visual web tasks

    Jing Yu Koh, Robert Lo, Lawrence Jang, Vikram Duvvur, Ming Chong Lim, Po-Yu Huang, Graham Neu- big, Shuyan Zhou, Ruslan Salakhutdinov, and Daniel Fried. Visualwebarena: Evaluating multimodal agents on realistic visual web tasks. arXiv:2401.13649, 2024

    Pith/arXiv arXiv 2024

  53. [53]

    Overthink: Slowdown attacks on reasoning llms

    Abhinav Kumar, Jaechul Roh, Ali Naseh, Marzena Karpinska, Mohit Iyyer, Amir Houmansadr, and Eu- gene Bagdasarian. Overthink: Slowdown attacks on reasoning llms. arXiv:2502.02542, 2025

    arXiv 2025

  54. [54]

    Web-scraping ai bots cause disruption for scientific databases and journals

    Diana Kwon. Web-scraping ai bots cause disruption for scientific databases and journals. Nature, 2025

    2025

  55. [55]

    Commercial llm agents are already vulnerable to simple yet dangerous attacks

    Ang Li, Yin Zhou, Vethavikashini Chithrra Raghuram, Tom Goldstein, and Micah Goldblum. Commercial llm agents are already vulnerable to simple yet dangerous attacks. arXiv:2502.08586, 2025

    Pith/arXiv arXiv 2025

  56. [56]

    TaskMatrix.AI: Completing tasks by con- necting foundation models with millions of APIs

    Yaobo Liang, Chenfei Wu, Ting Song, Wenshan Wu, Yan Xia, Yu Liu, Yang Ou, Shuai Lu, Lei Ji, Shaoguang Mao, et al. TaskMatrix.AI: Completing tasks by con- necting foundation models with millions of APIs. In- telligent Computing, 2024

    2024

  57. [57]

    ZebraLogic: On the scaling limits of llms for logical reasoning

    Bill Yuchen Lin, Ronan Le Bras, Kyle Richardson, Ashish Sabharwal, Radha Poovendran, Peter Clark, and Yejin Choi. ZebraLogic: On the scaling limits of llms for logical reasoning. In ICML, 2025

    2025

  58. [58]

    ExpShield: Safeguard- ing web text from unauthorized crawling and language modeling exploitation

    Ruixuan Liu, Toan Tran, Tianhao Wang, Hongsheng Hu, Shuo Wang, and Li Xiong. ExpShield: Safeguard- ing web text from unauthorized crawling and language modeling exploitation. arXiv:2412.21123, 2024

    work page arXiv 2024

  59. [59]

    Forget IPs: using cryptography to verify bot and agent traffic.Cloudflare Blog, May 2025

    Thibault Meunier and Mari Galicer. Forget IPs: using cryptography to verify bot and agent traffic.Cloudflare Blog, May 2025

    2025

  60. [60]

    Internet denial of service: attack and defense mechanisms (Radia Perlman Computer Net- working and Security)

    Jelena Mirkovic, Sven Dietrich, David Dittrich, and Peter Reiher. Internet denial of service: attack and defense mechanisms (Radia Perlman Computer Net- working and Security). Prentice Hall PTR, 2004

    2004

  61. [61]

    Re: Captchas: Understanding captcha-solving services in an economic context

    Marti Motoyama, Kirill Levchenko, Chris Kanich, Da- mon McCoy, Geoffrey M V oelker, and Stefan Savage. Re: Captchas: Understanding captcha-solving services in an economic context. In USENIX Security, 2010

    2010

  62. [62]

    The Hidden Dangers of Browsing AI Agents

    Mykyta Mudryi, Markiyan Chaklosh, and Grzegorz W ˘Ałjcik. The hidden dangers of browsing ai agents. arXiv:2505.13076, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  63. [63]

    s1: Simple test-time scaling

    Niklas Muennighoff, Zitong Yang, Weijia Shi, Xi- ang Lisa Li, Li Fei-Fei, Hannaneh Hajishirzi, Luke Zettlemoyer, Percy Liang, Emmanuel Candès, and Tatsunori Hashimoto. s1: Simple test-time scaling. arXiv:2501.19393, 2025

    Pith/arXiv arXiv 2025

  64. [64]

    2025 advanced 16 persistent bot report: Scraper bots deep-dive

    Tafara Muwandi, David Warburton, Merlyn Albery- Speyer, and Malcolm Heath. 2025 advanced 16 persistent bot report: Scraper bots deep-dive. https : / / www.f5.com / labs / articles / threat - intelligence/2025-advanced-persistent-bot- report- scraper- bots- deep- dive, March 2025. F5 Labs blog. Accessed: 2025-08-24

    2025

  65. [65]

    Browser use: Enable ai to control your browser

    Magnus Müller and Gregor Žuni ˇc. Browser use: Enable ai to control your browser. https : / / github.com/browser-use/browser-use, 2025. Ac- cessed: 2025-07-16

    work page 2025

  66. [66]

    CACTI: Captcha avoidance via client-side TEE integration

    Yoshimichi Nakatsuka, Ercan Ozturk, Andrew Paverd, and Gene Tsudik. CACTI: Captcha avoidance via client-side TEE integration. In USENIX Security, 2021

    work page 2021

  67. [67]

    Peter G. Neumann. Denial-of-service attacks. Com- mun. ACM, 43:136, 2000

    work page 2000

  68. [68]

    Game theory based defense mechanism against flooding attack using puzzle

    Raju Neyyan, Ancy Paul, Mayank Deshwal, and Amit Deshmukh. Game theory based defense mechanism against flooding attack using puzzle. ETCSIT, 2012

    work page 2012

  69. [69]

    A survey of webagents: Towards next-generation ai agents for web automation with large foundation models

    Liangbo Ning, Ziran Liang, Zhuohang Jiang, Haohao Qu, Yujuan Ding, Wenqi Fan, Xiao-yong Wei, Shanru Lin, Hui Liu, Philip S Yu, et al. A survey of webagents: Towards next-generation ai agents for web automation with large foundation models. In ACM SIGKDD, 2025

    work page 2025

  70. [70]

    Deep-captcha: a deep learning based captcha solver for vulnerability assess- ment

    Zahra Noury and Mahdi Rezaei. Deep-captcha: a deep learning based captcha solver for vulnerability assess- ment. arXiv:2006.08296, 2020

    Pith/arXiv arXiv 2006

  71. [71]

    Multi-factor authentication: A survey

    Aleksandr Ometov, Sergey Bezzateev, Niko Mäki- talo, Sergey Andreev, Tommi Mikkonen, and Yevgeni Koucheryavy. Multi-factor authentication: A survey. Cryptography, 2(1):1, 2018

    work page 2018

  72. [72]

    Introducing OpenAI o3 and o4-mini

    OpenAI. Introducing OpenAI o3 and o4-mini. https: //openai .com/index/introducing- o3- and- o4- mini/, 2025

    work page 2025

  73. [73]

    Logic-lm: Empowering large language models with symbolic solvers for faithful logical reasoning

    Liangming Pan, Alon Albalak, Xinyi Wang, and William Yang Wang. Logic-lm: Empowering large language models with symbolic solvers for faithful logical reasoning. arXiv:2305.12295, 2023

    Pith/arXiv arXiv 2023

  74. [74]

    Multi-logieval: Towards evaluating multi- step logical reasoning ability of large language models

    Nisarg Patel, Mohith Kulkarni, Mihir Parmar, Aashna Budhiraja, Mutsumi Nakamura, Neeraj Varshney, and Chitta Baral. Multi-logieval: Towards evaluating multi- step logical reasoning ability of large language models. arXiv:2406.17169, 2024

    Pith/arXiv arXiv 2024

  75. [75]

    Perplexity ai response on x

    Perplexity AI. Perplexity ai response on x. https : / / x .com / perplexity_ai / status / 1952531537385456019, February 2025

    work page 2025

  76. [76]

    Hu- manity’s last exam

    Long Phan, Alice Gatti, Ziwen Han, Nathaniel Li, Josephina Hu, Hugh Zhang, Chen Bo Calvin Zhang, Mohamed Shaaban, John Ling, Sean Shi, et al. Hu- manity’s last exam. arXiv:2501.14249, 2025

    Pith/arXiv arXiv 2025

  77. [77]

    Breaking recaptchav2

    Andreas Plesner, Tobias V ontobel, and Roger Watten- hofer. Breaking recaptchav2. In COMPSAC, 2024

    work page 2024

  78. [78]

    Gpqa: A graduate- level google-proof q&a benchmark

    David Rein, Betty Li Hou, Asa Cooper Stickland, Jack- son Petty, Richard Yuanzhe Pang, Julien Dirani, Julian Michael, and Samuel R Bowman. Gpqa: A graduate- level google-proof q&a benchmark. In COLM, 2024

    work page 2024

  79. [79]

    Quizbowl: The case for incre- mental question answering

    Pedro Rodriguez, Shi Feng, Mohit Iyyer, He He, and Jordan Boyd-Graber. Quizbowl: The case for incre- mental question answering. arXiv:1904.04792, 2019

    Pith/arXiv arXiv 1904

  80. [80]

    Openid con- nect core 1.0 incorporating errata set 1

    Nat Sakimura, John Bradley, Mike Jones, Breno De Medeiros, and Chuck Mortimore. Openid con- nect core 1.0 incorporating errata set 1. The OpenID Foundation, specification, 2014

    work page 2014

Showing first 80 references.

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.