Rendering on Real Silicon: GPU Render-Timing as a Passive, AI-Resistant CAPTCHA Signal

Technical Summary: Rendering on Real Silicon as a Passive, AI-Resistant CAPTCHA Signal

Problem Statement
The traditional CAPTCHA paradigm, which relies on perceptual or cognitive puzzles, has eroded due to the capabilities of modern vision-language models (VLMs) and agentic AI systems that solve image, text, and audio challenges with high accuracy. While behavioral biometrics and cryptographic attestation (e.g., TPM, WebAuthn) offer alternatives, they suffer from privacy concerns, persistent identifier leakage, or high enrollment costs. Furthermore, existing defenses are vulnerable to mimicry or side-channel spoofing. The authors identify a gap: automated clients often lack the physical hardware execution properties of genuine devices, yet current detection methods do not effectively exploit this physical-layer distinction without compromising user privacy.

Methodology
The paper proposes a passive, hardware-attestation approach that measures the physical timing behavior of a client's GPU under a controlled WebGL rendering workload. Unlike WebGL fingerprinting, which hashes pixel output to create a persistent device identifier, this method classifies traffic based on render-timing dynamics without retaining any persistent identity.

The methodology employs a single-endpoint collection strategy to ensure measurement consistency:

1. Data Collection: A public endpoint serves a shared WebGL harness. Real browser users (positive class) voluntarily submit timing records. Headless automation (negative class) is driven to the same URL by a sweep tool using a server-side secret, ensuring trustworthy labels.
2. The Harness: The system issues a deterministic, fragment-shader-bound WebGL workload. It records per-frame render times over a fixed window after a warm-up period. Crucially, each frame forces pipeline completion via a synchronous pixel read-back, ensuring measured time reflects actual GPU execution rather than asynchronous queue submission.
3. Feature Extraction: The system derives distributional statistics from the raw per-frame series, including mean/median render time, dispersion (standard deviation, coefficient of variation), shape (skewness, kurtosis), frame-to-frame jitter, and a timer-quantization indicator.
4. Negative-Class Matrix: To prevent classifiers from relying solely on software-renderer strings, the study includes a "hard negative" class: headless automation running on physical GPUs. This isolates the signal of automation from the signal of software rendering.
5. Evaluation Discipline: Generalization is evaluated using a device-held-out split, where entire GPUs are assigned to either training or testing sets, preventing data leakage from device identity.

Key Contributions

1. Empirical Threat Characterization: A 12-hour passive deployment revealed that the "in-the-wild" adversary is overwhelmingly render-free (86% of unsolicited requests). These clients do not execute client-side JavaScript or reach a rendering stage, meaning they yield no timing data.
2. Trustworthy Negative-Class Labels: The authors established a methodology for collecting identically measured timing samples from real browsers and keyed headless automation, including the difficult case of automation on real hardware.
3. Pilot Analysis of Timing Signatures: The study demonstrates a clean separation between software-rendered bots and genuine GPUs, and identifies a measurable, confound-controlled timing signature that distinguishes headless automation on real hardware from human interaction.

Results
The pilot dataset, collected on a single GPU architecture (Intel integrated GPUs), yielded the following findings:

• Software vs. Hardware: Software-rendered bots (e.g., SwiftShader) are significantly slower than genuine GPUs, exhibiting a mean render time of ~26.3 ms compared to ~5.1 ms for humans (a 5.2× gap). They also display higher jitter and quantization.
• Headless vs. Interactive on Real Hardware: Even when running on genuine hardware, headless automation exhibits a distinct timing signature compared to interactive human use. In a confound-controlled comparison (same GPU family and browser engine):
  • Headless sessions showed a 3.3× higher timer-quantization ratio.
  • 2.6× higher frame jitter.
  • 2.2× higher coefficient of variation (CV).
• Mechanism: The authors attribute the increased roughness in headless timing to the lack of a display compositor and refresh pacing, which normally regularize frame timing in interactive use. This contradicts the naive intuition that automation would produce "flatter" timing; instead, it produces more timing noise.

Significance and Claims
The paper positions this approach as a passive, physical-layer variant of hardware attestation. Its significance lies in three areas:

1. Orthogonality to Existing Evasion: The signal is orthogonal to the current "spoofing stack" (antidetect browsers, canvas-noise injection, renderer-string spoofing). While an attacker might perfectly forge the renderer string and pixel output of an "NVIDIA RTX 4070," they cannot forge the physical timing distribution of hardware they do not possess.
2. Privacy Preservation: Unlike fingerprinting, this method performs classification (human vs. automated) rather than identification, leaking no persistent identifiers.
3. Complementarity: It serves as a low-friction, hard-to-spoof signal that can be combined with behavioral biometrics and other risk scores.

Limitations and Scope
The authors explicitly state modesty regarding their claims:

• Single Architecture: The confound-controlled signature is demonstrated only on Intel integrated GPUs. Cross-architecture generalization to discrete NVIDIA/AMD GPUs or Apple Silicon remains an open question, as faster discrete GPUs might compress timing differences below measurability.
• Pilot Scale: The results are based on a limited dataset (13 GPUs for humans, 2 GPUs for hard negatives). The study supports separability in principle but does not claim a trained discriminator with characterized error rates.
• Adversary Adaptation: While the method filters render-free automation effectively, a sophisticated adversary could theoretically render on real hardware (increasing cost) or inject synthetic jitter. The authors view the method as a component of a multi-signal risk assessment rather than a standalone silver bullet.
• Timer Hardening: Browser coarsening or jittering of high-resolution timers could compress the signal, an impact not yet fully quantified at the population level.