Asklemmy

LLMs, IIRC, are really bad at IQ-test type questions that require abstract reasoning, especially if they require multiple steps. So, something like

The box is yellow and red.
If the box is yellow, it is good.
If the box is blue, it is unhappy.
If the box is good and happy, the box is awesome.
If the box is red, it is happy.
Is the box awesome?

is what I'd use.

Wait a minute - GPT-4 - is that you asking this question?

Show a picture, video, audio clip or text designed to elicit an emotion. Ask how the user feels.

Say to it

This statement is false

It's not so important to tell the difference between a human and a bot as it is to tell the difference between a human and ten thousand bots. So add a very small cost to passing the test that is trivial to a human but would make mass abuse impractical. Like a million dollars. And then when a bot or two does get through anyway, who cares, you got a million dollars.

Any bot? That's just impossible. We're going to have to tie identity back to meatspace somehow eventually.

An existing bot? I don't think I can improve on existing captchas, really. I imagine an LLM will eventually tip their hand, too, like giving an "as an AI" answer or just knowing way too much stuff.

Some kind of biometric scan.

I'd ask for their cell number and send a verification code. That'll stop 95% of all duplicate accounts. Keep the hash of their phone number in a hash list, rather than the number itself. Don't allow signups from outside whatever region you can SMS for free.

I realize this would mean relying on an external protocol (SMS), but it might just keep the crap out. Would help for ban evasion too, at least within an instance.