Abstract: Approaches presented herein relate to human authentication in a computerized environment. In particular, challenge-response authentication can be performed where a requestor must submit a correct and valid response. An automated attack on such an environment may use a proxy network to cause a large number of malicious requests to be received to the environment, over a period of time, that appear to come from different sources. To make such an attack less appealing, challenge-response authentication can require an amount of additional data to be transmitted with each request, where that amount is small enough to not have a significant impact on a single request from a legitimate user, but large enough that the amount of data to be transmitted when aggregated across a large number of malicious requests will be significant, resulting in a high cost to the attacker if the proxy network provider charges based on data transmission.