  Recent studies show that 20.4% of the internet traffic originates from
automated agents. To identify and block such ill-intentioned traffic,
mechanisms that verify the humanness of the user are widely deployed, with
CAPTCHAs being the most popular. Traditional CAPTCHAs require extra user effort
(e.g., solving mathematical puzzles), which can severely downgrade the
end-user's experience, especially on mobile, and provide sporadic humanness
verification of questionable accuracy. More recent solutions like Google's
reCAPTCHA v3, leverage user data, thus raising significant privacy concerns. To
address these issues, we present zkSENSE: the first zero-knowledge proof-based
humanness attestation system for mobile devices. zkSENSE moves the human
attestation to the edge: onto the user's very own device, where humanness of
the user is assessed in a privacy-preserving and seamless manner. zkSENSE
achieves this by classifying motion sensor outputs of the mobile device, based
on a model trained by using both publicly available sensor data and data
collected from a small group of volunteers. To ensure the integrity of the
process, the classification result is enclosed in a zero-knowledge proof of
humanness that can be safely shared with a remote server. We implement zkSENSE
as an Android service to demonstrate its effectiveness and practicality. In our
evaluation, we show that zkSENSE successfully verifies the humanness of a user
across a variety of attacking scenarios and demonstrates 92% accuracy. On a two
years old Samsung S9, zkSENSE's attestation takes around 3 seconds (when visual
CAPTCHAs need 9.8 seconds) and consumes a negligible amount of battery.
