1. A method comprising: receiving, by a processing device of a server device, a request for a transaction by a client device; in response to the request, causing, by the processing device, a graphical user interface to display on the client device, the graphical user interface comprising a form field and a user interface control mechanism, wherein the graphical user interface comprise a plurality of individual images embedded within the user interface control mechanism, each of the plurality of individual images comprising a cognitive transform of a character for input selection by a user, wherein the cognitive transform is visually interpretable by a human user and at least partially prohibitive to interpretation by malicious code; receiving, by the processing device, input comprising a selection of characters via the user interface control mechanism; collecting, by processing device, data relating to entry of the input at the user interface control mechanism, wherein the data represents behavioral characteristics of the entry of the input; generating a score from a comparison of the data against a human characteristic model corresponding to expected behavior characteristics of the entry at the user interface control mechanism, wherein the score indicates a probability that the input originated from the human user or from the malicious code imitating the human user; determining, by the processing device, whether the input is valid; generating, by the processing device, a seeded captcha image using at least a portion of the input as a seed, wherein the seeded captcha image comprises a second cognitive transform that is visually interpretable by the human user and at least partially prohibitive to interpretation by the malicious code; causing, by the processing device, the graphical user interface to display the seeded captcha image for a visual confirmation by the user; collecting, by the processing device, a response to the seeded captcha image by the user via the graphical user interface; determining, by the processing device, whether the response correctly solves the seeded captcha image; determining, by the processing device, whether the user is the human user when the response correctly solves the seeded captcha image, the input is valid, and the score is greater than a threshold; and permitting, by the processing device, the transaction when the user is determined to be the human user.