Low frequency against a specific login:
Monitor so that after x attempts over a specific login, one can only try it after x seconds / minutes.
Low frequency against a specific login, using CAPTCHA:
After x trials, begin to ask for a CAPTCHA, perhaps slow it down after x tries.
Just notice that slowing down some attempt by using delays is almost equivalent to enabling a DOS attack against that login. If someone tries to access your account, and fails, it'll end up adding a delay to your attempts, and you, the correct user, might get bored.
Low frequency against multiple logins:
If the overall load of your server increased, in a very detectable way, add CAPTCHAs. If it didn't, your unique alternative will be detecting how many failled attempts you have on your site, and again will have to use captcha. Or to add a small delay for all your logins, and that won't do any good to real users...