🤖 AI

On the Insecurity of Keystroke-Based AI Authorship Detection: Timing-Forgery Attacks Against Motor-Signal Verification

This paper demonstrates that keystroke-based AI authorship detection relying on inter-keystroke interval variability is fundamentally insecure because both human transcription of AI text and automated timing-forgery attacks can achieve near-perfect evasion rates, proving that motor signals alone cannot verify the semantic origin of content.

Original authors: David Condrey

Published 2026-01-27

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: David Condrey

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a security guard at the door of a library. Their job is to make sure that the person holding the book actually wrote it themselves, rather than copying it from a computer screen.

For a while, experts thought they had a clever way to do this using typing speed. The theory was: "If you type naturally, your fingers pause, speed up, and slow down in a messy, human rhythm. If a robot or a script types the text, it's too perfect and too fast." So, they built detectors that looked at the "heartbeat" of your typing to see if it was human.

This paper, "On the Insecurity of Keystroke-Based AI Authorship Detection," argues that this security guard is being fooled. The author, David Condrey, shows that these detectors are looking at the wrong thing. They can tell if a body is pressing the keys, but they cannot tell if a mind is thinking up the words.

Here is the breakdown of the paper's findings using simple analogies:

1. The "Copy-Paste" Trick (The Copy-Type Attack)

The biggest hole in the security system is a trick the author calls the "Copy-Type Attack."

The Scenario: A student uses an AI (like ChatGPT) to write an essay. Then, they open the essay on their phone, look at it, and type it out letter-by-letter on the school's computer.
The Flaw: The security detector sees the typing. It sees the pauses, the speed-ups, and the "messy" rhythm. It says, "Aha! This is a human typing!"
The Reality: The human didn't write the ideas; they just acted as a "biological printer." Because the detector only looks at the fingers and not the brain, it gets tricked. It's like a bouncer checking your ID to see if you are a real person, but not checking if you actually own the car you are driving.

2. The "Fake Rhythm" Trick (Timing-Forgery Attacks)

Even if a student doesn't type it out themselves, the paper shows that a hacker can fake the typing rhythm using software.

The Analogy: Imagine a musician who knows exactly how a jazz drummer plays. They can program a robot to hit the drums with the exact same "swing" and "pause" as a human.
The Result: The researchers built three different types of "fake rhythm" bots. They tested them against the detectors, and the bots fooled the system 99.8% of the time. The detectors thought the fake rhythms were real humans.

3. The "Two Different Jobs" Confusion

The paper argues that the people who built these detectors made a category error. They confused two very different jobs:

Job A: Identity Verification. "Is this specific person (John) typing?" (This works well. Your typing style is like a fingerprint).
Job B: Authorship Verification. "Did this person think up the story?" (This is what the detectors are trying to do, and they fail).

The paper says: "We can confirm a human operated the keyboard, but not whether that human originated the text."

4. The "Gap" That Doesn't Matter

The researchers admit that there is a tiny difference between typing your own thoughts and typing someone else's words.

The Analogy: When you write your own story, you might pause to think, "Hmm, what word should I use next?" When you copy someone else's story, you might pause to read the next line.
The Problem: The paper shows that this difference is so small (statistically speaking) that you can't use it for security. To catch the "copiers," you would have to set the detector so sensitive that it would also reject 16% of honest students who are just thinking hard. That's too many false alarms to be useful.

5. The Solution: Change the Game

The paper concludes that you cannot fix this by making the typing detectors "smarter." You can't get better at reading the rhythm because the rhythm doesn't tell you where the ideas came from.

Instead, we need completely different tools:

Revision History: Did the writer delete and rewrite sentences (like a real thinker), or did they just type straight through (like a copier)?
Challenge Questions: Ask the writer, "Why did you choose this example?" while they are typing. If they are just copying, they won't be able to answer.
Semantic Binding: Link the typing process to the meaning of the words, not just the timing.

The Bottom Line

The paper warns that schools and companies relying on "typing rhythm" to catch AI cheating are building a castle on sand. A student can easily bypass it by typing out AI text, or a hacker can fake the rhythm entirely.

The takeaway: These systems can prove a human was present, but they cannot prove a human was the author. To know who really wrote the essay, we need to look at the content and the thinking process, not just the speed of the fingers.

Technical Summary: On the Insecurity of Keystroke-Based AI Authorship Detection

Problem Statement

Recent proposals for detecting AI-generated text have shifted from analyzing linguistic output (perplexity, stylometry) to analyzing process-level behavioral signals, specifically keystroke timing dynamics. Systems such as those proposed by Kundu et al. [1] and Mehta et al. [2] rely on the premise that human motor signals—characterized by variable inter-keystroke intervals (IKI) and specific temporal patterns like "thinking pauses"—are distinct from the uniform, rapid injection of text by automated bots.

This paper identifies a fundamental category error in these approaches: they conflate motor presence (a human body operating the keyboard) with content provenance (a human cognitively originating the text). The authors argue that current threat models fail to account for a rational adversary who can generate content via Large Language Models (LLMs) and then physically transcribe it character-by-character. This "copy-type" attack produces authentic motor signals indistinguishable from genuine composition, rendering timing-only detectors insecure for verifying authorship. Furthermore, the paper demonstrates that even automated "timing-forgery" attacks, which synthesize keystroke intervals based on human distributions, can bypass these systems.

Methodology

Threat Model and Attack Definitions

The study evaluates Motor-Signal Verification Systems (MSVS) that accept a document and its keystroke trace to classify output as HUMAN or AI. The authors define two primary attack vectors:

Copy-Type Attack: An adversary generates text using an LLM and physically types it into the instrumented platform. The resulting motor signals are genuine by construction.
Timing-Forgery Attacks: Automated agents generate synthetic traces by sampling inter-keystroke intervals from empirical human distributions. The authors implement three variants:
- Histogram Sampling: Sampling IKIs independently from an empirical Cumulative Distribution Function (CDF) of human data.
- Statistical Impersonation: Matching the first and second moments (mean and variance) of the target population's IKI distribution, adjusted for digraph-specific latencies.
- Generative LSTM: A 2-layer LSTM network trained on real keystroke sequences to model the conditional distribution of IKIs given character history.

Experimental Setup

Datasets: The evaluation utilizes 13,000 human typing sessions from the Stony Brook University (SBU) Keystroke Corpus, supplemented by 5,000 automated injection sessions and 2,000 attack sessions (1,000 Histogram, 500 Statistical, 500 LSTM). Validation is performed across 11 additional public corpora (totaling >150,000 sessions) to ensure generalizability.
Features: The study evaluates a 7-feature vector encompassing all features proposed in prior work [1], [2]:
- $\delta$ : Coefficient of variation (CV) of IKIs.
- $\bar{t}$ : Mean IKI.
- $\sigma^2_{IKI}$ : IKI variance.
- $\rho$ : Pause density (fraction of IKIs > 500ms).
- $\beta$ : Mean burst length.
- $H$ : Shannon entropy of IKI distribution.
- $\gamma$ : Digraph variability.
Classifiers: Five classifiers (Logistic Regression, Random Forest, Gradient Boosting, SVM-RBF, MLP) are trained using 5-fold stratified cross-validation.

Key Results

1. Efficacy of Attacks

Copy-Type Attack: In empirical validation using the IIITD-BU dataset (34 transcription sessions) and pooled corpora (879 sessions), the copy-type attack achieved a 100% bypass rate against the detection threshold ( $T = 0.269$ ). The mean $\delta$ for transcription was $0.991$, well above the threshold, with a Cohen's $d$ of only $0.14$ between composition and transcription in free-text conditions.
Timing-Forgery Attacks: All three automated variants achieved $\ge 99.8\%$ evasion rates against the five classifiers.
- Histogram and LSTM attacks achieved 100% evasion.
- Statistical attacks achieved 99.8% evasion.
- Attack samples were classified as human with a mean confidence of $\ge 0.993$ .

2. Classifier Performance and Trade-offs

Baseline Separation: The classifiers achieved an Area Under the Curve (AUC) of 1.000 when distinguishing genuine human typing from fully automated (paste/API) injection. This confirms the systems correctly detect the absence of motor signals.
Operational Failure: When facing human motor signals (whether genuine or forged), the systems fail to distinguish provenance.
- To reduce the LSTM attack pass rate below 50%, the detection threshold must be raised to $T > 0.80$ .
- At this threshold, the False Rejection Rate (FRR) for legitimate human users rises to 16.3%.
- At $T = 0.90$ (FRR = 32.6%), the LSTM attack still maintains a 44% pass rate.
Feature Ablation: No single feature reliably separates all attack variants from genuine human typing. While features like $\delta$ and entropy effectively separate humans from bots, they cannot distinguish between a human composing text and a human transcribing text.

3. Theoretical Bounds

The authors formalize a non-identifiability result (Theorem 1). Under the assumption that the detector observes only keystroke timing ( $\tau$ ) and not the cognitive state, the mutual information between the features and content provenance is zero:
$I(f(\tau); \text{Provenance} | s, M_u) = 0$
Even when relaxing the idealized assumption that cognitive state does not influence motor execution (empirical $d \approx 1.28$ ), the resulting Bayes error is 26.1%, which is operationally insufficient for security decisions.

Significance and Claims

The paper asserts that keystroke-based AI authorship detection systems, as currently architected, are fundamentally insecure against rational adversaries.

Category Error: These systems verify motor authenticity (that a human was present) but cannot verify content provenance (that the human originated the text). The "copy-type" attack exploits this gap by using the human's own motor system to launder AI-generated content.
Structural Limitation: The vulnerability is not algorithmic but structural. Because the distinguishing variable (content origin) is a latent confounder unobserved in the feature space, no amount of feature engineering or classifier optimization can overcome the distributional overlap between composition and transcription.
False Assurance: Systems marketed as "AI-free" certification based on typing patterns provide false assurance. They can confirm a human operated the keyboard but cannot determine if that human was the author.
Defense Implications: Securing content provenance requires fundamentally different architectures that bind the observed writing process to the semantic content. The authors suggest viable directions include:
- Revision History Coherence: Analyzing non-monotonic editing patterns (deletions, rephrasing) which are rare in transcription.
- Challenge-Response: Forcing real-time comprehension of the text during composition.
- Semantic Binding: Integrating NLP to distinguish motor errors from semantic corrections.

The authors conclude that until such content-binding mechanisms are deployed, keystroke timing should only be used to confirm human presence, not authorship.