Detecting Cognitive Signatures in Typing Behavior for Non-Intrusive Authorship Verification

This paper proposes a privacy-preserving authorship verification framework that leverages large-scale keystroke timing data to identify unique cognitive signatures, effectively distinguishing genuine human composition from AI-generated text or mechanical transcription with high accuracy while resisting adversarial attacks.

The Gist

The Big Problem: "Who Wrote This?"

Imagine you hand in an essay, and a teacher asks, "Did you write this, or did an AI write it for you?"

Today, it's getting incredibly hard to tell the difference. AI can write essays that look perfect on the surface. Current tools try to spot AI by looking at the final product (the text itself), but AI is getting so good at mimicking human writing that these tools are failing. It's like trying to spot a fake painting just by looking at the finished canvas; the forger has gotten too good at copying the brushstrokes.

The New Idea: Watch the Painter, Not the Painting

This paper suggests a clever shift: Don't look at the text; look at how the text was made.

Think of a human writer like a chef cooking a complex meal.

• The Chef (Human): They chop, taste, think, chop again, maybe burn a little garlic, scrape it off, and start over. There are pauses to think, bursts of fast chopping, and moments of hesitation.
• The Robot (AI/Transcriber): If you just ask someone to copy a recipe word-for-word, they move their hands in a steady, rhythmic, mechanical beat. No thinking pauses, no "oops" moments, just a steady stream of action.

The authors argue that the keyboard is a window into the mind. When you write something original, your brain has to do three things:

1. Plan: "What do I want to say?" (This causes long pauses).
2. Translate: "How do I say it?" (This causes bursts of fast typing).
3. Revise: "Wait, that sounds wrong." (This causes backspacing and re-typing).

When you are just copying text (or when an AI generates it), you skip the "Planning" and "Thinking" parts. You just type.

The "Cognitive Signature" (The Fingerprint of Thought)

The researchers analyzed 136 million keystrokes (that's a lot of typing!) to find a pattern they call the Cognitive Load Correlation (CLC).

• The Human Pattern: When a human hits a difficult sentence, they pause longer. When the sentence is easy, they type fast. Their typing speed dances with the difficulty of the words.
• The Robot/Copy Pattern: When someone copies text, their speed stays the same regardless of how hard the words are. It's a flat, boring line.

The Analogy:
Imagine listening to a musician.

• A human composer playing a new song will speed up during the exciting parts and slow down to think during the complex jazz solos.
• A robot playing a recording will play every note at the exact same speed, perfectly on time, with zero hesitation.

The paper claims they can spot the difference with 85–95% accuracy just by listening to the "rhythm" of the typing.

Why Can't a Hacker Fake It?

You might ask: "Can't a bad actor just type slowly on purpose to trick the system?"

The authors say no, and here is why:

• Motor Forgery is Easy: It's easy to fake a specific rhythm (like a signature). You can practice typing "hello" slowly.
• Cognitive Forgery is Impossible: To fake the thinking pattern, you would have to pretend to think about every single word while you type it.
  • If you are copying a text, you have to memorize the whole thing, figure out where the "hard" words are, memorize where to pause, and then perform a complex act of "pretending to think" while typing.
  • It's like trying to fake a conversation by memorizing a script and acting out the pauses. Eventually, the "acting" looks too perfect or too unnatural. The system detects that the pauses don't match the natural flow of a mind actually creating ideas.

Privacy: The "Blurry Photo" Trick

A major concern is: "If you track my typing, aren't you spying on me? Can't they steal my identity?"

The paper proposes a privacy shield called Quantization.

• The Idea: Imagine you take a photo of a person. If the photo is super high-definition, someone can steal your identity (your face).
• The Solution: The system takes that high-def photo and turns it into a blurry sketch.
  • It rounds off the exact milliseconds of your typing (e.g., instead of 143ms, it just says "between 140 and 145ms").
  • Why this works: The "thinking" pauses are huge (1,000ms+). The "fingerprint" details (your unique finger speed) are tiny (under 15ms). By blurring the tiny details, the system destroys your biometric identity but keeps the big "thinking" pauses perfectly clear.

The Bottom Line

This paper proposes a new way to verify authorship that is:

1. Non-Intrusive: It works in the background of your normal text editor.
2. Privacy-Respecting: It throws away the data that could identify who you are, keeping only the data that proves you were thinking.
3. Hard to Cheat: It relies on the fact that thinking is messy and unique, while copying is smooth and mechanical.

In short: We can't always tell if a painting is real by looking at the paint. But if we watch the artist's hand, we can see if they are actually creating something new, or just copying a picture. This system watches the "hand" (the typing rhythm) to prove the "mind" (the human author) was there.

Technical Summary

1. Problem Statement

The proliferation of AI-generated text has created a crisis in authorship verification. Current detection methods rely on analyzing the output (the text itself), which is increasingly unreliable as Large Language Models (LLMs) converge toward human-like distributions. Furthermore, output-based defenses like watermarking are easily removed via paraphrasing, and proctoring is invasive.

The core problem is the lack of a reliable, non-intrusive method to verify that a specific human composed a text, rather than simply transcribing AI-generated content or copying existing text. The paper argues that current approaches fail because they ignore the process of writing.

2. Methodology

The proposed solution shifts the focus from what was written to how it was written, treating the keyboard as a "cognitive instrument" rather than a simple transducer.

A. Theoretical Foundation: Cognitive Signatures

The framework is built on the Flower and Hayes cognitive process model, which identifies three recursive stages of human writing:

1. Planning: Generating and organizing ideas (manifests as extended pauses, 1,000–5,000 ms).
2. Translating: Converting ideas into language (manifests as typing bursts aligned with clauses).
3. Revising: Evaluating and editing (manifests as backspace sequences and retyping).

In contrast, mechanical transcription (copying text) is a motor-level task characterized by stationary, rhythmic typing with minimal pauses and no correlation between content difficulty and typing speed.

B. The Core Metric: Cognitive Load Correlation (CLC)

The authors define Cognitive Load Correlation (CLC) as the primary discriminative measure.

• Definition: The correlation between content complexity (e.g., syntactic depth, n-gram surprisal) and typing latency (Inter-Keystroke Intervals or IKI).
• Genuine Composition: Exhibits a positive, moderate-to-strong correlation ($\rho \approx 0.3–0.6$). Writers pause longer before difficult content because they are generating it in real-time.
• Transcription/AI: Exhibits a near-zero or weak correlation ($\rho < 0.15$). Typing speed is determined by motor fluency, not the semantic difficulty of the text being copied.

C. System Architecture

The framework operates as a lightweight, non-intrusive background process (e.g., browser extension or LMS plugin):

1. Collection: Captures keystroke timestamps.
2. Quantization (Privacy Preservation): IKI values are quantized using a bin size of $r = 5$ ms.
   • Rationale: Motor identity features (biometric) operate at sub-15 ms resolution, while cognitive features operate at 200 ms+. Quantizing at 5 ms removes <0.5% of cognitive signal while destroying the fine-grained data needed for biometric re-identification.
3. Analysis: Computes CLC and entropy estimates to generate an "Evidence Record."
4. Verification: Compares the evidence against the hypothesis of genuine composition vs. transcription.

3. Key Contributions

• Process-Based Verification: Reframes authorship verification as a Human-Computer Interaction (HCI) problem, utilizing the temporal trace of cognition rather than text analysis.
• The CLC Metric: Introduces a novel statistical measure that entangles semantic content with typing behavior, making it structurally harder to forge than simple motor patterns.
• Privacy-Preserving Design: Demonstrates that high-accuracy verification is possible without collecting biometric identifiers, using evidence quantization to prevent keystroke dynamics from being used as a "who typed this" biometric.
• Adversarial Robustness Analysis: Provides a theoretical argument that cognitive signatures are resistant to timing-forgery attacks because they require the adversary to replicate the cognitive process (planning, translating, revising) in real-time, not just mimic motor timing.

4. Results and Evaluation

The evaluation is analytical, synthesizing data from multiple large-scale datasets (e.g., ScholaWrite, Aalto 136M, neuroQWERTY) totaling over 136 million keystroke events.

• Discrimination Accuracy: Under stated assumptions, the framework estimates 85–95% accuracy in distinguishing genuine composition from transcription.
  • For documents >1,500 words, statistical power exceeds 0.99.
• Privacy-Utility Tradeoff: Modeling shows that quantizing at 5 ms significantly reduces biometric leakage (entropy) while maintaining the utility of the cognitive signal.
• Adversarial Cost: The paper estimates that forging a positive CLC requires an adversary to memorize text, analyze its complexity, and rehearse specific pause patterns. This increases the attack cost from seconds (copy-paste) to 30–60 minutes of preparation per document, effectively neutralizing the incentive for cheating.

5. Significance and Limitations

Significance:

• Addresses the AI Verification Gap: Offers a solution that does not rely on detecting AI "stamps" in text, which are becoming undetectable.
• Ethical Deployment: Proposes a "Layered Transparency" model and "Contextual Integrity" to ensure the system is a tool for protecting student/author rights rather than an invasive surveillance overlay.
• Scalability: The method works within existing writing interfaces without requiring specialized hardware.

Limitations & Future Work:

• Analytical Nature: The 85–95% accuracy is a theoretical bound derived from cross-dataset synthesis, not a controlled user study comparing composition and transcription within the same participants.
• Population Bias: Current data skews toward university-educated adults on desktop keyboards. The system requires validation for:
  • Non-native writers (who may pause for language access rather than planning).
  • Mobile/Touchscreen users (different timing distributions).
  • Users with motor impairments.
• Future Directions: The authors call for within-subjects user studies, longitudinal stability checks, and integration with revision-pattern analysis to create layered verification systems.

Conclusion

The paper concludes that authorship is a property of the human process, not just the text. By capturing the "cognitive signatures" of planning and translating through keystroke timing, it is possible to verify authorship non-intrusively. This approach exploits a signal (the temporal trace of a mind composing in real-time) that AI-generated text fundamentally cannot produce, offering a robust alternative to failing output-based detectors.