{"id":"45fa3fd2-f00b-43fe-9661-16e0c6ae4f3b","arxiv_id":"2504.17271","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"A Siamese contrastive network with masked-autoencoder pretraining is claimed to outperform baselines for continuous touch-based authentication, but missing evaluation details prevent verification.","lead":"This paper proposes TouchSeqNet, a contrastive-learning system that authenticates smartphone users from their touch gestures, with a masked-autoencoder pretraining stage. It reports near-perfect accuracy on two public touch datasets and a new self-collected dataset, but the experimental protocol and code are not available.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The reported SOTA accuracies rest on an undescribed train/test split; without a user-disjoint protocol, near-ceiling pair-classification results on Touchalytics and BioIdent are consistent with sample-level identity leakage.","rationale":"The reader's weakest_assumption identifies the same load-bearing concern I find: the paper never describes a user-disjoint train/test split, and the evaluation is a binary pair-classification task in which sample-level leakage would trivially inflate accuracy. This is the single most load-bearing issue because every headline number, the SOTA comparison, and the claimed generalization to unseen users depend on the validity of this split. The architectural novelty and the ablation results are secondary: even a perfectly designed model cannot support the central claim if the evaluation protocol allows identity memorization. The paper provides no code, no data access, no per-user breakdowns, and no error bars, so there is no independent evidence to compensate for the missing protocol. The proposed concrete test directly settles the concern by re-running the same pipeline under a user-disjoint split; if accuracy is stable, the concern fails, and if accuracy drops, the paper's central claim is refuted. Since the reader already rejected the paper for this reason, I do not change the verdict, but I emphasize that the fix is not merely cosmetic: the split must be performed before any pair construction and must be described explicitly.","tokens_in":12162,"tokens_out":3520,"duration_ms":36949,"concrete_test":"Retrain the full pipeline on Touchalytics and BioIdent using a strictly user-disjoint split: assign users to training, validation, and test sets with no user overlap, then construct all positive and negative pairs only after the split so that no test pair contains a sample from a training user. Use the hyperparameters in Section 6.1.3 and report accuracy, F1, and AUC on the test pairs. If the metrics drop materially below the Table 1 values (for example, below 0.95 on Touchalytics), the reported near-perfect results are attributable to sample-level identity leakage rather than user generalization. If the metrics remain near 0.99 under a user-disjoint split, the leakage concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central empirical claim of TouchSeqNet depends entirely on the evaluation protocol in Sections 6.1.1 and 6.1.2, yet those sections never state how the data are split before contrastive pairs are constructed. The paper only says that positive pairs come from the same user and negative pairs from different users, and later refers to 'held-out test sets' without specifying whether the split is by user, by session, or by individual sample. If the split is at the sample level, a user's samples can appear in both training and test sets, which lets a pair classifier memorize per-user identity rather than generalize to unseen users. The near-perfect accuracies (0.9908 on Touchalytics, 0.9902 on BioIdent) are exactly what such leakage would produce, and the TMAE pretraining described in Section 6.2.1 is also run on the same datasets with no stated leakage guard. No code, data, error bars, or per-user results are provided, so the text as written does not rule out this failure mode. The claim that TouchSeqNet outperforms prior state-of-the-art systems is therefore unsupported by the experimental description.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes TouchSeqNet, a contrastive-learning framework for continuous touch-based authentication. The architecture combines a Temporal Masked Autoencoder (TMAE) pretraining stage, a Siamese Temporal-Attentive Convolutional Network (TACN), and a hybrid contrastive/cross-entropy loss. The authors evaluate on a self-collected Ffinger dataset and on two public benchmarks, BioIdent and Touchalytics, reporting near-ceiling accuracies (0.9769, 0.9902, and 0.9908 respectively) and claiming state-of-the-art performance. They also provide comparisons against five generic time-series baselines and ablate the contribution of the attention and pretraining components.","tokens_in":12366,"tokens_out":3974,"duration_ms":38301,"significance":"If the reported results are valid, the proposed combination of self-supervised masked autoencoding, Siamese contrastive learning, and attention-augmented temporal convolution would be a meaningful step for touch-based continuous authentication. The paper introduces a new dataset, Ffinger, and it is commendable that the authors evaluate multiple baseline models under a consistent pairing framework. However, the current manuscript does not provide enough experimental evidence to support these claims: the train/test protocol is unspecified, pretraining and evaluation may share data, and no code, data, error bars, or per-user statistics are provided. The significance is therefore conditional on a substantially strengthened evaluation.","major_comments":[{"comment":"The train/test protocol is not specified. The text defines positive and negative pairs only by same/different user and refers to \"held-out test sets\" without stating whether the split is by user, by session, or by individual sample. If the split is sample-level, samples from the same user can appear in both training and test sets, allowing the pair classifier to memorize user identity instead of generalizing across users. The near-ceiling results (0.9908 on Touchalytics, 0.9902 on BioIdent) are consistent with this leakage. Please specify the exact split origin, report per-user results, and give the number of users/sessions used for each dataset.","section":"Sections 6.1.1-6.1.2, Table 1"},{"comment":"Pre-training is conducted independently on each dataset and the model is then fine-tuned and evaluated on the same dataset. It is not stated whether the pre-training data are restricted to the training split. If the full dataset, including the test split, is used for masked-autoencoder pre-training, the \"transferable representation\" claim is confounded and the test numbers in Table 1 cannot be interpreted as generalization measurements. State explicitly which files/segments are used for pre-training, fine-tuning, and testing.","section":"Section 6.2.1"},{"comment":"The comparative evaluation uses generic time-series classifiers (TCN, Gate-Transformer, LSTM, InceptionTime, TSLANet) as baselines and does not compare with prior touch-biometric systems, such as the original Touchalytics evaluation or recent touch-dynamics authentication models. The conclusion that TouchSeqNet outperforms \"state-of-the-art methods\" is therefore not supported by the evidence. In addition, all numbers are single-run point estimates with no error bars, significance tests, or per-user variance; four-decimal precision is not meaningful without repeated runs or confidence intervals.","section":"Table 2 and Section 6.2.3"},{"comment":"The Ffinger dataset is not released, and no code or pre-trained models are provided. Basic acquisition information is also absent: the number of sessions per participant, device models, gesture length distributions, and IRB/consent details are not reported. Without these, the Ffinger results cannot be reproduced or independently checked, which is a serious limitation for an empirical claim of state-of-the-art performance.","section":"Section 3.1 and general availability"}],"minor_comments":[{"comment":"The slicing window is denoted by sigma in Section 4.1 but by delta in Section 6.1.3; please reconcile the notation.","section":"Sections 4.1 and 6.1.3"},{"comment":"The FingerCA description begins \"As illustrated in Figure 1,\" but FingerCA is shown in Figure 4; please correct the cross-reference.","section":"Section 5.3"},{"comment":"The text mentions auxiliary metrics Hits and NDCG@10, but these are never defined or reported anywhere in the experiments.","section":"Section 4.4"},{"comment":"The phrase \"self-supervised pertaining\" in the introduction should read \"self-supervised pretraining.\"","section":"Abstract/Introduction"},{"comment":"Section 6.2.1 says each model is evaluated on its corresponding validation set, while Section 6.2.2 reports held-out test sets; clarify which split is actually used for the reported numbers.","section":"Sections 6.2.1 and 6.2.2"}],"recommendation":"reject","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The punchline: TouchSeqNet's near-perfect accuracy numbers on Ffinger, BioIdent, and Touchalytics are not supportable from the text because the evaluation protocol never states how the data are split before contrastive pairs are built. This is the load-bearing flaw. But the paper isn't worthless: the TMAE pretraining idea applied to touch dynamics is a reasonable engineering move, the Siamese contrastive framing is standard, and the new Ffinger dataset could be a useful resource if it ever gets a proper description.\n\nWhat's actually new: combining a temporal masked autoencoder with a Siamese temporal-attentive convolutional network is a specific architecture that I haven't seen exactly this way before. The ablation suggests the pretrained module matters, especially on BioIdent and Touchalytics. If the numbers hold up, it's a meaningful step for continuous touch authentication.\n\nWhere it falls apart: Sections 6.1.1 and 6.1.2 describe the contrastive pairing but never say whether the train/test split is per user, per session, or per sample. If it's per sample, the model can memorize user identity rather than generalize to unseen users. The near-ceiling results on public benchmarks are exactly what such leakage would produce. There are no error bars, no significance tests, no per-user breakdowns. The baselines are generic time-series classifiers (TCN, LSTM, etc.), not the prior touch-biometric systems cited in the related work, so the \"state-of-the-art\" claim isn't actually tested against the SOTA it claims to beat. The pretraining is also run on the same datasets used for fine-tuning, with no stated leakage guard. No code or data is released, and Ffinger is described at a level that doesn't allow reproduction.\n\nThe reader's take is correct on all major points. The circularity concern is minor—there's no self-referential derivation—but the evaluation flaw is enough to sink the empirical claim.\n\nWho this is for: people working in mobile behavioral biometrics who might want to build on the TMAE-plus-Siamese idea. They should treat the numbers as untrustworthy until a protocol and data are available.\n\nRecommendation: The paper deserves a serious referee if the authors can supply the missing protocol, code, and proper user-disjoint evaluation. As written, it should not be accepted, but I would send it to review with a strong request for revision rather than desk reject outright, because the underlying idea has merit and the flaw is fixable.","headline":"The architecture is plausible, but the reported SOTA numbers are unverifiable because the train/test split is never described; as written, the empirical claim doesn't hold.","tokens_in":12922,"tokens_out":3182,"would_cite":false,"duration_ms":30556,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"TouchSeqNet, a contrastive learning framework with masked-autoencoder pretraining, reports about 99% accuracy for touch-based user identification on three datasets.","keywords":["continuous authentication","touch dynamics","contrastive learning","masked autoencoder","siamese network","behavioral biometrics","self-supervised learning","temporal convolutional network"],"falsifier":"Run TouchSeqNet under a strict leave-one-user-out protocol, where every sample of a held-out user appears only in the test set, and compare accuracy with the reported numbers; if accuracy collapses toward the no-pretraining baseline, the claimed user-level generalization was an artifact of sample-level train/test leakage.","tokens_in":11924,"feed_emoji":"📱","tokens_out":5264,"duration_ms":46742,"temperature":0.7,"pith_summary":"The paper argues that continuous touch-based authentication can be cast as a contrastive pair-classification problem: given two touch sequences, decide whether the same person produced both. To make that work, it pre-trains a Temporal Masked Autoencoder on unlabeled touch streams, transfers the encoder into a Siamese Temporal-Attentive Convolutional Network, and trains with a hybrid contrastive and cross-entropy loss. Reported accuracies reach 0.9769 on the new Ffinger dataset, 0.9902 on BioIdent, and 0.9908 on Touchalytics, beating TCN, Gate-Transformer, LSTM, InceptionTime, and TSLANet under the same pairing setup. If the results hold, the practical payoff is a non-disruptive authentication layer that keeps verifying identity throughout a session from natural swipes and taps.","feed_headline":"Touch-behavior AI identifies phone users with ~99% accuracy","feed_subtitle":"A masked-autoencoder pretraining stage plus Siamese contrastive scoring separates users from swipe and tap dynamics.","key_machinery":"The load-bearing object is the two-stage TouchSeqNet pipeline. Stage one is a Temporal Masked Autoencoder (TMAE), which slices touch streams into windows, tokenizes them with a Gumbel-Softmax quantizer, masks 40% of windows, and learns by regressing masked representations against a momentum-updated encoder while predicting discrete codewords. Stage two is a Siamese Temporal-Attentive Convolutional Network (TACN), in which the pre-trained encoder feeds dilated causal convolutions, multi-head attention, and a finger-channel attention module; the two branches' pooled embeddings are concatenated and scored by a classification head under a contrastive-plus-cross-entropy loss.","core_discovery":"The central claim is that touch dynamics carry enough per-user temporal structure that a self-supervised pretraining stage plus contrastive fine-tuning can separate users nearly perfectly, without handcrafted features. TouchSeqNet pre-trains a Temporal Masked Autoencoder to reconstruct masked windows of raw multi-sensor touch sequences, then transfers the learned temporal encoder into a Siamese network whose Temporal-Attentive Convolutional Network combines dilated causal convolutions, multi-head self-attention, and channel attention. The model outputs a same-user probability for each pair of touch samples and achieves 0.9769 accuracy on Ffinger, 0.9902 on BioIdent, and 0.9908 on Touchalytics, outperforming five time-series baselines in a matched experimental setup.","pith_inferences":["A strict test would be leave-one-user-out evaluation: the paper never states whether the train/test split is user-disjoint, so the reported accuracies should be re-checked with all samples of each user confined to one side of the split.","Balanced pair accuracy can flatter real-world authentication, where impostor pairs are rare; an operational deployment would need a fixed decision threshold and a report of false-acceptance and false-rejection rates at that threshold.","The near-perfect scores on public benchmarks may partly reflect that contrastive pair classification is easier than one-class authentication, because negative pairs are randomly drawn from other users; testing on harder impostor distributions (same-gender, same-device, mimicry) would show whether the margin survives."],"forward_implications":["A deployed system could verify identity continuously from normal touch interaction, with no extra user effort, because the model scores every pair of observed touch segments.","Self-supervised pretraining on unlabeled touch logs could let the system adapt to a new device or a new user's habits without collecting labeled impostor data.","The same encoder-plus-Siamese recipe transfers to other behavioral streams, since the paper's conclusion explicitly points to stylus, handwriting, and gesture input as extensions.","Near-perfect pair accuracy implies that impostor and genuine touch pairs are strongly separable in the learned embedding space, which is the property an authentication alarm needs."],"supporting_citations":[{"why":"Supplies the Touchalytics dataset, one of the two public benchmarks the method must beat.","marker":"[12]"},{"why":"Supplies the BioIdent dataset, the second public benchmark used for evaluation.","marker":"[3]"},{"why":"Supplies the masked autoencoder pretext task that TMAE adapts to time series.","marker":"[13]"},{"why":"Supplies the momentum encoder update and contrastive learning formulation used in pretraining.","marker":"[7]"},{"why":"Supplies the dilated causal convolution backbone that TACN extends with attention.","marker":"[14]"},{"why":"Supplies the multi-head self-attention mechanism used in both TMAE and TACN.","marker":"[39]"},{"why":"Supplies the tokenizer that maps windowed touch segments into discrete codebook embeddings.","marker":"[42]"},{"why":"Supplies the squeeze-and-excitation channel attention idea behind the FingerCA module.","marker":"[15]"},{"why":"Supplies the soft contrastive time-series framework that motivates the Siamese pairing design.","marker":"[21]"}],"fun_headline_variants":["Touch signals alone verify phone users 99% of the time","Self-supervised touch AI separates users with 99% accuracy","Contrastive learning turns swipes into biometric signatures","Masked autoencoder learns your touch fingerprint for auth","Continuous phone authentication hits 99% using only touch"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The reported results assume a user-disjoint train/test split, but the paper never describes the split, so if samples from the same user appear in both training and testing the model could memorize identity rather than learn touch style.","fun_headline_variants_meta":{"raw":{"variants":["Touch signals alone verify phone users 99% of the time","Self-supervised touch AI separates users with 99% accuracy","Contrastive learning turns swipes into biometric signatures","Masked autoencoder learns your touch fingerprint for auth","Continuous phone authentication hits 99% using only touch"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00016,"raw_usage":{"total_tokens":1204,"prompt_tokens":886,"completion_tokens":318,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":502,"completion_tokens_details":{"reasoning_tokens":238}},"tokens_in":502,"tokens_out":318,"duration_ms":3399,"temperature":1.0,"reasoning_tokens":238,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T10:44:13.693683+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run TouchSeqNet under a strict leave-one-user-out protocol, where every sample of a held-out user appears only in the test set, and compare accuracy with the reported numbers; if accuracy collapses toward the no-pretraining baseline, the claimed user-level generalization was an artifact of sample-level train/test leakage.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the Touchalytics dataset, one of the two public benchmarks the method must beat."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the BioIdent dataset, the second public benchmark used for evaluation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the dilated causal convolution backbone that TACN extends with attention."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the tokenizer that maps windowed touch segments into discrete codebook embeddings."}],"review_version":1}