pith. sign in

arxiv: 2603.00177 · v3 · pith:Z34QM5W4new · submitted 2026-02-26 · 💻 cs.CR · cs.HC· cs.LG

Detecting Cognitive Signatures in Typing Behavior for Non-Intrusive Authorship Verification

David Condrey This is my paper

Pith reviewed 2026-05-15 18:38 UTC · model grok-4.3

classification 💻 cs.CR cs.HCcs.LG
keywords keystroke dynamicsauthorship verificationcognitive loadtyping behaviorprivacy preservationAI text detectionnon-intrusive authentication
0
0 comments X

The pith

Cognitive signatures in typing behavior distinguish genuine text composition from transcription with 85 to 95 percent accuracy.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper defines a measure called Cognitive Load Correlation that captures timing patterns in keystrokes during writing. These patterns reflect the mental effort of planning and revising text, which differs when someone is genuinely composing versus simply copying or pasting AI output. By collecting only timing data without content, the approach verifies authorship while protecting privacy. This matters because AI-generated text is hard to detect from the output alone, but the human process of creating it leaves detectable traces in how we type. The method is shown analytically to work under its assumptions and resists simple forgery attempts.

Core claim

We define the Cognitive Load Correlation (CLC) from keystroke timing data and demonstrate that it separates genuine composition, which involves cognitive stages of planning and revision, from mechanical transcription of pre-existing text. Analytical evaluation on large keystroke datasets shows discrimination accuracy between 85 and 95 percent, achieved by operating only on timing metadata to minimize privacy risks. The signatures resist forgery because they are linked to the semantic content being produced.

What carries the argument

The Cognitive Load Correlation (CLC), a measure of correlation in keystroke timing that reflects cognitive load during composition stages.

Load-bearing premise

The assumptions enabling the accuracy estimate are valid and cognitive signatures remain entangled with semantic content enough to prevent successful timing forgery.

What would settle it

Collect typing data where participants transcribe text while deliberately varying their timing to mimic genuine composition patterns without actual cognitive planning, and check whether CLC still reliably distinguishes the two cases.

Figures

Figures reproduced from arXiv: 2603.00177 by David Condrey.

Figure 1
Figure 1. Figure 1: Cognitive signature timeline. (a) Genuine composition [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: System architecture showing the transformation of [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Modeled privacy-utility tradeoff. Accuracy curve is [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
read the original abstract

The proliferation of AI-generated text has intensified the need for reliable authorship verification, yet current output-based methods are increasingly unreliable. We observe that the ordinary typing interface captures rich cognitive signatures, measurable patterns in keystroke timing that reflect the planning, translating, and revising stages of genuine composition. Drawing on large-scale keystroke datasets comprising over 136 million events, we define the Cognitive Load Correlation (CLC) and show it distinguishes genuine composition from mechanical transcription. We present a non-intrusive verification framework that operates within existing writing interfaces, collecting only timing metadata to preserve privacy. Our analytical evaluation estimates 85 to 95 percent discrimination accuracy under stated assumptions, while limiting biometric leakage via evidence quantization. We analyze the adversarial robustness of cognitive signatures, showing they resist timing-forgery attacks that defeat motor-level authentication because the cognitive channel is entangled with semantic content. We conclude that reframing authorship verification as a human-computer interaction problem provides a privacy-preserving alternative to invasive surveillance.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 0 minor

Summary. The paper proposes detecting cognitive signatures in keystroke timing data to enable non-intrusive authorship verification. It defines the Cognitive Load Correlation (CLC) metric from a dataset of over 136 million keystroke events and claims this distinguishes genuine composition from mechanical transcription, with an analytical evaluation estimating 85-95% discrimination accuracy under stated assumptions. The framework limits biometric leakage via evidence quantization and argues robustness to timing-forgery attacks due to entanglement between cognitive signatures and semantic content.

Significance. If the analytical accuracy estimates hold and the assumptions regarding semantic entanglement prove valid, the approach could provide a meaningful privacy-preserving alternative to output-based or invasive biometric authorship verification methods, particularly as AI-generated text becomes more prevalent.

major comments (2)
  1. Abstract: The central claim of 85-95% discrimination accuracy is described as resulting from 'analytical evaluation under stated assumptions,' but no derivation steps, quantification of semantic entanglement, data splits, error bars, or explicit use of the 136M-event dataset to ground or test the assumptions are provided, leaving the load-bearing accuracy figure unsupported.
  2. Abstract: CLC is defined within the paper and directly employed to generate the accuracy estimate; without independent benchmarks, unfitted derivations, or cross-validation shown, this introduces a circularity risk where the metric may be tuned to the same data it evaluates.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for their constructive comments, which have prompted us to strengthen the clarity and evidentiary support in our presentation. We respond to each major comment below and have revised the manuscript to address the identified gaps.

read point-by-point responses

  1. Referee: Abstract: The central claim of 85-95% discrimination accuracy is described as resulting from 'analytical evaluation under stated assumptions,' but no derivation steps, quantification of semantic entanglement, data splits, error bars, or explicit use of the 136M-event dataset to ground or test the assumptions are provided, leaving the load-bearing accuracy figure unsupported.

    Authors: We agree that the abstract was overly concise and did not sufficiently reference the supporting analysis. The full manuscript contains the analytical derivation in Section 4, but to make this immediately accessible we have expanded the abstract to outline the key derivation steps, the quantification of semantic entanglement via correlation measures, the 70/30 data splits, bootstrap-derived error bars, and the explicit grounding of assumptions in the 136 million keystroke events. We have also added a short methods paragraph in the introduction that cross-references these elements. revision: yes

  2. Referee: Abstract: CLC is defined within the paper and directly employed to generate the accuracy estimate; without independent benchmarks, unfitted derivations, or cross-validation shown, this introduces a circularity risk where the metric may be tuned to the same data it evaluates.

    Authors: We acknowledge that the original presentation left open the possibility of perceived circularity. The CLC definition is derived from established cognitive-load models in the HCI and psychology literature and is not fitted to the evaluation dataset. The accuracy estimate itself is obtained analytically from modeled timing distributions under the stated assumptions rather than through data-driven optimization. To eliminate ambiguity we have added a dedicated subsection (4.3) that separates the theoretical definition, the unfitted analytical estimation procedure, and the empirical validation step; we also report cross-validation results on held-out data and an independent benchmark on a secondary keystroke corpus. revision: yes

Circularity Check

1 steps flagged

Self-defined CLC produces analytical 85-95% accuracy estimate by construction under internal assumptions

specific steps
  1. self definitional [Abstract]
    "Drawing on large-scale keystroke datasets comprising over 136 million events, we define the Cognitive Load Correlation (CLC) and show it distinguishes genuine composition from mechanical transcription. Our analytical evaluation estimates 85 to 95 percent discrimination accuracy under stated assumptions"

    CLC is defined internally from the dataset; the discrimination accuracy is then produced via analytical evaluation under the paper's own stated assumptions. The 85-95% figure is therefore generated from the definition itself rather than from an independent derivation or validation step, rendering the performance claim tautological to the metric's construction.

full rationale

The paper's central claim rests on defining the Cognitive Load Correlation (CLC) from the 136M-event keystroke dataset and then analytically estimating 85-95% discrimination accuracy under stated assumptions. No independent derivation, external benchmark, or unfitted empirical validation against the dataset is shown; the accuracy figure is generated directly from the CLC definition and its assumptions. This matches the self-definitional pattern where the metric and its performance claim reduce to the same internal construction. No self-citations or other load-bearing external references appear in the provided text.

Axiom & Free-Parameter Ledger

1 free parameters · 1 axioms · 1 invented entities

The central claim rests on a newly defined metric (CLC) and domain assumptions about cognitive processes in typing; no external benchmarks or machine-checked proofs are referenced.

free parameters (1)
  • CLC definition parameters and quantization thresholds
    Parameters required to compute the correlation and limit biometric leakage, likely fitted or chosen to achieve stated accuracy.
axioms (1)
  • domain assumption Keystroke timing patterns reflect distinct cognitive stages of planning, translating, and revising during genuine composition
    Invoked to link timing data to human authorship and distinguish from mechanical transcription.
invented entities (1)
  • Cognitive Load Correlation (CLC) no independent evidence
    purpose: Quantify cognitive signatures in typing behavior for authorship discrimination
    Newly introduced metric whose independent evidence is not provided outside the paper's definitions and estimates.

pith-pipeline@v0.9.0 · 5460 in / 1296 out tokens · 50319 ms · 2026-05-15T18:38:30.870362+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.