Click position patterns

What it measures

The fraction of click events whose (x, y) pixel coordinates both fall on a 10-pixel grid — coordinates evenly divisible by 10. A click at (240, 110) snaps; a click at (243, 108) does not.

The recorder listens document-wide and emits a click event for every completed click (press and release, with the press-to-release dwell time recorded) anywhere on the page — editor text and app UI alike. Red Stet counts how many of those carry grid-aligned coordinates and divides by the total. The result is one number between 0 and 1. Because UI controls sit at fixed positions, repeated clicks on the same button can cluster on identical coordinates for benign reasons — one more cause of grid-alignment that isn't automation.

Why it discriminates

Pointing at a target on a screen is a closed-loop motor act. The hand launches a fast ballistic movement toward the target region, then corrects with a slower sub-movement that bleeds off the remaining error. Fitts's 1954 formulation made this a quantitative law — index of difficulty as a function of distance and target width — but the underlying mechanism is the speed–accuracy tradeoff: faster movements land less precisely, and the nervous system trades one for the other in real time. The corrective phase never quite stops; it bleeds into a sub-pixel jitter around the intended target.

Scripted clicks have no corrective phase. A test framework, a click-bot, an accessibility scripting tool, or an automated browser instructs the browser to dispatch a click at coordinates (x, y) where x and y are integers chosen for convenience: the center of a button, the top-left of a region, a rounded approximation. The intent is "click somewhere in this element," and the coordinate the program picks tends to round to multiples of 5 or 10. There is no motor system in the loop and therefore no sub-pixel jitter — the noise the human nervous system contributes for free is missing.

The complication is that not all grid-aligned clicks are automation. Head-tracking devices, sip-and-puff switches, eye-gaze trackers, and other accessibility input methods often translate a high-level "select this UI element" intent into a click at the element's geometric center, which is frequently grid-aligned. Those clicks are human-driven; they look mechanical because the assistive layer between the human and the cursor is mechanical. Touch input introduces its own coordinate-rounding behavior that varies by browser. The signal sees "snap to grid" without seeing why — interpretation has to acknowledge the ambiguity.

Research history

The motor-control half of the story is old and well-established. Paul Fitts published The Information Capacity of the Human Motor System in Controlling the Amplitude of Movement in 1954 in the Journal of Experimental Psychology. The law that bears his name predicts movement time from target distance and width, and the experimental literature around it has tracked the speed–accuracy tradeoff across stylus tasks, mouse pointing, finger touch, and head tracking for seventy years. The sub-pixel jitter around landing positions is a direct consequence of that tradeoff; it is not a separate discovery, just the residual the law explains.

The discrimination half — using click positions to separate human from automated clicks — has a much thinner published trail. Most of the work lives inside commercial bot-detection systems (Google reCAPTCHA, Cloudflare Turnstile, Akamai Bot Manager, PerimeterX) whose features and weights are not public. Pusara and Brodley's 2004 paper on mouse-movement biometrics at the ACM workshop on visualization for computer security treats clicks as one of several mouse-derived features, and a line of behavioral-biometric work through the 2010s — Antal and Egyed-Zsigmond, Feher and colleagues, the BeCAPTCHA family of papers — folds click-position features into wider mouse-dynamics classifiers. The signal exists in the literature, but as a sub-feature, not a stand-alone discriminator. The most-cited surveys of mouse dynamics treat it as supporting evidence at best.

Key papers

Fitts (1954)

The Information Capacity of the Human Motor System in Controlling the Amplitude of Movement. Journal of Experimental Psychology, 47(6), 381–391. The foundational quantitative law for pointing, and the source of the speed–accuracy tradeoff that produces sub-pixel landing variation. doi:10.1037/h0055392

MacKenzie (1992)

Fitts' Law as a Research and Design Tool in Human-Computer Interaction. Human-Computer Interaction, 7(1), 91–139. The HCI re-derivation that ports Fitts to mouse and stylus tasks and underlies the modern interpretation of pointing-precision residuals. doi:10.1207/s15327051hci0701_3

Pusara & Brodley (2004)

User Re-Authentication via Mouse Movements. Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security, 1–8. Early treatment of mouse-derived features (including clicks) as a continuous-authentication biometric. doi:10.1145/1029208.1029210

Ahmed & Traore (2007)

A New Biometric Technology Based on Mouse Dynamics. IEEE Transactions on Dependable and Secure Computing, 4(3), 165–179. The most-cited mouse-dynamics paper of the 2000s; treats click features as part of a fused mouse-behavior vector. doi:10.1109/TDSC.2007.70207

Jorgensen & Yu (2011)

On Mouse Dynamics as a Behavioral Biometric for Authentication. Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, 378–383. A critical replication that examines how environmental factors (mouse model, screen resolution, surface) affect mouse-derived features, including click coordinates. doi:10.1145/1966913.1966983

Antal & Egyed-Zsigmond (2019)

Intrusion Detection Using Mouse Dynamics. IET Biometrics, 8(5), 285–294. Recent classifier evaluation that includes click-position distribution as part of the feature set; useful for the modern weighting context. doi:10.1049/iet-bmt.2018.5126

Acien, Morales, Vera-Rodriguez & Fierrez (2020)

BeCAPTCHA-Mouse: Synthetic Mouse Trajectories and Improved Bot Detection. arXiv:2005.00890. Treats mouse and click behavior as adversarial-detection signals and explicitly discusses synthetic-vs-human discrimination — the regime closest to Red Stet's. arxiv.org/abs/2005.00890

Confidence level

The motor-control physics is well-established; the discrimination application is not. Click-position patterns appear in production bot-detection systems, but those systems treat their feature lists as trade secrets. The published academic record on click coordinates as a standalone classifier is thin — most papers fold clicks into wider mouse-dynamics features, and the standalone discrimination rates that have been reported are well below what the cadence or correction-rate signals achieve.

Red Stet includes this signal because it composes well with the others and costs nothing to compute, not because it carries weight on its own. A document whose clicks all snap to a 10-pixel grid is, taken in isolation, weak evidence of anything — accessibility tools produce the same pattern, and a writing session may emit too few clicks to draw a stable rate from. The signal earns its place in the composite by being orthogonal to the others: a sophisticated adversary who has spoofed keystroke cadence and paste patterns and mouse trajectory still has to remember to add sub-pixel jitter to the click coordinates. One more dial to forget.

Known limitations

• Accessibility tools produce grid-aligned clicks from human users. Head-tracking, eye-gaze, sip-and-puff, switch-input, and on-screen keyboard "click here" UIs translate a select-this-element intent into a click at the element's geometric center — which often lands on a 10-pixel multiple. The user is human; the click looks mechanical. The signal cannot tell the two apart.
• Some browsers report click coordinates with reduced precision. Browser-level coordinate rounding for fingerprinting-resistance, DPI scaling at non-integer ratios, and OS-level event coalescing can produce grid-aligned coordinates regardless of the underlying click position. The signal sees the reported integer, not the physical landing.
• Touch input snaps differently than mouse input. Tap coordinates on mobile and tablet browsers go through their own coordinate-rounding pipeline that varies by browser, viewport zoom, and device pixel ratio. A tablet user may produce grid-aligned coordinates for reasons unrelated to the speed–accuracy tradeoff.
• The signal is near-binary, not continuous. A click either snaps or it does not. There is no graceful middle band the way there is for keystroke σ. That limits the discriminative power per event and forces Red Stet to accumulate many clicks before the rate stabilizes.
• Click volume per session is unpredictable. A writer who composes from keyboard alone may emit zero clicks in a 3,000-word session. Another writer who reorganizes paragraphs by selection may emit hundreds. The signal's denominator is whatever the session happens to produce, and a small denominator gives an unstable rate.
• Adversaries can defeat this signal cheaply. A scripted clicker that adds a Gaussian sub-pixel offset to every coordinate before dispatching the event evades grid-snap detection completely. The countermeasure is one line of code. The signal's value is forcing the adversary to remember the countermeasure, not making it impossible.
• In a writing session, most clicks land inside the editor text region. The spatial variety is narrow — there are no menu clicks, button presses, or scrollbar drags to widen the coordinate distribution. The narrower the spatial range, the more likely human clicks will accidentally land on grid-aligned coordinates by chance alone.

How Red Stet uses it gridSnapScore

The verifier walks the recorded event stream, counts every click event whose x and y are both divisible by 10, divides by the total click count, and maps the resulting rate to a 0–100 score: 0% grid-snap maps to 100 ("clearly human"), 100% grid-snap maps to 0 ("uncommon for hand-typed work"). Sessions with no clicks at all default to 60 — a neutral mid-band score that neither helps nor hurts the composite.

The 0.10 weight is the lowest in the composite, tied with mouse path geometry. Cadence (0.22), backspaces (0.20), paste ratio (0.15), paste source (0.12), and thinking pauses (0.11) all rank higher. Click patterns carry the smallest individual contribution because the literature behind it is the thinnest and the adversarial defeat is the cheapest.

The right-panel surface in the verifier surfaces grid-snap clicks both ways: each click whose coordinates land on the 10-pixel grid appears as an individual Questionable-tier moment on the timeline ("Grid-snap click · (x, y)"), filterable under the Clicks chip, and the aggregate rate feeds the composite through the formula above. Non-snapping clicks produce no moments — they are the expected case, not evidence. A single grid-snap moment is worth a glance, not a conclusion; the rate across many clicks is what the score reads.

The signal feeds the same composite verdict tier as the other six: Consistent with hand-typed composition at composite ≥ 70, Mixed signals — worth review in the 40–70 band, Patterns uncommon in hand-typed documents below 40. The page on how the signals combine walks the weighting and the reasoning behind the low individual contribution in full.