Keystroke cadence variance

What it measures

The inter-key interval — milliseconds between consecutive keydown events — across a writing session, and the standard deviation of that interval. Red Stet collects the key events from the recording sidecar, drops intervals of 800 ms or longer (those are paragraph breaks, not cadence), and reports the σ of what remains.

A typed paragraph yields a few hundred samples. A 5,000-character document yields thousands. The σ stabilizes quickly once the sample count crosses a couple hundred.

Why it discriminates

Hand typing is biomechanical. Finger flexors fatigue, recover, overshoot, miss-cue. Motor learning compresses practiced bigrams — th, ing, tion, ed — into tight, sub-100 ms clusters that any English speaker has rehearsed millions of times. Unpracticed character pairs sit far above that floor, sometimes by an order of magnitude. The result is a heavy-tailed distribution of inter-key intervals with a σ that rarely drops below 30 ms in continuous prose and routinely sits between 40 and 80 ms.

Pasted or programmatically emitted text has none of this structure. A script that pushes characters into a contenteditable through synthesized events — or a person typing one character at a time at metronome speed — produces a near-Gaussian, narrow distribution clustered around a single mean. There is no biological feedback loop generating variability: no fatigue, no muscle-memory shortcut, no eye-flick re-read pause between clauses.

The variability is mechanical: 10 fingers travel different distances across the keyboard at different levels of practice, while the writer plans the next clause. That mechanism is why the signal has held for 45+ years as a biometric — the underlying physiology hasn't changed since the first 1970s studies measured it on teletype terminals.

The same physiology produces the secondary structure researchers have catalogued — bigram-conditional latencies that cluster by hand-position (alternating hands faster than same-hand), digraph dwell times that correlate with finger strength, post-error slowdown after a backspace. Red Stet uses the σ summary because it's robust, language-independent, and survives short documents. The richer structure is available for future work; the σ alone separates machine cadence from human cadence in the published corpora.

Research history

The field starts in the late 1970s at the intersection of two unrelated efforts: U.S. Air Force authentication research and Xerox PARC's cognitive modeling of human-computer interaction. Forsén, Nelson, and Staron's 1977 Rome Air Development Center report — Personal Attributes Authentication Techniques — surveyed candidate biometrics and explicitly named keystroke timing as a measurable identifier on then-current teletype terminals. Three years later Card, Moran, and Newell published the Keystroke-Level Model for HCI in Communications of the ACM, establishing that keystroke timing was a meaningful, predictable construct worth modeling.

The breakthrough paper most modern work cites came from RAND Corporation the same year: Gaines, Lisowski, Press, and Shapiro's Authentication by Keystroke Timing: Some Preliminary Results (RAND R-2526-NSF, 1980). They tested seven typists on 300- and 600-word passages, measured digraph latencies, and showed individuals were separable on five common bigrams. The sample was small and the conditions tightly controlled, but the result lit a path: typing patterns carry identity, and the carrier signal is timing, not content.

The next decade produced the foundational papers of the modern field. Joyce and Gupta's 1990 Identity Authentication Based on Keystroke Latencies in Communications of the ACM generalized the approach to login-string authentication and is the citation most subsequent surveys lead with. Bleha, Slivinsky, and Hussien refined classifier accuracy in 1990. Monrose and Rubin's 1997 Authentication via Keystroke Dynamics at ACM CCS — and their longer 2000 follow-up in Future Generation Computer Systems — moved the field from fixed-string login authentication to free-text continuous monitoring, which is the regime Red Stet operates in.

Through the 2000s the work fanned out. Bergadano, Gunetti, and Picardi published a series of Italian-language studies showing the signal survived a non-English orthography. Killourhy and Maxion's 2009 DSN paper Comparing Anomaly-Detection Algorithms for Keystroke Dynamics shipped the benchmark dataset and methodology that most subsequent classifier papers measure themselves against. Banerjee and Woodard's 2012 survey in Journal of Pattern Recognition Research consolidated 30 years of results. By the 2010s, keystroke dynamics had moved into production: continuous-authentication systems at financial services firms, identity verification at Coursera and other MOOCs, and active-authentication research programs at DARPA and the European COST initiative. The 2020s have been about deep-learning classifiers, mobile keystroke dynamics (where the cadence physics differ substantially), and the new question Red Stet sits inside: distinguishing typed prose from pasted machine output.

Key papers

Forsén, Nelson & Staron (1977)

Personal Attributes Authentication Techniques. Rome Air Development Center Technical Report RADC-TR-77-333. The earliest systematic survey naming keystroke timing as a candidate biometric.

Card, Moran & Newell (1980)

The Keystroke-Level Model for User Performance Time with Interactive Systems. Communications of the ACM, 23(7), 396–410. Established keystroke timing as a measurable, modelable construct in HCI. doi:10.1145/358886.358895

Gaines, Lisowski, Press & Shapiro (1980)

Authentication by Keystroke Timing: Some Preliminary Results. RAND Corporation Report R-2526-NSF. The foundational experiment that demonstrated typing patterns carry identity. rand.org/pubs/reports/R2526

Joyce & Gupta (1990)

Identity Authentication Based on Keystroke Latencies. Communications of the ACM, 33(2), 168–176. The most-cited foundational paper of the modern keystroke-dynamics field. doi:10.1145/75577.75582

Bleha, Slivinsky & Hussien (1990)

Computer-Access Security Systems Using Keystroke Dynamics. IEEE Transactions on Pattern Analysis and Machine Intelligence, 12(12), 1217–1222. Refined classifier accuracy on Joyce-Gupta-style fixed-string authentication. doi:10.1109/34.62613

Monrose & Rubin (1997)

Authentication via Keystroke Dynamics. Proceedings of the 4th ACM Conference on Computer and Communications Security, 48–56. Extended the methodology to free-text monitoring. doi:10.1145/266420.266434

Monrose & Rubin (2000)

Keystroke Dynamics as a Biometric for Authentication. Future Generation Computer Systems, 16(4), 351–359. The expanded journal treatment. doi:10.1016/S0167-739X(99)00059-X

Bergadano, Gunetti & Picardi (2002)

User Authentication through Keystroke Dynamics. ACM Transactions on Information and System Security, 5(4), 367–397. First major study showing the signal generalizes across orthographies (Italian corpus). doi:10.1145/581271.581272

Gunetti & Picardi (2005)

Keystroke Analysis of Free Text. ACM Transactions on Information and System Security, 8(3), 312–347. The free-text classifier that most continuous-authentication systems descend from. doi:10.1145/1085126.1085129

Killourhy & Maxion (2009)

Comparing Anomaly-Detection Algorithms for Keystroke Dynamics. Proceedings of the IEEE/IFIP International Conference on Dependable Systems and Networks, 125–134. The benchmark dataset and evaluation protocol most modern classifier papers measure against. doi:10.1109/DSN.2009.5270346

Banerjee & Woodard (2012)

Biometric Authentication and Identification Using Keystroke Dynamics: A Survey. Journal of Pattern Recognition Research, 7(1), 116–139. The consolidating survey of 30+ years of results. doi:10.13176/11.427

Teh, Teoh & Yue (2013)

A Survey of Keystroke Dynamics Biometrics. The Scientific World Journal, 2013, 408280. Companion survey covering classifier evolution through the early deep-learning era. doi:10.1155/2013/408280

Confidence level

Forty-five-plus years of research, replicated across English and non-English corpora, deployed in production continuous-authentication systems at financial services firms, MOOC identity verification (Coursera's Signature Track and successors), and active-authentication programs funded by DARPA and the European Union. Of the seven signals in Red Stet's composite, this is the one with the deepest published literature and the clearest physiological grounding.

The signal's confidence comes from two independent sources: the biomechanical reason it exists is well-understood motor-control science, and the empirical separability has been measured across hundreds of datasets and dozens of classifier architectures.

Known limitations

• Highly practiced typists produce mechanical-looking cadence on familiar phrases. A professional transcriptionist or competitive typist on a well-rehearsed passage can produce σ in the low-20s. The signal alone cannot separate this case from synthetic typing — the composite has to do that work via other signals.
• Touch-typing trained users have lower variance than hunt-and-peck users. A 110-WPM touch typist sits at a different baseline than a 30-WPM hunt-and-peck typist. Both are human; their σ values differ by a factor of 2 or 3. The signal characterizes presence of human typing, not its skill level.
• Voice-to-text dictation produces patterns that look unlike either typed or pasted text. Dictated text arrives in short bursts at speech-recognition cadence — fast within a burst, long silences between. The signal can flag this as anomalous; it cannot identify it as dictation rather than as pasted output.
• Adversaries who type out model output character-by-character defeat this signal alone. A patient adversary who reads model output and re-types it produces a human cadence distribution. The composite catches this case through other signals (paste ratio, correction rate, thinking pauses); the σ on its own cannot.
• Mobile typing has fundamentally different cadence distributions. Swipe-typing, autocorrect insertions, and the soft-keyboard backspace economy produce timing patterns the desktop literature does not cover. Red Stet's anchors are calibrated on desktop and laptop typing; mobile sessions need their own baseline before this signal can be trusted on them.
• Browser performance lag introduces artificial cadence noise. A slow contenteditable, a heavy React re-render, or a background tab eating CPU produces inter-key intervals that look like the writer paused when they didn't. The 800 ms cutoff suppresses the worst of this; sub-800 ms lag-induced jitter still inflates σ.
• Short documents don't accumulate enough samples. Below roughly 200 inter-key samples the σ estimate has wide confidence intervals; below 11 samples it is meaningless. Red Stet's behavior: with 10 or fewer samples the cadence signal scores a neutral 60 (neither evidence for nor against) and the verifier notes the low sample count next to the composite. Document-level evidence bands apply on top — below 500 typed characters the verifier reports "Insufficient evidence" instead of a verdict tier, and 500–2,000 characters carries a reduced-confidence note (see Limitations).
• Coarsened browser timers can fake mechanical cadence. Privacy-hardened browsers quantize event timestamps (Firefox resistFingerprinting: 100 ms). The analyzer detects fully-quantized timing (≥ 90% of deltas on a 25/50/100 ms grid) and scores this signal neutral with a note rather than machine-like; partial coarsening below that bar remains a known confound (see Limitations → Measurement-environment confounds).
• The signal is content-agnostic but not language-agnostic. Languages with different bigram frequencies produce different σ baselines — Italian and Chinese pinyin do not share an English keystroke-cadence baseline. Within-language inference is robust; cross-language comparisons require recalibration.

How Red Stet uses it cadenceScore

The recording sidecar emits a key event for every printable keydown in the editor window, plus Enter, Tab, and Space. Backspace, Delete, and navigation keys get their own event types; modifier-only presses are skipped. Keyboard-shortcut chords (the c in Cmd-C) currently emit key events and are counted — a known impurity in the cadence stream, recorded with a modifier flag so a future pass can exclude them. The verifier walks the key events, computes inter-key intervals, drops anything at or above 800 ms (paragraph breaks, room-leaving, distraction pauses), and computes σ over what remains. The score maps σ to a 0–100 scale anchored on the sample-corpus distribution: σ = 8 ms scores 0 ("machine-like"), σ = 60 ms scores 100 ("clearly human"), values in between scale linearly. With 10 or fewer samples, the signal scores a neutral 60 instead (see Known limitations).

The 0.22 weight is the largest single weight in the composite — heavier than backspaces (0.20), paste ratio (0.15), and the mouse signals (0.10 each). The cadence signal earns the top weight because the published literature on it is deepest and because the underlying physiology is hardest to spoof at scale.

The per-moment surface in the verifier's right panel does not flag a low-σ run as "AI detected." It surfaces it as a window uncommon for hand-typed work — a span of N keystrokes where the local σ collapses below the human range — and invites the reader to inspect that window themselves. A practiced transcriptionist can produce the same pattern.

The signal feeds the composite verdict tier alongside the other six signals: Consistent with hand-typed composition at composite ≥ 70, Mixed signals — worth review in the 40–70 band, Patterns uncommon in hand-typed documents below 40. The page on how the signals combine walks the weighting in full.