# On the Insecurity of Keystroke-Based AI Authorship Detection: Timing-Forgery Attacks Against Motor-Signal Verification

arXiv: https://arxiv.org/abs/2601.17280 · HTML: https://mlsanity.com/paper/2601.17280/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 17 of its 39 references that are in the map.
- First posted on arXiv 24 Jan 2026.

## Builds on (most cited first, 17 of 17)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Certified Adversarial Robustness via Randomized Smoothing](https://mlsanity.com/paper/1902.02918/) (2019)
- [DetectGPT: Zero-Shot Machine-Generated Text Detection using Probability Curvature](https://mlsanity.com/paper/2301.11305/) (2023)
- [A Watermark for Large Language Models](https://mlsanity.com/paper/2301.10226/) (2023)
- [GLTR: Statistical Detection and Visualization of Generated Text](https://mlsanity.com/paper/1906.04043/) (2019)
- [Can AI-Generated Text be Reliably Detected?](https://mlsanity.com/paper/2303.11156/) (2023)
- [CoAuthor: Designing a Human-AI Collaborative Writing Dataset for Exploring Language Model Capabilities](https://mlsanity.com/paper/2201.06796/) (2022)
- [GPT detectors are biased against non-native English writers](https://mlsanity.com/paper/2304.02819/) (2023)
- [Who is Real Bob? Adversarial Attacks on Speaker Recognition Systems](https://mlsanity.com/paper/1911.01840/) (2019)
- [TypeNet: Deep Learning Keystroke Biometrics](https://mlsanity.com/paper/2101.05570/) (2021)
- [Keystroke Dynamics Against Academic Dishonesty in the Age of LLMs](https://mlsanity.com/paper/2406.15335/) (2024)
- [Detecting LLM-Assisted Academic Dishonesty using Keystroke Dynamics](https://mlsanity.com/paper/2511.12468/) (2025)
- [LLM-Assisted Cheating Detection in Korean Language via Keystrokes](https://mlsanity.com/paper/2507.22956/) (2025)
- [Obfuscating Keystroke Time Intervals to Avoid Identification and Impersonation](https://mlsanity.com/paper/1609.07612/) (2016)
- [Active Authentication via Korean Keystrokes Under Varying LLM Assistance and Cognitive Contexts](https://mlsanity.com/paper/2509.24807/) (2025)

## Built on by (most cited first, 3 of 3)

- [Detecting Cognitive Signatures in Typing Behavior for Non-Intrusive Authorship Verification](https://mlsanity.com/paper/2603.00177/) (2026)
- [Does AI Assistance Leave a Temporal Fingerprint? Detecting Overreliance in AI-Assisted Writing and Programming](https://mlsanity.com/paper/2609.17883/) (2026)
- [Writerslogic at PAN 2026: Process over Content for Robust Detection under Domain Shift](https://mlsanity.com/paper/2610.03565/) (2026)

## Abstract (arXiv)

Recent proposals advocate using keystroke timing signals, specifically the coefficient of variation (δ) of inter-keystroke intervals, to distinguish human-composed text from AI-generated content. We demonstrate that this class of defenses is insecure against two practical attack classes: the copy-type attack, in which a human transcribes LLM-generated text producing authentic motor signals, and timing-forgery attacks, in which automated agents sample inter-keystroke intervals from empirical human distributions. Using 13,000 sessions from the SBU corpus and three timing-forgery variants (histogram sampling, statistical impersonation, and generative LSTM), we show all attacks achieve ≥99.8% evasion rates against five classifiers. While detectors achieve AUC=1.000 against fully-automated injection, they classify ≥99.8% of attack samples as human with mean confidence ≥0.993. We formalize a non-identifiability result: when the detector observes only timing, the mutual information between features and content provenance is zero for copy-type attacks. Although composition and transcription produce statistically distinguishable motor patterns (Cohen's d=1.28), both yield δ values 2-4x above detection thresholds, rendering the distinction security-irrelevant. These systems confirm a human operated the keyboard, but not whether that human originated the text. Securing provenance requires architectures that bind the writing process to semantic content.