On the Insecurity of Keystroke-Based AI Authorship Detection: Timing-Forgery Attacks Against Motor-Signal Verification

TL;DR

This paper demonstrates that keystroke timing signals are insecure for AI authorship detection, as practical timing-forgery attacks can evade classifiers with over 99.8% success, highlighting the need for content-based verification methods.

Contribution

The paper introduces and evaluates timing-forgery attacks against keystroke-based AI authorship detection, revealing their effectiveness and the limitations of timing-only verification.

Findings

Timing-forgery attacks achieve ≥99.8% evasion rates.

Detectors classify ≥99.8% of attack samples as human with high confidence.

Mutual information between timing features and content is zero for copy-type attacks.

Abstract

Recent proposals advocate using keystroke timing signals, specifically the coefficient of variation ($\delta$) of inter-keystroke intervals, to distinguish human-composed text from AI-generated content. We demonstrate that this class of defenses is insecure against two practical attack classes: the copy-type attack, in which a human transcribes LLM-generated text producing authentic motor signals, and timing-forgery attacks, in which automated agents sample inter-keystroke intervals from empirical human distributions. Using 13,000 sessions from the SBU corpus and three timing-forgery variants (histogram sampling, statistical impersonation, and generative LSTM), we show all attacks achieve $\ge$99.8% evasion rates against five classifiers. While detectors achieve AUC=1.000 against fully-automated injection, they classify $\ge$99.8% of attack samples as human with mean confidence $\ge$0.993. We formalize a non-identifiability result: when the detector observes only timing, the mutual information between features and content provenance is zero for copy-type attacks. Although composition and transcription produce statistically distinguishable motor patterns (Cohen's d=1.28), both yield $\delta$ values 2-4x above detection thresholds, rendering the distinction security-irrelevant. These systems confirm a human operated the keyboard, but not whether that human originated the text. Securing provenance requires architectures that bind the writing process to semantic content.