Using process data in integrity cases — what the research supports

The shift this page describes

AI detectors inspect the finished text and guess how it was made. Process data inverts that: it records how the document was made, while it was being made — when text arrived, in what bursts, with what pauses, revisions, and deletions. The research tradition behind this is decades old and comes from writing science, not from the detection industry; the full literature review is here. This page is the practical version: what the evidence supports in an integrity case, and the fairness rules for using it.

What the research found

The foundational fact, from the field's central methods paper (Leijten & Van Waes, Written Communication 2013):

"Keystroke logging has become instrumental in identifying writing strategies and understanding cognitive processes."

For integrity specifically, two studies matter most.

Trezise et al. (2019, Journal of Learning Analytics) had participants both compose original text and transcribe prepared text, and measured the difference:

"while completing the free-writing task, participants typed in shorter bursts with longer pauses and typed more slowly with more revisions compared to the two transcription tasks."

Their conclusion, carefully hedged: keystroke and clickstream analysis "may be able to distinguish between a student writing an authentic piece of work and one transcribing a completed work."

Crossley et al. (EDM 2024) put a number on it:

"Results indicated that keystroke logs accurately predicted whether an essay was written or transcribed with 99% accuracy using a random forest model."

And described why the signal is strong:

"Authentic writing included a greater number of pauses before sentences and words, had a greater number of insertions and longer insertions, deleted more words and characters, and had a greater number of revisions than transcribed writing."

"Transcribers, on the other hand, produced a greater number of writing bursts because they were simply copying language."

"Authentic writing is a dynamic process where writers monitor their writing and evaluate whether the writing needs to be changed if problems are identified. Transcribed writing, on the other hand is much more linear."

The relevance to AI cases is direct: a student who generates text elsewhere and brings it into their document is, from the process record's point of view, transcribing — pasting in blocks or retyping finished prose — and that is exactly the behavior these studies distinguish from composing.

Why this evidence is different in kind from a detector score

A detector score is a population statistic applied to an individual: "documents with these word patterns are often AI-generated." Its published error rates are the reason integrity panels are warned off it.

Process evidence is about the individual document. "This essay arrived in four pasted blocks over nine minutes" and "this essay accumulated over three hours with 212 revisions" are observations, not inferences — reviewable by anyone, requiring no trust in a vendor's model. The questions it answers are the ones a hearing actually asks: When was this written? In what sessions? Did the text grow like drafting or arrive like pasting?

That reviewability matters for fairness in both directions. Process data is how an honest student demonstrates their work — the exonerating use — not just how misconduct is noticed. In our experience of how these records function, the exonerating use is the common one: the student who wrote honestly has hours of ordinary, unfakeable drafting behavior on their side.

The limits, stated as plainly as the findings

The research review lists these in full; the ones a case handler must know:

1. The 99% figure is from a controlled experiment. Participants composed or transcribed under assigned conditions. No study in this literature measured accuracy against a motivated adversary simulating composition behavior, and real classrooms contain legitimate behaviors the lab didn't (drafting elsewhere and pasting your own text in, for one).
2. Logs record behavior, not intent. A paste event shows text arriving; it does not show whether the source was the student's own notes, a friend's suggestion, or a chatbot. Even Trezise et al. stay at "may be able to distinguish." Treat process anomalies as questions to ask the student, not verdicts — the conversation guide is here.
3. Absence of a record is not evidence of guilt. A student who wrote offline, or without logging enabled, has no process record; that is a fact about tooling, not about honesty.
4. Consent is not optional. The research community's own practice is the standard: a 2026 published corpus required "informed consent from both parents and children," with participants "explicitly informed, orally and in writing, that participation was entirely voluntary and that they could withdraw at any time without any consequences" (Houssein et al.). Process capture in a course should be disclosed in the syllabus, consented to, and visible to the student — policy language examples here.

What a defensible process-evidence practice looks like

• Announce it before the work, never after. Students should know what is recorded and be able to see their own record.
• Use it first as the student's evidence. The strongest configuration is one where the student presents their record in response to a question — which also solves the consent problem structurally.
• Read records whole, not for gotchas. One large paste in an otherwise rich drafting history is usually the student's own outline arriving. The guide to reading these records honestly — including what they cannot show — is how to read a process record and what a writing record cannot prove.
• Prefer tamper-evident records. A history that can be silently edited afterward is weaker than one that is sealed and independently checkable — the difference explained in tamper-evident vs tamper-proof.

The bottom line

The writing-science literature says composing and transcribing leave different, measurable traces — with near-perfect separation in controlled conditions and honest hedges about everything beyond them. That makes process data the strongest evidence class available to an integrity case: not because it is infallible, but because its claims are about the actual document, its limits are published, and the student can hold the same record you do. Used with consent and read with care, it replaces "the algorithm says 87%" with facts both sides can look at.

Related reading: keystroke logging and writing-process research · what the research says for integrity panels · alternatives to AI detectors