Keystroke logging and writing-process research: the field that was watching all along

What this review covers

The public argument about AI and writing is dominated by one technology — the after-the-fact detector — and by the discovery, repeated across independent tests, that it cannot carry the weight being put on it. What that argument routinely misses is that a separate research tradition has studied writing by watching the process for decades: keystroke logging, the instrumented observation of how a text actually comes into being — every keypress, pause, deletion, and revision, timestamped.

This review reads that literature closely, because it is the scientific foundation under writing provenance. It covers three strands:

1. Writing-process research proper — the Inputlog tradition, which uses keystroke logs to understand how people write.
2. Process data in integrity contexts — the newer studies asking whether process data can distinguish authentic composition from transcription or contract cheating, including a 2024 study that reached 99% accuracy on exactly that question.
3. Keystroke dynamics as a biometric — the adjacent field that treats typing rhythm as an identifying characteristic, with its own accuracy numbers and its own caveats.

Every quotation below comes from a source fetched and checked on the date listed in the sources panel. Where a full text sat behind a paywall and only the abstract was checkable, we say so.

Strand one: watching writing to understand it

The instrument: Inputlog and its research program

The reference tool of the field is Inputlog, developed by Mariëlle Leijten and Luuk Van Waes at the University of Antwerp. The project's own description is usefully concrete about what process logging captures:

"Inputlog is a keystroke logging program enabling you to observe writing process dynamics and collect fine grained data."

And about what researchers do with it:

"Three types of analyses are offered: descriptive analyses (e.g., linear representation); sub process analyses based on algorithms (e.g., pause or revision analysis); process visualizations (e.g. fluency or source network)."

Note the vocabulary — pause analysis, revision analysis, fluency. These are first-class scientific objects in this field, not product marketing. The project states that "more than a thousand researchers are registered Inputlog users," and that teachers and trainers use it in classes. This is a mature, institutionalized research instrument, not a niche gadget.

The methods paper: Leijten & Van Waes (2013)

The field's standard methods citation is Leijten and Van Waes, "Keystroke Logging in Writing Research: Using Inputlog to Analyze and Visualize Writing Processes," Written Communication (2013). The publisher's full text is paywalled; the abstract, checked via the ERIC record, states the field's core claim:

"Keystroke logging has become instrumental in identifying writing strategies and understanding cognitive processes."

That sentence deserves a pause of its own. By 2013 — a decade before the AI-detection panic — it was already uncontroversial in writing research that logging keystrokes is how you identify writing strategies. The abstract is equally honest about the method's interpretive gap:

"While keystroke logging allows for ecological data collection, it is often difficult to connect the fine grain of logging data to the underlying cognitive processes."

So the founding methods paper itself warns against over-reading: the log shows what happened at the keyboard, and inferring why requires care. The paper's response to that gap is triangulation — it explores "the complementarity of the keystroke logging program Inputlog with other observational techniques: thinking aloud protocols and eyetracking data." The lesson carries directly into integrity contexts: process data is strong evidence of what happened, and should be combined with other evidence before anyone concludes why.

Discovering writing processes automatically

A representative later step is Conijn, van der Loo and van Zaanen, "What's (not) in a Keystroke? Automatic Discovery of Students' Writing Processes Using Keystroke Logging" (LAK 2018 companion proceedings, confirmed via the Tilburg University research portal). The title alone marks the field's trajectory: from manual analysis of logs toward automatic discovery of writing processes from keystroke data at student scale. (The portal record carries no quotable abstract, so we cite this paper for its existence and venue rather than its findings.)

Strand two: process data in integrity contexts

Composition and transcription look different: Trezise et al. (2019)

The question that matters for academic integrity is whether the process record of someone composing text differs measurably from the record of someone copying in text that already existed — because every outsourced essay, whether bought from a contract-cheating service or generated by a model, has to enter the submission box somehow.

Trezise, Ryan, de Barba and Kennedy, "Detecting Academic Misconduct Using Learning Analytics" (Journal of Learning Analytics, 2019), tested this directly, motivated by contract cheating:

"Keystroke logging and clickstream data... present promising alternative methods of detecting and preventing contract cheating."

Their experimental finding, from the abstract:

"...while completing the free-writing task, participants typed in shorter bursts with longer pauses and typed more slowly with more revisions compared to the two transcription tasks."

And their conclusion, stated with appropriate hedging:

"...keystroke and clickstream analysis may be able to distinguish between a student writing an authentic piece of work and one transcribing a completed work."

The mechanism is intuitive once stated: composing is slow, bursty, and self-correcting, because the writer is thinking; transcription is fast, smooth, and linear, because the thinking already happened somewhere else.

The strongest number in this review: Crossley et al. (2024)

Five years later, Crossley, Tian, Choi, Holmes and Morris put a number on it in "Plagiarism Detection Using Keystroke Logs" (Educational Data Mining 2024 — full text checked, not just the abstract):

"Results indicated that keystroke logs accurately predicted whether an essay was written or transcribed with 99% accuracy using a random forest model."

The features driving that classification are exactly the ones the writing-process tradition had been cataloguing for decades:

"Authentic writing included a greater number of pauses before sentences and words, had a greater number of insertions and longer insertions, deleted more words and characters, and had a greater number of revisions than transcribed writing."

"Transcribers, on the other hand, produced a greater number of writing bursts because they were simply copying language."

And the authors' interpretation, which could stand as a one-paragraph summary of why process evidence works where product evidence fails:

"Authentic writing is a dynamic process where writers monitor their writing and evaluate whether the writing needs to be changed if problems are identified. Transcribed writing, on the other hand is much more linear."

Hold that 99% against the numbers from the detector literature — the largest independent test of AI-text detectors found 26% accuracy on machine-paraphrased text. The comparison is not entirely fair, and we will be precise about why in the limits section below — the tasks differ, and the Crossley study is one experiment, not a product benchmark. But the direction of the gap is the point: the process record contains signal that the finished product simply does not carry. You cannot tell composition from transcription by reading the final text, because the final text is identical in both cases. The keystroke log makes the difference almost trivially visible.

Strand three: typing rhythm as a biometric

A separate field — keystroke dynamics biometrics — asks a different question: not how was this text produced but is this the same typist. It is worth reviewing here because it establishes how much identity signal lives in typing behavior, and because its honest accuracy caveats are a model for how process evidence should be presented.

The standard survey is Teh, Teoh and Yue, "A Survey of Keystroke Dynamics Biometrics" (The Scientific World Journal, 2013). On the field's surprisingly long history:

"The emergence of keystroke dynamics biometrics was dated back in the late 19th century"

— telegraph operators could be recognized by their keying rhythm — and the survey covers "the last three decades" of the modern field. On accuracy, the survey is candid:

"Keystroke dynamics biometrics are inferior in terms of authentication accuracy due to the variations in typing rhythm"

and behavioral biometrics generally "are normally inferior to physiological biometrics in terms of variability." Typing rhythm identifies, but noisily.

The modern deep-learning benchmark shows what scale does to that noise. TypeNet (Acien, Monaco, Morales, Vera-Rodriguez and Fierrez, arXiv:2004.03627), trained on the Aalto database of "more than 136M keystrokes from 168K users," reports:

"an equal error rate of 4.8% using only 5 enrollment sequences and 1 test sequence per user"

at a thousand-user scale. A 4.8% equal error rate is far from perfect — and that is the right lesson. Typing rhythm is genuinely characteristic of a person, and genuinely variable. Any system using it should treat it as corroboration, never as sole proof of identity.

The ethics thread: consent is the field's norm

Writing-process research watches people write, so the field built consent into its standard practice from the beginning. A recent, checkable example of the norm: a 2026 keylogging corpus in the Journal of Open Humanities Data (Houssein, Olive, Cislaru and Bordes) describes its protocol —

"Participation required informed consent from both parents and children... children were explicitly informed, orally and in writing, that participation was entirely voluntary and that they could withdraw at any time without any consequences."

The same paper summarizes, in passing, what the method is for:

"Keylogging is often used to analyze typing behavior and text composition. It provides valuable insights into how dynamics of text production (assessed through typing speed, pause length, error patterns, bursts of writing) varies according to different constraints."

Two norms, stated in one source: the data is scientifically rich, and it is collected with explicit, revocable consent. Any product that adopts the method inherits both obligations — a point the MLA-CCCC task force makes from the educator side, in its caution against using technology to "surveil, discipline, or punish".

Summary table

Study	Year	Question	Key finding
Leijten & Van Waes	2013	Methods	Keystroke logging "instrumental in identifying writing strategies"; connecting logs to cognition needs care
Conijn et al.	2018	Scale	Automatic discovery of student writing processes from logs (LAK)
Trezise et al.	2019	Integrity	Free writing: shorter bursts, longer pauses, more revisions vs transcription
Crossley et al.	2024	Integrity	99% written-vs-transcribed accuracy (random forest, keystroke features)
Teh et al. (survey)	2013	Biometrics	Typing rhythm identifying but variable; roots in 19th-century telegraphy
TypeNet	2020	Biometrics	4.8% equal error rate at 1K users, 136M-keystroke training corpus
Houssein et al.	2026	Ethics	Informed, revocable consent as standard protocol for keylogging research

What the literature does and does not establish

Established, with direct evidence:

• Keystroke logs reveal writing process — pauses, bursts, revisions — and the field has analyzed these signals for decades with standard tooling and a large research community.
• Composition and transcription produce measurably different process signatures, replicated across independent groups (Trezise 2019, Crossley 2024), with the strongest reported classification at 99% in a controlled study.
• Typing rhythm carries real identity signal (TypeNet's 4.8% EER at scale), with honest variability caveats from the field's own survey.
• Informed, revocable consent is the field's normal operating condition.

Not established — and worth being precise about:

• The 99% figure is from one controlled experiment with recruited participants, specific tasks, and a specific model. It is evidence that the signal is strong, not a certified error rate for any product, ours included. No study reviewed here certifies a real-world false-positive rate for process-based integrity judgments.
• The Leijten & Van Waes caution stands: logs record behavior, not intent. A long pause is a long pause; whether it was thinking, a phone call, or a visit to a chatbot in another window is not in the keystroke stream alone.
• Keystroke biometrics does not reliably identify individuals at population scale without enrollment, and nothing here suggests otherwise.
• None of this literature evaluates adversarial replay — a cheater re-typing generated text to manufacture a human-looking log. Trezise and Crossley both suggest re-typing still looks like transcription (bursts without revision structure), but a determined, slow, revision-faking adversary is outside what these studies tested.

Why this matters for writing provenance

The AI-detection debate is usually framed as a two-horse race between detectors and nothing. This literature says the framing is wrong. There has been a third option on the table for decades: look at the process, with consent, and the authorship question largely answers itself — not by statistical guesswork about the finished prose, but by direct observation of composition happening.

That is the scientific bet behind writing provenance, and behind Authmarks specifically: a consented session record that captures the typing, pasting, and revision structure this field has shown to be meaningful, sealed so it cannot be edited afterward, and verifiable by anyone without an account. The literature also dictates the honesty constraints we hold ourselves to — what a writing record cannot prove is this review's "not established" list, productized. The research was watching all along; provenance just gives the writer the record.