Temporal analysis in writing evidence: what typing cadence data can and cannot prove

What this review covers

Timing data from writing sessions — inter-keystroke intervals, pause patterns, burst lengths, session boundaries — has attracted growing attention in both biometric authentication and academic integrity research. The two applications use the same raw material but ask different questions: biometric identification asks whose typing signature is this, while behavioral classification asks whether the text was composed or transcribed. These are different problems with different accuracy profiles, different evidentiary weights, and different failure modes.

This review covers four papers across keystroke biometrics and writing-process research, examines what timing data actually measures at the hardware and OS level, and builds a clear account of what temporal evidence can and cannot establish when it appears in an integrity case or formal proceeding.

---

The biometric use: whose typing is this?

Keystroke dynamics as an authentication modality has a three-decade literature. Teh, Teoh, and Yue's 2013 survey, one of the most widely cited reviews in the field, defines the core premise: "Keystroke dynamics authentication is a behavioural biometric" that captures "dwell time" (the duration a key is held down) and "flight time" (the interval between releasing one key and pressing the next). Together these form a rhythm that is individual-specific — consistent enough within one person over time, and different enough between people, to build authentication systems.

The accuracy frontier for this use case is represented by Acien et al.'s TypeNet (2020), which scaled keystroke biometric classification to very large datasets using a deep recurrent neural network. TypeNet reports an Equal Error Rate (EER) of approximately 0.3% on datasets with millions of typing samples from thousands of users — meaning about 3 in 1,000 authentication attempts produce either a false accept or a false reject. This is strong performance by any biometric standard.

The critical caveat is the phrase "millions of typing samples." The accuracy figure depends on having a large, stable reference sample from the person being matched. In an educational context, a student may have produced a handful of documented writing sessions, spread across different task types and emotional states. Small reference samples are a known degradation vector for keystroke biometrics: Acien et al. note that accuracy falls with fewer enrollment keystrokes, and Teh et al.'s survey identifies within-session variation — caused by fatigue, illness, or simply writing a harder passage — as a persistent challenge. Identifying the typist from a single writing session against no reference sample is not a problem the biometric literature has solved.

The upshot for evidence use: keystroke biometrics can, in principle, corroborate that a known person produced a given record — if a sufficient reference sample exists and the comparison is done by an expert using appropriate methodology. It cannot, on the basis of a single new session, positively identify the author from the general population.

---

The behavioral classification use: composed or transcribed?

The more immediately applicable finding for integrity cases comes from a different question. Rather than asking who typed the text, Trezise et al. (2019) and Crossley et al. (2024) asked whether the keystroke log reveals how the text came to exist — whether it was composed in place, transcribed from an external source, or generated by a tool and pasted.

Trezise et al. used learning analytics data from a large-enrollment course to compare authentic writing with suspected contract-cheated submissions. Their finding: students who composed text "typed in shorter bursts with longer pauses and typed more slowly with more revisions" compared to students who appeared to be transcribing pre-prepared text. Authentic composition shows a characteristic pattern — bursts of typing, pauses for planning and revision, corrections, and structural recursion — that differs from the relatively smooth, fast, low-revision signature of transcription.

Crossley et al. (2024) tested this more rigorously. Working with a dataset of essays that were either authentically written or deliberately transcribed by participants copying from external sources, they found that process features derived from keystroke logs — including pause patterns, revision rate, and burst characteristics — classified written versus transcribed essays with 99% accuracy. The authors report: "Authentic writing included a greater number of pauses before sentences and words" compared to transcribed text. This pause distribution at linguistic boundaries — the micro-hesitation before starting a new sentence, reflecting planning — is a cognitive signature of composing rather than copying.

The 99% figure is striking and deserves scrutiny. It was achieved in a controlled experimental setting where the distinction between conditions was clean (participants were either writing their own essays or copying from a provided text). Real-world cases are messier: a student might legitimately paste in their own outline, then write the body. A student writing in a second language might pause more at word boundaries than a fluent writer, not because they are copying but because lexical access takes longer. The classification accuracy in ecologically valid conditions — real mixed workflows, real student populations — is likely lower than the headline number, though the directional finding (authentic writing has a characteristic temporal structure) is robust.

Three factors are worth making explicit. First, the Crossley study used a clean two-condition design: participants either wrote their own essay from scratch or copied a provided text verbatim. The condition most commonly at issue in actual AI-use cases — writing one's own essay with AI assistance at various stages of the process — was not tested. That hybrid workflow does not map cleanly onto either condition, and it is the condition where classification is hardest. Second, a student pasting in their own notes or outline produces a timing signature — a large block arriving without preceding keystroke activity — that is indistinguishable in the temporal data from a student pasting in AI-generated text; the paste event looks the same regardless of the source. Third, students who know they are being recorded may alter their composition behavior, either consciously (slowing down, adding artificial pauses) or unconsciously (writing more carefully), in ways that shift the timing distribution away from their natural baseline. These three factors together mean the applicable accuracy in a realistic integrity case is lower than 99%, though the directional finding remains robust.

---

What temporal data actually measures

Inter-keystroke timing data captured by a process recorder operates at the OS input event level. A keydown event carries a hardware timestamp independent of application logic — it records when the key was physically depressed, not when the application processed it. This makes the timestamps relatively hard to manipulate at the application layer without also manipulating the OS event queue, which requires elevated system access.

The measurable features include:

• Inter-keystroke interval (IKI): time between consecutive key-down events
• Dwell time: duration from key-down to key-up for each key
• Pause events: periods with no keyboard activity, particularly at sentence and paragraph boundaries
• Burst structure: runs of keystrokes with IKIs below a threshold, separated by pauses above it
• Revision events: backspace sequences and their timing relative to the surrounding keystrokes
• Session boundaries: when capture started and stopped, and any gaps within a session

These features are observable without any interpretation of the text content — they are structural properties of the writing event, not semantic analysis of the result.

---

What timing data can and cannot establish

Timing data CAN establish:

• Whether text arrived in typing bursts consistent with composition, or in large blocks consistent with paste-and-type transcription
• The approximate wall-clock time spent in active typing versus idle time
• Whether the session time is plausible for the length and complexity of the document
• Whether the pause distribution at linguistic boundaries matches the signature of authentic composition (per Crossley et al.)
• The revision rate and its distribution across the document

Timing data CANNOT establish without additional context:

• Identity — who produced the record, absent a reference sample and biometric comparison
• Intent — why a large block of text arrived without typing (the student's own pasted outline is a legitimate use case indistinguishable in timing data from pasted AI output)
• That AI was or was not used — timing data shows how text arrived in the editor, not what generated it; a student who wrote the text externally and typed it in would produce a transcription-like pattern even though no AI was involved
• That the record is complete — timing data shows what was captured, but cannot rule out that writing occurred outside the capture window

---

The forgery question

One important question for evidence purposes is whether timing data can be fabricated convincingly. Automated typing systems — scripts that replay keystrokes at configurable speeds — can replicate average human typing rates. However, replicating the natural pause distribution at linguistic boundaries is significantly harder. The Crossley et al. finding that authentic writing shows "a greater number of pauses before sentences and words" describes a cognitive signature: the planning micro-pause before each new sentence is a consequence of compositional processing, not keyboard mechanics. An automated replay script operating at the character level has no compositional process to mimic.

This does not make temporal forgery impossible — a sophisticated attacker who understood the research could attempt to inject linguistically-appropriate pauses into an automated replay. But it raises the cost and expertise required, and it produces a different attack surface than simply presenting a false document: the forged timing sequence would still need to survive statistical comparison against known authentic writing patterns. The difficulty is asymmetric — honest writers produce the right signal automatically.

---

Summary

Question	What timing data establishes	Confidence
Was this text typed in bursts consistent with composition?	Directly measurable	High, given an accurate capture
Was this text pasted in large blocks?	Directly measurable	High
Is the session time plausible for this document?	Directly measurable	High
Who typed this?	Only with biometric reference sample	Moderate at best (small samples)
Was AI used to generate the text?	Cannot establish directly — a student who typed AI-generated text character-by-character would produce an authentic-composition signature	N/A — wrong question for timing data alone
Is the timing record complete?	Only with sealed capture-start/stop events	Requires infrastructure

Timing data is one component of a process record, not a standalone proof. Combined with content snapshots, revision patterns, and a tamper-evident seal that authenticates the record as a whole, temporal evidence becomes a richer picture of how a text came into existence.

---

Related reading:

• Keystroke logging and writing-process research
• Chain of custody for digital writing evidence
• What a writing record cannot prove
• How to read a process record
• Process data in integrity cases