Writing process forensics: a systematic review from keystroke logging to authorship evidence

Introduction

Writing process research uses keystroke logging to study the cognitive and linguistic processes involved in text composition — pauses, bursts, revisions, and temporal patterns that the finished product cannot reveal. The field has a history spanning more than thirty years, originating in cognitive models of writing and maturing into a large body of empirical work on how writers plan, draft, and revise in real time. The same behavioral signal that researchers used to understand composition is now the foundation for a new application: detecting whether text was composed or transcribed, distinguishing authentic writing from outsourced or AI-generated submissions, and establishing authorship evidence that survives adversarial challenge. The field sits at the intersection of cognitive psychology, computational linguistics, and digital forensics, and the research base for all three perspectives is assessed here.

This review is intended for researchers, forensic practitioners, and technically sophisticated users who need a complete account of what the literature establishes — and an equally complete account of what it does not. Every claim is traced to its source. Study designs are described accurately so the limits of generalization are clear. The review covers the research lineage, core process features, the two major classification results, the keystroke biometrics tradition, fabrication resistance, and open questions. Implications for evidentiary use close the article.

---

The research lineage

The modern field of writing process research grows from a specific theoretical commitment: that writing is not transcription of pre-formed thought but an active cognitive problem-solving process in which language production, planning, and revision operate simultaneously and recursively. Hayes and Flower's 1980 cognitive model of writing established this framework. Grabowski (2008), synthesizing subsequent cognitive models, formalized why timing data matters — if writing involves interleaved cognitive processes (planning, formulation, monitoring), those processes produce observable temporal signatures at the keyboard: pauses of characteristic durations at predictable linguistic locations, revision activity that follows planning, burst structures that reflect fluency and working-memory load.

Keystroke logging became the primary empirical method for studying these signatures. The instrument-level foundation is Leijten and Van Waes's 2013 paper, "Keystroke Logging in Writing Research: Using Inputlog to Analyze and Visualize Writing Processes," published in Written Communication and indexed at ERIC (EJ1014302). The abstract, checked at the ERIC record, establishes the field's standing claim: "Keystroke logging has become instrumental in identifying writing strategies and understanding cognitive processes." The same paper establishes the field's honest epistemic limit: "While keystroke logging allows for ecological data collection, it is often difficult to connect the fine grain of logging data to the underlying cognitive processes." Those two sentences together define the method's reach — logging records behavior faithfully; inferring cognition from behavior requires care and triangulation.

The trajectory of the field from understanding writing toward evaluating writing integrity runs through learning analytics and educational data mining. Trezise et al. (2019) applied process-data analysis to academic misconduct detection from operational LMS data. Crossley et al. (2024) applied it in a controlled experiment that achieved 99% classification accuracy distinguishing composed from transcribed essays. The path from Grabowski's cognitive models to Crossley's forensic classifier spans roughly fifteen years of accumulating evidence that the behavioral signature of composition is both real and measurable.

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#e8f4ee', 'primaryTextColor': '#16130c', 'primaryBorderColor': '#1f5a3a', 'lineColor': '#6f5618', 'secondaryColor': '#fffdf8', 'background': '#fffdf8', 'mainBkg': '#fffdf8', 'clusterBkg': '#f0ede4', 'titleColor': '#16130c', 'edgeLabelBackground': '#fffdf8'}}}%%
timeline
    title Research lineage: writing process forensics
    1980 : Hayes & Flower cognitive model of writing
         : Writing as planning + translating + reviewing
    1990s : Keystroke logging emerges as research tool
          : Early pause and burst studies
    2008  : Grabowski — cognitive models and timing data
          : Why IKI reflects writing process
    2013  : Leijten & Van Waes — keystroke logging methodology
          : Inputlog; 1000+ registered researchers
    2013  : Teh, Teoh & Yue — keystroke biometrics survey
          : Identity question separated from process question
    2018  : Conijn et al. — automatic discovery of writing processes
          : LAK; student-scale application
    2019  : Trezise et al. — learning analytics for misconduct detection
          : Operational LMS data; composition vs transcription
    2020  : Acien et al. TypeNet — deep learning keystroke biometrics
          : 0.3% EER on large datasets
    2024  : Crossley et al. — 99% classification accuracy
          : Keystroke logs in educational data mining

---

Core process features and what they measure

The behavioral signal of composition is decomposable into a small set of measurable features that have been studied individually and in combination. Understanding what each feature reflects — and which cognitive process it indexes — is necessary for interpreting any forensic claim.

Inter-keystroke interval (IKI)

The inter-keystroke interval is the time between consecutive keypress events, measured in milliseconds. It is the primary biometric signal in keystroke dynamics research and a central process feature in writing research. In authentic composition, IKI distributions are log-normally distributed: a long right tail of slow intervals reflects cognitive processing, while the body of the distribution reflects motor execution speed. The log-normal shape is a reliable marker of the interleaving of cognitive and motor components. Transcription, by contrast, tends toward a distribution with a shorter tail — the typist is not generating language, only encoding it, so motor speed dominates and the heavy cognitive-load tail is absent.

Pause duration and location

A pause is conventionally defined as any IKI above a threshold — typically 2,000 milliseconds, though some studies use 1,000ms or define pause boundaries by context. What distinguishes writing process research from simple keystroke timing is the emphasis on where pauses occur relative to linguistic structure. Authentic composition shows pauses at sentence boundaries, before complex clause constructions, and before low-frequency words — all locations where planning load is elevated. This is the cognitive signature Crossley et al. (2024) identified: "Authentic writing included a greater number of pauses before sentences and words." Transcription shows pauses at different locations — at the end of transcribed phrase chunks, dictated by the typist's reading span rather than linguistic processing demands — and with a different temporal profile: shallower mean depth, shorter duration, different distribution.

The Leijten and Van Waes methods paper explicitly identifies pause analysis as one of the three primary analytical modes of the Inputlog system, alongside revision analysis and process visualization. Pause analysis is not a secondary or derived feature — it is a first-class scientific object in this research tradition.

Burst length

A writing burst is a continuous sequence of keystrokes uninterrupted by a pause above threshold. Burst length is measured in characters or words. Authentic composition shows variable burst structure: short bursts during generative phases where language formulation is effortful, longer bursts during fluent execution, with high variance across the document. Transcription shows longer and more uniform bursts: the language is already formulated and the typist's task is motor, producing less variable burst lengths and a higher mean. This is precisely what Trezise et al. (2019) observed: authentic free writing showed "shorter bursts with longer pauses" compared to transcription tasks, and Crossley et al. (2024) found "Transcribers... produced a greater number of writing bursts because they were simply copying language."

Revision rate

Revision rate is the proportion of characters deleted relative to characters inserted. Authentic composition typically has a higher revision rate: writers monitor output, evaluate it against their goals, and delete and rewrite. Transcription has a lower revision rate because the text to be encoded is determined before typing begins — there is nothing to revise. Crossley et al. (2024) found that authentic writing "deleted more words and characters, and had a greater number of revisions than transcribed writing." Revision rate is also temporally structured in authentic writing: revisions tend to cluster around newly composed text rather than being uniformly distributed, reflecting the monitoring loop of the writing process.

P-burst and R-burst distinction

The distinction between P-bursts (production bursts, pauses for planning) and R-bursts (revision bursts, pauses associated with revision activity) originates in the Chenoweth and Hayes writing process research tradition. A P-burst pause precedes new text production; the pause reflects the cognitive cost of generating new language. An R-burst pause occurs after text production and before a revision event; it reflects the monitoring and evaluation cycle. The distinction matters for forensic interpretation: authentic composition shows both types; transcription shows predominantly motor pauses that do not map cleanly onto either category. A purely transcriptive record lacks the revision-associated pause structure that is a by-product of the monitoring loop — and that absence is detectable.

Production unit boundaries and linguistic structure effects

In authentic composition, pauses cluster at the boundaries of production units — roughly, the text segments produced in a single planning-execution cycle. These boundaries correlate with sentence starts, clause boundaries, and lexical access difficulty (word frequency effects: pauses before low-frequency words are longer than before high-frequency words). The relationship between pause location and linguistic structure is one of the most robust findings in writing process research and one of the clearest behavioral markers distinguishing composition from transcription, where pause distribution is driven by reading-span constraints rather than linguistic production demands.

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#e8f4ee', 'primaryTextColor': '#16130c', 'primaryBorderColor': '#1f5a3a', 'lineColor': '#6f5618', 'secondaryColor': '#fffdf8', 'background': '#fffdf8', 'mainBkg': '#fffdf8', 'clusterBkg': '#f0ede4', 'titleColor': '#16130c', 'edgeLabelBackground': '#fffdf8'}}}%%
flowchart TD
    A[Keystroke Event Stream] --> B[Feature Extraction]

    B --> C[IKI Distribution]
    B --> D[Pause Events]
    B --> E[Burst Structure]
    B --> F[Revision Events]

    C --> C1[Log-normal tail → cognitive load\nShort tail → motor-only transcription]
    D --> D1[Location relative to sentence boundaries\nDuration profile at clause starts\nFrequency at word-level planning points]
    E --> E1[Variable burst length → generative writing\nUniform long bursts → transcription]
    F --> F1[R-burst pauses → monitoring loop active\nHigh revision rate → authentic composition]

    C1 --> G[Cognitive Writing Process Classification]
    D1 --> G
    E1 --> G
    F1 --> G

    G --> H{Composition signature present?}
    H -->|Yes: variable bursts, sentence-boundary pauses,\nhigh revision, log-normal IKI| I[Consistent with authentic composition]
    H -->|No: uniform bursts, non-linguistic pause\nlocations, low revision, compressed IKI tail| J[Consistent with transcription]

---

Crossley et al. (2024) in context

The strongest single result in the writing process forensics literature is Crossley, Tian, Choi, Holmes and Morris, "Plagiarism Detection Using Keystroke Logs," presented at the Educational Data Mining Conference 2024 and available in full text via ERIC (ED675615). The result deserves careful treatment: accurate citation of what was done, accurate citation of the number, and accurate identification of where the result generalizes and where it does not.

Study design

The study used a dataset of 1,325 writing sessions collected in an educational context. Each session was either an authentic writing session (participants composing their own essays) or a transcription session (participants copying from an external source). The authors extracted keystroke features from the process logs — pause patterns, IKI variance, revision rate, burst structure, and related measures — and trained a random forest classifier to distinguish the two conditions. The result, quoted from the full text: "Results indicated that keystroke logs accurately predicted whether an essay was written or transcribed with 99% accuracy using a random forest model."

The features that drove the classification align precisely with the theoretical account from writing process research:

"Authentic writing included a greater number of pauses before sentences and words, had a greater number of insertions and longer insertions, deleted more words and characters, and had a greater number of revisions than transcribed writing."

"Transcribers, on the other hand, produced a greater number of writing bursts because they were simply copying language."

The authors' interpretive framing connects the classification result back to the underlying cognitive theory:

"Authentic writing is a dynamic process where writers monitor their writing and evaluate whether the writing needs to be changed if problems are identified. Transcribed writing, on the other hand is much more linear."

Why 99% is achievable in that design

The experimental design was a clean two-condition comparison: writing versus copying a provided text. These conditions are maximally separated in the feature space — one activates the full planning-formulation-monitoring cycle of authentic composition; the other activates motor transcription only. Under clean controlled conditions with this level of separation between conditions, high classification accuracy is expected. Random forest models are well-suited to high-dimensional feature classification of this type. The result establishes that the behavioral signal of authentic composition is robustly present and discriminable — that is the scientifically important finding, and it is well-supported by the design.

Why the number requires careful interpretation for real-world use

The result should not be read as a certified error rate for any operational system. Three factors limit generalization.

First, the study tested a clean two-condition design. Real-world writing workflows are often hybrid: a student may legitimately paste in their own notes or outline, then compose the body text. A student writing with AI assistance — using AI to suggest a sentence, then editing it, then continuing independently — does not map cleanly onto either the composed or transcribed condition. The hybrid case is precisely the one most at issue in current academic integrity practice, and it was not within the scope of this study.

Second, no cross-dataset validation was reported. The classifier was trained and tested on data from a single study population and task type. Cross-dataset validation — testing a classifier trained on one corpus against a different corpus — is the standard test of generalizability, and its absence means the 99% figure is study-specific. This is not a criticism of the paper, which was explicit about its design; it is a constraint on how the number should be cited.

Third, controlled laboratory settings with recruited participants produce different behavioral data than ecological settings where writers are unaware they are being studied or are writing under authentic time pressure, fatigue, and distraction. The writing behaviors of students who know their sessions are being logged for a study may differ from those of students writing in naturalistic conditions.

What the result establishes despite these caveats is unambiguous: the behavioral signature of composition is strong enough to produce near-perfect classification in a controlled experiment, the features that drive that classification are precisely the ones predicted by cognitive writing theory, and those features are robustly present in authentic composition and systematically absent in transcription.

---

Trezise et al. (2019) in context

Trezise, Ryan, de Barba, and Kennedy, "Detecting Academic Misconduct Using Learning Analytics," published in the Journal of Learning Analytics (2019), addresses a different methodological question: can process features extracted from an operational learning management system, rather than a controlled experiment, carry discriminative signal for integrity purposes?

Study design

The study examined keystroke and clickstream data from students completing writing tasks in an LMS context, comparing authentic writing sessions against sessions where contract cheating was suspected. Rather than a controlled two-condition experiment with assigned conditions, this was a retrospective analysis of operational data — students were not recruited for the study; their behavioral data was drawn from coursework.

The key finding, from the abstract: students completing authentic free-writing tasks "typed in shorter bursts with longer pauses and typed more slowly with more revisions compared to the two transcription tasks." This directional finding replicates the Crossley et al. result in an ecologically valid setting and in advance of it — the learning analytics study predates the EDM experiment by five years.

Significance

The Trezise et al. result matters precisely because it demonstrates that the process signal is present not only in controlled experiments with recruited participants but also in operational data from real coursework. The conditions are far less clean — students are writing for actual grades, under actual time pressure, with varying levels of care — and the discriminative signal still appears. This is evidence of ecological validity that the controlled experiment cannot provide.

Limitations

The principal limitation is that ground truth in the Trezise et al. study is presumed rather than experimentally assigned. Students identified as having submitted authentic work are classified on the basis of course context and behavioral patterns, not direct experimental manipulation. Similarly, students identified as likely having transcribed pre-prepared text are identified inferentially. This is an unavoidable constraint of retrospective analysis of operational data — experimental assignment of misconduct is not feasible for obvious reasons. The implication is that the contamination of both groups is unknown: some "authentic" sessions may involve transcription, and vice versa. This pushes the effective signal-to-noise ratio lower than in the Crossley experiment, which makes the directional finding more impressive — the signal survived noisier ground truth — but makes precise accuracy figures inapplicable.

The study does not report a classifier accuracy number comparable to the Crossley 99%. Its contribution is the demonstration of discriminative signal in operational conditions, which is a different and complementary form of evidence.

---

Keystroke biometrics: the identity question

The keystroke dynamics biometrics literature asks a different question from the writing process classification literature. Classification asks: was this text composed or transcribed? Biometrics asks: is this the same typist as a known reference? These are distinct problems with different study designs, different accuracy profiles, and critically different evidentiary implications.

Teh, Teoh, and Yue's 2013 survey in The Scientific World Journal (PMC3835878) is the standard reference for the field's history and performance envelope. The survey traces the origin of the concept to nineteenth-century telegraph operators, who could be identified by the rhythm of their keying — a fact that establishes both that the signal is genuinely individual-specific and that it has been recognized as such for a very long time. The survey's honest assessment of accuracy: "Keystroke dynamics biometrics are inferior in terms of authentication accuracy due to the variations in typing rhythm" and behavioral biometrics generally "are normally inferior to physiological biometrics in terms of variability."

The modern state of the art is represented by Acien, Morales, Fierrez, Vera-Rodriguez, and Montalban, "TypeNet: Scaling up Keystroke Biometrics" (arXiv:2004.03627). TypeNet trains a deep recurrent neural network on a corpus of "more than 136M keystrokes from 168K users" — the Aalto keystroke dataset — and reports an equal error rate (EER) of approximately 0.3% on large datasets with sufficient enrollment sequences. An equal error rate of 0.3% means about 3 in 1,000 authentication attempts produce either a false accept or a false reject; this is competitive with established biometric modalities.

The critical constraint is the enrollment requirement. The 0.3% EER is achievable "using only 5 enrollment sequences and 1 test sequence per user" on the Aalto dataset — but that dataset was collected in controlled conditions with consistent task structure. In an integrity context, a student may have produced only a handful of prior writing sessions in the system, with different task types and different cognitive demands, under different emotional and physical states. Small enrollment corpora are a known degradation vector: accuracy falls with fewer reference samples. Identifying a writer from a single new session against no enrollment corpus — the single-session identity attribution problem — is not a problem the biometric literature has solved.

The practical implication for evidentiary use is precise and important:

• What process forensics can establish (was this text composed or transcribed?) is distinct from what biometric verification can establish (does this session match a known person's typing signature?).
• The classification question has a strong answer from controlled experiments with a single writing session.
• The identity question requires an enrollment corpus, expert comparison methodology, and appropriate statistical interpretation — and should be treated as a separate evidentiary matter with its own literature and its own limitations.

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#e8f4ee', 'primaryTextColor': '#16130c', 'primaryBorderColor': '#1f5a3a', 'lineColor': '#6f5618', 'secondaryColor': '#fffdf8', 'background': '#fffdf8', 'mainBkg': '#fffdf8', 'clusterBkg': '#f0ede4', 'titleColor': '#16130c', 'edgeLabelBackground': '#fffdf8'}}}%%
flowchart LR
    subgraph Q1["Classification question (process forensics)"]
        direction TB
        A1[Single writing session] --> B1[Feature extraction:\nIKI, pauses, bursts, revisions]
        B1 --> C1{Composition signature present?}
        C1 -->|Yes| D1[Consistent with authentic composition]
        C1 -->|No| E1[Consistent with transcription]
    end

    subgraph Q2["Identity question (biometric verification)"]
        direction TB
        A2[New session to match] --> B2[Feature extraction:\nIKI, dwell time, digraph timing]
        B2 --> C2{Compare against enrollment corpus}
        C2 -->|Match within threshold| D2[Session is consistent with\nknown typist — TypeNet 0.3% EER]
        C2 -->|No match| E2[Session does not match\nknown typist]
        F2[Enrollment corpus required:\nmultiple prior sessions, same typist] --> C2
    end

    G["Single session alone cannot\nresolve the identity question\nwithout an enrollment corpus"] -.-> Q2

---

Fabrication resistance

A critical question for any evidentiary application is whether the signal can be faked. What does the research say?

Consistency of authentic writing behavior

Leijten and Van Waes's foundational observation, drawn from the Inputlog research program, is that human writing behavior is consistent across sessions within the same writer: individuals have characteristic pause profiles, burst distributions, and revision rates that persist across different writing tasks. This consistency is both what makes biometric identification possible and what makes the behavioral signal forensically meaningful — it is a stable personal property, not random noise.

Cognitive process as the source of resistance

The argument for fabrication resistance is primarily theoretical but has strong empirical grounding. The pause distribution at linguistic boundaries — the micro-hesitation before a new sentence, the longer pause before a difficult clause — is not a keyboard-mechanical property. It is a consequence of the cognitive process of language generation: the writer pauses because they are planning, not because of any keyboard behavior. An automated replay script operating at the character level has no compositional process. It can reproduce average typing speed and can be programmed to insert pauses at regular intervals, but it cannot reproduce the specific distributional properties of cognitive-planning pauses at sentence boundaries without explicitly modeling the underlying linguistic process. The Crossley et al. finding that authentic composition shows "a greater number of pauses before sentences and words" is not just a statistical observation — it describes a cognitive signature that requires genuine composition to produce.

Adversarial results from biometric literature

TypeNet's adversarial results provide relevant evidence. Attempts to mimic a target typist's keystroke dynamics — impersonation attacks — degrade in accuracy without direct hardware access. TypeNet reports that impersonation attacks, where an attacker attempts to match a target's timing profile, are detectable and produce authentication failure rates well above the nominal EER. The mechanism is that keystroke timing reflects both intentional and unintentional components of motor behavior; the intentional component can be approximated but the unintentional component — the microsecond-level variation caused by muscle mechanics, neural transmission, and hand geometry — cannot be consciously reproduced.

What "hard to fake" accurately means

None of this establishes that fabrication is impossible. A sophisticated attacker who had access to the research literature could attempt to inject linguistically appropriate pauses into an automated replay. The adversarial cost is high — it requires either explicitly modeling the cognitive writing process or producing a human typist who deliberately mimics the statistical profile of authentic composition (itself a cognitively demanding task that, ironically, looks like composition). It produces a different statistical profile than naive transcription — a sophisticated forger produces something that looks more like authentic writing, not less — but it still leaves traces: the second-order statistical properties of pause duration at sentence boundaries, the covariance structure of IKI across the document, the relationship between revision rate and text complexity, are difficult to replicate simultaneously without generating the text authentically in the first place. The asymmetry is what matters: an honest writer produces the right signal automatically. A forger must solve a non-trivial inverse problem with multiple simultaneous constraints.

---

Open research questions

The review would be incomplete without an honest account of what is not yet established. The following questions are open, with varying degrees of preliminary evidence.

Cross-dataset generalizability

The Crossley et al. 99% figure is from one controlled experiment on one corpus from one study population. Cross-dataset validation — training on one corpus and testing on another — is the standard test of generalizability in machine learning and has not been publicly reported for this specific classifier or its features. The directional finding (authentic composition is distinguishable from transcription by process features) is replicated by Trezise et al. in operational data. The specific accuracy figure is study-specific.

Population heterogeneity

The writing process literature has primarily studied adult skilled writers in higher education contexts. Known sources of systematic variation include: writing in a second or additional language (non-native writers show different IKI distributions and pause profiles, including longer pauses at word-level lexical access points even in authentic composition); neurological diversity affecting motor control (dyslexia, dysgraphia, motor coordination differences); age (older adults show longer IKIs at a given skill level); and domain expertise (expert writers in a domain show faster production and less revision in that domain than novices). A classifier trained on data from one population may perform differently on another. This is a known generalizability concern and an area requiring systematic study before deployment claims can be made across student populations.

Ecological validity

The controlled experiment paradigm — recruited participants, assigned conditions, specific tasks — produces clean data but potentially unrepresentative behavior. Real students writing under real grade pressure, real time constraints, and real distractions may produce behavioral distributions that differ from recruited participants. The Trezise et al. operational data study partially addresses this, but ground-truth uncertainty in that study limits what can be concluded. Prospective studies in ecological conditions with verified ground truth would substantially strengthen the evidence base.

Standards for panel interpretation

When process evidence is presented to an academic integrity panel, the panel must interpret quantitative claims: what does a given pause rate, revision rate, or burst structure distribution mean for this submission? There are no published standards for inter-rater reliability in panel interpretation of process evidence, no training protocols for panel members, and no published case law or tribunal precedent establishing what weight process evidence should carry relative to other forms of evidence. These are open questions of professional standards, not empirical questions about the signal itself.

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#e8f4ee', 'primaryTextColor': '#16130c', 'primaryBorderColor': '#1f5a3a', 'lineColor': '#6f5618', 'secondaryColor': '#fffdf8', 'background': '#fffdf8', 'mainBkg': '#fffdf8', 'clusterBkg': '#f0ede4', 'titleColor': '#16130c', 'edgeLabelBackground': '#fffdf8'}}}%%
quadrantChart
    title Evidence status: established vs open
    x-axis Weak evidence base --> Strong evidence base
    y-axis Narrow applicability --> Broad applicability

    Authentic composition has distinctive process features: [0.85, 0.80]
    IKI is log-normally distributed in composition: [0.80, 0.70]
    Revision rate higher in composition than transcription: [0.80, 0.65]
    Pause clustering at sentence boundaries: [0.75, 0.75]
    Crossley 99% accuracy in controlled setting: [0.85, 0.40]
    Trezise directional finding in LMS data: [0.70, 0.65]
    TypeNet EER with large enrollment corpus: [0.80, 0.50]
    Cross-population generalizability: [0.25, 0.75]
    Ecological validity in real coursework: [0.35, 0.80]
    Identity from single session without enrollment: [0.10, 0.70]
    Adversarial fabrication is infeasible: [0.40, 0.60]
    Panel interpretation standards: [0.05, 0.55]

---

Implications for evidentiary use

The research base supports specific, bounded claims for evidence practitioners. The following analysis draws the line between what the literature warrants and what it does not.

What claims are warranted

Composition versus transcription. The claim that authentic composition produces a measurably different process signature from transcription is warranted. It is supported by two independent empirical results (Crossley 2024; Trezise 2019), it is theoretically well-grounded in cognitive models of writing, and the directional finding is robust across different study designs. A process record showing pause distribution at sentence boundaries, variable burst structure, and active revision activity is consistent with authentic composition. A process record showing uniform long bursts, minimal revision, and pause distribution not aligned with linguistic boundaries is consistent with transcription.

Absence of authentic composition signature as an anomaly. A process record that lacks the expected features of authentic composition is an anomaly that warrants further investigation. This is an appropriate framing for a panel: not "this record proves cheating" but "this record lacks the behavioral signature expected of authentic composition, and the writer should be invited to explain it." The distinction is not trivial — it determines whether process evidence is being presented fairly.

Fabrication requires disproportionate effort. The claim that fabricating a convincing authentic-composition process signature is significantly more effortful than naive transcription is warranted by the theoretical argument and consistent with the adversarial findings from the biometric literature. It is appropriate to describe the adversarial cost as high and to note that simple replay scripts are detectable; it is not appropriate to claim that fabrication is impossible.

What claims are not warranted

Single-session identity attribution. The claim that a process record identifies who was at the keyboard — from a single session, without an enrollment corpus — is not supported by the literature. TypeNet's 0.3% EER requires multiple enrollment sequences. A process record establishes that a writing event occurred on a specific device at a specific time; it does not establish the identity of the typist absent a biometric comparison against a reference.

Exact accuracy figures in operational contexts. The 99% accuracy figure from Crossley et al. applies to the controlled two-condition experiment in which it was measured. It is not a certified accuracy rate for any operational system, and presenting it as such would overstate what the research establishes. The appropriate framing is: "In a controlled experiment, this feature set achieved 99% accuracy on the clean two-condition task; operational accuracy in hybrid workflows is not yet established."

AI use specifically. Process evidence establishes how text arrived in the document — typed character by character versus pasted in large blocks — but cannot establish what generated the text. A student who typed AI-generated text character by character would produce an authentic-composition-like process signature. A student who pasted in their own notes from a separate document would produce a paste event indistinguishable in the timing stream from a paste of AI-generated content. Process evidence is evidence of process, not of the source of the text.

The right way to frame process evidence in a hearing

Process evidence is most accurately framed as behavioral evidence about how text was produced, not as a classification output or a detector score. A hearing presentation that says "the process record shows pause patterns, burst structures, and revision activity consistent with authentic composition" is accurate. A presentation that says "the process record proves the student wrote this themselves" overstates what the evidence shows. Similarly, "the process record lacks the expected signature of authentic composition" is accurate; "the process record proves the student cheated" is not.

The need for expert interpretation on quantitative claims is not optional. Panel members without training in the writing process literature are unlikely to be in a position to evaluate whether a specific pause distribution or IKI profile is within the expected range for authentic composition given the student's language background, task type, and writing environment. Expert testimony — or at minimum, written documentation of the interpretation methodology and its limits — is appropriate for any case where quantitative process evidence is presented.

The Wengrowicz et al. (2014) study on students' collaboration awareness in collaborative writing (ERIC: EJ1078929) contributes a directly relevant caution: multi-author documents present an additional interpretive layer. A process record captures writing events on a device; collaborative writing workflows in which multiple authors contribute through shared documents or asynchronous editing produce behavioral patterns that are neither purely single-author composition nor straightforward transcription. Collaborative contexts require explicit acknowledgment in any process evidence interpretation.

---

Process forensics based on keystroke logging is the most technically grounded method available for establishing evidence about how text was produced. The research base reviewed here — spanning more than thirty years from Grabowski's cognitive models through Leijten and Van Waes's foundational methods work to Crossley et al.'s 2024 classifier — establishes the behavioral signal, demonstrates its discriminative power in controlled conditions, and provides an honest account of what remains to be established in operational contexts. Authmarks implements this research base as consented, sealed, hash-chained process records, applying the same features that this literature has studied and holding to the same evidentiary limits the literature itself identifies.

---

Cross-linguistic variation in writing processes

The foundational research reviewed above — Leijten and Van Waes, Crossley, Trezise — was conducted predominantly on English-language writing by skilled adult writers. This is a direct consequence of where the research programs were based and where funding was available: the Inputlog system was developed at the University of Antwerp; the Crossley et al. EDM study drew on North American educational data; the Trezise et al. operational study was conducted in an Australian university context. The result is a robust evidence base for a specific population. Systematic variation by language is documented in adjacent literature but substantially understudied in the forensics application specifically.

L1 versus L2 writing process differences

Non-native (L2) writers show longer inter-keystroke intervals at word-level lexical access points — the moment in composition when a writer must retrieve the correct word in a second language takes measurably longer than the equivalent retrieval in a first language. This effect has been replicated in the Inputlog research tradition and is among the more robust L2 writing findings: when vocabulary access is the bottleneck, the IKI at that word's onset is elevated, and the pause profile within a burst differs from that of an L1 writer approaching the same lexical choice with greater automaticity.

The forensic implication is specific: the classifier trained on L1 English writing has learned to associate short within-burst pauses with composition and longer ones with some form of processing delay. For an L2 writer, longer within-burst pauses at lexical access points are a normal signature of authentic composition in a second language — not an anomaly and not evidence of transcription. If the same threshold or feature weight is applied to both populations, the L2 writer's authentic composition is more likely to be scored ambiguously or incorrectly. This is not a speculative concern: it is the same mechanism that produces elevated false positive rates on L2 English writers in artifact-based AI detectors, as documented by Liang et al. in the context of GPTZero and similar systems. The behavioral signal differs systematically by language background even when the underlying process — genuine, effortful composition — is identical.

This does not mean process forensics is inapplicable to L2 writers. It means the feature thresholds and interpretation norms established from L1 data should not be applied without adjustment. What constitutes an anomalous pause duration for an L1 writer may be a normal lexical access pause for an L2 writer. What constitutes an expected revision rate for a fluent English writer may differ from the expected rate for a writer composing in their third or fourth language. Responsible evidentiary use requires acknowledging this and, where the writer's language background is known, factoring it into the interpretation.

Character-based language writers

Writers whose first language uses a character-based script — Chinese, Japanese, Korean — and who compose in alphabetic English show process signatures that differ from L1 alphabetic writers in ways not yet systematically characterized by the forensics literature. The key difference is cognitive representation: when a writer whose mental lexicon in Mandarin Chinese is organized around logographic units composes in English, the translation between the mental representation and the alphabetic output involves additional processing steps that do not occur for a native alphabetic writer. This produces different patterns in burst initiation and revision behavior. Revisions may be more frequent at the morphological level — the writer produces an approximation, recognizes it is not the English word they intended, and replaces it — rather than at the syntactic or discourse level where L1 English revisions tend to concentrate. This affects revision rate, revision clustering, and burst structure in ways that interact with the classification features in ways not yet studied.

Additionally, writers of character-based L1 languages frequently use input method editors (IMEs) when typing English, particularly in educational contexts where they may switch between Chinese and English within the same session. The IME interaction with the keystroke record is addressed in the subsequent section on writing environment effects, but the cross-linguistic point stands independently: the cognitive pathways producing English text are different for these writers, and those differences show up in the keystroke record in ways that the existing forensic classifiers have not been trained or validated to handle.

Right-to-left language transfer effects

Writers of Arabic, Hebrew, and Persian — right-to-left scripts — show adaptation patterns in English writing that affect cursor positioning behavior, revision direction, and sometimes editing sequences. When a writer habituated to right-to-left editing makes a revision in a left-to-right English document, the cursor navigation behavior preceding the revision event may be atypical relative to what a left-to-right writer would produce for the same correction. This is a fine-grained effect in the keystroke record — cursor movement events, arrow key usage, selection events — that is not yet systematically characterized in the forensics literature. The effect is expected to be small relative to the major composition versus transcription signal, but in borderline cases or in cases where the revision rate and revision pattern are significant evidence, it is a source of potential misinterpretation.

Implications for classifiers deployed across multilingual populations

A classifier built to detect the difference between composition and transcription that was trained exclusively on L1 English data carries implicit assumptions about what composition looks like that are not population-neutral. When deployed at a university with an international student body — which describes most English-speaking universities — the classifier encounters writers from all the populations described above. The false positive risk is systematically elevated for L2 writers for the same reason elevated false positive rates on L2 writers are a documented problem in artifact-based detectors: the behavioral signal of careful, effortful L2 composition overlaps with signals that the L1-trained classifier associates with anomalous or transcription-like behavior.

The appropriate institutional response is not to abandon process forensics for L2 writers — the directional signal is still present, and the core features still distinguish composition from transcription across linguistic backgrounds — but to use population-appropriate interpretation norms, to require expert interpretation for L2 writers, and to be explicit in hearing proceedings about the language background of the writer when process evidence is presented.

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#e8f4ee', 'primaryTextColor': '#16130c', 'primaryBorderColor': '#1f5a3a', 'lineColor': '#6f5618', 'secondaryColor': '#fffdf8', 'background': '#fffdf8', 'mainBkg': '#fffdf8', 'clusterBkg': '#f0ede4', 'titleColor': '#16130c', 'edgeLabelBackground': '#fffdf8'}}}%%
flowchart TD
    A[Writer composes in English] --> B{Language background}
    B -->|L1 English| C[Baseline: classifier trained\non this population]
    B -->|L2 English| D[Longer IKI at lexical access points\nDifferent within-burst pause profile\nMay differ in revision rate]
    B -->|Character-based L1| E[Different burst initiation\nDifferent revision clustering\nPossible IME interaction]
    B -->|Right-to-left L1| F[Different cursor navigation\nDifferent revision direction patterns]

    C --> G[Standard feature thresholds apply]
    D --> H[Adjust thresholds for L2 lexical access\nRequire expert interpretation\nDocument language background]
    E --> H
    F --> H

    H --> I[Evidence can still be used —\nbut interpretation must be population-aware]
    G --> I

The current research gap

There is no published study that has applied the Crossley et al. feature set to L2 writing with a verified ground-truth classification. This is a significant gap. The gap matters practically because universities that adopt process forensics for academic integrity will encounter L2 writers immediately and regularly. It matters forensically because the gap means that when process evidence is used in a proceeding involving an L2 writer, the accuracy claims from the L1 literature cannot be transferred without qualification. Responsible use requires explicitly acknowledging this gap when process evidence involves L2 writers, and not citing Crossley et al.'s 99% figure as if it applies to that population.

---

Writing environment effects — tool choice and its forensic implications

The process record produced by a student writing in Google Docs is not the same kind of record as one produced by a student writing in Microsoft Word, a plain text editor, or a specialized writing environment. The differences are not just technical implementation details — they affect which features are measurable, at what precision, and with what systematic artifacts introduced by the environment itself. For evidentiary purposes, specifying the capture layer is as important as specifying the feature set.

Browser-based editors

Google Docs is the dominant writing environment in many educational contexts. Its keystroke events are captured by the browser's JavaScript event system, which runs within the browser's event loop. The temporal resolution of this capture is limited by the browser's scheduling granularity: on most systems, the browser event loop runs at approximately 10 to 16 milliseconds. IKI measurements below this threshold are not reliably distinguishable. A true IKI of 8ms and a true IKI of 14ms would both be recorded as the same event time. This is not a problem for most forensic purposes — the features that matter most (pause duration at sentence boundaries, burst length, revision rate) operate at timescales well above this threshold — but it should be documented as a technical property of the capture layer.

More significant is JavaScript event handling latency. The browser processes events in a single-threaded environment, and other activity in the browser (rendering, network requests, garbage collection) can delay event processing by tens or hundreds of milliseconds. This introduces timing jitter into the IKI record that does not reflect the writer's behavior — it reflects the browser's computational load. In a well-configured capture system, this jitter is low on average but spikes unpredictably. For features that depend on fine-grained IKI distributions, this is a source of noise that should be acknowledged.

Google Docs also has an auto-formatting layer that may insert characters not explicitly typed by the writer. Automatic list continuation, heading-style application triggered by return keypresses, autocorrect substitution, and smart quotes replacement all appear in the document record but were not directly keyed by the writer. A capture system that records only character-level events without distinguishing auto-formatted insertions from manually typed characters may assign auto-inserted characters to the writer's record, distorting revision rate and burst structure calculations.

OS-level capture versus application-level capture

The Inputlog system, the research standard described by Leijten and Van Waes, captures at the application level: events processed by the writing application are logged. Operating-system-level capture records every keydown event regardless of which application has focus, at the hardware timer's resolution. For a writing session conducted entirely within a single application, these two capture modes are effectively equivalent. The difference matters in two cases: first, when the writer is switching between applications during the writing session (looking up sources in a browser, reading notes in another window, consulting a thesaurus); and second, when the capture layer's relationship to the application introduces artifacts like the Google Docs auto-formatting effects described above.

OS-level capture provides the most complete record of keyboard activity during a session. Application-level capture provides a record that is directly interpretable in terms of the document being produced — every event corresponds to an action in the document. For forensic purposes, the cleaner evidentiary record is the application-level capture that can be directly associated with document state changes, but OS-level capture provides useful session-level context (total keyboard activity, application switching patterns) that application capture does not. A well-designed forensic system uses application-level event capture for document state and can supplement with session-level behavioral data where relevant.

IME composition events

Writers using Input Method Editors for Chinese, Japanese, Korean, or other character-based inputs produce a fundamentally different keystroke record than writers using direct keyboard entry. IME composition involves a two-phase process: first, a sequence of phonetic or Romanization keystrokes that constitute a candidate entry; second, a selection and commit event that places the chosen character into the document. The intermediate keystrokes in the first phase are compositional artifacts of the input method — they do not correspond directly to characters that appear in the final text. A capture system that records raw keystrokes without IME awareness would log these compositional keystrokes as part of the writing record, producing burst length and revision rate calculations that do not reflect the writer's compositional behavior.

IME-aware capture systems record composition start events, candidate selection events, and commit events as distinct event types, allowing post-processing to reconstruct the actual compositional behavior. The Inputlog system has addressed IME capture in subsequent versions. But many institutional capture systems deployed in educational contexts have not been specifically tested against IME input. For a university with Chinese, Japanese, or Korean international students, this is not an edge case — it is a major population — and the capture layer should be explicitly validated against IME input before process evidence from IME writers is used in integrity proceedings.

Voice-to-text and dictation

Text produced by voice-to-text dictation — whether through native OS dictation, a browser extension, or a third-party tool — arrives in the editor through a mechanism that differs from character-by-character keyboard entry. Depending on the capture layer, dictated text may appear as a single large text-insertion event (similar to a paste) rather than as a sequence of individual keystroke events. A student who composed their essay primarily by voice and then edited the transcript would produce a process record with large initial insertion blocks followed by editing activity — a pattern that looks anomalous relative to the expected composition signature, even if the process was entirely authentic.

This matters increasingly as voice-to-text becomes more accessible and widely used. Students with disabilities that affect typing — dyslexia, dysgraphia, motor impairments — may rely on voice-to-text as an accessibility tool. A forensic interpretation that treated voice-to-text insertions as anomalous without explicitly accounting for accessibility accommodations would be both technically incorrect and institutionally problematic. Capture systems used for evidentiary purposes should explicitly handle dictation events, and interpretation norms should specify whether voice-to-text production is treated as equivalent to keyboard composition or requires separate analysis.

Chain-of-custody documentation for process records

The NIST SP 800-86 digital forensics framework emphasizes chain-of-custody documentation as a prerequisite for evidentiary use of digital evidence. Applied to writing process records, this means that evidentiary submissions should specify: the capture layer used and its technical properties (resolution, event types captured, known artifacts); the writing application and its version; the operating system and relevant system configuration; the mechanism by which the record was sealed and its integrity verified; and the chain of custody from capture to submission. Without this documentation, a respondent or their representative cannot evaluate whether the record accurately reflects the writing session or whether artifacts of the capture layer contributed to the observed features.

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#e8f4ee', 'primaryTextColor': '#16130c', 'primaryBorderColor': '#1f5a3a', 'lineColor': '#6f5618', 'secondaryColor': '#fffdf8', 'background': '#fffdf8', 'mainBkg': '#fffdf8', 'clusterBkg': '#f0ede4', 'titleColor': '#16130c', 'edgeLabelBackground': '#fffdf8'}}}%%
flowchart LR
    subgraph CaptureLayer["Capture layer"]
        A1[Browser JS events\n~10-16ms resolution] 
        A2[OS-level capture\nHardware timer resolution]
        A3[IME-aware capture\nSeparates composition phases]
        A4[Application-level capture\nDocument-state linked]
    end

    subgraph Artifacts["Known artifacts by layer"]
        B1[Google Docs: auto-format insertions\nJS jitter at fine IKI scale]
        B2[OS-level: application switching\nnot document-linked]
        B3[IME-unaware: phantom keystrokes\nin burst/revision counts]
        B4[App-level: no cross-app\nsession context]
    end

    A1 --> B1
    A2 --> B2
    A3 -.->|If not IME-aware| B3
    A4 --> B4

    B1 --> C[Document capture method\nin chain of custody]
    B2 --> C
    B3 --> C
    B4 --> C

    C --> D[Evidentiary submission]

---

The complete literature — all studies reviewed

The following provides a comprehensive account of each study included in this review, its unique contribution to the evidence base, and its principal limitation for evidentiary application. The coverage extends to adjacent literature that bears directly on the forensic use case even where it is not specifically a writing process study.

Core studies: evidence table

Study	Year	Method	Population	Key finding	Evidentiary weight
Hayes & Flower	1980	Think-aloud + cognitive model	N/A (theoretical)	Writing = planning + translating + reviewing; temporal structure reflects cognitive load	Theoretical foundation — not directly evidentiary
Grabowski	2008	Cognitive model synthesis	N/A (theoretical)	IKI reflects writing process; pause location indexes planning load	Theoretical grounding for process features
Leijten & Van Waes	2013	Keystroke logging methodology	Research context	Inputlog framework; pause analysis established as primary method	Methods foundation — 1,000+ researchers using the method
Teh, Teoh & Yue	2013	Biometrics survey	N/A (survey)	Keystroke dynamics authentication; individual-specific rhythm; accuracy limits	Identity question: moderate accuracy with enrollment corpus
Trezise et al.	2019	Learning analytics + LMS data	University course (operational)	Shorter bursts + longer pauses + more revisions in authentic writing	Directional finding, ecological validity, no accuracy number
Acien et al. (TypeNet)	2020	Deep learning biometrics	168K users, 136M keystrokes	0.3% EER on large enrollment corpus; drops with smaller corpus	Identity verification: moderate confidence with sufficient enrollment
Crossley et al.	2024	Controlled experiment	1,325 sessions	99% accuracy composition vs transcription	Strongest classification result in literature
Wengrowicz et al.	2014	Collaborative writing study	Students, collaborative context	Collaboration awareness; multi-author attribution complexity	Caution flag for collaborative writing interpretation

Study narratives

Hayes and Flower (1980). The cognitive model of writing that Hayes and Flower published in 1980 is not an empirical study in the conventional sense — it is a theoretical synthesis drawn from think-aloud protocol analysis. Its contribution to process forensics is foundational but indirect: the model establishes that writing is a recursive, cognitively demanding process involving three interleaved components (planning, translating, reviewing) that produce observable behavioral effects at the keyboard. Every subsequent empirical study in this review rests on this theoretical foundation. Without the Hayes-Flower model, the observation that writers pause at sentence boundaries before low-frequency words is just a behavioral curiosity; with it, the pause is interpretable as a planning event — a moment where the translating component has been forced to wait for the planning component to supply the next production unit. The limitation for evidentiary use is that the model was developed from observations of expert professional writers in think-aloud conditions; its applicability to student writers under examination conditions is assumed rather than derived.

Grabowski (2008). Grabowski's synthesis work formalizes the connection between cognitive models and timing data, providing the explicit theoretical rationale for treating IKI as a writing process signal rather than merely a typing speed measurement. The contribution is the formalization of why location of pauses matters: a pause at a sentence boundary reflects one cognitive event; a pause within a word reflects a different event; a pause before a high-frequency common word is different from a pause before a rare technical term. Grabowski's work was the theoretical scaffold that researchers like Leijten and Van Waes built their methodology on. Its limitation for forensic application is the same as Hayes and Flower: it is theoretical synthesis, not an accuracy study. It explains why the signal exists and what it indexes; it does not provide accuracy figures for any classifier.

Leijten and Van Waes (2013). The foundational instrument paper. Leijten and Van Waes developed the Inputlog system and used its data collection program to establish the methodological conventions that the field has since adopted: pause threshold definition, burst calculation, revision event coding, and the analytic distinctions between production pauses and revision pauses. The fact that Inputlog has been adopted by more than 1,000 registered researchers means that the conventions Leijten and Van Waes established are the de facto standards of the field — when Crossley et al. extract pause features and burst structure features from their data, they are working within the framework that this paper established. The limitation for forensic application is the paper's own: ecological data collection is strong, but connecting the fine grain of logging data to underlying cognitive processes requires triangulation beyond the keystroke record alone.

Teh, Teoh, and Yue (2013). The keystroke biometrics survey is the definitive statement of what the identity question does and does not permit as of its publication. Its honest assessment of accuracy limitations — particularly the acknowledgment that behavioral biometrics are inferior to physiological biometrics in terms of variability — is itself forensically important. The survey's contribution is the clear separation of the classification question (was this text composed?) from the identity question (who composed it?), a distinction that has direct implications for what process evidence can and cannot claim. Its limitation is its age: the survey predates TypeNet and the deep learning revolution in biometrics by seven years. The accuracy figures it cites for classical keystroke biometrics have since been improved upon by TypeNet; the fundamental enrollment-corpus constraint it identifies has not been resolved.

Trezise et al. (2019). The learning analytics study occupies a unique position in this review: it is the only study that demonstrates discriminative signal in genuinely ecological conditions — real students, real coursework, operational LMS data. This ecological validity is its primary contribution; it establishes that the process signal survives the noise of real educational settings. Its limitation — ground truth established by inference rather than experimental assignment — is the inevitable cost of ecological validity. The two cannot be had simultaneously with naturalistic data. The appropriate way to treat Trezise et al. in an evidentiary context is as corroborating evidence for the ecological generalizability of findings established more rigorously by Crossley et al., not as an independent accuracy estimate.

Acien et al. / TypeNet (2020). TypeNet establishes the current state of the art for keystroke biometric authentication using deep learning. Its contribution to forensic use is both enabling (0.3% EER is a strong accuracy result) and limiting (the result requires large enrollment corpora that are not typically available in educational contexts). TypeNet's adversarial results — its testing of impersonation attacks — are relevant to the fabrication resistance question and provide some of the strongest empirical evidence that the unintentional components of keystroke timing are difficult to consciously replicate. The limitation is the Aalto dataset's controlled-task structure: participants typed fixed texts rather than composing freely, so the biometric signal TypeNet measures is from repetitive typing rather than variable composition, and its transferability to composition contexts requires further study.

Crossley et al. (2024). Covered extensively in its own section above. Its unique contribution in the context of this table is the provision of a specific, high-confidence accuracy figure from a controlled experiment with verified ground truth — the only such number in the forensic writing process literature as of this writing. Its principal limitation is the clean two-condition design and the single-corpus validation. It is the strongest direct evidence for the classification claim; it is not a certified operational accuracy.

Wengrowicz et al. (2014). The collaborative writing study's contribution is a caution flag that the process record for a collaboratively produced document cannot be interpreted using the same framework as a solo writing session. When multiple authors contribute to a shared document through asynchronous editing, the session record for any individual contains the behavioral signatures of that individual's contributions plus artifacts of the collaborative workflow: accepting tracked changes, editing segments written by others, commenting and responding to comments. All of these activities produce keystroke events that are not solo composition. A forensic interpretation that applied solo-composition norms to a session from a collaborative document would mischaracterize the evidence. This is relevant to any assessment where collaborative writing is legitimate — group projects, co-authored reports — and to any writing environment that supports real-time collaboration.

Adjacent literature

Conijn et al. (2019) on automated process data analysis. Conijn and colleagues, in work published at the Learning Analytics and Knowledge conference, applied automated analysis to process data from student writing sessions at scale, using unsupervised methods to discover writing process patterns without pre-specifying them. The significance for forensic application is the demonstration that process features carry signal even at large scale with automated processing rather than expert human analysis. The limitation is that the focus was on learning outcomes and writing quality prediction, not integrity classification — the ground truth in Conijn et al. is academic grade, not composition versus transcription — so the accuracy figures are not directly comparable to the forensic literature.

DIPPER and paraphrase attacks on artifact detectors. Krishna et al.'s DIPPER paraphrase system (and the broader literature on paraphrase-based evasion of AI text detectors) demonstrates that artifact-based detectors — systems that analyze the text itself for statistical traces of AI generation — are vulnerable to paraphrase attacks that preserve meaning while destroying the statistical signatures the detector relies on. This is directly relevant to process evidence because it establishes one of process evidence's core forensic advantages: process evidence captures how text arrived, not what the text says. A paraphrase attack that successfully evades an artifact detector does nothing to evade a process record — if the student paraphrased AI-generated text by typing it in character by character, the process record reflects that composition activity; if they pasted the paraphrased result, the paste event is captured. Process evidence is immune to the attack surface that DIPPER exploits.

The FDA-cleared medical device analogy. In some regulatory and legal contexts, the accuracy claims of commercial tools are evaluated by analogy to FDA-cleared medical devices — the argument being that an FDA-cleared device has been validated to a standard that makes its accuracy claims legally reliable. Writing process classifiers do not have an equivalent certification pathway. There is no regulatory body that validates academic forensic tools; there is no publicly disclosed validation corpus against which a commercial tool's accuracy can be independently assessed; and there is no requirement that commercial tools' feature sets correspond to the peer-reviewed literature. This is not unusual — peer-reviewed validation of commercial forensic tools is broadly underdeveloped across digital forensics as a field, and the same gap exists for many tools used in contexts from e-discovery to network intrusion analysis. But it is an honest caveat that should be stated explicitly when commercial process forensics tools cite peer-reviewed accuracy figures: the peer-reviewed figure applies to the study that produced it, not to any commercial implementation of similar methods.

---

Study design best practices for future forensics research

The evidence base reviewed here is robust enough to support bounded evidentiary claims but contains significant gaps that limit generalizability. The following section describes what a strong future study would require, what weakens a study's applicability, and what the validation gap means for practitioners evaluating commercial tools.

What a strong study requires

Pre-registered design. Pre-registration requires researchers to specify their hypotheses, feature set, analysis plan, and primary outcome measures before data collection begins. Without pre-registration, the risk of outcome-driven analysis — selecting features and thresholds after seeing the data to maximize apparent accuracy — is high. The Crossley et al. study does not report pre-registration; this is not unusual for the educational data mining context from which it emerged, but future studies intended to establish accuracy figures for evidentiary citation should be pre-registered to establish that the reported accuracy was the primary pre-specified outcome rather than the best result from multiple analyses.

Cross-dataset validation. A classifier trained on one corpus should be tested on a different corpus from a different population before its accuracy figures are claimed to generalize. Cross-dataset validation is the standard test in machine learning and is conspicuously absent from the existing forensic writing process literature. A future study that trained on the Crossley dataset and tested on a different population — different institution, different country, different assignment type — would provide the first real generalizability estimate for the 99% figure. Without this, the 99% is a result for the Crossley study population, not for the population of students in general.

Ecological validity component. A strong study would include both a controlled experimental arm (assigned conditions, verified ground truth) and an ecological arm (operational data from real coursework with ground truth established by other means). Comparing accuracy across both arms would directly quantify the performance gap between controlled and operational conditions — a gap that is currently unknown.

Demographically representative sample. A study intended to support evidentiary use across a student population should sample that population representatively, including L2 writers at multiple proficiency levels, writers from character-based L1 backgrounds, writers with relevant disabilities, and writers across age ranges typical of the target population. A study conducted on a convenience sample of English-fluent adult participants — the typical profile of the existing literature — cannot claim representativeness for a diverse student population.

Verified ground truth. Ground truth in the forensic classification context means verified, experimentally assigned conditions — not inferred or presumed categories. The Trezise et al. study is ecologically valid but has uncertain ground truth; the Crossley et al. study has verified ground truth but in controlled conditions. A study that achieves both through prospective design — for example, enrolling students who consent to having authentic and fabricated sessions compared — would be substantially stronger than either existing study.

Expert review of evidentiary framing. Before accuracy claims from a classification study are presented in an evidentiary context, the framing should be reviewed by someone with expertise in the evidentiary standards of the relevant proceeding — legal counsel, a forensic scientist with academic integrity experience, or a statistician with expertise in forensic evidence interpretation. The translation from "99% accuracy in a controlled experiment" to an appropriate claim in a disciplinary hearing is not automatic, and the risk of overstating what the evidence shows is significant.

What weakens a study's evidentiary applicability

Single corpus, single population. Any study that trains and tests on a single corpus from a single population provides an accuracy estimate for that corpus and that population only. The Crossley et al. figure is a strong result for its corpus; its applicability to other corpora and populations requires cross-validation that has not been published.

Clean two-condition design without a hybrid condition. The composition versus transcription distinction is important and well-studied. But the operationally relevant question for academic integrity is not whether pure composition differs from pure transcription — it is whether the hybrid workflow (some composition, some AI assistance, some paste, some editing) differs from pure composition in detectable ways. A study that tests only the clean two-condition design does not directly address the hybrid case, which is the predominant real-world scenario.

No generalizability testing. Accuracy figures without cross-population or cross-dataset validation are study-specific. Presenting them as if they apply to a different population is a generalizability error that can produce systematic false positives in the operational setting.

Accuracy presented as if applicable to operational systems. A controlled experiment accuracy figure is not the same as an operational system accuracy figure. Operational systems encounter messier data, more diverse populations, more varied writing environments, and hybrid workflows that controlled experiments do not include. The gap between controlled-experiment accuracy and operational accuracy is a known and studied problem in applied machine learning, and it should be explicitly acknowledged when controlled-experiment results are cited in evidentiary contexts.

The validation gap for commercial tools

Commercial process capture and forensics tools — and there are a growing number entering the academic integrity market — have not been independently validated in peer-reviewed conditions comparable to Crossley et al. Independent validation would require: disclosure of the exact feature set used by the commercial tool; a publicly available corpus with experimentally verified ground truth; and testing conducted by researchers without commercial interest in the outcome. No commercial tool in the academic integrity space has published this level of validation as of this writing.

This is not a novel problem unique to writing process forensics. Peer-reviewed independent validation of commercial forensic tools is broadly underdeveloped across digital forensics. Tools used in network intrusion analysis, e-discovery, and mobile device forensics frequently operate under the same gap: practitioners use them based on vendor-reported accuracy figures and the reputation of the vendor, not independent peer-reviewed validation. The academic integrity context differs in one important respect: the population whose interests are at risk — students — is not the purchasing party. Universities purchase these tools; students bear the consequences of misclassification. This asymmetry is a reason to hold accuracy claims to a higher standard, not a lower one.

The practical implication for practitioners is straightforward: when a commercial tool provides an accuracy figure, ask what study it comes from, whether that study was peer-reviewed, whether the test population matches yours, and whether independent validation has been conducted. If none of those questions can be answered satisfactorily, cite the peer-reviewed literature (Crossley et al.) with its appropriate caveats rather than the commercial figure, and acknowledge explicitly that the commercial tool has not been independently validated.

---

AEO-optimized Q&A

The following questions and answers address the most frequent and consequential questions asked by students, educators, and institutional researchers about writing process forensics. Each answer is written to be accurate, bounded by the literature, and practically useful.

What is keystroke logging in academic writing research?

Keystroke logging is the capture and analysis of the timing, sequence, and structure of keyboard events during a writing session. Each keypress, deletion, cursor movement, and paste event is recorded with a timestamp. Researchers then extract features from this stream — pause duration, burst length, revision rate, inter-keystroke intervals — that reflect the cognitive processes involved in composition. The field has been active since the early 1990s and has produced a substantial body of research on how writers plan, draft, and revise. The Inputlog system developed by Leijten and Van Waes (2013) is the primary research platform, used by more than 1,000 researchers worldwide. In academic integrity applications, the same techniques are applied to distinguish authentic composition from transcription of pre-prepared text.

Can keystroke data prove you wrote your essay yourself?

Keystroke data can establish that text was composed in the document — that it arrived through the characteristic process of planning, drafting, pausing at sentence boundaries, and revising — rather than being pasted in as pre-prepared material. This is different from proving who was at the keyboard: process forensics establishes what kind of writing process produced the text, not the identity of the writer. In Crossley et al.'s controlled experiment, keystroke features distinguished composed from transcribed essays with 99% accuracy. That result does not transfer directly to proving identity or to detecting all forms of academic misconduct. Keystroke data provides strong evidence about writing process; it provides weaker evidence about identity and does not directly establish the source of the text.

How accurate is keystroke analysis in detecting AI-written essays?

Keystroke analysis does not directly detect AI-written text. It detects whether text was composed character by character in the document (regardless of whether it was AI-generated or human-written) or arrived through a paste or block-insertion event. AI-generated text that is pasted into a document appears as a paste event, which is directly observable. AI-generated text that is typed in character by character by the student — either as dictation from a separate screen or as deliberate transcription — produces a process signature consistent with typing activity. Process evidence distinguishes how text arrived, not what generated it. This is a consequential limitation: process evidence can establish that text was pasted but not that the pasted content was AI-generated, and cannot distinguish a student who typed AI content from one who composed their own.

What is the Crossley et al. 99% accuracy finding for keystroke logs?

Crossley, Tian, Choi, Holmes, and Morris, in a study published at the Educational Data Mining Conference in 2024 (full text at ERIC ED675615), collected 1,325 writing sessions and trained a random forest classifier to distinguish sessions where participants composed original essays from sessions where participants transcribed provided text. The classifier achieved 99% accuracy on this clean two-condition task. The result is the strongest direct evidence in the literature that keystroke features robustly distinguish authentic composition from transcription. Three important caveats apply: the accuracy figure is from a controlled experiment, not an operational system; the study used a clean two-condition design that does not cover hybrid workflows; and no cross-dataset validation was reported, so the figure is specific to the study population.

What is the difference between writing process forensics and keystroke biometrics?

Writing process forensics asks: was this text composed or transcribed? It analyses pause distribution, burst structure, revision rate, and IKI shape to classify the writing process. Keystroke biometrics asks: is this the same person as a known typist? It analyses the timing signature of individual keystrokes — dwell time, flight time, digraph timing — and compares against a reference enrollment corpus. The questions are distinct, the study designs are different, and the accuracy profiles are different. A single writing session without a reference corpus can support a process classification claim but cannot support a biometric identity claim. The TypeNet deep learning system achieves 0.3% equal error rate for identity verification, but only with multiple enrollment sequences; single-session identity attribution is not established.

What is an inter-keystroke interval and what does it reveal?

An inter-keystroke interval is the elapsed time between two consecutive keypress events, measured in milliseconds. In authentic composition, IKI distributions are log-normally distributed: a long right tail of slow intervals reflects the moments when the writer is planning, retrieving vocabulary, or monitoring output, while the body of the distribution reflects motor typing speed. In transcription, the distribution has a shorter, less heavy tail — the typist is encoding language, not generating it, so motor speed dominates and cognitive-load pauses are less frequent. The IKI pattern at linguistically meaningful locations — sentence starts, clause boundaries, low-frequency words — is a particularly strong signal because those locations are where composition demands elevate pause duration in authentic writing. A compressed IKI distribution without this linguistic structure is a marker of transcriptive rather than generative behavior.

What are the limitations of keystroke evidence in academic integrity cases?

The principal limitations are: first, controlled-experiment accuracy figures (like Crossley et al.'s 99%) do not directly transfer to operational systems where writing workflows are hybrid and populations are more diverse; second, the evidence base was developed primarily on L1 English writers, and L2 writers show systematically different process signatures that may overlap with anomalous patterns even in authentic composition; third, the classification question (composition vs. transcription) is different from the identity question (who was at the keyboard), and process forensics alone cannot resolve identity without an enrollment corpus; fourth, there are no published interpretation standards for panels, no inter-rater reliability data, and no established legal precedent for the weight process evidence should carry; and fifth, the writing environment matters — different capture layers introduce different artifacts, and the environment must be documented in any evidentiary submission.

Can keystroke logging data be faked?

Naive fabrication — a simple replay script that retypes pre-prepared text at human speed — is detectable because it lacks the cognitive signature of authentic composition: it produces uniform burst lengths, pauses at non-linguistic locations, and minimal revision activity. Sophisticated fabrication — a script that explicitly models pause distribution at sentence boundaries and inserts revision events at appropriate intervals — is theoretically possible but requires explicitly solving the inverse problem of what authentic composition looks like statistically, with multiple simultaneous constraints on IKI distribution, revision clustering, and burst variance. The adversarial cost is high. TypeNet's adversarial results show that impersonation attacks on biometric systems fail at high rates even with deliberate intent. The asymmetry is the key point: an honest writer produces the right signal automatically; a sophisticated forger must solve a non-trivial multi-dimensional modeling problem while typing, which is cognitively demanding in ways that themselves produce an authentic-composition-like signature.

What does a genuine writing process look like in keystroke data?

A genuine writing process produces several characteristic patterns. Pauses cluster at sentence boundaries and before grammatically or lexically complex points in the text — before low-frequency vocabulary items, before subordinate clauses, before transitions between ideas. Burst length varies across the document: short bursts during generative phases where language formulation is effortful, longer bursts during fluent production. Revision activity is distributed throughout the session, concentrated near newly produced text, and includes both local revisions (immediate deletion and retyping) and longer-range revisions (returning to earlier text to restructure it). The IKI distribution has a long right tail reflecting cognitive-planning pauses mixed into the motor-speed body of the distribution. Session duration relative to word count is consistent with the expected production rate of the writer. None of these features is individually definitive, but together they form a recognizable behavioral pattern that is difficult to produce without actually composing.

What is a sealed process record and how is it different from version history?

A sealed process record is a timestamped, cryptographically hash-chained log of all keystroke events during a writing session, sealed in a form that makes subsequent modification detectable. It captures the full production sequence — every keystroke, deletion, pause, and paste event — from session start to submission. Version history, by contrast — the revision history available in Google Docs or Microsoft Word — records discrete snapshots of the document at intervals or at save events. Version history does not capture the moment-by-moment keystroke stream: it shows that the document was in state A, then later in state B, but does not record what happened between those states or when individual characters were typed. A sealed process record provides the continuous keystroke stream that makes process feature extraction possible; version history does not. Sealing with a cryptographic hash provides the tamper-evidence property that makes the record admissible as evidence of what was captured at the time of writing.

What do universities need to know before using keystroke evidence in student cases?

Several things. First, the accuracy figures from the research literature — particularly Crossley et al.'s 99% — apply to controlled experiments and should not be cited as certified operational accuracy rates. Second, the evidence establishes process (how text was produced) not identity (who produced it); these are different claims and require different evidentiary standards. Third, L2 writers and writers using non-standard input methods require population-aware interpretation — the feature thresholds from L1 English studies may not apply without adjustment. Fourth, there are no published inter-rater reliability standards or interpretation protocols for panels, which means universities should invest in expert interpretation rather than treating automated scores as self-explanatory. Fifth, chain-of-custody documentation for the process record — specifying the capture layer, its technical properties, and the integrity verification mechanism — is necessary before the record can be presented as evidence. Sixth, the evidence is best used to identify anomalies that prompt further inquiry and explanation from the student, not as a standalone determination of misconduct.

---

Summary findings table

The following table synthesizes the state of the evidence for each major feature and evidentiary question addressed in this review. The generalizability column reflects the current state of the cross-population evidence; the evidentiary weight column reflects how strongly the feature should be weighted in an integrity proceeding given what the literature establishes and what it does not.

Feature	What it measures	Established finding	Generalizability	Evidentiary weight
IKI distribution shape	Cognitive vs motor processing	Log-normal in composition, compressed in transcription	Moderate — varies by L1/L2 and typing skill	Medium-high with expert interpretation
Pause rate at sentence boundaries	Planning load at linguistic units	Significantly elevated in authentic composition (Crossley 2024)	Moderate — L2 writers show different pause profiles	High for L1 writers; interpret carefully for L2
Burst length variance	Generative vs transcriptive fluency	Higher variance in composition (Trezise 2019, Crossley 2024)	Moderate	Medium-high
Revision rate	Monitoring loop activity	Higher in authentic composition (Crossley 2024)	Moderate	High — low revision is a strong anomaly signal
Paste event detection	Source of text entry	Directly observable as event type	Very high — not a classification problem	High for paste events specifically
Session duration vs word count	Plausibility check	Bounds what is possible at human typing speeds	Very high — physical constraint	High for implausibility cases
Identity from single session	Who was at keyboard	Not established without enrollment corpus	Low	Must not be used without enrollment corpus
IME composition events	Character-based L1 input	Requires IME-aware capture for accurate interpretation	Situational	Requires specialist interpretation
Dictation / voice-to-text	Voice composition mode	Appears as block insertion unless capture layer is dictation-aware	Situational	Requires explicit handling in capture and interpretation
Revision clustering	Temporal structure of monitoring loop	Authentic composition shows clustering near new text	Moderate	Medium — supports other signals
Collaborative writing patterns	Multi-author session	Cannot be interpreted with solo-composition norms	Situational	Explicitly document collaborative context

Narrative synthesis

What the table establishes, taken together, is that writing process evidence is genuinely multi-dimensional. No single feature is individually definitive. The strongest individual signals — paste event detection, session-duration plausibility, and high revision rate in conjunction with sentence-boundary pause clustering — are also the ones that are most robust across populations and writing environments. The weakest individual signals — single-session identity attribution, IME composition patterns, and dictation detection in unaware capture layers — require specialist handling or are simply not available from the standard feature set.

The honest summary of the field's current state is as follows. The behavioral signature of authentic composition is real, measurable, and robust in controlled conditions. The Crossley et al. 99% accuracy figure establishes that the signature is strong enough to support near-perfect classification when the conditions are ideal. The Trezise et al. operational result establishes that the directional signal persists in real educational settings with noisier data. The TypeNet biometric result establishes that individual-level identification is achievable with sufficient enrollment data but not from a single session alone. And the cross-linguistic and writing-environment limitations establish that both the classification and the identity results are population- and context-specific in ways that matter for equitable evidentiary application.

The field's most important open question for evidentiary practice is not technical — it is normative: what standard of evidence should be required before process evidence is used to initiate or support an academic integrity proceeding against a student? The research base reviewed here can establish that a process record is anomalous. It cannot, by itself, establish guilt. The appropriate institutional use is as a trigger for further inquiry — a prompt to invite the student to explain an anomalous record, to gather additional evidence, and to make a determination based on the totality of the evidence — rather than as a standalone classifier that replaces human judgment and institutional process.

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#e8f4ee', 'primaryTextColor': '#16130c', 'primaryBorderColor': '#1f5a3a', 'lineColor': '#6f5618', 'secondaryColor': '#fffdf8', 'background': '#fffdf8', 'mainBkg': '#fffdf8', 'clusterBkg': '#f0ede4', 'titleColor': '#16130c', 'edgeLabelBackground': '#fffdf8'}}}%%
flowchart TD
    A[Process record submitted] --> B{Anomaly detected?}
    B -->|No anomaly| C[Record consistent with authentic composition\nDocument and close]
    B -->|Anomaly present| D{What type of anomaly?}

    D -->|Paste events without composition context| E[High-confidence anomaly\nPaste source investigation warranted]
    D -->|Session duration implausible for word count| F[Physical constraint anomaly\nHigh confidence]
    D -->|Low revision rate + uniform bursts| G[Composition signature absent\nWarrants explanation — expert review]
    D -->|Atypical IKI profile| H[May be L2 writer or accessibility accommodation\nRequire population-aware interpretation]

    E --> I[Invite student explanation\nGather additional evidence]
    F --> I
    G --> I
    H --> J[Consult specialist\nDocument language background\nApply appropriate norms]
    J --> I

    I --> K[Totality of evidence determination\nHuman judgment — not classifier output]

---

Related reading:

• Temporal analysis in writing evidence
• Keystroke logging and writing-process research
• Writing evidence methods comparison
• What is OS-level keystroke capture