The Chain of Intent

Testing what a detector learns

We compared real human mouse traces from the Balabit benchmark with six openly specified automation generators. The generators range from linear and grid motion to smoother trajectories and replayed human movement. Together they produced 360 seeded sessions in the same event format.

A human-versus-automation detector reached a session AUC of 0.98 within that distribution. A detector using implementation artifacts alone retained 99.3% of the full AUC. Much of the separation came from characteristics of the tools used to generate the movement.

The chart compares that separation with a different test on 685 real human sessions: distinguishing account-owner activity from identity mismatch. The automation detector reached an AUC of 0.42 in that test. The mismatch label identifies a different operator; it does not document whether the account owner granted permission.

Unfamiliar tools change the result

Training on one automation family did not ensure reliable detection of another. Cross-family artifact-detector AUC fell as low as 0.00. For the family that replayed recorded human motion, leave-one-family-out AUC ranged from 0.44 to 0.60 across feature regimes.

These experiments expose the limits of the evaluated detectors and generators. They do not establish a universal detection rate for automated agents. The replay control provides a case where an automated executor can produce movement drawn from genuine human traces.

Permission needs its own evidence

The report separates agency into six axes: executor, actuation, assistance, goal origin, supervision, and authorization. Interaction traces can support some execution-related inferences, but they do not contain the full relationship between an actor and the person who granted authority.

The formal result considers cases where permission changes while execution stays fixed. Two identical traces can then have opposite authorization states. A trace-only test cannot distinguish them, regardless of classifier quality.

The paper describes the evidence needed to carry delegation: who granted authority, its scope, its recipient, and how it can expire or be revoked. It compares those requirements with existing standards. Behavioral detection can still support anomaly triage; applications need separate provenance to verify the authority behind an action.

Limitations

One modality (remote-desktop mouse dynamics) and synthetic automation: the generators model a spectrum, not a census of deployed tools, so transfer findings are stated conditionally.

The Balabit illegal label denotes identity mismatch, genuine human motion from a different person, not a documented authorization violation. That isolation is the point, and the boundary is stated.

The replay control is intentionally a best case for the adversary; it establishes a floor, not a typical case.

The identity detector's AUC speaks to identification; the authorization claim rests on the formal result plus identity being neither necessary nor sufficient.

Scope of the findings

Automation is not equated with malice, agent identity with principal identity, detectability with disclosure, or classification with authorization.

Behavioral detectors remain useful for anomaly triage; the claim is about what they can certify.

No new wire protocol or standard is proposed. A requirements artifact and coverage analysis, not an adopted specification.

No novel evasion technique is published; the generators are well-known, openly specified motion models.

Reproducing the results

All code, generators, cached results, and figures are deterministic (seed 42). No proprietary detector, feature list, trace, or attack result from any GrayPass system enters the analysis.