The Shape of Identity
Modeling behavioral continuity through time, context, and drift.
People have recognizable typing rhythms and pointer movements. Those patterns also change with practice and time. This study asks how much of the apparent accuracy of behavioral identification depends on when researchers collect the training and test data.
The same people, under different time splits
We reanalyzed the CMU keystroke benchmark: 51 people typing the same password 400 times across eight sessions. The scaled Manhattan detector stays fixed. The protocols change enrollment and testing: same-session uses 25 enrollment repetitions, while mixed and disjoint use 50.
Mean equal error rate rose from 10.0% when enrollment and testing shared a session, to 14.3% with mixed sessions, to 18.6% with separate sessions. The chart shows the estimates and their 95% subject-bootstrap confidence intervals. These are benchmark results, not measurements of a GrayPass product.
The same detector reports more error when time is respected
Mean equal error rate with 95% subject-bootstrap confidence intervals. CMU benchmark, 51 subjects.
Mean equal error rate
Practice changes the pattern
Hold times retained measurable person-specific structure across sessions, with intraclass correlations between 0.55 and 0.77. Inter-key latencies were less stable: all 20 latency features fell below 0.5. Different timing features therefore support different claims about continuity.
Median typing duration shortened by 26% across the eight sessions, and 96% of participants typed faster in the final session than in the first. Verification error also increased with distance from enrollment, from 14.6% to 21.7%. A template from an earlier session captures a person at one point in that changing pattern.
We repeated the protocol comparison on the Balabit mouse benchmark. Its ten-user cohort showed person-specific structure alongside sensitivity to the evaluation protocol. The small sample and uncertain session order limit how far that comparison can generalize.
Reporting continuity over time
The report models behavioral identity as a distribution with trait, context, and drift components. This framing gives researchers a way to describe stable differences between people while accounting for changes within a person.
A longitudinal claim needs its enrollment procedure, time split, and uncertainty alongside its accuracy figure. The full paper proposes a seven-item reporting standard so readers can assess how closely an evaluation matches the conditions in which a system would operate.
Limitations
The CMU benchmark is fixed-text password entry by a university population on laboratory apparatus; absolute error levels and the practice curve are specific to that setting.
The benchmark provides session order and a one-day minimum separation, not calendar dates, so no claim is made in units of elapsed time.
The Balabit cohort has ten users, uncontrolled tasks, and unverified session order; its protocol contrast is indicative only.
Detectors are deliberately simple and untuned; stronger detectors would lower absolute error but cannot remove the underlying distributional movement.
Practice, fatigue, motivation, and time of day are confounded in session order; no causal claim is made among them.
Scope of the findings
No claim that any behavioral signal uniquely identifies a person. Intraclass correlations well below 1 say the opposite.
No performance of any product or deployed system. Every EER characterizes a benchmark under a stated protocol with a deliberately simple detector.
No universal accuracy figure for keystroke or mouse biometrics, and the report should not be cited as one.
Reproducing the results
Everything is deterministic under seed 42. A single script regenerates every number from the source data into a machine-readable results file, and every figure from the same file.
The full report includes the methods, results, and references.
Read the full report