The Human Confidence Score: a passive approach to bot detection

CAPTCHAs and similar challenge-response systems make a binary decision — pass or fail — based on a single interaction that itself has become trivially solvable by modern bot frameworks. Worse, the challenge is visible: it interrupts the user, and its difficulty must keep escalating against automated solvers, degrading the experience for real humans in the process.

CertiLayer starts from a different premise: behavioral signal collected passively, over the course of an entire session, is far harder to convincingly forge than a single challenge response — and requires no interruption to collect.

Every session is reduced to a fixed 34-dimensional feature vector across seven feature groups: presence flags, keyboard timing (inter-key interval, dwell/flight time, typing burst score, error-correction rate), mouse dynamics (velocity, acceleration, curvature, micro-adjustments), scroll behavior, touch dynamics, device motion, and navigation patterns.

A key empirical finding: for single-page sessions with no real navigation, modalities 17–33 (mouse/scroll/touch/motion/navigation) should be left at exactly zero rather than approximated. Filling in synthetic values for absent modalities measurably degrades score accuracy — the honest "this signal wasn't present" representation outperforms interpolation.

M1 (rule-based gates) performs sub-millisecond pre-filtering on obviously synthetic patterns before any model inference runs.

M2 (Siamese LSTM) verifies keystroke-timing consistency for identity continuity across a session — frozen after training due to a known MPS/Apple Silicon NaN instability with LSTM layers, so this model runs CPU-only by design, not as a temporary workaround.

M3 (XGBoost) is the primary bot/human classifier, trained on the non-keyboard modalities (features 17 onward) and achieving 0.9993 validation AUC.

M4 (contrastive autoencoders, one per modality group) catches novel anomalous patterns the classifier hasn't seen — the layer most responsible for detecting new bot frameworks the training data never saw.

The four model outputs combine into a single Human Confidence Score:

HCS = 0.55 × M3_score + 0.20 × M4_keyboard_score + 0.15 × M4_mouse_score + 0.10 × M4_touch_score

Weights were tuned empirically against the validation set, reflecting M3's role as primary classifier and the M4 modalities as corroborating anomaly signal.

Thresholds — HCS ≥ 0.35 is Human Verified, 0.30–0.35 is Human Likely, below 0.30 is Synthetic — were selected via a threshold sweep against the validation set, aiming to keep the false-accept rate on bot traffic low without materially increasing false rejections of real human sessions.

An AUC/AUROC score close to 1.0 shows the models separate the two classes well across all possible thresholds — it does not, by itself, justify that 0.35 specifically is the correct operating point for production. A full precision/recall and false-accept/false-reject curve at each candidate threshold is the next piece of published methodology; until that's published here, treat 0.35 as the current production setting rather than a formally proven optimum.

Every computed HCS is committed to a Merkle-tree audit ledger, BLAKE3-hashed. This means a customer can independently verify that a score we reported for a given session hasn't been altered after the fact — the ledger is tamper-evident by construction, not by access control alone.

A k6 load test against the production Rust ingestion endpoint, ramping through 1,000 → 2,500 → 5,000 concurrent virtual users, measured p95 latency of 11ms with a 0% error rate. See /research/benchmarks for the full breakdown alongside per-model validation scores.