Behavioural biometrics cannot tell tired from impostor

The premise is appealing: everyone types differently, so typing patterns identify people. The premise is true and the operational consequences are worse than the premise suggests.

Part of Remote workforce identity

Why the variation is the problem

A person's typing pattern is not stable. It changes with circumstances that have nothing to do with identity.

• Fatigue, illness, caffeine, stress
• A different keyboard, a laptop versus a desk setup, an external mouse
• Injury — a sprained wrist changes everything for weeks
• Task type — writing prose differs from writing code differs from filling a form
• Environment — working on a train, on a sofa, at a standing desk

A model sensitive enough to detect a different person is sensitive enough to detect a person with a cold. The deviation looks identical because it is the same kind of signal.

The base rate problem

This is the arithmetic that determines whether the system is usable, and it is usually omitted from vendor material.

Workforce:                        10,000 employees
Actual impostors:                      2   (0.02%)

Classifier: 95% true positive, 2% false positive

  Impostors detected:               1.9   ≈ 2
  False alarms:      9,998 × 0.02 = 200

  Alerts generated:                 202
  Proportion that are real:         ~1%

# 200 employees investigated for being impostors
# because they typed differently than usual.

Two hundred investigations to find two cases, and the two may be among the ones dismissed as noise. Operationally this means the alerts get ignored, which is the standard fate of a low-precision signal.

The human cost

Worth stating explicitly, because it is usually treated as a footnote.

Being investigated as a suspected impostor is a serious event for an employee. Doing that to two hundred people, most of whom were tired or using a different keyboard, damages trust in a way that is hard to recover from and is not offset by the two genuine detections.

There are also jurisdictions where continuous behavioural monitoring of employees raises legal questions independent of its accuracy.

Why a patient operative is not caught

The detection assumes the impostor behaves differently. Someone operating a long-term placement has time and incentive to avoid that.

The second row is the practical defeat. If the substitution happens at or before the point where the baseline is established, there is no anomaly at any point afterwards.

The deterministic alternative

# Probabilistic
  observe continuously → compute deviation → threshold → alert
  output: a score, requiring human triage
  cost:   continuous monitoring, 200 false alarms

# Deterministic
  on sensitive action or on schedule:
    challenge → signature from enrolled credential
  output: valid or not
  cost:   a gesture, taking seconds
  monitoring: none

The second collects nothing and produces no score to triage. Either the credential produced a valid signature with user verification, or it did not.

Where behavioural signals still have a place

Not as an identity control. As a risk signal feeding into decisions where a probabilistic input is appropriate.

• Raising the assurance required for a particular session, rather than accusing anyone
• Prioritising which sessions get a step-up challenge
• Detecting automated interaction, where the deviation is large and unambiguous

In each of those the output is an adjustment rather than an allegation, which is the right use of a signal with this precision. The failure is deploying it as a detector of impostors, where the base rate makes precision impossible.

A worked example: the base rate

Take 2,000 employees, a model at 95% true-positive rate and 2% false-positive rate, and one genuine impostor in the population over a year.

Tightening the threshold to cut the 40 also cuts the 1, because a patient operative sits closest to baseline of anyone in the population. The arithmetic does not have a favourable setting.

Objections and honest limits

“Our false-positive rate is much lower than 2%.” Then it was measured on a population that was not injured, tired or changing hardware. Those conditions are the normal state of a workforce over a year.

“It is one signal among many.” As routing input, fine. The problem is when it gates access, because then a repetitive strain injury becomes a lockout and the employee has no way to argue with a score.

Using behavioural signals responsibly

1. Never let a score block access on its own. It cannot distinguish tired from impostor.
2. Compute your own base rate before buying. With a realistic impostor prevalence.
3. Ask the vendor about injury and hardware change. The answer is usually silence.
4. Gate the consequential actions deterministically. A signature, not a probability.
5. Keep behavioural output for investigation. Where a human reads it in context.

Terms used here

Base rate

The underlying prevalence of the thing being detected, which dominates how often an alert is real.

Behavioural biometric

A model of typing, mouse or interaction rhythm used as an identity signal.

Patient operative

An attacker who deliberately conforms to the baseline, which is exactly what the model rewards.

Frequently asked questions

Why do behavioural biometrics produce so many false alarms? The base rate of impostors is tiny. Even a good classifier applied to ten thousand employees generates hundreds of false positives for a handful of real cases.

Why doesn't it catch a patient operative? If the substitution happens at or before baseline establishment, the baseline is theirs and there is no anomaly to detect at any later point.

Is there any good use for these signals? Yes — as a risk input that raises the assurance required for a session, or prioritises step-up challenges. Not as a detector of impostors.

What does a deterministic challenge cost? A gesture taking seconds, on sensitive actions or a schedule. It collects nothing continuously and produces a binary result rather than a score to triage.

Can the model be tuned to fix this? No setting works. Tightening cuts the false positives and the true positive together, because the patient operative sits closest to baseline.

What is the human cost? A wrist injury or a new keyboard produces weeks of flags, and the employee cannot argue with a score they cannot see.

Where do behavioural signals belong? In investigation and routing, read by a human in context — not gating access.

Sources and further reading

• NIST SP 800-63B — reauthentication and session management
• Literature on base rate effects in rare-event detection.
• EDPB guidelines and opinions on data protection at work
• NIST SP 800-63B — Authentication and Lifecycle Management