Gaze Tracking and Keystroke Dynamics Fail to Verify Student Identity Without Continuous Biometric Re-Authentication

Like a physical exam hall where an invigilator watches a student's posture and pen grip, behavioral biometrics monitor how a remote test-taker types and looks at the screen. But while a human proctor can instantly distinguish between a nervous fidget and an attempt to cheat, algorithmic gaze tracking and keystroke dynamics cannot make that definitive judgment alone.[2][6]

The actionable takeaway for educational institutions is clear: passive behavioral tracking cannot replace active physiological security. To secure high-stakes online assessments, platforms must use typing rhythms and eye movements merely as tripwires. When behavior drifts, the system must trigger a definitive facial scan to confirm the student's identity.[6]

The shift toward remote learning has forced universities and certification boards to rethink how they verify that the person taking a test is the person who registered for it. Traditional passwords only prove who logged in at the start of the session. They offer zero protection against proxy testing, where a student hands the keyboard to an expert five minutes into the exam.[2]

To close this gap, the industry turned to continuous authentication. This protocol repeatedly verifies the user's identity in the background throughout the entire session. Because prompting a student for a fingerprint scan every two minutes would destroy their concentration, developers leaned heavily into behavioral biometrics, which operate invisibly.[2][4]

The Mechanics of Behavioral Tracking

Keystroke dynamics analyze the unique physical rhythm of a user's typing. The software measures "dwell time," which is the exact millisecond duration a key is held down, and "flight time," the latency between releasing one key and striking the next. Together, these metrics form a distinctive typing signature.[4]

Gaze tracking applies a similar principle to eye movements. Using a standard webcam, the system maps the distance between the pupil and corneal reflections to determine exactly where the user is looking. It establishes a baseline for how a specific student reads a question, scans multiple-choice options, and blinks.[5]

In theory, these passive signals offer a frictionless security layer. If a proxy takes over the keyboard, the sudden shift in flight times and dwell times should instantly flag the intrusion. If a student looks off-screen to read a hidden cheat sheet, the gaze tracker should catch the anomaly.[4][6]

However, empirical data reveals a severe reliability problem. Behavioral biometrics generate an unsustainable volume of false alarms when deployed as standalone authenticators. Human behavior is inherently unstable; a student types differently when they are fatigued, stressed, or simply shifting their seating position.[2][3]

The Mathematical Limits of Passive Signals

A 2020 study published in Computers & Security tested a continuous authentication model using free-text keystrokes. While the neural network achieved a false rejection rate of roughly 1.95 to 2.07 percent under controlled conditions, that margin of error remains too high for high-stakes testing.[1]

In a standard two-hour exam involving thousands of keystrokes, a 2 percent false rejection rate guarantees that the system will repeatedly flag the legitimate student as an imposter. Locking a student out of their final exam because their hands grew tired and their typing rhythm slowed is an unacceptable failure mode.[1][6]

The reliability drops even further across multiple sessions. A 2026 evaluation in the journal Electronics measured the cross-session shift in keystroke dynamics. When a threshold established on a Monday was applied to the same user on a Wednesday, the total error rate spiked to 19 percent due to natural behavioral drift and hardware variations.[3]

Gaze tracking suffers from similar mathematical limitations. Research published in Applied Sciences indicates that gaze-based authentication systems exhibit an average error rate of 4 percent. Lighting changes, screen glare, and natural eye fatigue easily disrupt the webcam's ability to accurately map the pupil, triggering false positives.[5]

The Necessity of Physiological Anchors

Because behavioral signals are noisy, they cannot serve as the final arbiter of identity. If a platform relies solely on keystroke dynamics to terminate an exam, it will inevitably penalize honest students. Instead, the industry is moving toward a layered architecture where behavior dictates the frequency of physiological checks.[6]

In this hybrid model, keystroke and gaze tracking function as a continuous risk-scoring engine. As long as the student's typing rhythm and eye movements match their historical baseline, the system remains silent. The student experiences a frictionless exam environment without intrusive interruptions.[6]

When the behavioral model detects a significant anomaly—such as a sudden 30 percent increase in typing speed or a prolonged gaze away from the primary monitor—it does not assume the student is cheating. Instead, the anomaly triggers a mandatory re-authentication event.[3][6]

The system pauses the exam timer and prompts the student to look directly at the webcam for a randomized liveness check and facial recognition scan. This physiological biometric provides the definitive proof of identity that the behavioral signals lack.[6]

Balancing Security and Usability

This approach solves the proxy testing problem without overwhelming the student. If an expert takes over the keyboard, their distinct flight times will trigger the facial scan. When the webcam sees the proxy instead of the registered student, the system definitively logs the violation and terminates the session.[4][6]

By using behavioral biometrics as a trigger rather than a judge, educational platforms can maintain continuous security while minimizing false lockouts. The noisy data from keystrokes and eye movements becomes highly valuable when its only job is to ask the camera to take a closer look.[6]

Implementing this layered security requires careful calibration. Administrators must set the behavioral anomaly thresholds high enough to ignore minor fatigue, but low enough to catch a genuine seat-swap. A threshold that is too sensitive will trigger constant facial scans, defeating the purpose of the passive monitoring.[3][6]

The financial cost of this architecture is relatively low. Because keystroke dynamics rely on standard keyboards and gaze tracking uses existing webcams, universities do not need to ship specialized hardware to remote students. The investment lies entirely in the cloud-based machine learning models that process the telemetry.[4][5]

Privacy and Accessibility Concerns

The continuous collection of granular behavioral data introduces significant privacy liabilities. Tracking a student's eye movements and typing cadence generates a highly personal biometric profile. Institutions must ensure this data is encrypted, stored temporarily, and destroyed immediately after the exam window closes.[2]

Furthermore, behavioral biometrics struggle with accessibility. Students with motor impairments, tremors, or conditions like dyslexia naturally exhibit highly variable typing rhythms and reading patterns. A rigid keystroke dynamics model will disproportionately flag these students as anomalies.[2][6]

To prevent discriminatory outcomes, continuous authentication systems must allow for personalized baselines and manual overrides. Students with documented accommodations must be able to disable the behavioral triggers and rely on periodic, scheduled facial scans instead.[6]

The European Union's stringent data protection regulations already classify behavioral biometrics as sensitive personal data. Educational platforms operating globally must build explicit consent flows, explaining exactly how dwell times and gaze vectors are calculated and when they trigger a physiological scan.[2]

The Future of Remote Proctoring

As machine learning models improve, the false rejection rates of passive biometrics will slowly decrease. However, the fundamental instability of human behavior means that keystrokes and eye movements will never achieve the mathematical certainty of a fingerprint or an iris scan.[1][6]

The utility of behavioral biometrics lies in their persistence, not their precision. They are the only security layer that can watch a student for two hours without causing immediate fatigue. They fill the massive blind spots between the initial login and the final submission.[6]

Ultimately, securing online education requires accepting the limitations of the technology. Gaze tracking and keystroke dynamics are powerful tools for detecting when something has changed, but they fail entirely at proving who is sitting in the chair.[6]

That definitive proof still requires a physiological anchor. By pairing the continuous, invisible monitoring of behavior with the undeniable certainty of facial recognition, online proctoring can finally scale to meet the demands of global digital education without sacrificing academic integrity.[6]