HUMAN VS AGENT / RESEARCH NOTES

Was a person actually in the loop?

Behavioral signals can add context to an approval. Independent attack testing shows why they cannot stand alone.

As software agents take on more tasks, an approval button becomes an important boundary. A system may ask a person to confirm a step. The research question is whether the interaction provides evidence that a person actually participated in that particular decision.

The Human vs Agent project explores a low-enrollment signal for this moment: the mouse movement leading up to an approval click. It is an experimental risk signal, not proof of identity, informed consent, or legal authorization.

Three checks, three different failure modes

The prototype runs a trained model in the browser and combines its output with two additional checks:

• Behavior: a gradient-boosted model evaluates 30 features describing the approach to a click.
• Geometry: heuristics inspect whether movement was recorded and whether a click landed exactly at the target’s center.
• Freshness: a new target and challenge identifier distinguish the current attempt from a stale response.

These checks add different kinds of evidence. They also fail differently. A human can click at a button’s center, an automated system can generate a cursor path, and an adaptive agent can inspect the current challenge.

Strong offline results need context

The initial evaluation compared 13,605 human traces with 13,604 generated adversarial traces. Five-fold validation grouped traces by user, so one person’s interactions did not appear on both sides of a fold. The reported AUC was 0.9988 against those generated adversaries.

That number describes the constructed evaluation. It does not establish performance against all real automation. Reused human traces were especially revealing: the classifier caught only 1.4% of replayed traces, because a recording can still contain human-like movement.

The important result came from independent attacks

A later stress test used a third-party WindMouse attacker rather than the project’s training generators. At the deployed research threshold of 0.2297, 46 of 58 attempts passed (79%; reported 95% confidence interval 67–88%). The model’s AUC on 49 live human traces versus those 58 attack traces was 0.900.

The analysis traced part of the gap to shortcut learning: one feature was strongly affected by how synthetic negative examples had been generated and sampled. The model could learn a generator artifact instead of a durable distinction between people and automation.

Thresholds change the trade-off

The human baseline in this analysis consisted of 49 traces from one person on one machine. These are research observations, not customer performance guarantees. A broader population and additional devices are needed to estimate deployment trade-offs.

What the prototype does not prove

• A passing score does not establish human presence, identity, understanding, or consent.
• Fresh targets reduce some replay opportunities but do not stop an adaptive attacker that reads the current page. Position-only challenges retain a chance of success.
• Mouse dynamics does not provide an accessible verification channel for keyboard-only, touch, or assistive-technology users.
• Client-side code and thresholds can be inspected or bypassed. The public demo is not a secure merchant integration.
• The original demo’s signature-like display was illustrative. This site does not issue a trusted or merchant-verifiable attestation.

Where CogniVow goes from here

The direction is layered assurance: combine behavioral context with stronger authentication, accessible alternatives, and clear human review. Future work includes more independent attackers, broader human evaluation, improved synthetic data, and trustworthy attestation mechanisms.

Our mission is to help keep a person meaningfully involved when an agent acts. The research tells us to earn that trust through evaluation, rather than declare it from a model score.

Research basis: Karthik Godugolla’s Human vs Agent research, including the initial model evaluation and later independent adversarial stress tests. The later findings qualify the initial offline results. The public demo uses the supplied model at its original threshold; its interface has been rebuilt for this site.