Training-Free Cohort-Relative Keystroke-Cadence Verification

Abstract

We present a keystroke-cadence verifier for high-assurance login that is synthesised in closed form from enrolment data—no gradient training, no epochs. Each typing sample becomes a fixed-length timing vector; the model z-score-normalises features, removes incoherent enrolment samples, optionally weights features by a multi-class Fisher ratio, forms PCA sub-prototypes, and decides by a cohort-relative weighted-cosine margin gated by a per-user threshold. On the public CMU keystroke benchmark (51 subjects), under a protocol with strictly held-out impostors, the method attains a mean per-subject Equal-Error-Rate of 9.38% (7.78% with Fisher weighting disabled). That is in the same range as the best detector reported by Killourhy and Maxion (9.62%), but we stress this is not a head-to-head comparison: our cohort-relative protocol uses the other enrolled subjects as negative evidence, which their per-subject detectors do not, and the per-subject variance is large ( 8.5%; 95% CI [7.0,11.7]%). A component ablation—reported in full, including a negative result—shows that cohort-relative scoring alone sets a low-false-accept operating point (FAR 0.69% vs 13.3% for an unweighted single-threshold baseline, 19 fewer impostor admissions); per-user adaptive thresholds were measurably inert on this benchmark, and Fisher weighting slightly hurts. Cross-session drift would otherwise make a static operating point reject 40–86% of genuine logins; we close that gap with password-gated continuous learning—a cadence rejection that the password confirms is appended as a new neuron, so the template tracks the user while impostors (who lack the password) can never poison it. Across CMU sessions this halves the fallback rate and halts the drift escalation at no false-accept cost. We are explicit about the remaining limitations: the synthetic study is an internal consistency check rather than independent evidence, and only zero-effort impostors are evaluated.