How we check for AI

Every response to a SampleLabs survey is checked before it counts. Our checker, Dot, looks for bots, AI-written answers, people rushing through and people answering twice. This is exactly what it looks at.

The checks

You can switch each one on or off for every survey.

• Bot trap

  Every survey has a hidden field that real people never see. Bots fill it in, people don't. We also run Cloudflare's invisible check, the kind you pass on many websites without noticing, and watch for a script driving the browser for someone (see below). Google's reCAPTCHA looks too, but for now it only takes notes: it never turns anyone away.

• Too fast

  Nobody can read and answer a question in under 2 seconds. Once 20 people have answered your survey, we also know its usual pace, and anyone going more than three times faster gets flagged.

• Duplicates

  Flags a second response from the same browser, so one person can't answer twice.

• Attention check

  Adds one question with a single right answer, like "Pick Strongly disagree for this one." Someone who isn't reading gets it wrong.

• AI-written answers

  On open-text questions, flags answers that were pasted in or read like they came from an AI tool.

• Session recording

  Records the screen while people answer, so you can watch any response back and judge for yourself. Anything people type is hidden before it leaves their browser. Recordings are deleted after 30 days.

Spotting a script in a real browser

Some bots don't fill in forms directly. They drive a real browser, the way AI agents and tools like Browserbase do, so they pass the usual "are you human" checks. Part of the bot trap is watching how the pointer and keyboard are used. Each check needs several clicks, moves or key presses before it judges, so one odd moment never gets a person flagged.

• Clicks dead in the middle

  Scripts aim for the exact middle of a button, to the pixel. A hand on a mouse never lands there, not even once in a while. When most of someone's clicks hit the dead centre, it was a script, whether the pointer jumped there or slid there.

  Shows in your results as "Clicked by a script".

• Slides drawn with a ruler

  Some scripts slide the pointer over to look human. They slide in a perfectly straight line, in steps of exactly the same size. A hand curves, speeds up, slows down and corrects itself. Dot looks at the last stretch before each click.

  Shows in your results as "Clicked by a script".

• Typing to a metronome

  Scripts hold every key down for the same time and wait the same time before the next one. People speed up, slow down and pause. Dot only looks at when keys go down and up, never which keys, and it needs both the holds and the waits to be steady, so a phone keyboard that taps out letters instantly is fine.

  Shows in your results as "Typed by a script".

• A mouse that reports too neatly

  A real mouse reports where it is faster than the screen redraws, so the browser often bundles a few readings into one move. A script sends its moves one at a time, and never bundles a single one. This even catches scripts that copy a human's curves and typing rhythm. Browsers that can't report this are never judged by it.

  Shows in your results as "Mouse moved by a script".

People who tap on a phone or tablet, use only a keyboard, or use a screen reader leave no mouse clicks or moves to judge, so the pointer checks can never catch them. Dot only notes timings and positions on the survey page, never what anyone types. These checks work on surveys built in SampleLabs.

Checking the note itself

The checks above read a note the person's own browser writes, so a clever bot might try to block it or write its own. Dot checks the note against things it knows for itself: our own clock, the answers that arrived and what the browser says it is. Before any of these could flag anyone, we ran them over nearly 1,900 real survey responses, and they caught none.

• A note that goes missing

  The note is written as people answer, and parts of it reach us along the way, timed by our own clock. A bot that blocks it, or swaps in a made-up one at the end, leaves a note that disagrees with what we already heard.

  Shows in your results as "Bot check blocked or rewritten".

• Answers with no hands

  Some bots fill in the form from inside the page, without moving a pointer or pressing a key. Answers arrived, but nothing was clicked, tapped or typed. Screen readers and voice control press for people, so they're never caught by this.

  Shows in your results as "Answered with no hands".

• A note that doesn't add up

  The note can't claim more time on the questions than had passed on our clock, and plenty of typing has to land somewhere in the answers.

  Shows in your results as "Bot check note doesn't add up".

• A browser that doesn't add up

  A phone without a touch screen, a phone whose window fills its whole screen, or a browser that says a script is driving it.

  Shows in your results as "Browser's details don't add up".

Someone who answers a whole survey on a computer with only the keyboard is marked "Keyboard only (have a look)", so you can judge the answers yourself. That mark never turns anyone away: people who can't use a mouse are real people too.

Where a response comes from

Dot also looks at where each response comes from. For now it only takes notes on these: they don't flag anyone or turn anyone away yet. Every morning we measure each one against our own bots and against real people we trust, so a student on a busy campus network or someone on holiday never gets caught by mistake. A check only starts flagging once it catches bots without catching people.

• Rented servers

  AI agents and bot tools mostly run on servers rented from Amazon, Google and the like. People answer from home, from work or on their phone. Dot checks the address against the lists those companies publish.

• VPNs and Tor

  Hiding behind a VPN or Tor is an easy way to answer one survey many times from what look like different places. Dot checks public lists of VPN and Tor addresses. Plenty of honest people use a VPN, so this will never turn anyone away on its own.

• A clock from somewhere else

  A bot rented in one country often reaches a survey through another. The address says the Netherlands, but the browser's clock says California. Dot only counts a clock that's hours off, so a Belgian on Dutch time, or someone who just got back from a trip, is fine.

• The same address, again and again

  A third response to the same survey from the same address in one day. Two is fine: flatmates and colleagues share an address.

Dot keeps the address rough, with its last part dropped. The full address is only kept scrambled, so a repeat can be matched but the address can never be read back.

When Dot catches something

You decide what happens, and you always see what was caught and why.

• Flag only

  Everyone can finish the survey. Each flagged response shows in your results with the reason, like "Too fast (12s)", and you decide what to leave out.

• Turn them away

  Flagged people are sent to an end page. Their response is kept out of your counts, your charts and your download.

Surveys built somewhere else

Built your survey in Google Forms or Qualtrics? Dot can still guard it. People go through a short check page first, which runs the bot trap, too fast, duplicates and the attention check before sending them on to your survey. Dot can only read open answers in surveys built in SampleLabs, so the AI-written answer check needs a SampleLabs survey.

See Protect