# How we check for AI

Every response to a SampleLabs survey is checked before it counts. Our checker, Dot, looks for bots, AI-written answers, people rushing through and people answering twice. This is what it looks at. We explain each check in plain words but keep the exact lines to ourselves, so a bot can't be built to sit just inside them.

Dot, the checker inside SampleLabs Protect, runs an ever-growing checklist of hundreds of checks on every survey response, for bots, scripts driving a real browser, AI-written answers, rushing and repeat visits, before it counts. Every day we test Dot on real people answering surveys on SurveySwap, our student survey site, and every night our own bots attack it. We keep building new bots to beat it, and a check only starts flagging once it catches them and leaves the people alone. Below are the main ones in plain words.

## The checks

You can switch each one on or off for every survey.

- **Bot trap.** Every survey has a hidden field that real people never see. Bots fill it in, people don't. We also run Cloudflare's invisible check, the kind you pass on many websites without noticing, and watch for a script driving the browser for someone (see below). Google's reCAPTCHA looks too, but it only takes notes: it never turns anyone away.
- **Rushed answers.** Some people race through a survey faster than anyone could read it. Once enough people have answered yours, Dot also knows its usual pace and spots anyone far quicker than that. A rushed response is marked "Rushed": it's a quality label, not a bot flag, because a quick person is still a person. You decide whether to keep their answers.
- **Duplicates.** Flags repeat entries from the same browser or IP address.
- **Attention check.** Adds the check questions you select, spread through your survey. Each has a right answer, like "Pick Strongly disagree for this one." Someone who isn't reading gets them wrong. They come in the same languages as the survey builder.
- **AI-written answers.** On open-text questions, flags answers that were pasted in or read like they came from an AI tool.
- **Session recording.** Records the screen while people answer, so you can watch any response back and judge for yourself. Anything people type is hidden before it leaves their browser. Recordings are deleted after 30 days.

## Spotting a script in a real browser

Some bots don't fill in forms directly. They drive a real browser, the way AI agents and tools like Browserbase do, so they pass the usual "are you human" checks. Part of the bot trap is watching how the pointer and keyboard are used. Each check needs plenty of clicks, moves or key presses before it judges, so one odd moment never gets a person flagged.

- **Clicks dead in the middle.** Scripts aim for the exact middle of a button. A hand on a mouse almost never lands there. When most of someone's clicks hit the dead centre, it was a script, whether the pointer jumped there or slid there. Shows in your results as "Clicked by a script".
- **Slides drawn with a ruler.** Some scripts slide the pointer over to look human. They slide in a perfectly straight line, in steps of exactly the same size. A hand curves, speeds up, slows down and corrects itself. Dot looks at the last stretch before each click. Shows in your results as "Clicked by a script".
- **Typing to a metronome.** Scripts hold every key down for the same time and wait the same time before the next one. People speed up, slow down and pause. Dot only looks at when keys go down and up, never which keys, and it needs both the holds and the waits to be steady. Phones and tablets type on the screen, which gives no timings worth judging, so they're never judged by it. Shows in your results as "Typed by a script".
- **A mouse that reports too neatly.** A real mouse reports where it is faster than the screen redraws, so the browser often bundles a few readings into one move. A script sends its moves one at a time. This even catches scripts that copy a human's curves and typing rhythm. Computers and browsers where a real mouse rarely bundles are never judged by it. Shows in your results as "Mouse moved by a script".
- **Readings squeezed together.** Scripts that do bundle their moves tend to squeeze the readings into practically the same instant, tighter than any common mouse sends them. A few browsers do that with a real mouse too, so Dot leaves out the setups where people's mice do it. Shows in your results as "Mouse readings bunched by a script".
- **Typing timed like dice.** Scripts that try to type like a person pick how long to hold each key, and how long to wait before the next, at random from a range. That spreads the times out evenly, like rolling dice. People's typing is lopsided: mostly quick keys, a long tail of slower ones, and now and then a key held far longer than the rest. Dot only judges plenty of typing, and never on phones and tablets. Shows in your results as "Typing timed like dice".
- **A keyboard timed like dice.** Some people only use the keyboard, and that's fine on its own: it's marked for a look, never turned away. A keyboard-only response where every key was held for an evenly drawn time is a script. Shows in your results as "Keyboard only, keys held for evenly drawn times".

People who tap on a phone or tablet, use only a keyboard, or use a screen reader leave no mouse clicks or moves to judge, so the pointer checks can never catch them. Dot only notes timings and positions on the survey page, never what anyone types. These checks work on surveys built in SampleLabs.

## Checking the note itself

The checks above read a note the person's own browser writes, so a clever bot might try to block it or write its own. Dot checks the note against things it knows for itself: our own clock, the answers that arrived and what the browser says it is. Before any of these could flag anyone, we tested them on real survey responses to make sure they leave people alone.

- **A note that goes missing.** The note is written as people answer, and parts of it reach us along the way, timed by our own clock. A bot that blocks it, or swaps in a made-up one at the end, leaves a note that disagrees with what we already heard. Shows in your results as "Bot check blocked or rewritten".
- **Answers with no hands.** Some bots fill in the form from inside the page, without moving a pointer or pressing a key. Answers arrived, but nothing was clicked, tapped or typed. Screen readers and voice control press for people, so they're never caught by this. Shows in your results as "Answered with no hands".
- **A note that doesn't add up.** The note can't claim more time on the questions than had passed on our clock, and plenty of typing has to land somewhere in the answers. Shows in your results as "Bot check note doesn't add up".
- **A browser that doesn't add up.** A phone without a touch screen, a phone whose window fills its whole screen, or a browser that says a script is driving it. Shows in your results as "Browser's details don't add up".
- **Clicks the page made itself.** When a person clicks, the browser marks it as real. When a bot runs code inside the page to press buttons, the browser marks those clicks as made by the page. One alone proves nothing, so Dot needs more. Shows in your results as "Clicked by the page's own code".
- **A screen that doesn't fit.** Some screen sizes only exist on one kind of computer. A browser that says it's one kind of computer, but reports a screen only another kind has, is dressed up. Shows in your results as "Screen size doesn't fit the computer".
- **A graphics chip that doesn't fit.** The browser says which graphics chip it draws with. Servers without a screen draw with software, and a phone never has a desktop computer's chip. Shows in your results as "Graphics chip doesn't fit the device".

Someone who answers a whole survey on a computer with only the keyboard is marked "Keyboard only (have a look)", so you can judge the answers yourself. That mark never turns anyone away: people who can't use a mouse are real people too. Only when the browser looks like a bot's as well, because its window fills the whole screen or the page's own code pretends the person left, is it marked "Keyboard only, in a bot's browser", and that one counts.

## Where a response comes from

Dot also looks at where each response comes from. We test each check against our own bots and against real people, to keep a student on a busy campus network or someone on holiday from being caught by mistake. A check only starts flagging once it catches bots without catching people. Rented servers have passed that test. The others take notes until they pass it too.

- **Rented servers.** AI agents and bot tools mostly run on servers rented from Amazon, Google and the like. People answer from home, from work or on their phone. Dot checks the address against the lists those companies publish. This one flags: it shows in your results as "Came from a cloud server".
- **VPNs and Tor.** Hiding behind a VPN or Tor is an easy way to answer one survey many times from what look like different places. Dot checks public lists of VPN and Tor addresses. Plenty of honest people use a VPN, so this will never turn anyone away on its own.
- **A clock from somewhere else.** A bot rented in one country often reaches a survey through another. The address says the Netherlands, but the browser's clock says California. Dot compares the clock with the city the address is in, not just the country, and only counts a clock that's hours off, so a Belgian on Dutch time, or someone who just got back from a trip, is fine.
- **The same device, all over the world.** One computer answering from several countries in a single day is hopping between rented connections. Dot remembers each device across every SampleLabs survey, so a bot that hit one survey is already known when it reaches the next.
- **The same address, again and again.** Several responses to the same survey from the same address in one day. A couple is fine: flatmates and colleagues share an address.
- **An AI agent's own browser.** Some AI agents browse in a browser of their own, and it says so in the name it gives every website. People rarely browse that way, so Dot notes it. It never turns anyone away on its own.

Dot keeps the address rough, with its last part dropped. The full address is only kept scrambled, so a repeat can be matched but the address can never be read back. A device is remembered the same way: a scrambled code made from what the browser already says about itself.

## When Dot catches something

You decide what happens, and you always see what was caught and why.

- **Flag only.** Everyone can finish the survey. Each flagged response shows in your results with the reason, like "Clicked by a script", and rushed answers are marked "Rushed" next to it. "Why Dot flagged it" sets out Dot's case in a few plain lines, like where the device answered from and what its clock says. You decide what to leave out.
- **Turn them away.** Flagged people are sent to an end page, and so are rushed ones if you have the rushed answers check on. Their response is kept out of your counts, your charts and your download.

## Surveys built somewhere else

Built your survey in Google Forms or Qualtrics? Dot can still guard it. People go through a short check page first, which runs the bot trap, rushed answers, duplicates and an attention question before sending them on to your survey. Dot also gives you two more of its attention questions to add to your survey yourself. Dot can only read open answers in surveys built in SampleLabs, so the AI-written answer check needs a SampleLabs survey.

## Questions people ask

### Can you tell if a survey answer was written by AI?

Dot flags open answers that were pasted in or read like they came from an AI tool, and shows which answer gave it away. It reads the finished answers, the same ones you see in your results, so this check runs on surveys built in SampleLabs.

### How do you catch AI agents that use a real browser?

By how the pointer and keys behave, by checking the browser's own note against our clock, and by where the response comes from. AI agents click the dead centre of buttons, type to a steady beat and mostly run on rented cloud servers. People don't.

### Will a real person ever be flagged by mistake?

We do extensive research to keep that from happening. A check only flags once it catches our own bots without catching the real people we test it against. Until then it only takes notes.

### Why don't you publish the exact thresholds?

Because a bot can be built to sit just inside them. We explain what the main checks look at in plain words, and every flag in your results says why it was given, so you can judge it for yourself.

### Do you record what people type?

No. Dot notes when keys go down and up, never which keys. Session recordings hide typed text before it leaves the browser. The only words Dot reads are the finished open answers, the same ones you see in your results.

### Are people on a VPN turned away?

No. Plenty of honest people use a VPN, so Dot only takes a note of it and never turns anyone away for it.

### Does Dot work for people on phones or with screen readers?

Yes, and it never judges them on what they can't do. Taps, keyboards and screen readers leave no mouse clicks, so the mouse checks skip them, and phones and tablets are never judged on typing rhythm.

### Is this a CAPTCHA?

No. A CAPTCHA asks people to prove they're human, and AI agents now pass most of them. Most of Dot's checks ask nothing of people: they look at how the survey was answered.

### Can I switch a check off?

Yes. Every check can be switched on or off for each survey in Protect, and you choose whether flagged people are only marked or turned away. https://samplelabs.io/protect