Your Mouse Knows Who You Are

The idea is simple. Everyone moves a mouse a little differently: how fast you go, how you curve toward a button, how long you pause before you click. If a computer can learn that, it can tell whether the person using it is really you. Basically FaceID, but for your mouse.

I spent Summer 2026 at Clarkson University as an undergraduate researcher in Prof. Daqing Hou's group, mentored by Charles Devlen. The work I built on trained a separate model for every user in every dataset. Across three public datasets, that came to 59 models. It works, but it does not scale, and it cannot recognize anyone it was not trained on.

So I built one model for everyone. It is a 2-layer BiLSTM in PyTorch that reads a stretch of mouse movement and turns it into a 128-number embedding, a kind of fingerprint for how you move. I trained it with semi-hard triplet loss, the same idea behind FaceNet and TypeNet: pull samples from the same person together and push different people apart.

No single public dataset is big enough for that, so I trained across five of them at once: Balabit, ChaoShen, DFL, TWOS and Gmail. The payoff is that the model can check people it never saw during training, with no retraining.

On July 29, 2026 I presented the work at the Summer 2026 RAPS (Research and Project Showcase) at Clarkson, in a talk called "Authentication Using Mouse Movement." It won Best Undergraduate Oral Presentation in Computational Science & Applied Mathematics II.

The model was partly learning which dataset a movement came from, not who made it.

There is a catch, and I found it myself in mid-July, two weeks before the talk. Every dataset was recorded by a different logger, and each logger checks the mouse at its own rate. One records an event about every 110 milliseconds, the others about every 8 or 16. That timing leaves a fingerprint. Three timing statistics alone could guess which dataset a single movement came from 57% of the time, when chance was 20%.

That means the model could partly cheat. Instead of learning who you are, it could learn which dataset you came from. The numbers I presented at RAPS counted impostors from other datasets too, which makes the job easier than real life. When every impostor comes from the same dataset as the real user, the error rate climbs a lot.

Fixing that is my Fall 2026 independent study at RIT, sponsored by Dr. Dukka KC and graded by Prof. Hou, running on RIT's research GPU clusters. The goal is a model that learns the person, not the dataset. My first try, resampling every dataset to the same clock, takes away most of the timing shortcut but throws out more than half the training data, so there is more to do.