Behavioral Analysis | Techlist.io

cloudflareAug 7, 20263 min readCurated summary

Unveiling good and bad behaviors on the Agentic Internet

The Internet contains a mix of human, automated, and hybrid traffic, so classifying visitors simply as “good humans” or “bad bots” no longer works. Cloudflare argues that website owners should evaluate continuous behavior and build trust over time, rather than rely only on isolated risk checks. Its strategy combines transparent bot classification through BotBase with behavioral detection through Precursor. ## Risk and Trust Are Different - **Risk** measures how likely a request or action is to be harmful, often based on a momentary event. - **Trust** develops over time through reputation and observed behavior. - A suspicious action should not automatically lead to rejection if the actor has an established, trustworthy identity. - Cloudflare’s goal is to create incentives for safer behavior, from blocking malicious activity to enabling beneficial automated participation. ## Verified Bots and Transparency - Cloudflare defines verified bots and agents through two requirements: - They honestly declare who they are. - They do not abuse the trust they receive. - Transparency helps site owners decide which behaviors and data uses to permit. - BotBase is designed as a directory of all known bots and agents, not just approved ones. - Actors that violate expectations can lose their verified status and become harder to trust across Cloudflare’s network. ## Continuous Detection with Precursor - Precursor is a client-side system that continuously analyzes behavior throughout a session. - Its JavaScript is injected at the CDN, so customers do not need to manually place or rerun detection code. - Unlike CAPTCHAs and other one-time challenges, Precursor evaluates behavior in context over multiple pages. - Continuous analysis makes it more expensive for bot developers to imitate human behavior across an entire session. ## What Cloudflare Has Observed - In a 24-hour snapshot, Precursor processed **206 million evaluation events across 73,438 zones**. - Suspicious behavior frequently begins in the middle of a session, meaning point-in-time checks can miss it. - A single session may shift between human and automated behavior, such as when a user hands part of a shopping journey to an agent. - Site owners therefore need classifications based on use case, purpose, and data usage rather than a simple human-versus-bot decision. ## Understanding Human Cursor Behavior - **Precursor Trace** is an interactive demonstration of part of Precursor’s detection process. - It examines cursor acceleration, corrections, rhythm, and movement texture. - The demo illustrates how behavioral signals can distinguish natural interaction from automated movement. ## Adaptive Intelligence - Cloudflare indicates that its bot detection engines will soon provide more adaptive outcomes for requests identified as automated. - The excerpt ends before detailing how this upcoming capability will work. Website owners should treat automation as a spectrum: verify transparent actors, monitor behavior continuously, and make decisions based on trust, intent, and use case rather than isolated signals.

Read original

Behavioral Analysis AI Agents Cloudflare JavaScript+3

cloudflareJul 13, 20263 min readCurated summary

Introducing Precursor: detecting agentic behavior with continuous client-side signals

Precursor is Cloudflare’s new client-side, session-based system for detecting bots and agentic automation through continuous behavioral signals. Unlike one-time challenges, it evaluates interactions across an entire user journey, making automation harder to imitate while reducing friction for legitimate users. It complements Turnstile by extending behavioral detection beyond sensitive checkpoints such as login, signup, and checkout. ## The Visibility Gap in Bot Detection - Cloudflare analyzes more than 1 trillion requests daily across over 20% of the web. - Turnstile runs nearly 3 billion times per day and provides risk-based verification at important application endpoints. - However, point-in-time challenges offer limited insight into how users and bots behave throughout the rest of a session. - Precursor addresses this gap by continuously observing interactions across an application. ## Why Session Behavior Matters - Modern bots can execute JavaScript, operate real browsers, and pass individual CAPTCHAs. - Sustaining believable behavior over a complete session is substantially more difficult. - Precursor uses accumulated behavioral signals to improve detection precision. - This can reduce unnecessary challenges for legitimate users while increasing the cost and complexity of bot operations. ## Human and Automated Interaction Patterns - Human mouse movement reflects physical and cognitive constraints: - Wrist and forearm movement produce curved paths. - Clicking involves a delay after seeing an interface element. - Hand tremors create subtle physiological oscillations. - Automated interactions often reveal: - Straight-line movement or mathematically ideal curves. - Unusually precise clicks. - Repeated velocities, origins, timing, and movement rhythms. - Individual actions may appear plausible, but patterns across a full session can expose automation. ## How Precursor Works ### Injection and Data Collection - Cloudflare dynamically injects a compact, obfuscated JavaScript bundle into HTML responses passing through its network. - No additional configuration, third-party embedding, or network connection is required. - The script observes signals such as: - Pointer movement - Keyboard timing and activity - Focus changes - Page visibility - Events are serialized, buffered in memory, and periodically sent for analysis. ### Edge-Side Evaluation - Cloudflare deserializes the incoming data and runs multiple evaluators against the behavioral streams. - Evaluators cross-reference signals to identify inconsistencies. - Examples include checking whether: - Pointer activity matches page visibility duration. - Keyboard events occur while a text field is focused. - The results are consolidated into detection signals that influence bot scoring. ### Session Integration - Signals accumulate across the session rather than resetting with a page refresh or new challenge. - Session metadata also supports: - Shadow-mode heuristics - Session analysis - Predicted-versus-actual completion comparisons - Session delinquency heuristics - These observations help improve detection and adjust a session’s bot score. ## Privacy by Design - Precursor collects only information considered necessary for detecting automation and abuse. - Keyboard behavior is recorded as timing and rhythm, not the actual keys pressed. - Signals are evaluated as aggregate behavioral patterns. - Data is used internally by Cloudflare’s detection systems and is not exposed in customer dashboards or linked to accounts, identities, or persistent profiles. ## Session-Based Analytics - Cloudflare is introducing session-oriented views in Security Analytics alongside Precursor. - These views shift analysis from isolated requests to complete visitor journeys. - The provided article excerpt ends while beginning to describe these dashboards. Precursor is best understood as a complement to Turnstile: continuous, privacy-conscious session analysis can detect automation that passes individual challenges while reducing reliance on aggressive interruptions for genuine users.

Read original

Behavioral Analysis JavaScript Bot Management Bot Detection+3

googleApr 3, 20263 min readCurated summary

Evaluating alignment of behavioral dispositions in LLMs

The post introduces a framework for evaluating whether LLM behavior aligns with human behavioral tendencies in realistic social and workplace situations. Instead of relying on self-report questionnaires, it converts validated psychological traits into situational judgment tests and compares model responses with judgments from human annotators. Across 25 models, larger systems align better when humans strongly agree, but models remain overconfident and often fail to represent legitimate human disagreement. ## From Psychological Self-Reports to Situational Tests - The researchers adapt statements from established instruments measuring traits such as empathy, emotion regulation, and assertiveness. - Because LLM self-reports can vary with prompt wording and may not predict real behavior, the statements are transformed into realistic user-assistant scenarios. - Each scenario presents two possible actions: - One expressing or supporting a behavioral trait. - One opposing or suppressing it. - Three annotators review each generated test to ensure the scenario and actions accurately represent the intended trait. - Models respond naturally, and an LLM judge maps each response to one of the two actions. - Human preferences are collected from 10 annotators per scenario, drawn from a pool of 550 participants. ## Measuring Directional Alignment - Directional alignment measures whether a model gives greater probability to the action favored by the human majority. - The analysis focuses on scenarios with strong human consensus: - Unanimous agreement: 10 of 10 annotators. - Very high agreement: 9 or 10. - High agreement: 8 or 9. - Smaller models, particularly those under 25 billion parameters, often perform near chance and struggle to distinguish when a trait should be expressed or restrained. - Larger models over 120 billion parameters and frontier closed-weight models perform substantially better. - These models approach near-perfect alignment when human agreement is unanimous, but performance generally plateaus in the low-to-mid 80% range when consensus is weaker. - Qualitative deviations included: - Encouraging emotional openness in professional situations where humans preferred composure. - Favoring harmony in disputes instead of standing up for one’s position. - Recommending immediate action in time-sensitive situations without sufficient logistical verification. ## Representing Human Disagreement - The study also evaluates distributional alignment: whether model confidence reflects the diversity of human opinions. - When human annotators disagree, a well-aligned model should distribute its probability more evenly between the available actions. - The results show systematic model overconfidence across all 25 evaluated systems. - Models tend to favor one action too strongly even when human preferences are divided, indicating that they often fail to preserve pluralism in human judgment. ## Broader Implications - The framework distinguishes two types of alignment gaps: - Directional gaps, where models choose differently from a clear human majority. - Distributional gaps, where models fail to reflect uncertainty or disagreement among people. - The findings suggest that scale improves behavioral alignment but does not fully solve nuanced social judgment. - Evaluating behavior in realistic scenarios may reveal limitations that conventional personality questionnaires or direct model self-reports miss. Future alignment work should assess not only whether models choose the human-majority response, but also whether their confidence and range of responses appropriately reflect genuine variation in human perspectives.

Read original

Behavioral Analysis Large Language Models Situational Judgment Tests Psychological Questionnaires+4

discordMar 17, 20263 min readCurated summary

How ROOST is Advancing Online Safety

Discord argues that online safety should be built through shared, open-source infrastructure rather than isolated corporate systems. Its donated rules engine, Osprey, lets platforms detect suspicious behavior and harmful activity in real time, while ROOST develops and maintains tools for broad industry adoption. Early adoption, including by Bluesky, suggests this model can raise baseline safety standards across the internet. ## The Need for Shared Safety Tools - Nearly 100 million people use Discord daily, generating hundreds of millions of events that must be evaluated for threats. - Generative AI has increased the scale and sophistication of phishing, deepfakes, and coordinated abuse. - Smaller platforms often lack the resources to build effective trust-and-safety systems from scratch. - ROOST aims to make proven safety technologies open, shared, and auditable. ## How Osprey Works - Osprey is a real-time rules engine for event processing and behavioral analysis. - It can evaluate logins, messages, account creation, content posts, and platform-specific actions. - Safety teams write rules in a simple language and deploy them without engineering dependencies. - The engine produces transparent decisions indicating whether activity is safe, suspicious, or malicious. - Discord runs thousands of rules across hundreds of action types. - Investigation findings feed new rules, while enforcement generates additional signals for future detection. - The open-source release is based on Discord’s production system rather than a reduced version; improvements from ROOST were later reintegrated into Discord. ## ROOST’s Collaborative Model - ROOST builds on earlier cross-industry efforts such as image hashing for child-safety work, the Tech Coalition’s Lantern program, GIFCT incident response, and shared ISO safety standards. - Unlike organizations that primarily steward open-source projects, ROOST also develops and maintains a suite of public-interest safety tools. - Its projects include Osprey and Coop, a comprehensive review tool. - Open-source tools can raise the minimum level of protection available to smaller platforms and reduce the spread of threats across services. - The model also enables companies to build managed services around free tools, similar to businesses built around Linux. ## Adoption and Industry Impact - Musubi announced a managed Coop offering, while Zentropi integrated its labeling engine with Coop. - Osprey v1 was introduced at FOSDEM, prompting collaboration among engineers from multiple organizations and protocols. - Platforms such as Bluesky are already using Osprey. - More than 360 million users across participating platforms are now covered by open-source safety tooling. - ROOST continues development through public contributor and adopter working-group meetings held every two weeks. ROOST’s approach suggests that open, production-grade safety infrastructure can help platforms respond faster to emerging threats while creating a shared foundation for industry-wide improvement.

Read original

Behavioral Analysis Generative AI Open Source Trust And Safety+4