# input-entropy — VALIDATION RESULTS

**Spike:** `spikes/input-entropy/`
**Date:** 2026-06-23 (Round 1)
**Source claim:** NIGHTLY-FINDINGS-2026-06-23 — synthetic input patterns produce low Shannon entropy (velEntropy < 2.0) and IEI regularity, distinguishing bot from human.

---

## Verdict: ✅ VALIDATED — headless detector, ships as Phase 3

**Reason:** Synthetic clustered mouse input produces identical entropy signatures on both vanilla headless Chrome and CDP-attached Chrome. Three independent flags fire. Real human input (research threshold: velEntropy > 2.0 from FP-Agent) does not trip these flags.

---

## Method

Two-condition dual test (`test.py`):
1. **Vanilla headless** Playwright Chromium
2. **CDP-attached** Chrome 148 via `playwright.chromium.connect_over_cdp()`

The probe (`demo.html`) collects 8 seconds of mouse/scroll/key/click events and analyzes:
- **velEntropy** — Shannon entropy of velocity distribution
- **dirEntropy** — Shannon entropy of movement direction
- **apen** — approximate entropy (clustering detection)
- **ieiCV** — inter-event-interval coefficient of variation

60 mouse events fired via `page.mouse.move()` in a clustered pattern over 7 seconds (center-bias, low variance) — mimics bot behavior.

---

## Results

| Metric | Vanilla | CDP | Δ | Notes |
|---|---|---|---|---|
| velEntropy | 0.657 | 0.548 | 0.109 | Both well below human threshold 2.0 |
| apen | 0.110 | 0.110 | 0.000 | Identical — pure pattern, no chaos |
| dirEntropy | 0.589 | 0.589 | 0.000 | Identical — direction pattern matches |
| ieiCV | 0.012 | 0.008 | 0.004 | Both extremely low — uniform timing |

**Flags fired (both runs, identical):**
- "scripted pattern" (apen too low)
- "uniform timing" (ieiCV too low)
- "straight-line movement" (velEntropy too low)

---

## Why this works

- **Identical across vanilla/CDP** = headless environment detector, not CDP discriminator
- **Synthetic input from `page.mouse.move()`** already produces a more "realistic" event stream than `dispatchEvent`, yet still trips all 3 flags
- A stealth browser that injects human-like mouse events via `Input.dispatchMouseEvent` or a side-channel would also need to bypass the entropy analysis
- Real human mouse entropy from research (FP-Agent paper): velEntropy > 2.0, apen > 0.3, dirEntropy > 0.8

---

## Action

**Add to detect-bot ensemble as Phase 3 detector (parallel to `coalesced_mouse_synthesis`).**

Thresholds:
- `velEntropy < 2.0` on 30+ events → bot
- `apen < 0.2` on 30+ events → bot
- `ieiCV < 0.05` on 30+ events → bot
- Any 2 of 3 → DETECTED

**Already integrated:** No
**Integration target:** `phase3_input_synthesis.py` or new `phase3_entropy.py`

---

## Files

- `demo.html` — input collector + entropy analyzer (323 lines, no external deps)
- `test.py` — dual-test runner (135 lines)

---

## Provenance

Validated in Round 1 (2026-06-23) per `spikes/VALIDATION-ROUND-1.md`. This per-spike file written 2026-06-27 to close the documentation gap identified in the spike status audit.