GrayPass verifies identity from how users interact — reaction times, keystroke cadence, and optional gaze — without storing raw biometrics in plaintext.
Decision: accept on hash; else require fuzzy pass and probability ≥ threshold (tuned for FAR/FRR & EER).
Combining a deterministic, privacy-preserving salted brainprint with a calibrated learned embedding yields fast, tolerant, and discriminative authentication — while keeping users in control of their data.
Beyond the core loop
Baseline telemetry, replay-hardened schedules, and cancelable templates sit beside the runtime to make the architecture feel like a living system—not just a static diagram.
GrayPass keeps a continuous, encrypted replay loop that produces DET/EER curves, latency histograms, and per-session decision notes. Every anonymized record carries timing, distance, probability, and human-readable reason codes so we can audit the system without revealing private inputs.
Before a sensitive attempt, GrayPass issues a signed schedule—think shuffled Stroop cues with jittered delays and cursor targets. The client renders exactly what the server dictates, streams fine-grained timestamps plus tab visibility, and the server scores adherence, variance, and micro-kinematics. If something smells scripted, we attach forensic reason codes to the denial.
Feature vectors are projected through per-user randomness, snapped to a deterministic grid, and wrapped in helper data. We store only the helper and a template hash—so if anything leaks, a rotation just swaps the seed and template reference while the brainprint stays private.