Position Paper
TeacherAware
Wave-0 Complete
Provenance, Not Detection
Why the AI-cheating problem is unwinnable as a detection problem and solved as a provenance problem — and what a working implementation looks like.
Aaron Kushner · Citizen Scientist Series · 2026-07
1. The detection dead end
Two-thirds of American students use AI for schoolwork. The tools built to catch them — humanizers, drip-typers, autotypers, agentic browsers that type for you — have crossed the threshold where "did this text come from AI?" is no longer operationally answerable. Even the vendors selling detection concede the race is a dead end: every improvement in the detector funds an improvement in the evader. Meanwhile the false positives land on honest students, disproportionately multilingual writers, and every accusation without evidence corrodes a classroom.
Schools have responded by retreating — oral exams, pen-and-paper, no take-home writing. That retreat abandons the slow, iterative practice that take-home work exists to build, and it abandons AI literacy in the same stroke, two years before those students need it professionally.
2. Change the question
A finished document cannot testify about its own origins. The composition process can. TeacherAware moves the question from "does this text look AI-generated?" — a judgment about a static artifact, losing — to "here is exactly how this text came to exist" — a record of a process, winnable, because the record is made while the process happens.
Students compose inside a sanctioned workspace. Every keystroke, paste, and citation placement is hashed into a tamper-evident chain as it happens; the running chain root is witnessed by the server during composition, so a session fabricated afterward cannot reproduce the roots the witness already stamped. At submission the server independently replays the whole chain. The work arrives carrying its own evidence.
3. The threat ladder, and the defense that climbs it
Each rung of cheating tooling meets a specific, mostly deterministic countermeasure:
| Attack | Defense |
|---|
| Paste AI text / "humanized" text | The chain records the paste as a paste, with source classification. No detector needed — the event is simply visible. |
| Autotyper injects keystrokes while the student steps away | Deterministic absence detection: text produced while nobody is on camera is flagged, localized to the exact seconds it happened. |
| Transcribing from a phone or second device | Gaze awareness: eyes sustained off-screen while text is produced. Calibrated to each student's own rest position in the opening seconds of a session, so a low camera or a tilted head is baseline, not evidence. |
| AI assistant open in another window | Whole-screen capture (window/tab shares are rejected) with a two-stage review: stage 1 sees the AI window; stage 2 judges whether it was actually used — typed query, rendered response — and whether what it produced is about this assignment. |
| Human-cadence drip tools (the irreducible) | Keystroke-rhythm analysis today; a stylometric backstop on the roadmap — comparing the submission against the student's own corpus of previously proctored work, the one signal a perfect drip can't forge. |
The architecture is an escalation ladder, not a dragnet: a cheap deterministic pass watches every session locally; the expensive AI review runs only on the moments the cheap pass flagged. A clean session never calls a model at all — which is both a cost property (a ten-hour essay costs the same as a ten-minute one) and a values property (nobody re-reviews a student who did nothing).
4. The privacy objection, answered structurally
Proctoring software has a deserved reputation problem. The answer is not a privacy policy; it is architecture that makes the abuses impossible:
- Webcam frames are background-blurred at capture — the bedroom behind the student is never recorded.
- Frames live encrypted in memory under a non-extractable session key, hash-sealed into the ledger. On a clean pass they are destroyed. Nobody — vendor included — can re-watch a clean session, because it no longer exists.
- The permanent record is a frame-free timeline of events: "eyes off-screen 10s at 2:14 PM," never video.
- Students under 13 never use the webcam. The screen tier alone still defeats most of the ladder.
- The system opens by telling the student how to stay clean — a close-your-AI-windows nudge before capture ever starts. Advisory posture throughout: every output is evidence for a human teacher, never a verdict.
5. What this restores
With provenance in place, the teacher can assign take-home writing again — the assignment the AI era supposedly killed. The teacher can also sanction AI where it belongs: the same environment that records unauthorized AI use can host an authorized, constitutionally-constrained writing collaborator, used in the open, on the record. Integrity infrastructure and AI-literacy infrastructure turn out to be the same infrastructure.
This is not a proposal. The workspace, the chain, the citation library, the escalating proctor, and the teacher dashboard are running code as of July 2026 — the companion spec sheet inventories every shipped feature, and the go-to-market brief maps who it's for and how it reaches them.
[OK here's some stuff i wrote: The point is not to make cheating impossible. it's never been impossible, even before AI. It's just right now, the incentive structure is reversed. it used to be difficult and risky, now it's easy and undetectable. You snooze, you lose. So the point is to remedy that, to re-reverse it, to make it exponentially more difficult to cheat than it is now.]
[like this from http://localhost:8600/human-author-provenance/paper/index.aaron-v1.claude.html: (with this quote and citation: "I watched a freshman I knew sign the declaration that he'd done his homework without A.I. as ChatGPT was still open in the next window"[2]
— Theo Baker, Stanford senior, The New York Times, May 17, 2026. In April 2026, Stanford reinstated in-person proctored exams after a century-long ban — abandoning an honor system that AI had made structurally untenable.) Large language models can now write — and write convincingly. A user can generate a plausible manuscript with minimal creative input, or produce text in the style of a real author and attribute it to them. The technology is a remarkable invention; it is also, for publishing, a genuine credibility problem. Post-hoc detection tools have emerged to address this, and they do useful work — but they operate probabilistically, are sensitive to writing style and native language, and cannot be made reliable — the error rate is a structural property, not an engineering problem to be solved. More fundamentally: the author owns none of it. The detector is someone else's black box. Its verdict is someone else's output. If your work is flagged, you have no record of your own, no counter-evidence, no standing. They answer a question about the output — and they answer it unreliably. Detection cannot see inside the writing session, and attest to what the actual process was. It can only guess from the finished page.
Things have now escalated substantially to the point where the entire ecosystem of authorship and attribution is imploding, and fast. The previous attempts to solve the problem, based on detection, are fighting a losing battle in an arms race they cannot win. AI was born to simulate a human. Any author can easily purchase tools from opportunistic adversarial entrepreneurs who correctly see an economic opportunity, regardless of the ethics or morality considerations, and without considering the impacts on honest authors and the entire economic and creative ecosystem. AI also gives such an entrepreneur the ability to engineer and update these products without years of technical training, in almost real time. Barring some breakthrough in AI contribution detection, a completely new approach may be needed.
We present TeacherAware, the solution
--I like the conciseness of this document... so maybe this is a document package, with the front-page this language and citation... or really this: http://localhost:8600/human-author-provenance/paper/index.aaron-v1.claude.html but just with the problem b, with teacheraware work surface as the embed and the product playground, with buttons so you can see each of the workspaces, which also changes the description in the figure, and the architecture figure changed to teacheraware and with the last pills after github changed to reflect this case, instead of publisher, author, it's teacher/school and student, otherwise the same i think it works fine. no trust tiers section, and no future directions, that's all well described in the docs you made (which we are still revising, see all the brackets. ]