CoderPad Cheating Detection Explained (2026)

The Short Answer

CoderPad detects cheating through five overlapping layers — Focus Awareness for browser tab attention, paste event logging with external-source highlighting, full keystroke-level playback that interviewers can scrub through after the session, AI-driven webcam snapshot analysis on the async Screen product, and a probabilistic LLM-generated code classifier rolled into Screen in 2025. None of these layers run outside the browser tab where the CoderPad pad is loaded. CoderPad cannot see a second monitor that is not being screen-shared, a desktop application overlaid on the browser, or a separate device sitting next to the candidate. The detection surface is real, well-instrumented for what it covers, and structurally bounded by the browser sandbox.

How CoderPad Focus Awareness Actually Works

Focus Awareness is the feature candidates most often confuse with full screen surveillance. It is not. Focus Awareness listens for browser-level focus and blur events on the CoderPad tab and logs each transition with a timestamp. When the candidate clicks into another tab, switches to another application, brings up a notification, or moves to a different desktop, the CoderPad tab loses focus and the event fires.

The event flows to two places. During a live Interview session, it appears as a real-time signal in the interviewer's view, typically as a subtle indicator that the candidate has tabbed out. In post-session playback, the same event appears as an orange dot on the timeline, allowing the reviewer to see exactly when each focus loss occurred and how long it lasted. CoderPad does not capture what the candidate was looking at during the focus-loss window. That part of the observation is structurally outside the browser sandbox.

A focus-loss event log roughly resembles the structure below. The exact field names differ in CoderPad's internal schema, but the shape is representative of what shows up in the post-session export.

[
  { "ts": "2026-06-04T14:02:11Z", "type": "focus_lost", "dur_ms": 1840, "src": "tab_blur" },
  { "ts": "2026-06-04T14:02:13Z", "type": "focus_gained", "dur_ms": null },
  { "ts": "2026-06-04T14:08:42Z", "type": "paste", "size_chars": 312, "external": true },
  { "ts": "2026-06-04T14:08:43Z", "type": "edit_burst", "chars": 312, "ms": 180 },
  { "ts": "2026-06-04T14:14:07Z", "type": "focus_lost", "dur_ms": 31200, "src": "tab_blur" },
  { "ts": "2026-06-04T14:14:38Z", "type": "focus_gained", "dur_ms": null },
  { "ts": "2026-06-04T14:14:40Z", "type": "edit_burst", "chars": 642, "ms": 410 }
]

The pattern the reviewer is trained to spot is the one on lines four through seven: a 31-second focus loss immediately followed by a 642-character typing burst at 1500-plus characters per second. That sequence is the canonical fingerprint of an external lookup. The pattern on lines one through two — a sub-two-second focus blip — is normal background noise and is generally ignored.

Paste Tracking and the External-Source Highlight

CoderPad logs every paste event into the pad and tags whether the content originated from inside CoderPad or from an external source. External pastes are highlighted in yellow on the playback timeline, with a hover tooltip that displays "Code pasted." The reviewer can scrub to the exact moment of the paste, see what was pasted, and watch the keystrokes that surround it.

This is one of the most reliable layers of CoderPad's detection because the browser clipboard API gives the platform a clean, unambiguous signal: a paste event either happened or it did not. There is no probabilistic gray zone. The reviewer sees a binary tag and a content snapshot. The limitation is that paste tracking only fires when content actually crosses the clipboard into the pad. Content that is typed in manually — even content that was visible elsewhere first — does not trigger a paste event. This is the gap that turns paste tracking from a comprehensive AI-detection mechanism into one signal among several.

CoderPad's documentation in 2026 frames paste detection as evidence rather than verdict. A candidate pasting in their own previously-written boilerplate is a legitimate pattern. A candidate pasting in a 200-line function immediately after a focus loss is a different pattern. The same event type produces different interpretations depending on the surrounding context.

Playback Mode and the Keystroke-Level Audit Trail

CoderPad's most distinctive detection surface is full keystroke-level playback. Every character typed, deleted, pasted, or moved within the pad is recorded with a timestamp. After the interview ends, the reviewer can replay the session keystroke by keystroke, jump to specific moments via the timeline, and see paste events, focus losses, and code execution annotated on the playback bar.

This is more granular than what most candidates assume. Playback is not a screen recording of the candidate's whole machine — it is a recording of the pad's internal state machine. Every edit, every cursor move, every multi-cursor selection, every run of the code is in the log. A reviewer who is suspicious of a particular moment can scrub to that moment and see exactly how the code was constructed.

Playback is also what makes CoderPad's defensive posture against AI-assisted candidates viable even without a real-time classifier. A solution that arrives fully-formed in a single burst, with no exploratory edits, no false starts, and no debugging cycles, has a recognizable shape in playback. A solution built up incrementally by a candidate who understood the problem has a different shape. The artifact reveals the process.

The 2025 LLM Probabilistic Classifier

CoderPad added a probabilistic LLM-generated code classifier to the Screen product in 2025 and extended it into more of the Interview product through 2026. The classifier operates on the submitted code rather than on the keystroke stream, producing a confidence score for the hypothesis that the code was generated by a large language model.

The model looks at features that tend to differ between human and LLM output: variable naming consistency, comment style, idiomatic depth, structural symmetry, and certain canonical patterns that LLMs over-produce relative to human candidates. The output is a score, not a binary flag, and CoderPad presents it in the candidate report alongside the other integrity signals. The hiring company decides what threshold to act on.

This classifier is the layer that catches code that was typed in manually but written by an external model. The candidate avoided every paste event, the focus tracker logged nothing unusual, the playback looks like normal typing — but the code itself carries the structural fingerprint of LLM output, and the classifier scores it accordingly. This is a meaningful expansion of CoderPad's detection scope and one that closes a gap that existed in the 2023-2024 stack.

What Each CoderPad Product Detects

CoderPad ships two distinct products with overlapping but non-identical detection surfaces. Conflating them is a common candidate mistake. The matrix below summarizes published capabilities as of 2026.

CoderPad Screen, the asynchronous take-home or screening assessment, is where the automated stack does the heaviest lifting. The candidate completes the assessment without a live interviewer, so detection runs without human supervision and the classifier, webcam AI, paste log, and Focus Awareness signals are aggregated into a post-session report. CoderPad Interview is the live pair-programming environment, where automated signals supplement rather than replace the interviewer's real-time judgment. Drawing Mode is a sub-surface within Interview, used primarily for system design rounds where the interaction itself is the integrity signal.

What CoderPad Cannot Detect

The boundary of CoderPad's detection surface is the browser tab. Everything outside that tab is structurally outside the system's observation. This is the architectural reality of a web-based assessment platform, not a temporary gap that future versions will close.

Specifically, CoderPad cannot see applications running outside the browser, content rendered on a second monitor that is not being screen-shared, overlays drawn above the browser through OS-level compositing that bypass standard screen-capture surfaces, audio playing on the system, processes running in the background, a second device positioned next to the candidate's main machine, or any input that is not a keystroke or paste into the pad. CoderPad's own documentation acknowledges that it does not have system-level access to monitor external applications, browser history, or a second monitor.

This is the same architectural boundary that defines the invisible AI assistant category. Tools built as desktop applications that render outside the browser sit outside CoderPad's observation surface by design. The detection that remains is the structural fingerprint of the code in the classifier and any behavioral signal the interviewer can pick up over the video call.

There is one important caveat specific to Interview. When the interviewer requests a screen share, the browser-side share captures whatever the candidate selects — full screen, a single application window, or a browser tab. The contents of the shared surface are visible to the interviewer in real time and reviewable in the call recording afterwards. The screen-share content is not, however, ingested into CoderPad's automated detection layers. It is a human-observed channel, not a machine-analyzed one.

How False Positives Show Up in CoderPad

The detection stack produces false positives in recognizable patterns. The Focus Awareness signal flags any tab blur, including legitimate ones — switching to a problem statement on a separate tab, briefly checking documentation that the interviewer explicitly allowed, glancing at a Zoom chat. A nervous candidate with a habit of alt-tabbing can rack up a focus-loss count that, in isolation, looks alarming.

The paste classifier also produces false positives when candidates paste in their own boilerplate, reused setup code, or copied-and-modified snippets from a previous part of the same session. The external-paste highlight is binary; it does not distinguish between code copied from ChatGPT and code copied from the candidate's local notes.

The LLM classifier produces false positives most reliably on candidates who write very clean, idiomatic code in well-trodden patterns. A senior engineer writing Python with consistent naming, type hints, and concise list comprehensions can score high on a model trained against typical LLM output, because typical LLM output is, by construction, clean and idiomatic. This is the same dynamic discussed in why qualified candidates fail technical interviews — the signal that the detection system reads as suspicious is, in some cases, also the signal that the candidate is good.

What This Means for Candidates in 2026

The accurate model of CoderPad's detection is layered, browser-bounded, and uneven across the product line. Screen carries heavier automated detection than Interview. Interview puts more weight on the live interviewer than on the classifier. Drawing Mode functions mostly as a non-code reasoning surface where the interaction itself is the integrity signal.

Candidates often optimize against the wrong layer. Avoiding pastes does nothing against the LLM classifier on Screen. Avoiding tab switches does nothing against the playback shape analysis on Interview. Worrying about webcam snapshots while the real binding constraint is the interviewer's perception of fluency is a common misallocation. The effective risk profile is the joint distribution of all the layers, weighted by which product the candidate is sitting in front of.

For candidates running through a CoderPad-based loop as part of a broader remote technical interview process on Zoom or Google Meet, the binding constraint is almost always the live interviewer rather than the automated stack. The conversation, the reasoning, the ability to handle follow-up perturbations of the problem — these dominate the outcome. The automated signals contribute to the post-session writeup, but the in-session judgment is what closes the loop.

Closing Frame

CoderPad's 2026 cheating detection is a thoughtfully layered system within the constraints of a web-based platform. Focus Awareness is precise. Paste tracking is unambiguous. Playback is the most underrated detection layer in the stack because it preserves the full shape of the candidate's process. The LLM classifier added in 2025 closes the gap where typed-but-not-pasted AI output used to slip through. AI webcam analysis on Screen extends the surface beyond pure code signals.

Everything in the stack runs inside the browser tab. The boundary is structural, not provisional. Understanding which layer applies to which product, and which gaps are permanent rather than temporary, lets candidates form an accurate risk assessment rather than reacting to vendor marketing or forum speculation. Accuracy beats anxiety in both directions — overestimating the surveillance scope leads to under-prepared candidates avoiding the wrong things, and underestimating it leads to candidates blindsided by a signal they did not know existed.