How Cipher works
How Surbee scores response quality and detects survey fraud.
Cipher is Surbee's response quality and fraud detection engine. Every response to a Surbee survey is scored automatically, so you can trust your data without manually reviewing each submission.
Cipher combines four kinds of evidence:
- Behavior. How the respondent moved, typed, scrolled, and paused.
- Device and network. Browser fingerprint, automation flags, VPN, proxy, and datacenter signals.
- Content. Whether open answers look human, original, and consistent.
- Coordination. Whether many responses look like the same actor or a fraud ring.
The risk score
Each response receives a Cipher risk score from 0 to 1, where higher means more suspicious. Responses at or above 0.5 are flagged and surfaced in the dashboard (and in your Slack channel, if connected). Every flagged response carries a list of reasons so you know why.
You stay in control
Cipher recommends, it does not delete. Flagged responses are still collected. You decide whether to keep, review, or discard them.
What Cipher can tell you about a response
A score on its own is not very convincing. For every response, Cipher also turns the raw signals into a few plain-language observations, so you see not just that a response is trusted or flagged but why. For example:
- "Answered on an iPhone, held in hand, with natural typing and one fast answer on Q2."
- "Pasted a long answer into the feedback question and switched tabs twice."
- "Desktop, steady mouse movement, consistent answers, no quality concerns."
Each response shows the two or three signals that moved its score the most, and you can open any response to see the full breakdown, question by question. The same plain-language treatment works on desktop and on mobile.
On phones and tablets
A phone has no mouse and no keyboard, so Cipher does not pretend to grade one as if it did. On a touch device it streams a different set of signals, including touch pressure, swipe shape, and the device's own motion, and scores the response on those. See Cipher on phones and tablets.
Detection tiers
Cipher runs in tiers. Higher tiers add more checks and cost more credits, so you can match depth to how much fraud risk a study carries.
| Tier | Focus | Example checks |
|---|---|---|
| 1 | Timing and basic behavior | Rapid completion, uniform timing, low interaction, straight lining, minimal effort |
| 2 | Device and automation | WebDriver detected, automation flags, missing plugins, suspicious user agent, paste behavior |
| 3 | Advanced behavior and basic AI | Robotic typing, mouse teleporting, tab switching, basic AI content, contradictions |
| 4 | Network and content quality | Hover and scroll patterns, VPN and datacenter IPs, plagiarism, semantic analysis |
| 5 | Full AI and fraud rings | Full AI content analysis, answer sharing, coordinated timing, device sharing, Tor and proxy detection |
What gets checked
Some of the signals Cipher looks at:
- Timing. Completion that is impossibly fast, suspiciously uniform per question, or accelerating toward the end.
- Interaction. Too few mouse movements, keystrokes, or clicks for a real attempt.
- Typing. Robotic keystroke rhythm, no corrections, heavy pasting.
- Answers. Straight lining (the same option repeatedly), low answer entropy, duplicated or near duplicate responses.
- Automation. WebDriver and headless browser flags, missing plugins, anomalous screen size.
- Network. VPN, proxy, Tor, datacenter IPs, and timezone mismatches.
- Content. AI generated open text, plagiarism, and answers that contradict each other.
- Coordination. Shared devices, shared answers, and synchronized timing across responses (fraud rings).
Cipher keeps learning
Cipher is not a fixed rulebook. Every scored response becomes labeled training data: a machine-learning model learns from the real responses your surveys collect — and from the verdicts you give when you confirm or reject a flagged response — and is retrained on a schedule. A new model only goes live if it genuinely scores better than the one before it, and when it does, it rolls out to every survey automatically.
This holds on every device. Desktop and mobile responses feed the same loop, device class and all, so the model gets better at telling a real person from a bot on a phone exactly as it does on a laptop. See Cipher on phones and tablets for the step-by-step.
Using Cipher
- Inside Surbee. Cipher runs automatically on every published survey. Turn it on or off, pick a tier, and override individual checks in the survey's Cipher settings.
- From your own app. Use the Cipher API and SDK to score responses you collect anywhere. See Cipher SDK and API.