Preventing cheating in remote exams isn't a single technology problem. It's a layered security challenge that spans identity verification, environment control, behavioural monitoring, and post-exam review.
Here's how ProctorEdge approaches each layer.
Layer 1: Identity Before the Exam Begins
The most fundamental integrity question is: is this the person who enrolled?
ProctorEdge answers it before the first question appears. The candidate onboarding flow requires:
- Government ID capture — the candidate photographs their ID document in-session
- Live face match — our CV model confirms the live camera feed matches the ID photo
- Room scan — the candidate rotates their camera to show the exam environment: no second monitors, no prohibited materials, no other people
This sequence creates a verified identity record that persists through the session. If the candidate is replaced mid-exam (an increasingly rare but real concern), the subsequent face-match checks will flag the discrepancy.
Layer 2: Browser Lockdown
Screen-based cheating — switching to a browser tab with answers, opening a PDF of notes, messaging a helper — is prevented by our browser extension layer.
The extension:
- Detects tab switches and raises an immediate violation alert
- Monitors clipboard activity to catch copy-paste behaviour
- Blocks screen sharing to prevent forwarding questions to an external collaborator in real time
- Detects developer tools being opened (used in some technical cheating scenarios)
Some ProctorEdge exam configurations also enable full browser lockdown mode, which prevents any application outside the exam interface from receiving focus.
Layer 3: AI Vision Analysis
This is the layer that handles what a human eye might miss across hundreds of concurrent sessions.
Our AI Detection service processes video frames from the candidate's webcam and applies two primary models:
Object Detection (YOLOv8)
Trained to identify objects in the camera frame: people, smartphones, tablets, laptops, printed materials, earphones. A second person walking into frame, a phone placed on the desk, a second screen visible in the background — these are flagged with confidence scores and timestamped clips.
The model runs at 1–2 frames per second during active sessions, with higher sampling rates triggered by motion events. This keeps processing costs reasonable while ensuring suspicious moments aren't missed.
Facial Analysis (MediaPipe)
Tracks facial landmarks to monitor:
- Gaze direction — where is the candidate looking? Sustained off-screen gaze, especially correlated with answer selections, is a meaningful signal
- Head pose — a candidate consistently looking down and to the right at regular intervals shows a pattern different from someone thinking
- Presence continuity — face disappearing from frame triggers alerts; face-swap attempts raise higher-severity flags
Ensemble Scoring
Individual model outputs feed into a severity scoring system. A single low-confidence gaze anomaly is noise. A pattern of off-screen gaze plus a detected second device plus a tab switch in a 5-minute window is a high-severity cluster. The ensemble approach reduces false positives while catching genuine integrity concerns.
Layer 4: Human Review
Nothing in ProctorEdge triggers an automatic disqualification. Every violation flag routes to a human reviewer — the institution's administrator or proctor.
The review interface shows:
- The timestamped clip from the violation event
- The detection model that raised the flag and its confidence score
- The candidate's full session context (how long they'd been in the exam, their prior behaviour)
- A severity assessment and recommended action
The human reviewer makes the integrity determination. The AI provides evidence; the administrator makes the decision.
Layer 5: Post-Exam Analytics
After the session closes, ProctorEdge generates:
- A violation summary listing all flagged events with clip references
- A session integrity score aggregating the severity and frequency of violations
- A comparison against cohort baseline — was this candidate's behaviour notably different from others in the same exam?
Institutions can set automated review triggers: any session with a violation score above a threshold goes into a review queue automatically, rather than requiring manual triage of thousands of clean sessions.
What the System Can't Catch
Honest disclosure matters here.
Analogue cheating — a physical textbook held below the camera frame — is harder to detect than device-based cheating. Our room scan requirement reduces the risk, but it's not foolproof.
Well-prepared substitution — if someone presents a very accurate fake ID and the live face match is defeated — is a real risk for the highest-stakes exams. For those, additional verification layers (biometric liveness detection, institution-registered photos) provide additional coverage.
Sophisticated technical circumvention — feeding a pre-recorded video loop to the camera, for instance — requires significant technical knowledge and equipment. Our detection models include liveness checks that catch common versions of this, but a highly motivated and technically capable actor is never a zero-risk scenario.
The honest answer is: no exam security system is unconditional. ProctorEdge raises the bar significantly — it makes cheating difficult, evidence-generating when it occurs, and not worth the effort for the vast majority of candidates.
That's the right goal. Perfect is the enemy of good enough to protect credential integrity at scale.
If you'd like to see the detection system in action, request a demo and we'll walk through a live session with you.