Assessment validity is the new security perimeter

For two decades, the take-home essay and the coding take-home quietly carried the credentialing economy. They were cheap, scalable, and assumed to be valid. The assumption was simple enough to be invisible: the submission is the submitter’s work. Generative AI broke that assumption — not as a policy violation but as a structural fact — and the field’s response has been to reach for the one control it already had lying around: surveillance. That control is the wrong control. It doesn’t work at its stated purpose, and it actively harms the learners the system is supposed to credential fairly. This is not a cheating problem. It’s a validity problem, and the right way to see it is as a security-engineering problem: assessment validity is the new security perimeter.

The collapse nobody named correctly

The dominant framing in education technology is “AI cheating.” That framing is wrong, and the wrongness matters because it determines the control you reach for. Cheating is a behavior; validity is a property of the measurement instrument. What collapsed in late 2022 was not that students started misbehaving. What collapsed was that the artifact — the essay, the take-home code, the reflection paper — stopped being evidence of the skill it was used to measure.

Before the collapse, an essay was a passable proxy for a cluster of skills: reading comprehension, argument construction, synthesis, revision. The proxy held because producing a coherent essay required doing the underlying work. After the collapse, the artifact can be produced without the skill. The essay still exists as a file. It is still graded. It may still be excellent. But the inference from “this essay is good” to “this person can write a good essay” is now false, and it is false in a way that cannot be patched by better detection. There is no reliable detector, and even if there were, the arms race would continue to erode validity faster than detection can restore it.

This is the thing EdTech mostly refuses to say out loud: the measurement instrument stopped measuring what it claimed. You can’t fix that with a policy update. You can’t fix it by asking students to certify they didn’t use AI. You can only fix it by changing what counts as evidence — or by accepting that the credential means less than it did. Most institutions are doing the second thing quietly and calling it something else.

Why proctoring is the wrong control

Having lost artifact-level validity, the field reached for the only available re-assertion of the submission-submitter binding: watch the person while they work. Remote proctoring — webcam, eye-tracking, browser lockdown, room scans — became the default patch. It is a security-engineering category error.

The binding that proctoring tries to preserve is “the submitter is the doer.” That is an authentication problem. The security-engineering answer to authentication problems is not to watch the user more closely. We learned this in the 1990s. You solve authentication with cryptographic primitives and trusted custody of credentials, not with a camera pointed at someone’s face. Watching the user is what you do when you’ve failed to design the system to produce verifiable evidence. It is the control you reach for when you’ve given up on the instrument.

Worse, it doesn’t even work on its own terms. The USENIX security community has documented bypasses for every major remote proctoring suite: virtual cameras that inject a synthesized feed, second-device workflows that the lockdown browser can’t see, prompt-injection and escape techniques against the lockdown browser itself, and the structural inability of eye-tracking to distinguish anxiety-driven gaze patterns from suspicious behavior. The proctoring vendors iterate; the bypasses iterate faster because the attacker’s surface is enormous and the defender’s is a thin client. This is not a bug list. It’s the steady-state of a system designed to surveil a commodity endpoint it does not control.

And the surveillance imposes a documented bias tax. Neurodivergent learners, disabled learners, and learners from certain demographic groups are flagged at disproportionate rates — not because they cheat more, but because the heuristics are calibrated to a narrow behavioral baseline. Stimming, atypical gaze, assistive-device use, dark skin tones under bad lighting, room conditions in shared housing — all of these trip the model. We wrote about this at length in The proctoring bias tax, and the short version is this: a control that flags the population you’re trying to credential fairly is not a neutral control that happens to have edge cases. It is a control that is structurally incompatible with the credentialing goal.

So proctoring is simultaneously ineffective at its stated purpose and actively harmful to a population the system owes fair treatment. If this were a security product in any other domain, it would have been deprecated. In EdTech it is the default.

Reframe: the perimeter is the evidence

Here is the reframe. In a credentialing system, the thing you are protecting is a binding: this credential attests that this person demonstrated this skill. That binding has two custody points. The first is the issuer’s signing key — if anyone can mint the credential, the credential means nothing. We wrote about that in Why we didn’t use a blockchain, and the conclusion was that the issuer key’s custody is the real trust anchor, not the ledger it’s written to.

The second custody point — the one the field almost entirely ignores — is the evidence. The credential is trustworthy only if it is signed by a custody-rooted issuer over evidence that itself has a provenance chain. If the evidence is forgeable, the issuer’s signature attests to nothing. Generative AI made the second custody point forgeable at industrial scale. That is the actual breach. Proctoring tries to patch it by watching. The correct response is to design evidence that has structural provenance.

What does evidence with structural provenance look like? Process artifacts: the version history of a piece of code, the revision trail of a document, the draft-to-final diff. In-process observation: assessment that happens while the work is being done, not after. Multi-modal verification: a learner explaining their own architecture decisions, live or asynchronously, in a way that ties to the artifact. Work-based evidence: artifacts produced inside a controlled environment where the doing is observed, not just the submission. These are the controls that make a credential an attestation of doing rather than of producing a file. We mapped where this sits in the overall system in The credentialing trust stack — it’s the assessment layer, and it’s the layer generative AI actually broke.

The perimeter moved. It used to be “stop cheating during the exam.” Now it’s “prove the evidence is genuine.” Those are different problems, and they have different controls. The first is a policing problem; the second is a custody problem.

The security-engineering reframe

Stop treating assessment integrity as a policing problem and treat it as a custody problem. This is the move that connects the two halves of the trust stack.

In credentialing, custody of the issuer key is what makes the credential trustworthy — not the ledger, not the blockchain, not the format. Custody means the key is held by an entity whose authority to issue is verifiable and whose ability to issue is protected. We didn’t use a blockchain because the blockchain doesn’t solve custody; it solves replication, which is a different and easier problem.

The parallel at the assessment layer is exact. Custody of the evidence is what makes the assessment trustworthy — not the proctor, not the lockdown browser, not the detection model. Custody here means the evidence is produced and held in a way whose provenance is verifiable — the doing is observed in-process, the artifact’s history is intact, the link between learner and work is structural, not attested after the fact. Proctoring’s fundamental architectural flaw is that it observes the person during a window and then infers that the artifact produced in that window belongs to them. The observation and the artifact are coupled only by temporal coincidence and camera angle. Evidence-first design inverts this: the artifact carries its own history, the process of its creation is captured as part of the work, and the learner’s relationship to the work is established through the mechanics of production, not through a separate surveillance layer bolted on afterward. The provenance is built in. You don’t watch someone take a test and then trust the test; you design the assessment so the work itself is the evidence of doing.

This reframes the entire security-engineering question. Assessment integrity is not a policing problem. It is a custody problem. Policing — proctoring, detection, behavioral surveillance — scales badly and predictably: every new adversarial technique demands a new countermeasure, every countermeasure imposes a new compliance and bias burden, and the population being policed pays the cost in friction, dignity, and access. Custody — evidence provenance, process capture, structural binding of learner to work — scales as infrastructure. It is neutral to learner identity. It does not care whether you are neurodivergent, whether your lighting is poor, whether your face conforms to the detector’s training set. The right analogy is authentication itself. We stopped authenticating users by watching them type and started authenticating them through cryptography and trusted custody of credentials. The assessment field has not yet made this move. It is still stationing a guard behind every user, squinting at their hands.

That move has a budget attached to it. Organizations currently spend enormously on proctoring tooling — webcam surveillance, browser lockdown, identity verification suites, AI behavioral detection — in a category that is documented to be bypassable, documented to impose a bias tax, and structurally incapable of solving the problem it was purchased to solve. That budget is the trust budget, and it is mis-allocated to the wrong control. Reallocating it from surveillance to evidence-capture — in-process assessment design, tooling that records work history, AI-validated work products that generate non-forgeable provenance, human observation embedded in the learning process rather than imposed at the testing gate — is the move. Not a moral argument. A resource-allocation argument. You are buying guards for a door that is no longer the perimeter.

I want to be honest about the trade-offs, because this is where the position needs to be precise rather than rhetorical. Evidence-first assessment is harder to design than a proctored exam. It requires assessment literacy that most institutions have not invested in — authentic tasks, scaffolded process capture, rubrics that evaluate work history not just final artifact, faculty who can interpret process evidence. It does not scale as cheaply as a multiple-choice exam delivered to ten thousand learners through a learning management system. Some of it requires human attention to process, and that attention is finite. Infrastructure for evidence capture — versioned workspaces, recorded interaction logs, in-tool observation — is real engineering, not a configuration toggle. And there are high-stakes summative contexts — licensure, certain professional certifications, contexts where the downstream consequence of a false credential is severe and immediate — where some form of verified presence may still have a legitimate, narrow role. The claim is not that verified presence has zero role. The claim is that proctoring as the primary control — the load-bearing wall of assessment integrity — is the error. It is the wrong structure bearing the wrong load. Presence verification is a supplement to evidence custody, not a substitute for it. Say so plainly: if your integrity model depends on watching the learner rather than capturing the work, your integrity model is a camera pointed at a problem it cannot see.

The field is treating a perimeter breach by hiring more guards at the wrong door. The breach is forgeable evidence. The door being guarded is the testing session. The actual perimeter — the evidence itself, its provenance, its binding to the person who produced it — has moved, and the field has not followed. Surveillance does not secure a perimeter; it monitors one that was already assumed. When the assumption collapses, the monitoring is theater.

Build the evidence’s custody, or accept that the credential means less than it did before generative model access became ambient. Those are the options. There is no third door. Assessment validity is the new security perimeter, and surveillance is not a perimeter.