How Online Proctoring Tools Detect Cheating in 2026
Proctoring tools detect cheating across three layers: behavior (eye, head, voice patterns), environment (other devices, multiple faces), and machine state (running processes, network activity). Knowing the layer matters because each tool emphasizes different ones.
Behavior detection: ML models classify gaze, head pose, and voice patterns from webcam/mic streams. Environment detection: room scans pre-exam, plus continuous webcam to spot phones, second monitors, or extra people. Machine-state detection: enumerate processes, count displays, check for VMs, scan installed Chrome extensions. Each proctor weights the layers differently - Honorlock leans on environment + behavior; Respondus leans on machine state + recording. The LDBypass overlay is invisible only to the screen-capture portion of the machine-state layer; behavior and environment detection are unchanged by its use.
Key points
- Behavior: gaze, head pose, voice, typing pattern.
- Environment: room scan, webcam, mic, room ambient noise.
- Machine state: processes, displays, VMs, extensions, screen capture.
- LDBypass affects only the screen-capture portion.
- Behavior + environment detection still operates normally.
Common questions
Which detection layer is hardest to evade?
Behavior (especially audio) is the hardest. Cameras pointed at you see what you do regardless of what is on screen.
What does the LDBypass overlay actually defeat?
Screen capture: the overlay window is missing from any frame the proctor records. Other layers (camera, audio, processes) operate normally.
Are there layers we did not list?
Network analysis (some proctors check for unusual outbound traffic), keystroke timing (some check typing patterns), and integrity attestation (limited adoption) round out the surface.