Adding noise is the tell, not the disguise

We shipped noise twice, on two signals that share no code: the pixels a page reads back from a canvas, and the path the pointer takes to a button. Both times the noise did exactly what it promised, and both times it became the most legible thing about the browser. Scalebrowser now reports the honest canvas value, and its pointer paths are calibrated against 120 recorded people instead of shaken by a tremor model.

What did the canvas noise do?

It gave every profile its own canvas fingerprint by adding a small, deterministic offset to the pixels. Whenever a page read a canvas back, through getImageData, toDataURL, toBlob or WebGL's readPixels, every channel of every pixel moved by up to two values, seeded per profile. It is the same family of defence Brave ships as farbling, which Brave describes as "slightly randomizing the output of semi-identifying browser features, in a way that's difficult for websites to detect". On one machine, five test profiles produced five different canvas hashes.

How did the canvas noise give itself away?

The public checker at BrowserScan marked the canvas as manipulated and took points off the browser's score for it. A graphics card draws a flat region as one colour, and our offset put variation into every flat region on the page, so the value no longer looked like any device. The research agrees that this is a dead end: Nguyen and Vadrevu attacked the randomisation defences deployed in real browsers in Breaking the Shield (WWW 2025) and concluded that "no fully deployable defense against canvas fingerprinting attacks exists currently".

So we took it out on every readback surface: canvas, WebGL, WebGPU, measureText and audio all report what the device really produces. That has a cost, and we accept it on purpose: profiles on the same machine share one canvas fingerprint. A shared honest value is ordinary, because every machine with the same hardware and drivers reports it too. A manipulated value is unique in the way that gets a browser looked at.

What went wrong with the pointer?

The same thing, on an axis with nothing in common with graphics. Human hands shake, a synthetic straight line does not, so our input layer added a small tremor and a lateral wobble to every pointer path. On our behaviour bench the result reversed direction 4.5 times per 100 samples, where a person recorded on the same bench reversed 0.27 times: 17 times as often.

The reason is the same as for the canvas. Physiological tremor sits around 8 to 12 hertz at an amplitude far below one pixel, and Chromium delivers pointer events aligned to the display frame, at about 60 per second, so the tremor never reaches the page at all. Injecting it produces movement no real trace contains. Detection research found the same from the other side: in BeCAPTCHA-Mouse, synthetic trajectories from generators trained to fool a classifier were caught at high rates, and the authors conclude that "GAN generators introduce patterns that allow its detection".

What replaced the noise?

1. The tremor and the lateral wobble came out of the pointer path entirely.
2. Movement is modelled the way clean human pointing is described in the motor-control literature: a duration from Fitts' law, one large ballistic impulse that slightly overshoots, and a small correction back onto the target.
3. The targets come from the SapiMouse dataset, "mouse dynamics data from 120 subjects" recorded in the browser, and every change is measured against the middle 80 percent of those people.

Six of the eleven measures on the bench now sit inside the human band. Direction reversals are down from 4.5 but still above it, and they are one of the five measures we have not closed yet. The root of most of the rest is timing: our events arrive 27.5 milliseconds apart where people sit around 17. We publish that number because it is the next thing to fix, not because it is finished. The human input page of the documentation tracks the current state.

What should you take from this if you build your own stack?

Before you add randomness to hide a value, ask what the real distribution of that value looks like, and whether your randomness could ever produce it. A canvas nobody else has and a hand that trembles at a frequency no mouse delivers are both easier to spot than the value you started with. Measure against real people or real devices first, then change the generator until it lands inside their band.