What Does Corroboration Mean in Bot Detection?

Corroboration in bot detection means using two or more independent indicators to confirm whether a user is human or automated before making a blocking decision. A single odd signal — a mismatched graphics fingerprint, a too-fast click, a suspicious port — is kept as evidence, not a verdict. The system cross-checks that signal against unrelated data from the browser, network, device, and behavior layers, then feeds the combined pattern into an AI model that weighs the whole picture.

What Corroboration Means in Practice

In everyday terms, corroboration is the difference between "this looks weird, block it" and "this looks weird, let me check three other independent things before I decide." BotRefund runs 106 independent checks. Each check adds one objective fact about the visit. No single check triggers a block. Instead, the platform tests whether other signals support the same story, then lets an AI model evaluate the complete pattern across browser, network, device, and behavior evidence.

This approach directly addresses a core problem: privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. Treating any single anomaly as proof of automation would generate false positives. Corroboration keeps the signal as evidence and requires convergence before acting.

Why Single Signals Fail

A lone anomaly is not a bot verdict. The source material repeats this principle across every signal page: WebGL Texture Constraint, Impossible Tab Speed, Suspicious Ports, and window.open Tamper all state explicitly that "a single anomaly is not a bot verdict." Real users on VPNs, corporate proxies, or uncommon hardware regularly trigger individual checks. A headless browser might spoof a user-agent perfectly but fail on WebGL texture limits. A residential proxy might hide the IP but leak timing inconsistencies in tab switching. Each gap is a clue; none is a conclusion.

This is why the industry has moved away from rule-based blocking. Simple rules — "block if WebGL vendor string mismatches" — catch real users on new devices or privacy-hardened browsers. Corroboration replaces the binary rule with a weighted pattern.

The Three-Layer Verification Process

Every signal passes through the same three-step pipeline, described identically across BotRefund's signal pages:

1. Independent evidence — The check adds one objective fact about the visit. For example, the WebGL Texture Constraint check looks for a mismatch that a real browsing session does not normally create.
2. Cross-checked context — The system tests whether other signals support the same story. It compares browser, network, device, and behavior data independently.
3. AI prediction — The model weighs the complete pattern instead of trusting a raw rule. By seeing how all signals fit together, it identifies a visit as bot or human with 99% accuracy.

This pipeline is the operational definition of corroboration: evidence → cross-check → weighted decision.

Types of Independent Evidence Used

Corroboration works because the evidence comes from fundamentally different layers. The source pack groups checks into four categories:

• Hardware & GPU fingerprinting — WebGL texture constraints, renderer strings, canvas fingerprints. These reveal the actual graphics stack.
• Biometric & behavioral interactions — Impossible tab speed, window.open tamper, mouse tremor, click timing, scroll patterns. These capture human motor variability.
• Network, VPN & geolocation evading vectors — Suspicious ports, proxy signatures, IP-to-timezone consistency, TLS fingerprint alignment.
• Browser integrity checks — JavaScript engine mismatches, automation property leaks, extension fingerprints, cookie behavior.

Each layer is independently spoofable, but spoofing all layers consistently without leaving contradictions is extremely difficult. That asymmetry is what corroboration exploits.

How Cross-Checking Works

Cross-checking means testing whether independent signals tell a coherent story. A visitor claiming to be a Chrome user on Windows 10 with an NVIDIA GPU should show: matching WebGL renderer, consistent canvas fingerprint, typical mouse micro-movements, plausible tab-switch timing, residential IP in the claimed timezone, and a TLS fingerprint that matches Chrome's cipher suite order. If the WebGL texture constraint fails but every other signal aligns, the system treats it as an outlier — perhaps a rare driver version — not a bot. If the WebGL fails, the tab speed is impossible, the mouse moves in perfect lines, and the IP is a data center range, the convergence of independent failures drives the AI prediction toward "bot."

The key is independence. Checks within the same layer (e.g., two WebGL parameters) can be spoofed together. Checks across layers require the attacker to control hardware, network, and behavior simultaneously.

AI Prediction and Pattern Weighing

The final step is not a rule engine. The AI model evaluates the complete picture across browser, network, device, and behavior evidence. It assigns weights based on how predictive each signal combination has proven to be. A rare hardware mismatch might carry little weight if behavioral signals are strongly human. A common hardware match might carry little weight if behavioral signals are strongly synthetic. The model learns these interactions from labeled data, not from hardcoded thresholds.

This is why BotRefund states "accuracy comes from corroboration, not one browser tell." The 99% accuracy claim rests on the model's ability to weigh the full pattern, not on any single check's precision.

Key Facts

Fact	Detail	Source
Number of independent checks	106	S1
Core principle	"A single anomaly is not a bot verdict"	S1, S3, S6, S7
Verification pipeline	Independent evidence → Cross-checked context → AI prediction	S1, S3, S6, S7
Evidence layers	Browser, network, device, behavior	S1
Stated accuracy	99% via corroborated pattern weighing	S1, S3, S6, S7
False-positive guards	Privacy tools, travel, corporate networks, unusual devices explicitly acknowledged	S1, S3, S6, S7
Refund capability	Proves bot clicks, negotiates with Google and Meta, recovers spend back to 2017	S2, S5
Case study result	FinTrust recovered $140,000, 14% average bot click rate, +18% conversion rate	S4

Limitations and When This Approach Doesn't Apply

Corroboration-based detection assumes the attacker cannot perfectly simulate all layers simultaneously. Sophisticated adversaries with access to real device farms, residential proxy networks, and behavioral replay tools can reduce the signal gap. The system also depends on the quality and diversity of its training data for the AI model; novel attack patterns may initially evade detection until the model updates.

For very low-traffic sites, the volume of signals may be insufficient for reliable pattern weighing. For applications requiring deterministic, explainable decisions (e.g., regulatory compliance), a probabilistic AI verdict may need a rules-based overlay. The source pack does not specify model retraining frequency, explainability features, or on-premise deployment options.

Common Misconceptions

• "More checks = better detection" — Only if checks are independent. 106 correlated checks add little over 10 independent ones.
• "Corroboration means consensus" — It means convergence of independent evidence, not majority vote. One strong behavioral signal can outweigh several weak hardware signals.
• "99% accuracy means 1% false positives" — Accuracy is a composite metric. False positive and false negative rates depend on traffic mix and threshold tuning.
• "This replaces WAFs or CAPTCHAs" — Corroboration is a detection layer. Enforcement (challenge, block, log) is a separate decision.

FAQ

How many independent signals are needed before a decision?

There is no fixed number. The AI model weighs the complete pattern. A visit with three strongly contradictory signals may be classified as bot; a visit with one mild anomaly and 20 consistent signals stays human. The system does not use a threshold count.

Can a sophisticated bot farm bypass corroboration?

Sophisticated farms using real devices, residential proxies, and behavioral replay can narrow the gap. Corroboration raises the cost and complexity of a convincing spoof but does not make it impossible. Continuous model updates and new signal layers are the countermeasure.

Does corroboration slow down page loads?

The source pack states setup takes "about one minute" and mentions "fast setup" as a feature. Client-side signal collection runs asynchronously. The AI evaluation occurs server-side. No specific latency figures are provided.

What happens when signals conflict — e.g., hardware looks real but behavior looks synthetic?

The AI model weighs the conflict based on historical predictive value. Strong behavioral anomalies (impossible tab speed, zero mouse tremor, superhuman click speed) typically outweigh hardware consistency because behavior is harder to spoof at scale across sessions.

Can I see which signals triggered a verdict?

The source pack describes "audit-ready refund dispute reports" and "client-side behavioral proof logs" for ad platform disputes. It does not specify a per-visit signal breakdown dashboard for customers.

Is corroboration only for ad fraud, or does it apply to account takeover, scraping, and carding?

The source pack focuses on ad click fraud (Google and Meta refunds). The same corroboration architecture applies to any automated threat, but the signal weights and training labels would differ. The pack does not document non-ad-fraud use cases.

How often is the AI model updated?

Not specified in the source pack. Model freshness matters for novel attack patterns; ask the vendor about retraining cadence and how new signals are integrated.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• Bot detection: how it works and how to bypass it
• Bot detection 101: How to detect bots In 2025? - The Castle blog
• Understanding Bot Detection and Its Techniques | Indusface

Learn more

Visit the website for more information.