Neural Network-Based Cheating Detection for CoMas

CoMas is the proctoring tool Carleton University uses for online exams. It takes periodic screenshots of each student's desktop, and all of them are reviewed by hand. One assessment can produce thousands of images, so review is slow and inconsistent between reviewers. This project builds a screening layer that ranks screenshots by how likely they are to show cheating, so a proctor looks at the most suspicious ones first instead of all of them. The system detects two things: whether an AI coding assistant (GitHub Copilot or Cursor) is open in Visual Studio Code, and whether a student has left their Brightspace quiz. The main finding is that these two need different methods. A chat panel and a quiz page can both be identified from on-screen text, so a keyword rule over OCR handles them accurately. Inline ghost text, the dimmed code an assistant suggests at the cursor, contains no distinctive words and is invisible to OCR. On real screenshots an OCR-only detector found only 3 of 14. Detecting ghost text needs a visual model, so a ResNet50 was fine-tuned using transfer learning from ImageNet. Real CoMas screenshots could not be obtained, so training data was generated synthetically, including hard negatives that place a non-assistant panel where a chat panel would be, so the model cannot simply learn that a panel on the right means cheating. The most important result is a negative one. Seven trained models were tested on both synthetic images and 27 real screenshots, and the two rankings disagreed: the model that scored best on synthetic data (0.999 AUROC) was one of the worst on real screenshots (0.786), and a model that ranked near the bottom on synthetic data came out near the top on real ones (0.901). Testing on synthetic data alone did not just make the results look better than they were, it picked the wrong model. The version that shipped uses tiled inference at native resolution, which was rejected on synthetic evidence and only chosen after testing on real screenshots. It finds 11 of 14 real ghost-text screenshots with 1 false positive out of 13, compared with 3 of 14 for OCR alone. The deliverable is a desktop application that scores a folder of screenshots and presents a ranked review queue and an evidence export suitable for an academic integrity case.