What it is
Network-layer proctoring enforces exam integrity by controlling which destinations the candidate's device is permitted to reach during a session, rather than by policing a single browser window or observing the candidate with a camera.
Why it matters
Every modern cheating vector, including overlays, remote-access tools, proxy services, and cloud AI calls, travels on the network, so the network path is the only enforcement surface where no single vector can hide.
How Aiseptor implements it
Aiseptor is the reference implementation of this category: the candidate device operates inside a deterministic, short-lived enclave whose reachable destinations are whitelisted by the exam policy and nothing else.
Definition
Canonical definition
Network-layer proctoring is an architectural approach to exam integrity in which enforcement is applied to the candidate device's network path rather than to a specific application. A session-scoped policy defines the set of destinations the device is allowed to reach; everything else, including overlay backends, cloud language models, remote-control tunnels, unauthorized cloud storage, and proxy-ring infrastructure, is unreachable for the duration of the assessment. The approach replaces the detection-based model of legacy proctoring (observe the candidate, infer misconduct) with a prevention-based model (constrain the device, observe that the constraints held). Because the controls apply regardless of which process initiates a request, network-layer proctoring is structurally resistant to process renaming, binary obfuscation, and the continuous churn of new cheating tools. It is also the only layer where every distinct cheating vector converges: an invisible overlay, an on-device LLM with a cloud fallback, a proxy-ring remote-access session, and a second-device lookup all eventually need to move data somewhere off the exam, and the network path is the one surface none of them can avoid.
In practice
A concrete example
Consider two candidates sitting the same take-home coding assessment. One has a browser extension quietly calling a cloud AI API to suggest completions; the other has renamed a Cluely fork to look like a system utility so it doesn't appear suspicious in a process list. An application-layer or process-scanning defense has to identify each of these individually, and misses both if either is new or renamed. A network-layer policy doesn't need to know either tool exists: it only recognizes that neither the completion API nor the fork's inference backend is on the exam's approved-destination list, so both requests fail identically, regardless of what sent them or what they were called.
Citations
- [1]Aiseptor architecture whitepaper (public version) (2026)
- [2]Aiseptor provisional patent filing on ephemeral network enclaves (2026)