Abstract
Field Computer-implemented systems for detecting recurrence of previously remediated employee knowledge deficits. This publication describes an approach that uses behavioral feature vectors derived from user interaction patterns rather than semantic embeddings derived from natural language text. Background After an employee completes remediation for a knowledge deficit, organizations need to determine whether the same deficit comes back during subsequent work. One established approach compares dense semantic embeddings of text communications against stored vector fingerprints using cosine similarity. The approach described here operates on a fundamentally different input type: behavioral interaction patterns encoded as feature vectors, not semantic representations of language. Technical Description When remediation is completed, the system begins collecting behavioral interaction data from the employee's work sessions. Each session is encoded into a 128-dimension feature vector capturing: action frequency counts per action type, sequential ordering of actions (encoded as n-gram frequencies over the action sequence), dwell times per UI element category, decision branching ratios at choice points, and error-correction event counts. The encoding process works as follows. The system captures a raw event stream of (timestamp, action_type, target_element, duration) tuples during each work session. A feature extraction module computes the 128-dimension vector by concatenating: 32 dimensions for action-type frequency histogram, 32 dimensions for bigram transition probabilities between action types, 32 dimensions for dwell-time distribution statistics (mean, variance, skewness, kurtosis per element category), 16 dimensions for branching ratios at decision points, and 16 dimensions for correction event rates per workflow stage. A baseline embedding is computed post-remediation by averaging the feature vectors across M sessions (default M = 10) collected during the first two weeks after remediation completion. This baseline represents the employee's healthy behavioral pattern in the relevant domain. For each subsequent session, the system computes a drift score: drift = 1 minus the cosine similarity between the current session's feature vector and the stored baseline vector. A rolling average of drift scores is maintained over a window of K consecutive sessions (default K = 5). Recurrence is flagged when the rolling average drift exceeds a configurable threshold T (default T = 0.25) sustained for at least two consecutive evaluation windows. When triggered, the system generates a recurrence record containing: employee_id, baseline_vector_hash, drift_scores_array, detection_timestamp, and session_ids contributing to the detection. If the monitoring period expires without the drift threshold being exceeded, the system logs a non-recurrence determination with the full drift score history. Distinguishing Characteristics This system operates on behavioral feature vectors constructed from action logs, not on semantic embeddings generated from natural language text. No language model processes any input. No text is embedded. The feature vectors represent patterns of actions (what the employee did and how they did it), not the meaning of communications (what the employee said). The system compares against a single behavioral baseline, not simultaneously against both a gap fingerprint and a remediation fingerprint. There is no forgetting-curve decay function modulating any threshold over time. The threshold is fixed.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
Davis, Kenneth, "Behavioral Feature Vector Drift Detection for Post-Remediation Knowledge Deficit Recurrence Monitoring", Technical Disclosure Commons, (March 25, 2026)
https://www.tdcommons.org/dpubs_series/9636