AI text detectors answer one question: how likely is it that a machine produced this passage? Every commercial tool, from Turnitin to GPTZero to Originality.ai, is a statistical classifier making a probabilistic guess. None of them detects AI the way a spectrometer detects lead. They detect statistical patterns that AI text tends to have, and those patterns overlap heavily with patterns that certain humans produce, which is why the tools fail in predictable and well-documented ways.
The failure record is not anecdotal. In the largest independent evaluation to date, Weber-Wulff and colleagues tested 14 detection tools and found that not one exceeded 80 percent accuracy. Their published conclusion was that the tools are “neither accurate nor reliable.” Stanford researchers led by Weixin Liang found that seven widely used detectors falsely flagged an average of 61.3 percent of essays written by real humans who learned English as a second language. OpenAI built its own classifier, measured it at a 26 percent detection rate with a 9 percent false positive rate, and shut it down in July 2023 citing low accuracy.
This article explains the three mechanisms detectors actually use, walks through the peer-reviewed evidence on where each one breaks, and covers the mathematical argument that reliable detection may be impossible as language models improve. If you are a student, a teacher, an editor, or anyone whose work gets run through these tools, the mechanics matter, because the errors are not random. They fall on specific people.
The three mechanisms behind every detector
Strip away the marketing and there are only three technical approaches to detecting machine-written text: statistical scoring, trained classification, and watermarking. Every product on the market is one of these, or a blend of the first two.
Perplexity and burstiness
The oldest approach measures how predictable a text is to a language model. Perplexity is the standard metric. A detector runs its own language model over your text, token by token, and asks at each step: given everything so far, how surprised is the model by the next word? Low surprise across the whole document means low perplexity, and low perplexity is treated as evidence of machine authorship, because language models generate text by repeatedly sampling words they themselves rate as likely. A model’s output is, almost by construction, text that a similar model finds unsurprising. If tokenization is unfamiliar territory, our explainer on how LLM tokenization actually works covers the units these probability scores are computed over.
GPTZero, built by Edward Tian in 2023, popularized a second signal it calls burstiness: the variance in perplexity across sentences. Human writing tends to alternate between plain sentences and odd, surprising ones. Early ChatGPT output held a steadier rhythm. Flat variance therefore counted as machine evidence.
The mechanism explains the failure mode. Perplexity does not measure “written by a machine.” It measures “predictable to a language model.” Any human whose prose is simple, conventional, and grammatically safe will score low. That describes a large share of second-language writers, who draw on smaller vocabularies and stick to structures they trust. It also describes writers following rigid templates, such as lab reports and standardized-test essays. The signal and the demographic are confounded, and no threshold tuning can fully separate them.
A more sophisticated variant of the statistical approach deserves mention because it shows how far the idea can be pushed. DetectGPT, from Eric Mitchell and colleagues at Stanford, observed that machine-generated text tends to sit at a local maximum of a model’s probability function. Perturb a machine-written passage with small rewrites and the model rates almost every perturbation as less likely than the original. Perturb a human-written passage the same way and the likelihood moves in both directions, because human text does not sit on the model’s probability peaks. Measuring that curvature gives a zero-shot detector that needs no training data at all. It is a genuinely elegant idea, and it still inherits every weakness of the family: it needs access to a scoring model similar to the generator, it is expensive because each verdict requires dozens of perturbed rescores, and as the Krishna results discussed below show, a paraphraser collapses its accuracy like everything else.
Trained classifiers
The second approach dominates commercial tools today. Vendors assemble large corpora of human-written and machine-written text, then train a supervised classifier, typically a fine-tuned transformer, to separate the two. Turnitin, Originality.ai, Copyleaks, and Pangram all work this way. The classifier learns whatever features distinguish its training corpora: word frequencies, syntactic habits, punctuation rhythms, discourse patterns, and combinations no human could name.
This works well inside the training distribution and degrades outside it. A classifier trained mostly on GPT-3.5 output meets text from a newer model, or from a model prompted to write informally, or from a human whose style resembles the machine corpus, and its decision boundary lands in the wrong place. The RAID benchmark, presented at ACL 2024 by Liam Dugan and colleagues, tested detectors across 11 generators, multiple decoding strategies, and 11 adversarial attacks, and found that detectors which look strong on their home distribution lose substantial accuracy when the generator, the sampling temperature, or even the use of repetition penalties changes.
Vendors have responded with better training. Pangram’s technical report describes hard negative mining, in which the training loop actively hunts for human texts the model misclassifies, including essays by second-language writers, and feeds them back as corrective examples. Pangram reports a 0 percent false positive rate on the Stanford TOEFL benchmark after holding those essays out of training. That is a vendor-reported number on 91 documents, not an independent audit, but the method is a real answer to a real defect, and it shows the bias was a data problem rather than a law of nature.
Watermarking
The third mechanism is different in kind. Instead of inspecting text after the fact, the model provider embeds a signal during generation. The scheme published by John Kirchenbauer and colleagues at the University of Maryland partitions the vocabulary into green and red lists at each generation step, seeded by preceding tokens, and softly boosts green-list words. A human never notices, but a detector that knows the seed can count green tokens and compute a statistical score that separates watermarked text from unwatermarked text with high confidence over a few hundred words.
Google DeepMind shipped a production version. SynthID-Text, published in Nature in October 2024 by Sumanth Dathathri and colleagues, uses a tournament-based sampling procedure and was evaluated in a live experiment across roughly 20 million Gemini responses, with the paper reporting no detectable loss in response quality. Watermarking is the only detection approach with a designed signal rather than an inferred one, and we covered the full family of schemes in our piece on how LLM watermarking embeds detection signals.
Its limits are structural. Watermarking requires the generator’s cooperation, so it covers only providers that opt in. Open-weight models can be run without any watermark at all. And the signal survives light editing but degrades under heavy paraphrasing, which turns out to be the universal solvent for this entire field.
What the independent evidence shows
Three studies from 2023 remain the evidentiary backbone of this debate, and nothing published since has overturned them.
The Weber-Wulff study, published in the International Journal for Educational Integrity, tested 14 tools including Turnitin, GPTZero, and OpenAI’s classifier against document sets covering human writing, raw AI output, AI output with manual edits, and machine-paraphrased AI output. No tool cleared 80 percent overall accuracy. The tools showed a bias toward calling text human-written, which sounds cautious until you notice what it means: they miss the machine text they exist to catch. Thirteen of the 14 produced false negatives on the edited AI documents, and none correctly classified all of the AI documents that had been paraphrased by machine. Accuracy on straightforward AI text was often barely above 50 percent for several tools.
The Stanford study by Liang and colleagues, published in Patterns, ran 91 TOEFL essays by non-native English speakers through seven commercial detectors. The average false positive rate was 61.3 percent. At least one detector flagged 97.8 percent of the essays. All seven detectors unanimously agreed that 19.8 percent of them, nearly one in five, were machine-written. Every single essay was written by a human. The same detectors classified essays by American eighth graders correctly almost every time. The asymmetry is exactly what the perplexity mechanism predicts: simpler vocabulary reads as machine output.
GPTZero published a rebuttal in October 2023 along with an updated model. According to Pangram’s independent rerun of the benchmark, the updated GPTZero model still produced a 7.7 percent false positive rate on those essays, or 1.1 percent if its softer “possible AI content” label is generously counted as a pass.
Then there is the vendor gap. Turnitin states that its document-level false positive rate is below 1 percent. Independent spot checks have repeatedly landed higher, and journalists testing small samples have found error rates far above the marketing figure. The honest summary is that nobody outside Turnitin has been able to reproduce sub-1-percent performance on adversarially realistic data, and the company’s own guidance now tells institutions not to treat the score as proof of misconduct. Vanderbilt University read the same evidence and disabled Turnitin’s AI detector entirely in August 2023, writing that the tool’s error profile made it unusable for disciplinary decisions.
Why the base rate turns small errors into mass accusations
Even a detector that met its marketing claims would generate a flood of false accusations, because of arithmetic that has nothing to do with machine learning. Suppose a university scans 10,000 essays. Suppose 5 percent were substantially machine-written, and the detector catches 80 percent of those with a false positive rate of just 1 percent. It flags 400 guilty essays and 95 innocent ones. Roughly one in five accused students did nothing wrong. Raise the false positive rate to the 2 percent that independent tests routinely find, and nearly one in three accusations is false. The 5 percent guess is also doing quiet work in that arithmetic. Nobody knows the true rate of machine-written coursework, though task-level usage data now puts rough bounds on the question, as we show in what Americans actually use AI for.
Now scale that across millions of first-year college students in the United States and add the demographic skew from the Stanford data. The students most likely to be falsely flagged are the students least equipped to fight an accusation: international students, second-language writers, and students at institutions that treat a percentage score as evidence. Accusations based on detector output began reaching federal courts in 2025 and 2026, with students suing universities over misconduct findings built on these scores, according to a litigation tracker that follows the cases. Dozens of universities have now dropped or disabled detectors rather than defend them.
The impossibility argument
The deepest problem is not engineering quality. It is a theorem-shaped argument about what detection can achieve at all.
Vinu Sankar Sadasivan and colleagues at the University of Maryland formalized it. The performance of any detector is bounded by the total variation distance between the distribution of human text and the distribution of machine text. As language models improve, that distance shrinks, because producing text distributed like human text is the literal training objective. In the limit, the best possible detector’s AUROC approaches 0.5, which is a coin flip. The bound applies to every detector that could ever be built, not just the ones that exist.
The same paper demonstrated two practical attacks. Recursive paraphrasing broke watermark detection and statistical detectors alike. And spoofing attacks ran the pipeline in reverse: an adversary can learn a watermark’s green-list bias well enough to compose human text that triggers the detector, framing an innocent author. Kalpesh Krishna and colleagues made the paraphrasing attack concrete with DIPPER, an 11-billion-parameter paraphraser that dropped DetectGPT’s detection accuracy from 70.3 percent to 4.6 percent at a fixed 1 percent false positive rate. Their proposed defense, retrieval against a database of everything the provider ever generated, works in principle but requires providers to store and search every output they have ever produced, which raises its own privacy problems. Those problems are not hypothetical, as we documented in our analysis of what models memorize and leak from their training sets.
There is a second, quieter limitation worth stating plainly. Detection is non-stationary. Every detector is trained against the models of its moment, and the models change under it. Fine-tuning, new decoding strategies, and post-training methods like RLHF, which we explained in our piece on how RLHF and Constitutional AI shape model behavior, all shift the output distribution that classifiers depend on. A detector is a snapshot of an arms race, sold as a measuring instrument. The one asymmetry detectors never get is access to the model’s internals, and the research program that does have that access is only beginning to cash it in, as we detail in our companion analysis of how researchers actually read an LLM’s mind.
What actually happens next
Three trajectories are visible in the evidence, and none of them is a better classifier.
First, provenance replaces inference where providers cooperate. SynthID is deployed in production, and watermarking plus content credentials gives platforms a way to label AI text at the source instead of guessing after the fact. Coverage is the weakness. A watermark regime only constrains people who use watermarked models, and open-weight models guarantee that determined evaders always have an exit. Watermarks will catch the casual case and miss the motivated one.
Second, institutions retreat from scores to process. The universities that dropped detectors did not stop caring about authorship. They moved to methods that do not depend on a classifier: oral defenses, versioned drafts, in-class writing, and assignments that require engagement with material a model cannot see. This is slower and more expensive than a dashboard percentage, which is precisely why the dashboard was attractive and why it failed.
Third, the legal system starts pricing the errors. A false accusation backed by a tool whose published false positive rate is contradicted by peer-reviewed testing is a liability problem, not just a pedagogy problem. The lawsuits now in progress will decide whether a detector score alone can carry a misconduct finding. The technical evidence summarized above suggests it should not, and the vendors’ own disclaimers increasingly agree.
For readers who still have to live with these tools, the evidence supports a few concrete rules. A detector score is a screening signal, comparable to a spam filter, and should trigger a conversation rather than a verdict. A single flagged document proves nothing, and the Weber-Wulff data shows that a clean score proves even less, since the tools miss edited machine text far more often than they catch it. Scores below a tool’s own stated confidence threshold should be discarded entirely. Any accusation should require independent evidence: draft history, version metadata, or a discussion of the work that the author can either sustain or cannot. And anyone accused on the basis of a percentage has a strong, citable, peer-reviewed record to point to, starting with the three studies above.
The honest engineering summary is this: AI text detection works as a weak prior and fails as evidence. The mechanisms are real, the signals exist, and on easy cases the tools are often right. But the same mechanisms guarantee specific, demographically skewed false positives, the accuracy ceiling drops as generators improve, and a motivated user defeats every deployed system with a paraphraser. Any policy that treats a detector score as proof is building on a foundation the underlying mathematics does not support.