How AI Text Detectors Actually Work

A piece of writing goes in, a number comes out. Most people assume the tool behind that number works like a plagiarism checker, scanning a database, matching phrases, catching a machine in the act of repeating itself. That assumption is wrong. Detectors don't read for meaning, and they don't compare a submission against any archive of known sentences. What they produce is a probability score, generated by measuring how statistically predictable the writing is to a machine learning model trained on labeled examples of human and AI text.

The distinction matters because it changes what the score actually means. A detector isn't asking "did a machine write this?" in any direct sense. It's asking "how closely does the statistical shape of this text resemble the shape of text a language model tends to produce?" Those are different questions, and the gap between them is where most of the controversy around these tools lives.

GPTZero, one of the earliest and most widely used detectors, illustrates how quickly the underlying method has had to change. It built its original reputation on two specific statistical signals, and by the fall of 2023, its own technical documentation describes an architecture that no longer relies directly on either one. Something about those original signals stopped being sufficient on their own; the next section picks up what replaced them and why the field moved in that direction.

How detectors moved from two metrics to deep-learning classifiers

The two foundational signals are perplexity and burstiness, and perplexity measures how surprised a reference language model is by each word choice in a piece of text. Burstiness measures how much that surprise varies from one sentence to the next. AI-generated text tends to score low on both, since a language model samples high-probability tokens at a steady clip rather than reaching for the unexpected word. YouScan's 2026 explainer offers a clean illustration: given the prompt "the hiker went out into the," a model will reliably complete the sentence with "woods," a low-perplexity, high-probability ending.

Those two metrics were the industry's starting point, but they weren't where it stayed. The leading commercial detectors have since moved to deep-learning classifiers, typically fine-tuned transformer models such as RoBERTa or DeBERTa, trained on millions of labeled human and AI passages. Rather than relying on a single measurement, a classifier learns combinations of features that no individual metric captures on its own. Compilatio's September 2026 explainer describes the model as learning "patterns, linguistic habits, and structural clues that are more common in AI outputs," a broader net than perplexity and burstiness alone ever cast.

In practice, that net includes vocabulary diversity, average sentence length, punctuation habits, and overall stylistic consistency, the practical levers Coursera's August 2026 update identifies as what feature extraction actually isolates. Some systems go a step further and add embedding-based comparison, converting a document into numerical vectors that capture its meaning and comparing that semantic shape against known AI output.

GPTZero has built explainability into this architecture as a stated design goal, flagging sentence-level AI probability rather than issuing a single opaque score for an entire document, a choice it frames as consistent with OECD and UNESCO guidance on AI transparency. That kind of granularity makes detectors feel more rigorous, and in a narrow sense, it is. But sophistication in method doesn't guarantee reliability in outcome. Every new AI model release shifts the statistical patterns these classifiers were trained to recognize, which forces retraining on a rolling basis. YouScan describes detectors as generally losing this race, chasing a moving target that redraws itself with each model update. The next section takes up why that race is unwinnable by design, not just difficult. It's unwinnable by design.

Why detection errors resist training fixes

Detectors fail in a specific, structural way. Predictable, low-variance writing isn't a signature unique to AI. Formulaic academic prose reads that way. Legal writing reads that way. So does careful, heavily edited human writing, and so does English produced by a non-native speaker following the rules they were taught. Every one of these categories produces the same low-perplexity, low-burstiness statistical shape that classifiers are trained to associate with machine generation.

A study titled "GPT detectors are biased against non-native English writers," cited by YouScan as "the dirty secret of perplexity-based detection," documents that low-perplexity human text gets flagged disproportionately. Writers composing in a second language tend to choose safer, more common words and simpler sentence constructions, the same low-perplexity choices a language model makes, and get flagged disproportionately as a result.

OpenAI's own experience offers a stark, well-resourced demonstration of the ceiling this creates. The company built and released an AI Classifier, then discontinued it in July 2023, citing its low rate of accuracy. If any organization had the data, the engineering talent, and the incentive to make detection work reliably, it was the maker of the models the classifier was meant to catch. It didn't work well enough to keep running.

The errors run in both directions. Human-written content that happens to be uniform, formal, or produced by a non-native speaker gets flagged as machine-generated, a false positive with real consequences for a student or professional wrongly accused. Meanwhile, AI-generated text that's been revised by a human, or generated with deliberate stylistic variation, slips through as a false negative. Grammarly's March 2026 update notes that short passages, mixed AI-human editing, and creative or unconventional writing styles all degrade detector performance in this way.

The problem compounds as the models being detected get better. Post-2024 AI systems vary rhythm and sentence structure on purpose, which has weakened burstiness as a reliable signal, and YouScan notes that "burstiness alone isn't the gotcha it used to be". Classifier-based systems face a version of the same ceiling from a different angle. Their accuracy depends on the specific detector, the type of text being evaluated, the editing history of the document, the language it's written in, and the threshold the tool is set to flag at. There's no single accuracy number that describes how well these tools work, only probabilities that shift depending on context.

Even the vocabulary flagged as a giveaway illustrates the same fragility. Words like "realm," "illuminate," "delve into," and "at its core," along with an overuse of em dashes, show up often enough in AI output that Coursera's update lists them as common triggers. The method breaks down at exactly the point where it needs to hold.

Watermarking as a structurally different approach

Watermarking plants a verifiable signal into the text at the moment of generation, rather than inferring authorship from style after the fact. The model biases its word choices according to a secret, key-dependent statistical pattern, choosing between near-equivalent words in a way invisible to a human reader but detectable to anyone holding the key. Detection here measures a planted signal directly rather than inferring authorship from resemblance to a training distribution, which makes it considerably more reliable than stylometric inference when the watermark survives intact.

That "when" carries weight. Light editing or a run through a paraphrasing tool blurs or erases the signal entirely, YouScan's explainer notes. Watermarking solves the reliability problem for text that reaches a reader in its original, unedited form.

Deployment has moved from experimental to operational over the past two years. Google introduced SynthID-Text in a 2024 paper, marking the first production deployment of generative text watermarking inside Gemini, and followed with a SynthID-based detector rollout in May 2026, though access to the SynthID Detector portal remains gated to journalists and researchers rather than open to the public. Anthropic announced in August 2026 that Claude would begin watermarking its output, with any model released on or after August 2, 2026 covered immediately and older models brought into compliance by December 2, 2026.

OpenAI took a different path. OpenAI stated in 2024 that it had built a watermarking system for ChatGPT but opted not to deploy it, citing concerns about false positives for non-native English speakers and the risk of users switching to competitors. An earlier GPTZero technical account characterized watermarking as "not yet a reliable or industry-standard solution". The developments since then, Anthropic's commitment and the regulatory deadlines now in force, have moved watermarking well past that earlier state of uncertainty.

Regulation, more than voluntary adoption, is what's driving the shift. The EU AI Act became applicable on August 2, 2026, and requires providers of generative AI systems placed on the market from that date forward to mark their outputs in a machine-readable format detectable as artificially generated. Providers with systems already on the market before that date have until December 2, 2026 to comply. China moved earlier still, requiring both explicit and implicit labeling of AI-generated content since September 2025. Watermarking has stopped being a design choice a company can weigh against user experience and market positioning. For providers operating in either jurisdiction, it's now a legal obligation.

A parallel forensic track is developing alongside watermarking: research into model fingerprinting, active as of 2026 (arXiv:2605.29245), aims to identify which specific model produced a given piece of text by examining implicit identity signals across datasets and outputs, without needing the model's cooperation the way a watermark does. That extends the detection surface beyond providers who opt in.

Watermarking offers something classifiers never could: a real signal instead of an inference. But that signal only exists where a provider chooses, or is required, to embed it, and only survives where the text isn't touched afterward. Evasion research has already found the seams in that second condition, and increasingly in the first.

How evasion research has outpaced detection

The gap between what evades detection and what catches it hasn't been closing. It's been widening, and the pace at which it's widening is the more urgent finding. Research published in 2026 found that so-called "humanizer" tools could push a large share of AI-generated rewrites past detection entirely, and competitive benchmark results from the same period show just how much ground evasion techniques gained in a single year.

The clearest evidence comes from the ELOQUENT/PAN Voight-Kampff shared task, a competition that pits evasion systems directly against a panel of detectors. In the 2024 CLEF competition edition, the best-system fool rate against the detector panel was 0.049, a very low evasion success rate. A year later, the 2025 edition saw that number jump to 0.654, a roughly thirteenfold increase in a single competition cycle.

That leap wasn't the product of some breakthrough in model training or fine-tuning. It came from two prompting-side recipes, techniques anyone could apply without retraining or fine-tuning anything. One combined Hindi back-translation with an explicit instruction to the model to "be imperfect." The other recipe rotated a passage through nine different languages before returning it. Neither recipe touches model weights. Both work by pushing generated text away from the tight statistical center a detector was trained to recognize, and the fact that prompt-level tricks alone produced a thirteenfold jump in evasion success says something uncomfortable about how thin the detection margin really is.

A 2026 study out of the University of Technology Sydney (arXiv:2607.13565) explains the mechanism at work, showing why the explanation matters more than the headline number. Durable evasion operates through register shift: pushing a generation's style outside the distribution the detector was trained on. Pulling a generation into the training distribution, the more familiar evasion tactic of direct paraphrase, does not survive contact with an adversarially fine-tuned detector, which learns to see through that kind of superficial change fairly easily. Cross-decade style attacks (writing in a register borrowed from a different era of prose) work precisely because they land outside anything the detector has ever been trained to flag. That's what makes register-shift attacks structurally durable rather than a temporary trick that the next training cycle patches out.

Lighter-touch human editing accomplishes something similar by a cruder route. It adds back burstiness and perplexity variation, the very irregularity classifiers are trained to treat as evidence of human authorship, letting revised AI text slip past stylometric detectors that were never built to catch a hybrid. Paraphrasing tools built specifically to defeat AI checkers work reliably against these detectors for the same reason.

How single-model AI writing infrastructure produces catchable text

None of this changes a more basic fact about why raw, single-model AI output gets caught in the first place. It defaults to the statistical average of one model's training distribution: consistent in tone, predictable in token choice, and largely absent of a specific personal or opinionated point of view. That combination is exactly the signal detectors are built to find.

Left without deliberate voice inputs, a language model produces the statistical average of everything it was trained on, generic copy that could have come from anyone and therefore reads as though it came from no one in particular. A brand-voice guide found that a majority of consumers say they can identify AI-written content on sight, and the giveaway they cite most often isn't a telltale phrase or a suspicious em dash. It's the absence of a specific, personal, or opinionated perspective. That's a harder problem for a single model to solve than swapping out a few flagged words, because it's baked into what a single model, trained on one distribution, is structurally suited to produce.

An adversarial multi-model approach is built to close that gap, working at the architecture level rather than the editing level. When a piece of writing is drafted, then critiqued, then revised across several models trained on different distributions, the resulting text stops carrying any single model's statistical fingerprint cleanly. That is the underlying premise behind writing kernel architectures such as the ones Letterwrite builds, where adversarial councils of models produce output that converges through genuine iteration rather than settling by default into the smoothed-over average one model would produce alone.