How AI text detectors actually work — and the three ways they break

What a detector is

Strip away the product pages and an AI text detector is one thing: a classifier that reads finished text and outputs a statistical guess about how that text was produced. It was not there when you wrote. It does not see your drafts, your keystrokes, or your version history. It sees the final string of words and asks: does this look more like the text in my "human" pile or my "AI" pile?

Everything good and everything broken about detectors follows from that one sentence. This article walks through how the guess is actually made — in the vendors' and researchers' own words — and then through the three structural ways it fails. Not bugs: structural properties, acknowledged by the people who build these systems.

The classic recipe: perplexity and burstiness

The first generation of detectors, and still the most explainable, scored two statistics. GPTZero — the tool that made these words famous — defined them in its own support documentation.

Perplexity is, in GPTZero's words, "a measure of how likely an AI model would have chosen the exact same set of words as found in the document." A language model writes by repeatedly picking probable next words, so text a model finds highly predictable — low perplexity — looks machine-made, while surprising word choices look human. GPTZero even published a working threshold: "generally, a perplexity above 85 is more likely than not from a human source."

Burstiness is "a measure of how much the perplexity varies over the entire document." Human writing runs hot and cold — a plain sentence, then a strange one, fragments, a long wandering clause. Early model output was uniform. Per GPTZero, "greater burstiness tends to indicate that the document is more human-like," though it concedes "there is no set threshold for burstiness."

Read those definitions again and notice what they measure: predictability of word choice. Not authorship. A careful human writing plain, well-organized prose — a lab report, a methods section, a non-native speaker using the vocabulary they are sure of — produces exactly the low-perplexity, low-burstiness profile the recipe calls machine-like. That is not a tuning problem. It is what the statistic is.

And here is the detail most detector debates miss: GPTZero itself moved on. The same support page states that "as of autumn 2023, GPTZero no longer uses perplexity and burstiness for its AI detection because we migrated to a deep-learning based architecture." The signals that made the category explainable were retired by the company that popularized them.

The modern recipe: a trained classifier, which is a black box

Current detectors — GPTZero's newer architecture, Turnitin's model, and the rest — are themselves neural networks, trained on piles of human-labeled and AI-labeled text to tell the piles apart. They are more accurate than the perplexity recipe and less explainable: there is no threshold to quote, because the decision lives in millions of learned weights.

What you get instead of an explanation is a vendor-published error rate, and those come with fine print. Turnitin's headline claim, in its own FAQ, is a false-positive rate "under 1% for documents with over 20% of AI writing" — a conditional most people drop when repeating the number. Below its 20% threshold, Turnitin's report shows an asterisk and declines to attribute a percentage at all. We unpack the full set of caveats in what your Turnitin AI score actually means; the point here is simply that even the most confident vendor scopes its accuracy claim, in writing.

Now the three breaks.

Break one: false positives on real human writing

The cleanest evidence comes from OpenAI — the company with the best possible access to AI-generated text. It launched a public AI text classifier in January 2023 and shut it down six months later. The retirement note, as reported at the time: "As of July 20, 2023, the AI classifier is no longer available due to its low rate of accuracy." The numbers behind that sentence, from OpenAI's own launch disclosure as reported by The Register: the tool correctly identified only about 26% of AI-written text, wrongly labeled human-written text as AI about 9% of the time, and was "sometimes extremely confident in a wrong prediction."

The false positives are not evenly distributed. The Stanford study by Liang et al. (arXiv 2304.02819) ran seven commercial detectors over essays by non-native English speakers and found that "these detectors consistently misclassify non-native English writing samples as AI-generated, whereas native writing samples are accurately identified." The measured numbers: the detectors "misclassified over half of the TOEFL essays as 'AI-generated' (average false positive rate: 61.22%)," and all seven detectors unanimously flagged 19.78% of those human-written essays. The same detectors showed "near-perfect accuracy for US 8-th grade essays." The mechanism is exactly the perplexity logic above: limited vocabulary reads as predictable, and predictable reads as machine.

If you are on the receiving end of such a flag, the practical playbook is in falsely accused of using AI and how to appeal an AI cheating accusation.

Break two: paraphrase laundering

The second break runs the other way: text that was AI-generated, passed through a rewriting step, stops looking AI-generated. Sadasivan et al. (arXiv 2303.11156) tested this systematically and reported that "our recursive paraphrasing method can significantly reduce detection rates, [while] it only slightly degrades text quality in many cases, highlighting potential vulnerabilities in current detection systems in the presence of an attacker."

This is not just a lab result; "humanizer" tools that industrialize the attack are a commercial category now — roughly 150 of them for sale, with peer-reviewed tests showing paraphrased AI text drops detectors to 26% accuracy. We walk through the whole category, the numbers, and the vendors' counter-claims in AI humanizers and the detector arms race. They defeat provenance labels as well as detectors when the labeling is careless — see the Grammarly Authorship laundering episode for a documented case and the fix that followed.

The asymmetry is what makes this break so corrosive: the student who did nothing wrong has no button to press to look more human, while the student who outsourced the essay has several. A detector-centred regime is hardest on the honest and softest on the prepared.

Break three: the ceiling, and why watermarking hasn't saved it

The third break is mathematical. The Sadasivan paper provides "a theoretical framework connecting the AUROC of the best possible detector to the Total Variation distance between human and AI text distributions." Translated: the best achievable detector — not today's products, the theoretical optimum — is capped by how statistically different human and AI text are. Every model generation shrinks that difference, because sounding human is precisely what the models are optimized for. The ceiling is not fixed; it descends.

The often-proposed rescue is watermarking: have the model embed a hidden statistical signature at generation time. OpenAI has publicly discussed having built exactly this, and its stated reasons for not releasing it map onto the breaks above. In OpenAI's language, as quoted in TechCrunch's report: the method is "highly accurate and even effective against localized tampering, such as paraphrasing," but "less robust against globalized tampering" — such as running the text through translation or another model — "making it trivial to circumvention by bad actors." OpenAI also noted the fairness problem, that watermark-based checking could "stigmatize use of AI as a useful writing tool for non-native English speakers." The company that would most benefit from reliable detection of its own output looked at the mechanism and left it on the shelf.

What this means, practically

The three breaks compound into one conclusion: judging finished text is an adversarial guessing game with a falling ceiling, error rates that land hardest on honest and non-native writers, and cheap laundering on the other side. The institutions acting on this are not fringe — see the universities that turned off AI detection.

The alternative is to change what gets examined. A detector asks: what does this finished text look like? A writing-provenance record answers a different question: what actually happened while this document was written? — observed at the time, with consent, and sealed so it cannot be quietly edited afterwards. None of the three breaks applies to it: there is no statistical guess to get wrong, paraphrasing a document does not alter the already-sealed record of how it was made, and there is no distribution gap to shrink. It has its own honest limits — catalogued in what a writing record cannot prove — but they are the limits of evidence, not of guesswork.

That is the approach Authmarks takes: witness the process, seal the record, and let anyone verify it free, without an account. If you would rather your writing carried its own proof than took its chances with a classifier, a free account is where that starts.