How AI text detection actually works: perplexity, classifiers, and why the ceiling is structural

Short answer

AI text detection is a classification problem: given a finished text artifact, estimate the probability it was generated by a language model. Every current approach infers a generative process from its output — and that inference has a structural ceiling because artifact statistics do not uniquely identify what produced them. No amount of model improvement eliminates this ceiling; it follows from the problem definition, not from engineering shortfalls.

The classification problem and why it is the wrong one

All AI detection methods, whatever their architecture, solve the same formal problem: assign a score to a document reflecting the posterior probability P(AI | text). The working hypothesis is that machine-generated text bears statistical fingerprints — regularities in word choice, syntactic structure, or probability under a reference model — that human text does not.

That is a well-posed machine-learning problem. It is, however, a different question from the one an integrity proceeding must answer. An institution adjudicating an academic misconduct allegation needs to know whether this student composed this text — a question about a person, a process, and a specific act. The detector answers a question about the surface statistics of a document. Those two questions can come apart. A student who wrote an authentic essay in a formal academic register may produce text with statistical properties similar to AI-generated text; a student who generated text and lightly edited it may produce text that scores cleanly as human. The category error is baked into the approach before any model is trained.

This matters when reading vendor accuracy claims. A reported accuracy figure, even a high one, describes performance on a benchmark drawn from the training distribution. The question being answered in a real adjudication is harder, narrower, and not what the benchmark measured.

Approach 1: Perplexity-based detection

Perplexity is a standard information-theoretic measure of how surprised a language model is by a sequence of tokens. Formally, for a text of N tokens, it is the exponentiated average negative log-likelihood under the model:

PP(text) = exp( -1/N · Σ log P(token_i | token_1 … token_{i-1}) )

Low perplexity means the model found each successive token unsurprising given its context — the text was, in a sense, predictable to the model. High perplexity means the model was repeatedly caught off guard.

The intuition behind perplexity-based detection: a language model generating text tends to select from the high-probability portion of its own probability distribution (via sampling with temperature, beam search, or greedy decoding). The result is a sequence that any model from the same family assigns low perplexity to. Human writing, being expressive and idiosyncratic, tends to take paths the model would not have chosen — producing higher and more variable perplexity.

A related signal is burstiness: the variance in per-token log-probability across a passage. Human writing tends to alternate between highly predictable stretches (formulaic transitions, common idioms) and locally surprising choices (unusual word selection, creative phrasings). AI-generated text tends to hold perplexity more uniformly low — the model is consistently near the mode of its distribution.

The pipeline from a text artifact to a perplexity score is straightforward:

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#e8f4ee', 'primaryTextColor': '#16130c', 'primaryBorderColor': '#1f5a3a', 'lineColor': '#6f5618', 'secondaryColor': '#fffdf8', 'background': '#fffdf8', 'mainBkg': '#fffdf8', 'clusterBkg': '#f0ede4', 'titleColor': '#16130c', 'edgeLabelBackground': '#fffdf8'}}}%%
flowchart LR
    A["Input text"] --> B["Tokenize"]
    B --> C["LM forward pass"]
    C --> D["Per-token\nlog-probability"]
    D --> E["Average\nperplexity score"]
    E --> F{"Threshold"}
    F -->|below threshold| G["Flag as AI"]
    F -->|above threshold| H["Pass as human"]

The failure modes are distinct from the obvious "the model is imperfect" story. First, non-native English speakers systematically write with lower perplexity than native speakers. Liang et al. (arXiv:2304.02819) demonstrated this empirically, finding that GPT detectors misclassified the TOEFL essays of non-native writers as AI-generated at rates far exceeding their error rates on native-English college essays. The structural reason is straightforward: a controlled vocabulary, simpler syntactic choices, and closer adherence to standard phrasing all reduce perplexity. The "AI signal" the model finds is correlated with writing features that characterize a learner, not a machine.

Second, the perplexity distribution is model-family-specific. A text generated by GPT-4 will be assigned low perplexity by GPT-family models, but if evaluated by a Llama-family or Mistral-family model the score will be different and the calibration of the detection threshold will no longer apply. As model diversity grows, any single reference model provides a partial view.

Third — and this is the entry point to the paraphrase problem discussed later — perplexity is a property of the finished text, not of the process that produced it. Rewriting a passage changes its perplexity under any reference model. There is no conservation law that keeps the statistical fingerprint intact after transformation.

Approach 2: Zero-shot likelihood ratio (DetectGPT-style)

Mitchell et al. (arXiv:2301.11305) proposed a more principled zero-shot method that does not require a fine-tuned classifier. The key insight is that language models tend to generate text that sits at local maxima of their own probability surface. When a model samples a token sequence, it is, roughly, navigating toward high-likelihood regions. The resulting text is therefore not just low-perplexity in the aggregate — it is locally high-probability relative to small perturbations.

The detection procedure exploits this. For a candidate passage, the method:

1. Generates a set of slightly perturbed variants of the passage by masking tokens and re-sampling from the reference LM (or using a separate perturbation model such as T5).
2. Computes the log-probability of the original passage under the reference model.
3. Computes the average log-probability of the perturbed variants.
4. Classifies the text as AI-generated if the original has substantially higher likelihood than its perturbations — that is, if it sits at a local maximum.

For human text, perturbations change the text but do not reliably reduce its likelihood, because human text is not sitting at the model's local maximum to begin with. The likelihood ratio between original and perturbations is therefore lower and less discriminating.

In controlled experiments, DetectGPT outperformed raw perplexity classification, especially on longer texts, suggesting the curvature of the likelihood surface carries signal beyond the level of the surface itself.

The failure modes are different from, and compounding with, perplexity-based approaches. The most significant is computational cost: every inference call requires generating a set of perturbations (typically dozens) and running them through a large reference model. For an institution checking hundreds of submissions per day, this is a non-trivial infrastructure problem. Second, the method is sensitive to the choice of perturbation strategy: if the perturbation model is too weak or uses too little diversity, the variants are not meaningfully distinct and the signal collapses. Third, and practically important, the method is unreliable on very short texts — the local maximum hypothesis requires a passage long enough for the pattern to emerge above noise. Abstracts, short-answer responses, and paragraphs in isolation are borderline inputs for this method.

Approach 3: Fine-tuned neural classifiers

The dominant commercial approach — including the architecture underlying Turnitin's AI writing detector — is supervised fine-tuning: train a base language model on a labeled dataset of human and AI text, and produce a binary classifier. Unlike the previous two approaches, the classifier is not zero-shot; it learns features from examples rather than constructing them analytically.

The training and inference pipelines:

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#e8f4ee', 'primaryTextColor': '#16130c', 'primaryBorderColor': '#1f5a3a', 'lineColor': '#6f5618', 'secondaryColor': '#fffdf8', 'background': '#fffdf8', 'mainBkg': '#fffdf8', 'clusterBkg': '#f0ede4', 'titleColor': '#16130c', 'edgeLabelBackground': '#fffdf8'}}}%%
flowchart TD
    subgraph Training
        A["Human essays\n(labeled)"] --> C["Fine-tune\nbase model"]
        B["LLM-generated essays\n(labeled)"] --> C
        C --> D["Trained classifier\n(frozen weights)"]
    end
    subgraph Inference
        E["New text"] --> F["Tokenize"]
        F --> D
        D --> G["AI probability\nscore 0–1"]
    end

Fine-tuned classifiers capture features that raw perplexity scoring misses. During training, the model can learn syntactic patterns (e.g., consistent avoidance of sentence fragments), semantic coherence signals (e.g., unusually smooth topic transitions), discourse structure (e.g., formulaic introduction-body-conclusion organization without the local inconsistencies that appear in genuine drafting), and vocabulary patterns at multiple scales. In controlled benchmarks, the best fine-tuned classifiers outperform zero-shot methods on in-distribution text.

The central limitation is distributional shift. A classifier trained on a corpus of GPT-3.5 essays and college student essays will learn features that discriminate those two populations. When that same classifier is applied to a different population — text generated by a newer model with a different fine-tuning profile, text from a different domain, text in a different register, text in a different language, text from a non-native writer — its learned features may not apply, and its outputs become unreliable.

This is not a bug that can be patched by retraining. It is a structural property of supervised classification: performance on out-of-distribution inputs is not guaranteed, and cannot be guaranteed without knowing the test distribution in advance. Every institution is, in effect, a different test distribution from the benchmarks the vendor used to report accuracy. Weber-Wulff et al. (arXiv:2306.15666), testing commercial and academic detectors against a representative sample of student-like AI-generated texts across multiple domains and tools, found substantial variance across tools and conditions — with several tools performing near-chance on inputs outside their apparent training distribution.

Why paraphrasing defeats all three approaches

Paraphrasing — rewriting a passage to preserve its meaning while altering its surface form — is not a sophisticated attack. It is a standard editing operation available to any writer and automated by dozens of consumer tools. Its effect on detection is decisive across all three approaches.

The shared reason is that all three methods extract signals from the statistical properties of the finished text. Perplexity-based methods measure how surprising the text is to a reference model. Zero-shot likelihood ratio methods measure how near a local probability maximum the text sits. Fine-tuned classifiers measure combinations of syntactic, semantic, and discourse features learned from training data. All of these signals are properties of the text as it currently stands, not records of the process that produced it.

Paraphrasing changes those properties. A paraphraser operating at the sentence or paragraph level (such as DIPPER, the 11B-parameter system built by Krishna et al.) selects different words, restructures syntax, and redistributes probability mass under the reference model. The resulting text has different perplexity, a different position relative to the likelihood surface, and different syntactic and discourse features. The meaning is preserved; the fingerprint is not.

The RAID benchmark (Sadasivan et al., arXiv:2310.15654) quantified this across a comprehensive suite of detectors. The results show detection rates falling to near chance on paraphrased text at fixed false-positive operating points. Critically, this does not mean detectors catch fewer cheaters while correctly clearing the innocent; it means the tools that most aggressively flag text are generating more false positives on legitimate submissions while still failing to catch the most evasive cheaters. The aggressive threshold hurts the honest population without improving coverage of the dishonest one.

The calibration problem

A standard response to documented weaknesses in a classifier is: improve the training data, tune the threshold, retrain on harder examples. This works for genuinely tractable problems. It does not work for the problem AI detection faces, because the core tension is not a property of the model architecture — it is a property of the statistical task.

Any classifier producing binary outputs (or a threshold applied to a continuous score) faces the precision-recall tradeoff: lowering the classification threshold catches more true positives (AI-generated text correctly flagged) but also more false positives (human text incorrectly flagged). Raising the threshold reduces false positives but misses more true positives. For a fixed model, this is a curve; the operating point is a choice about who bears the risk.

When vendors report a false positive rate (FPR), that rate is measured on benchmark text — typically a collection of essays sampled from the same domain and style distribution used to train the classifier. Real institutional text is harder. The populations that drive the effective FPR upward in practice are well-documented in the literature:

• Non-native speakers. Liang et al. (arXiv:2304.02819) found that TOEFL essays by non-native English writers were misclassified as AI-generated at rates that would be professionally unacceptable if applied to the broader student population. The detector's false-positive behavior is not uniform across students.
• Formal academic register. Text written to sound authoritative, follow academic conventions, and avoid colloquial phrasing sits closer to the AI-text distribution that the classifier learned to flag.
• Short texts. Most detection methods degrade on texts below a few hundred words. Short-answer responses, paragraph-length assignments, and in-class writing samples are systematically less reliable inputs.
• Newer LLM outputs. A classifier trained on GPT-3.5-era text will encounter GPT-4 and successor outputs that may not match its training distribution, shifting the effective accuracy in either direction.

"Improving the model" can shift where on the precision-recall curve the system operates. It cannot collapse that curve to a point. The tradeoff is structural, and where the threshold is set is a policy decision with distributional consequences, not a technical problem with a technical solution.

What process-based evidence does differently

The three approaches reviewed above share a defining architectural choice: they interrogate the artifact — the finished text — and attempt to infer from it whether a language model was involved in its production. Process-based evidence does not make this inference. Instead, it records what actually happened during composition and presents that record directly.

The question the two approaches answer are genuinely different. Artifact-based detection asks: "does this text look like it was machine-generated?" Process-based evidence answers: "what sequence of editing operations produced this text, over what time period, with what input sources?" These are not equivalent, and the second question is the one that matters in an integrity proceeding.

Crossley et al.'s study of keystroke logging in academic integrity contexts (EDM 2024, ED675615) found that process features — drawn from keystroke logs capturing the sequence, timing, and character-level operations of composition — distinguished composed from transcribed text with approximately 99% accuracy. The features driving classification were not derived from the finished text at all: they included typing rate variance, revision depth, and the temporal distribution of edits. An authentic writer produces a signature in the process that is independent of what the finished text looks like.

Process-based evidence does not have a paraphrase attack equivalent. There is no way to make a paste event look like twenty minutes of incremental typing without actually performing twenty minutes of incremental typing. The keystroke log records what happened in the document; retroactively editing the document's content does not alter the process that generated those edits. This is not a harder version of the same problem the detectors face — it is a different evidential structure. The record belongs to the writer, is sealed at completion, and is verifiable by a third party without requiring access to any model or any vendor infrastructure.

None of this means process evidence is a perfect solution to academic integrity. It requires consent, requires that the writing environment support keystroke capture, and is most useful when deployed at assignment time rather than retrospectively. But the failure modes are different in kind from detection failure modes: they are logistical rather than structural, and they do not produce false positive accusations against writers who composed their own work.

Summary comparison

Detection approach	Core signal	Key failure mode	Appropriate role
Perplexity-based	Average surprise to a reference LM	Non-native speakers; paraphrasing; model-family mismatch	Fast triage on clearly in-distribution text; not evidence for adjudication
Zero-shot likelihood ratio (DetectGPT)	Local curvature of the LM probability surface	Computationally expensive; unreliable on short texts; defeated by paraphrasing	Research benchmark; not yet viable for high-throughput institutional use
Fine-tuned neural classifier	Syntactic, semantic, and discourse features learned from training data	Distributional shift; paraphrasing; non-native speakers; newer LLMs	Current commercial state of the art; published FPR does not reflect institutional distribution
Process-based evidence (keystroke provenance)	Composition sequence, timing, and editing operations	Requires consent and instrumented environment; not retroactive	High-accuracy composition verification; no paraphrase attack surface

---

The historical arc — from plagiarism detection to AI detection

Understanding why current AI detectors are structurally limited requires understanding the longer history of automated writing analysis. The tools deployed today did not emerge from a clean-room research program. They grew from an existing plagiarism detection industry with a different architecture, different assumptions, and different threat models — and that lineage shapes their weaknesses.

The n-gram matching era (2000–2012)

The first generation of automated academic integrity tools — Turnitin, SafeAssign, iThenticate — were built around a specific and tractable problem: verbatim or near-verbatim copying from source texts. The underlying method was string matching: normalize the submitted text into overlapping character or word n-grams, compare those n-grams against an indexed corpus of prior submissions and web content, and surface passages where the overlap is suspiciously high.

This is an information retrieval problem. The threat model it addresses is equally specific: a student who copies paragraphs from Wikipedia, a paper mill, or a classmate's submission from a prior year. The statistical signal is identity — the submitted text either contains the source material or it does not. There is no ambiguity about the reference: the source text is in the index, or it isn't.

The architecture optimized for this problem was a crawler and an indexed document store. The detector needed a large corpus to match against, fast substring search, and a deduplication layer to surface the most likely true positives. It did not need to model how language works. It needed to model how copying works.

This architecture had one important property that is worth naming explicitly: it had no false positive problem for the honest student population. A student who wrote their own essay would not match against any document in the index, because their essay did not exist before they wrote it. The detector's false positives were rare edge cases — coincidental phrasing overlap, quotations from widely-used sources, boilerplate formulae that appear in many essays. These were manageable. The detection/clearance decision was reliable because the underlying question (is this text copied from a source?) has a fact-of-the-matter answer.

Stylometric approaches (2008–2022)

Parallel to the commercial plagiarism detection industry, academic research developed stylometric methods for authorship analysis. The goal was different: not to find copied text but to fingerprint individual authors based on their characteristic writing habits — word choice, punctuation frequency, sentence length distribution, function word usage, and syntactic construction preferences.

Stylometry's original application was literary and forensic: identifying the author of anonymous pamphlets, resolving disputed authorship claims, or corroborating authorship in legal contexts. By the mid-2010s, the methods had matured considerably. Burrows' Delta and its successors could reliably attribute texts to authors within a closed set; neural stylometric models achieved high accuracy even on short samples when the author set was known and samples were large.

The limitation that made stylometry unsuitable as an academic integrity tool was its dependency structure: it required a training corpus of verified writing samples from the target author. To verify whether a submitted essay was written by student X, you needed a substantial collection of confirmed writing from student X to build a profile against. For most academic contexts, this was not available. The method worked for disambiguation within a closed set (is this essay more like the style of author A or author B?) but was poorly suited to the open-ended question (did this student write this?).

Nonetheless, stylometric research contributed two things to the eventual AI detection effort. First, it demonstrated that statistical properties of text carry real authorship signal — establishing the plausibility of statistical detection in principle. Second, it surfaced the population-level confounds that would later plague AI detectors: writing style is not independent of age, language background, education level, or genre. A stylometric model trained on professional prose would misattribute undergraduate writing.

The 2022 rupture

ChatGPT's public release in November 2022 forced a response from the plagiarism detection industry within weeks. The scale of the disruption was not primarily about detection rates — it was about the nature of the threat. Plagiarism detection's core assumption was that students would copy from sources. AI generation created a new category: text that was novel (not in any index), statistically coherent, fluent, and produced in seconds without any source to match against.

The n-gram matching architecture was immediately irrelevant. There was no source to find. The industry pivoted to the fine-tuned classifier approach described earlier — a pivot that took months and required assembling training corpora that did not exist at the time. The result was a set of tools built under time pressure, validated against benchmark data that was itself assembled in months rather than years, and deployed at institutional scale before their failure modes were fully characterized.

The benchmark papers that subsequently defined the field document what happened next:

• Weber-Wulff et al. (arXiv:2306.15666, 2023) tested fourteen AI detection tools against a corpus including generated text across multiple LLMs, domains, and registers. The headline finding was stark: no tool performed uniformly well across all conditions, and several tools that claimed near-perfect accuracy in press materials performed at chance on portions of the test corpus.

• The RAID benchmark (Sadasivan et al., arXiv:2310.15654, 2023) introduced a systematic evaluation covering multiple attack types including paraphrasing, translation, and prompt engineering. RAID showed that paraphrase attacks reduced detection rates to near chance for all tested tools at any fixed false-positive threshold. This was not a finding about one tool — it was a finding about the entire class of artifact-based detection approaches.

• The M4 benchmark (2024) extended coverage to multilingual contexts and a wider range of generation sources, finding that cross-lingual and cross-domain generalization remained a persistent challenge even for tools that performed well in English-language academic contexts.

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#e8f4ee', 'primaryTextColor': '#16130c', 'primaryBorderColor': '#1f5a3a', 'lineColor': '#6f5618', 'secondaryColor': '#fffdf8', 'background': '#fffdf8', 'mainBkg': '#fffdf8', 'clusterBkg': '#f0ede4', 'titleColor': '#16130c', 'edgeLabelBackground': '#fffdf8'}}}%%
timeline
    title Detection technology evolution
    2001 : Turnitin launched — n-gram corpus matching
    2012 : Stylometry matures — authorship by statistical fingerprint
    2020 : GPT-3 released — first large-scale fluent generation
    2022 : ChatGPT public launch — plagiarism detection era ends overnight
    2023 : First commercial AI detectors — fine-tuned classifiers deployed at scale; Weber-Wulff and RAID benchmarks published
    2024 : Detector collapse documented — paraphrase attacks reduce detection to near chance across all artifact-based tools

The historical arc matters for how institutions should interpret vendor claims. A tool born in 2023 under market pressure, validated on a benchmark assembled that same year, and deployed into a threat landscape that mutates monthly is not the same kind of tool as software validated over a decade in a stable problem domain. The confidence that is appropriate for one is not appropriate for the other.

Why the architecture mismatch was not accidental

The core architectural error — using artifact-based statistical inference for a question that requires process evidence — was not a random engineering mistake. It was a natural consequence of the industry's existing infrastructure and assumptions. Plagiarism detection had always interrogated the artifact, because the artifact was where the copying signal lived. Extending that architecture to a new problem was the path of least resistance.

The problem is that AI generation broke the equivalence that made artifact-based detection reliable for plagiarism. In plagiarism detection, the artifact contains a causally connected record of copying: if the text appears in both the submission and the source, the copying happened, and the detector finds it. In AI generation detection, the artifact contains only a statistical trace of the generative process — a trace that is not uniquely informative, not causally connected to intent, and not robust to any surface transformation. The detector finds a pattern, not a fact.

---

The watermarking alternative — LLM-side detection

All of the approaches discussed so far operate post hoc: they examine a finished text and attempt to infer its origin. A fundamentally different architecture attempts to solve the detection problem at generation time, by embedding a signal in AI-generated text during the generation process itself. This is the LLM watermarking approach.

How green-red token watermarking works

Kirchenbauer et al. (arXiv:2301.10226) introduced the canonical watermarking scheme. The core idea is to partition the vocabulary into two sets — "green" tokens and "red" tokens — and bias the language model's output distribution toward green tokens during generation. Because the partition is deterministic given the preceding context (it is seeded by the previous token), the green/red assignment changes at every position in the sequence. The detector, given access to the same seeding rule, can reconstruct the expected green/red assignment for any candidate text and count how many tokens fall in the green set.

In more detail: at each generation step, the model computes its usual probability distribution over the vocabulary. The watermarking procedure then applies a soft boost to all tokens in the "green" list for the current position (determined by hashing the preceding token). The model samples from this modified distribution. The result is text that, statistically, contains more green tokens than chance would predict — but the boost is small enough that the text quality is not perceptibly degraded.

Detection is a hypothesis test:

H₀: text was generated without watermarking (green tokens appear at base rate)
H₁: text was generated with watermarking (green tokens are over-represented)

The test statistic is a z-score:

z = (count_green − N × expected_green_rate) / sqrt(N × expected_green_rate × (1 − expected_green_rate))

where N is the total number of tokens in the sample. Large positive z-scores reject H₀ and identify the text as watermarked. The method requires no access to any model — only to the seeding rule used at generation time.

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#e8f4ee', 'primaryTextColor': '#16130c', 'primaryBorderColor': '#1f5a3a', 'lineColor': '#6f5618', 'secondaryColor': '#fffdf8', 'background': '#fffdf8', 'mainBkg': '#fffdf8', 'clusterBkg': '#f0ede4', 'titleColor': '#16130c', 'edgeLabelBackground': '#fffdf8'}}}%%
flowchart TD
    subgraph Generation
        A["Prompt input"] --> B["LM computes\ntoken distribution"]
        B --> C["Hash previous token\n→ green/red partition"]
        C --> D["Boost green token\nprobabilities"]
        D --> E["Sample token\n(biased toward green)"]
        E --> F["Append to output;\nrepeat for next token"]
    end
    subgraph Detection
        G["Candidate text"] --> H["Reconstruct green/red\npartition per position"]
        H --> I["Count green tokens"]
        I --> J["Compute z-score"]
        J --> K{"z > threshold?"}
        K -->|Yes| L["Watermarked\n(AI-generated)"]
        K -->|No| M["Not watermarked"]
    end

Statistical detection power and text length

The detection power of the watermarking test increases with text length. At 200 tokens, the false positive rate at a threshold of z = 4 is approximately 3 × 10⁻⁵ and the true positive rate is around 0.80, depending on the strength of the green-token bias. At 500 tokens, both rates improve substantially. At 1,000 tokens, the test has very high power and an extremely low false positive rate. This is a theoretical property of the hypothesis test — more observations reduce variance in the estimate of the green-token rate.

The implication is that watermarking works well for longer texts and poorly for short ones. A 50-word paragraph has insufficient statistical power to reliably detect the watermark even if it is present.

Why watermarking fails in practice

Despite the theoretical elegance of the approach, watermarking has not solved the AI detection problem in practice, for several intersecting reasons.

Paraphrasing disrupts the token sequence. Watermarking is embedded in the token sequence — specifically in the vocabulary choices made at each position. When a paraphraser replaces tokens with synonyms or restructures sentences, it changes which tokens appear at each position, scrambling the green-token signal. Because the green/red partition is position-dependent (seeded by the preceding token), even a moderate amount of paraphrasing can destroy enough of the watermark to push the z-score below the detection threshold. The paraphrase attack that defeats artifact-based classifiers also defeats token-level watermarking.

Instruction-following models do not embed watermarks. Watermarking requires modification of the generation process — specifically, it requires access to the model's internal probability distribution at each step. When users access LLMs through APIs with instruction-following interfaces, they have no ability to enforce watermarking. OpenAI experimented with deploying a watermark in ChatGPT in 2022 and subsequently delayed and deprioritized it, citing concerns about detection evasion and competitive disadvantage if only some providers watermark. Without universal adoption across all providers, users simply switch to non-watermarking models.

Open-source LLMs bypass the requirement entirely. A substantial fraction of AI text generation occurs via open-source models (Llama, Mistral, Qwen, and their derivatives) run locally or on consumer cloud instances. These can be operated without any watermarking modification. There is no regulatory mechanism to require watermark deployment, and strong incentives against it from a competitive standpoint.

The Sadasivan impossibility result. Sadasivan et al. (arXiv:2310.15654) proved a formal impossibility result that applies to all artifact-based detection methods, including watermarking: under any paraphraser that preserves the semantic content of the text, there exists an attack that drives the detector's performance arbitrarily close to the random baseline. The result is not a statement about current paraphrasers being strong enough — it is a statement about the mathematical relationship between paraphrasing and statistical detection. As paraphrase quality improves, detector performance degrades toward chance, and this is not a contingent finding about current technology.

The practical conclusion: watermarking is a theoretically coherent approach that faces fatal deployment barriers (adoption across providers, robustness to paraphrasing, open-source bypass) that engineering improvements cannot resolve without coordination mechanisms that do not currently exist.

---

Vendor landscape — what the five major tools actually do

The detector market that emerged after ChatGPT's launch now includes dozens of tools. Five have achieved significant institutional deployment and deserve close examination of what they actually measure, what their validated accuracy figures show, and what populations their error rates concentrate in.

GPTZero

GPTZero was created by Princeton computer science student Edward Tian in January 2023 and became the first widely-deployed public AI detection tool. Its core approach combines two signals: perplexity (the aggregate log-likelihood surprise metric described earlier) and burstiness (variance in per-sentence perplexity). The intuition is that human writing is "bursty" — alternating between predictable and surprising stretches — while AI writing maintains uniformly low perplexity.

GPTZero's interface presents a document-level probability score alongside paragraph-level highlighting intended to show which portions of a text are more or less likely to be AI-generated. This paragraph-level breakdown has intuitive appeal for instructors but introduces an additional problem: the statistical reliability of a 2–3 sentence excerpt is substantially lower than the reliability of a full essay. The paragraph-level scores should be treated with considerably more caution than the document-level score.

GPTZero has iterated its models since launch and added a "human writing score" framing distinct from a raw perplexity score. Independent testing by Weber-Wulff and others has found that GPTZero performs reasonably on in-distribution text (fluent English essays in academic registers) but degrades on non-native English writing, on short texts, and on paraphrased AI output. The tool has reported accuracy figures ranging from 85% to 99% in different press contexts, with the higher figures corresponding to controlled benchmark conditions not representative of diverse institutional populations.

Known high-FPR population: Non-native English speakers; formal academic prose in narrow domains; texts below 250 words.

Turnitin AI Writing Detection

Turnitin's AI writing detection module, launched in April 2023, is the most widely deployed tool in higher education owing to Turnitin's pre-existing institutional relationships. Its architecture is a fine-tuned classifier trained on Turnitin's proprietary corpus of student essays — a large and domain-specific dataset that gave Turnitin an advantage in training data coverage compared to tools built from scratch.

Turnitin has publicly claimed 98% accuracy and 1% false positive rate in press materials. Weber-Wulff et al. (arXiv:2306.15666), testing Turnitin alongside other tools against a diverse benchmark, found that these figures did not hold uniformly across their test conditions. The gap between vendor-reported accuracy and independent benchmark accuracy is a consistent pattern across the detector market, not a finding specific to Turnitin — the benchmark conditions used for press claims typically favor the vendor's training distribution.

One specific concern documented in the literature: Turnitin's training corpus was assembled during a period when the dominant AI writing tool was GPT-3.5-era ChatGPT. As the distribution of AI-generated student text has shifted toward GPT-4, Claude, Gemini, and their successors, the classifier's learned features may not generalize cleanly. Turnitin updates its model periodically, but the lag between deployment of new LLMs and retraining on new-model output is a persistent challenge.

Known high-FPR population: Non-native English speakers writing in formal registers; very short submissions; text generated by LLMs released after the last model update.

Copyleaks

Copyleaks is an Israeli company with a longer history in plagiarism detection. Its AI detection module claims ensemble methodology — combining multiple detection signals — and multilingual support across over 30 languages. The multilingual claim is significant because most AI detectors were validated exclusively on English text.

Weber-Wulff et al. included Copyleaks in their 2023 evaluation. Results showed performance above chance but with substantial variance across test conditions, consistent with the broader pattern of tools performing well on their training distribution and degrading elsewhere. The multilingual support, while commercially marketed, has not been independently validated with the same rigor as the English-language performance claims.

Copyleaks has been adopted by some institutions specifically for multilingual contexts. Institutions considering this use should treat the multilingual accuracy claims as unverified and pilot the tool against a local sample of authentic non-English student writing before deployment.

Known high-FPR population: Non-English writing in languages with smaller training corpora; short texts; formal technical prose.

Originality.ai

Originality.ai entered the market targeting content marketing agencies rather than academic institutions. Its primary use case is verifying that outsourced content has not been generated by AI. The fine-tuning corpus reflects this origin — it was assembled from web content domains (blog posts, marketing copy, SEO articles) rather than academic essays.

This domain specificity matters: a classifier trained on marketing content will have learned features that discriminate marketing-register AI text from marketing-register human text. When applied to academic essays, it is operating out of distribution. The tool's published accuracy figures relate to its intended use case; there is no independent validation of its performance in academic contexts. Several reports from educators who have tested Originality.ai on student essays describe higher false positive rates than the tool's documentation suggests.

Originality.ai should not be used as an academic integrity tool without institutional-scale validation against local student populations.

Known high-FPR population: Academic writing in any register; any non-English text; student writing by non-native speakers.

Winston AI

Winston AI follows an architecture similar to GPTZero — perplexity-based scoring with a fine-tuned layer — with a user interface oriented toward professional and institutional use. It has not been the subject of the same volume of independent academic evaluation as Turnitin or GPTZero, which makes claims about its accuracy harder to assess from published literature.

Winston AI's vendor-published figures cite 99.6% accuracy and 0.5% false positive rate on their benchmark. The absence of independent replication makes these figures unverifiable. The general finding from the field — that vendor accuracy claims systematically exceed independent test results for artifact-based detection — should apply here as it does to all other vendors.

Known high-FPR population: Presumed similar to other perplexity-based tools; insufficient independent data to characterize precisely.

Comparative summary

Tool	Core signal	Vendor-claimed accuracy	Weber-Wulff independent result	Known high-FPR population
GPTZero	Perplexity + burstiness	85–99% (context-dependent)	Substantial variance across test conditions	Non-native speakers; short texts; formal prose
Turnitin AI	Fine-tuned classifier (proprietary corpus)	98% accuracy, 1% FPR	Below claimed on diverse corpus	Non-native speakers; post-GPT-3.5 LLM outputs
Copyleaks	Ensemble (claimed)	Not uniformly specified	Above chance; variance by condition	Non-English text; short texts
Originality.ai	Fine-tuned classifier (web/marketing corpus)	Not independently validated	Not tested	Academic writing; non-native speakers
Winston AI	Perplexity + fine-tuned	99.6% accuracy, 0.5% FPR	Not independently replicated	Insufficient data

The critical finding from Weber-Wulff et al. deserves restatement: tools that claimed near-perfect accuracy in press releases failed to maintain that accuracy across the diverse test corpus. No tool performed uniformly well across all tested conditions. This is not a selective finding about weak tools — it is a systematic finding about the state of the art.

---

A worked detection case study

Abstract analysis of detection methods and benchmark results is useful, but concrete cases clarify what these failure modes look like from the perspective of the affected individuals. The following scenario is hypothetical but constructed from documented patterns in the published literature.

The students

Student A is a native English speaker who grew up in the United States, attended a mid-sized public high school, and is in their second year of college. They wrote a 1,200-word argumentative essay on climate policy in response to a standard prompt. They wrote the essay over three sessions during the week before the deadline, with visible revision — the opening paragraph was rewritten twice, a counterargument paragraph was added late, and the conclusion was edited for tone. Their writing is articulate but informal in places, with sentence fragments in two locations and an unconventional comma usage that their instructor has noted before.

Student B is a non-native Mandarin speaker who completed secondary school in China and is in their first year of college. English is their third language. They wrote a 1,000-word essay on the same climate policy prompt. Their essay is grammatically careful, uses a controlled vocabulary drawn from academic English they have studied deliberately, avoids colloquial phrasing, adheres closely to the five-paragraph structure taught in their preparation program, and exhibits the characteristic features of non-native academic writing: consistent clause structure, limited use of idiomatic expressions, and a formal register that does not vary within the essay.

Student C is a native English speaker who used GPT-4 to generate a 1,100-word essay on the same prompt, then ran the output through Quillbot on its "standard" paraphrase setting before submitting it. The paraphrasing changed approximately 35% of the word choices and restructured roughly 20% of the sentences, while preserving the argument structure, all substantive claims, and the essay's organization.

How each detection approach handles these three cases

Perplexity-based detection (e.g., a GPTZero-style tool):

Student A's essay contains informal constructions, unconventional punctuation, and local stylistic variation. Its perplexity under a GPT-family reference model is moderate-to-high, with high burstiness — the predictable transitions and idioms alternate with the unexpected sentence fragments. Score: likely below the detection threshold. Result: cleared.

Student B's essay has been written to be correct, precise, and formal — precisely the features that reduce perplexity. The controlled vocabulary, consistent structure, and avoidance of colloquial phrasing push perplexity toward the low end of the human range and well into the range shared with AI-generated text. Score: likely near or above the detection threshold. Result: flagged, despite being entirely authentic writing.

Student C's essay was generated by GPT-4 — intrinsically low perplexity — but has been paraphrased by Quillbot. The paraphraser replaces roughly a third of the vocabulary choices with alternatives from higher in the perplexity distribution and restructures sentences in ways that increase the model's surprise. Score: the paraphrasing may be sufficient to push the score below the detection threshold, depending on the tool and the threshold setting. Result: cleared or ambiguous.

Zero-shot likelihood ratio (DetectGPT-style):

Student A: perturbations of their essay do not systematically reduce log-probability, because authentic human writing is not sitting at the model's local maximum. Likelihood ratio: not discriminating. Result: cleared.

Student B: the same structural reason that lowers perplexity for Student B also tends to place their writing closer to the model's probability maximum than typical native-speaker writing. Perturbations that introduce more idiomatic or colloquial phrasing may actually increase the reference model's surprise, producing a likelihood ratio that resembles the AI-detection signature. Result: risk of flagging.

Student C: the original GPT-4 output would score as AI-generated. After Quillbot paraphrasing, the token-level likelihood landscape has been disrupted. The paraphrased version may not sit at the model's local maximum in the same way, producing a likelihood ratio that no longer clearly indicates AI generation. Result: detection evasion likely.

Fine-tuned neural classifier (e.g., Turnitin-style):

Student A: a classifier trained on native-speaker student essays has seen many essays with informal constructions, sentence fragments, and stylistic variation. These features are represented in the human training distribution. Score: likely low. Result: cleared.

Student B: a classifier trained primarily on native-speaker academic English has learned to associate formal, controlled, low-variance prose with AI generation. Student B's writing matches those features. Whether the classifier correctly generalizes or misclassifies depends on whether non-native English writing was represented in the training corpus and at what proportion. If it was underrepresented — as Liang et al.'s findings suggest is common — the classifier will assign a higher AI probability than the evidence warrants. Result: elevated risk of flagging.

Student C: the fine-tuned classifier is checking for syntactic, semantic, and discourse features of AI generation. After Quillbot paraphrasing, roughly a third of the token choices have changed. The discourse structure — the essay's internal organization, transition strategy, and claim structure — is unchanged, because Quillbot operates at the sentence level and does not reorganize paragraphs. Whether this is sufficient to evade detection depends on the classifier's feature weighting. Some classifiers weight discourse structure heavily; others weight token-level features. In practice, paraphrase evasion rates against fine-tuned classifiers vary but are consistently non-trivial. Result: likely partial evasion; outcome uncertain.

The central lesson

The pattern that emerges from this case study is the one predicted by the theoretical analysis. Student B — the authentic non-native writer — is at risk of being incorrectly flagged by all three detection approaches, for structural reasons that are documented and well-understood in the literature. Student C — the actual AI user — has taken a single low-effort paraphrasing step that substantially reduces detection probability across all three approaches.

The method that most aggressively pursues Student C also most aggressively wrongly accuses Student B. Tuning the threshold to reliably catch Student C also catches Student B — and many others like them. Tuning the threshold to reliably clear Student B also clears Student C. This is not a limitation of a specific tool; it is the precision-recall tradeoff operating on a test population where the AI-signal and the non-native-speaker-signal are not orthogonal.

---

The false positive arithmetic — institutional scale consequences

Individual case studies illustrate the mechanism. Arithmetic illustrates the magnitude.

A representative institution

Consider Institution X: a mid-sized comprehensive university with 20,000 enrolled students. Academic writing is assessed in courses across all departments; approximately 60% of students submit at least one substantive written assignment per semester that could plausibly be subject to AI detection review. This yields 12,000 essays in scope per semester — a conservative estimate that excludes shorter written work, in-class assignments, and graduate-level submissions.

The student population includes 30% non-native English speakers — approximately 6,000 students, a figure consistent with international student enrollment at many universities in English-speaking countries.

Under vendor-claimed rates

At the false positive rate of 1% commonly claimed in vendor documentation — applying uniformly — 120 innocent students per semester would be incorrectly flagged as potential AI users. This is already a significant number. One hundred and twenty students receiving misconduct inquiries they do not deserve in a single semester at a single institution.

But the 1% figure applies to the native English benchmark population, not the full student body. Liang et al. (arXiv:2304.02819) documented false positive rates for non-native English writers that substantially exceeded rates for native writers in the same detection tools. The reported FPR for TOEFL essays in that study was in the range of 61% across the tools tested. Even using a more conservative figure of 15% — accounting for some mitigation from institutional fine-tuning — the non-native English population alone contributes approximately 900 incorrectly flagged students per semester.

More realistic estimates, incorporating the non-native speaker differential and the formal-register effect documented for native speakers: 400–800 wrongful flags per semester at a single large institution.

The positive predictive value problem

Detector performance is often discussed in terms of accuracy, sensitivity, and specificity. The metric that matters for institutional policy is different: positive predictive value (PPV) — the probability that a flagged submission is actually AI-generated.

PPV depends not just on the detector's sensitivity and specificity but on the base rate of AI use in the population being tested. Bayes' theorem makes this precise:

PPV = (TPR × prevalence) / (TPR × prevalence + FPR × (1 − prevalence))

Suppose the true prevalence of AI-assisted writing in the institution's submitted essays is 10% — a conservative estimate that actual surveys of student behavior suggest may be low. Suppose the detector has a true positive rate (TPR) of 70% and a false positive rate of 5% (a reasonable estimate for the full institutional population, accounting for non-native speakers):

PPV = (0.70 × 0.10) / (0.70 × 0.10 + 0.05 × 0.90)
    = 0.070 / (0.070 + 0.045)
    = 0.070 / 0.115
    ≈ 0.609

At 10% AI prevalence, 5% FPR, and 70% TPR, a positive detection result carries only a 61% posterior probability of actually indicating AI generation. This is slightly better than a coin flip.

If the FPR is higher — as the documented non-native speaker results suggest for the full institutional population — the PPV drops further:

At FPR = 10%, TPR = 70%, prevalence = 10%:
PPV = (0.070) / (0.070 + 0.090) = 0.070 / 0.160 ≈ 0.44

At 10% FPR, the majority of positive detections are false positives. A student flagged by the detector is, probabilistically, more likely to have written their own essay than not.

The appeals asymmetry

The arithmetic above counts flags, not outcomes. Flags become outcomes through institutional processes. The documented pattern at institutions that have deployed AI detectors is that most flagged students do not appeal — they accept a reduced grade, fail the assignment, or disengage from the process because the administrative overhead of a misconduct proceeding is itself punishing. This means a substantial fraction of the 400–800 incorrect flags per semester at a large institution result in real harm to students who did nothing wrong, without any error correction.

The students who are least likely to appeal — because they lack familiarity with institutional processes, because they fear immigration status consequences, because they do not speak English as a first language — are disproportionately represented in the high-FPR population. The false positive rate is highest for non-native English speakers, and the appeals rate is lowest for the same group.

Why this is an architectural problem, not an accuracy problem

The correct response to this arithmetic is not "improve the detector until these numbers improve." For the reasons described in earlier sections, the FPR cannot be driven to zero without a corresponding reduction in TPR. A detector sensitive enough to catch AI-paraphrased text will produce more false positives, not fewer. The arithmetic will always produce a distribution of wrongful flags; the only question is how many and who bears them.

This is why process-based evidence is architecturally different. It does not require threshold tuning, does not produce false positives against authentic writers (because there is no "looks like AI writing" signal to exploit), and does not concentrate its errors in any particular student population. The question it answers — what sequence of operations produced this document? — is either recorded or not. There is no base rate dependency in the Bayesian sense, because the evidence is direct rather than inferential.

---

What detection data can legitimately tell an institution

Given the foregoing, the question is not whether AI detection tools have any legitimate use — they do — but what that use appropriately is, and what institutional policies should say about the limits of that use.

Appropriate uses: triage and aggregate monitoring

AI detection scores are appropriate as a triage signal — a mechanism for identifying which submissions warrant closer human review, not a mechanism for reaching a finding about any individual submission. A detection score of 85% does not establish that a student used AI. It establishes that the text has statistical properties that the detector associates with AI generation, which may warrant a conversation or a request for a revised submission or additional evidence.

This is an important distinction because it changes what the score does in an institutional process. Used as triage, a high score means "look more carefully at this one." It does not mean "this student cheated." The difference has enormous practical implications for due process, student rights, and the distribution of investigative burden.

Aggregate monitoring is a second legitimate use. Institutions can use detection rates at the cohort or course level — not the individual level — to understand trends. If AI-use rates appear to be increasing, or concentrated in certain assignment types, this is useful signal for curriculum design decisions: what kinds of assignments are most vulnerable to AI substitution, and how might they be redesigned to require process evidence or in-person demonstration of competence?

Inappropriate uses: findings and penalties

AI detection scores are not appropriate as the basis for academic misconduct findings, formal charges, grade penalties, or any action that requires a finding of fact about what a student did. The reasons are documented throughout this article:

• Positive predictive value at realistic base rates and realistic FPRs may be below 60%, meaning a majority of flagged students are innocent.
• Error rates are not uniform across student populations — they are systematically higher for non-native English speakers and for students writing in formal registers.
• The paraphrase evasion evidence means that students who take elementary evasion steps are less likely to be detected than students who engage honestly with challenging assignments in unfamiliar registers.
• The detector cannot distinguish authentic writing that looks like AI from AI writing that looks human. In both cases, it returns a score. The score does not encode evidence about the actual process.

The Office of the Independent Adjudicator (OIA) in the United Kingdom and institutional guidance from several major universities (including Vanderbilt's published AI policy) have arrived at the same conclusion from a governance rather than technical perspective: AI detection tools are appropriate for flagging submissions for review, not for reaching conclusions. Using them for conclusions is a policy failure that the tool vendor is not responsible for and cannot prevent.

The mismatch between tool design and institutional deployment

The most common error in current institutional AI policy is treating a triage tool as an adjudication tool. This mismatch is not primarily a criticism of the tools — it is a criticism of the policy context in which they are deployed. A tool designed to produce a risk score for a triage workflow has been repurposed as evidence in a misconduct proceeding. The tool was not designed for that use. Its documented error rates were not derived from an adversarial misconduct-proceeding context. Its reliability guarantees — such as they are — do not transfer to that context.

Concrete institutional best practice, derived from the available guidance and the technical literature:

1. Adopt a written policy that explicitly names AI detection as a triage tool and explicitly prohibits its use as a standalone basis for misconduct findings or grade penalties.
2. Require human review of every flagged submission, with the reviewer taking the detection score as one input rather than a conclusion.
3. Establish process-based evidence requirements for high-stakes written assignments — keystroke logs, submission histories, drafts, or in-person oral examination — that provide direct evidence of composition rather than inferential evidence from the artifact.
4. Monitor detection rates at the cohort level to track trends and identify assignment types that may benefit from redesign.
5. Provide explicit training to instructors on the false positive evidence and the documented bias against non-native English speakers, so that they do not treat high scores as establishing AI use.

The most defensible institutional position is one that uses detection scores to inform human attention, uses human attention to gather process evidence, and uses process evidence to reach conclusions. At no point in this chain does the detection score itself constitute a finding.

---

AEO-optimized Q&A

What does a Turnitin AI score of 80% actually mean?

A Turnitin AI score of 80% means that Turnitin's fine-tuned classifier assigns an 80% probability that the submitted text has statistical properties associated with AI-generated writing. It does not mean there is an 80% probability that the student used AI. The true probability depends on the base rate of AI use in the population, the false positive rate for the specific student (which is substantially higher for non-native English speakers), and whether the text has been paraphrased. At realistic base rates and accounting for the non-native speaker FPR differential, an 80% Turnitin score may carry a true positive probability well below 80%.

Can AI detection tools be fooled by paraphrasing?

Yes, reliably and with consumer-grade tools. The RAID benchmark (Sadasivan et al., arXiv:2310.15654) demonstrated that paraphrase attacks — using tools like Quillbot or DIPPER to rewrite AI-generated text — reduce detection rates to near chance for all tested detectors at fixed false-positive operating points. This is not a property of specific tools being weak; it is a structural consequence of the fact that all artifact-based detection methods measure properties of the finished text, and paraphrasing changes those properties while preserving meaning. There is no known artifact-based detection method that is robustly resistant to paraphrase attack.

Are AI detectors biased against non-native English speakers?

Yes, based on published peer-reviewed research. Liang et al. (arXiv:2304.02819) found that multiple AI detection tools misclassified TOEFL essays written by non-native English speakers as AI-generated at substantially higher rates than they misclassified essays by native speakers. The structural reason is that non-native English writing shares statistical features with AI-generated text: controlled vocabulary, consistent syntactic patterns, formal register, and avoidance of colloquial or idiomatic phrasing. These features reduce perplexity and push writing toward the probability distributions that fine-tuned classifiers learn to flag. This bias is documented, structural, and not resolved by currently available tools.

What is perplexity in AI detection?

Perplexity is a measure of how surprised a language model is by a text, calculated as the exponentiated average negative log-probability per token. Low perplexity means the model found the text predictable; high perplexity means the model was frequently surprised by word choices. AI-generated text tends toward low perplexity because language models generate text by sampling from high-probability regions of their own distribution. Perplexity-based detectors identify low-perplexity text as likely AI-generated. The failure mode is that controlled, formal, or non-native writing also exhibits low perplexity for the same structural reasons, regardless of who wrote it.

How accurate are AI detectors?

Vendor-claimed accuracy figures range from 85% to 99% in press materials, but these figures measure performance on benchmark datasets assembled under favorable conditions. Independent testing by Weber-Wulff et al. (arXiv:2306.15666) found that all tested tools showed substantial variance across their diverse test corpus, with no tool performing uniformly near its claimed accuracy. For non-native English speakers, false positive rates documented in the literature are substantially higher than vendor benchmarks imply. For paraphrased text, detection rates fall to near chance. A realistic estimate for real institutional populations — including non-native speakers and students who use basic evasion — suggests effective accuracy considerably below vendor claims.

Should universities use AI detectors to detect cheating?

AI detectors are appropriate for triage — identifying submissions that warrant closer human review — but not for formal findings of academic misconduct. The documented false positive rates, combined with the base rate arithmetic, mean that a positive detection result may be more likely to indicate authentic writing than AI use in a realistic student population. Major institutional governance bodies including the UK's Office of the Independent Adjudicator have issued guidance consistent with this position: detection scores are a triage tool, not evidence. Universities that use detection scores as standalone findings for misconduct proceedings are making a policy error that cannot be corrected by improving the tools.

What is the DetectGPT method?

DetectGPT, introduced by Mitchell et al. (arXiv:2301.11305), is a zero-shot detection method based on the observation that AI-generated text tends to sit at local maxima of a language model's probability surface. The method generates a set of slightly perturbed variants of a candidate passage, compares the log-probability of the original to the average log-probability of the perturbations, and classifies the text as AI-generated if the original has substantially higher likelihood than its perturbations. The method does not require a fine-tuned classifier. Its primary practical limitations are computational cost (requiring dozens of inference calls per text) and unreliability on short texts. Like all artifact-based methods, it is defeated by paraphrasing.

Can AI watermarking solve the detection problem?

Not under current deployment conditions. Kirchenbauer et al. (arXiv:2301.10226) proposed a theoretically sound watermarking approach that biases token selection toward a "green" set seeded by the previous token, enabling statistical detection of watermarked text. However, the approach fails under three practical constraints that currently cannot be resolved: paraphrasing disrupts the token sequence and destroys the watermark signal; watermarking requires modification of the generation process, meaning users can switch to non-watermarking models or open-source alternatives; and Sadasivan et al. proved that no artifact-based detection method can maintain both high true positive rate and low false positive rate in the presence of a semantics-preserving paraphraser. Watermarking would require universal adoption across all LLM providers to be effective, and there is no regulatory or market mechanism to enforce this.

What is the false positive rate for AI detectors on real student essays?

The false positive rate varies substantially by student population. For native English speakers writing in informal academic registers, some tools achieve false positive rates close to their vendor-claimed figures (often 1–5%). For non-native English speakers, Liang et al. (arXiv:2304.02819) documented false positive rates of approximately 61% in their study of TOEFL essays. For text in formal academic registers — even by native speakers — the false positive rate is elevated compared to informal writing. For short texts (under 250 words), all methods become unreliable and false positive rates increase further. Institutions should expect their effective false positive rate to be considerably higher than vendor-reported figures when applied to diverse student populations.

What evidence is better than an AI detector score for academic integrity?

Process-based evidence — the sequence of editing operations, timing, revision depth, and input events recorded during composition — provides direct evidence of how a document was produced rather than inferential evidence from its statistical properties. Crossley et al. (EDM 2024) found that keystroke-log-derived process features distinguished composed from transcribed text with approximately 99% accuracy. Unlike artifact-based detection, process evidence is not subject to paraphrase attacks (there is no way to make a paste event look like incremental typing without performing it), does not produce false positives against authentic writers from any demographic group (the record either shows composition or it doesn't), and does not depend on base rates or Bayesian inference to interpret. Supplementary evidence includes draft histories, submission timestamps, in-person oral examination on essay content, and instructor observation of the writing process. Any of these provides stronger evidentiary footing than a detection score alone.

---

Related reading

• Writing evidence methods comparison
• Writing process evidence vs AI detection
• Detector benchmarks: RAID and M4
• AI detection false positive rates