AI Detector False Positives: What a 0.5% Cap Really Means

AI detectors are now used to make consequential calls on published content, student submissions and agency deliverables. Accuracy is the headline number. The false-positive rate for your kind of writing is what decides whether the tool is safe to use on your content.

A false positive is any verified human document a detector calls AI. The rate can vary by type of writing, by passage length and by how closely the documents used to set the threshold resemble the content being tested. A tool that is accurate on a balanced test set may still flag a larger share of human text in kinds of writing it was not tested on. That is not a labeling error in the narrow sense; it is a consequence of where the threshold was placed and what documents were used to set it.

The stakes are rising. According to AI Detector: The Complete 2026 Guide by Mohab A. Karim, the Academic Integrity Council found that 87% of universities updated their AI policies between January 2025 and early 2026, and a RAND survey found 54% of students and 53% of teachers using AI for schoolwork, while only 45% of principals reported having any school or district AI policy. The AEO Content AI Content Detector uses a ModernBERT classifier and a predictability check from a pair of open Qwen2.5 models, held to a 0.5% false-positive cap in every register rather than a single aggregate rate.

What will determine which AI detectors remain credible in the next 12-24 months?

We expect detectors to be judged more on false-positive rates published for each kind of writing than on headline accuracy. These are forecasts from current signals, not findings.

Three signals are already visible in our sources, and all three push the same way: toward buyers who ask for specific error rates rather than one overall accuracy figure.

One gap remains. As Karim puts it, the industry is "full of vendors publishing their own accuracy numbers, which is a bit like a company grading its own exam." Edited and paraphrased text is also harder: RAID (ACL 2024) found detectors easily fooled by adversarial attacks, sampling changes, repetition penalties and unseen models, and in our own tests GPT-4 text rewritten sentence by sentence with the DIPPER paraphraser was called AI only 31% of the time by our current detector. Independent, per-writing-type testing is the audit I would want to see before placing consequential trust in any single tool's aggregate claim.

Where does the false-positive rate climb, and which writing register is most exposed?

Formal institutional prose. Our previous detector called 8 of 637 US federal agency documents AI (1.26%) and 4 of 2,868 pre-2021 Medium posts (0.14%), seven times the 0.02% we saw on marketing blogs.

The Medium result is worth reading closely. The rate there was 0.14%, with a 95% upper bound of 0.36%, under our cap overall. The four posts called AI were a USAID program update, a policy analysis of an Affordable Care Act bill, a technology company's design case study and a list of 100 headline-style post titles. Three of the four were neutral, well-organized institutional prose, and there were no false positives in tech tutorials, data science, crypto and finance, startups, personal essays or culture writing. The agency documents pointed the same way: the hardest source was the State Department's ShareAmerica, plain English written for international readers, with 5 of its 90 documents called AI.

Our data does not show why institutional prose gets misread. A plausible explanation is that it is the register AI models imitate by default: neutral, explanatory and information-dense. Reinhart et al. (PNAS, February 2025) found model writing noun-heavy and information-dense, with a larger gap from human writing for instruction-tuned models than for base models. We did not test why marketing blogs came out lower, so we do not offer a reason.

A common assumption is that older human content is safe from AI detectors. The Medium archive predates ChatGPT by years, yet the false-positive rate on it was still seven times the rate on marketing blogs and client archives. Age did not protect the text. Dates also mislead in the other direction: in one payments company's blog, 7 of 50 posts from January to October 2022 already read like GPT-3 or Jasper output, so we only trust human labels for text dated 2021 or earlier.

Our archives are not the only place the rate climbs. As James Kuhman summarizes in What an AI Detector Cannot Prove, Liang and coauthors tested seven detectors in 2023 on 91 TOEFL essays by non-native English speakers: on average the detectors falsely classified 61.22% of them as AI-generated, all seven misclassified the same 18 essays, and the same detectors performed nearly perfectly on 88 essays by American eighth-grade students.

Passage length is a separate variable. When we cut verified human Medium posts into 50-, 100-, 200- and 300-word chunks, our detector called 1.0% of the 50-word chunks AI and none of the longer ones. Very short tails caused trouble elsewhere: two of three false alarms in one 2019 blog were 47- and 62-word call-to-action tails, so we now drop tails under 150 words. A plausible explanation is that very short passages give a classifier too little text to go on, but we have not tested that directly.

Training runs add a third source of variation. Retraining the identical recipe moved the not-called rate on human documents from 0.22% to 0.66%, and recall on pipeline articles at the strict threshold from 97.8% to 92.4%. The runs varied as much as the effects we were trying to measure, so no single run is canonical. We only ship a model after confirming it on fresh data that took no part in choosing it.

Small rates also add up with repetition. In The Problem with AI Detector Companies, Tim Requarth cites Princeton computer scientist Arvind Narayanan's calculation that if every instructor ran an AI detector on all student work, roughly 500 to 1,000 written works over four years, 5 to 10 percent of the student body would be falsely accused of cheating at some point. A rate that looks tiny per document stops looking tiny across a whole degree.

The not-called zone, documents whose highest passage scores at least 0.5 but below 0.998, is our response to that uncertainty. Rather than force a verdict, the detector withholds one. On pre-2021 Medium posts, 0.73% were not called, against 0.22% on the older pool: coverage we give up rather than force a call.

How does targeted recalibration reduce agency prose false positives, and what does confirmation on fresh data prove?

By retraining: we added 100 documents from other federal agencies to the training set. Agency false positives fell from 8 of 637 (1.26%) to 2, with none on 511 documents from unseen agencies.

The previous detector (v8d) was above our 0.5% cap on agency prose. The new training documents came from agencies such as the CDC, NIH, FDA and EPA. We keep whole sources on one side: an agency is used either to train the detector or to test it, never both. Our agency test used 9 agencies for testing, 11 for training, and 8 more that we collected only after choosing the model. The retrained version (v9b) called 2 of the 637 agency documents AI, 0 of 4,546 verified human documents and 2 of 2,868 Medium posts, while still catching 99.6% of held-out AI articles.

Because we trained and compared five candidate models, picking the best one on those test sets could flatter it. So we confirmed the winner on data that took no part in choosing it: 511 documents from 8 agencies never used anywhere, where the old detector made 3 false positives and the new one 0, and 1,401 fresh Medium posts from authors not in the first sample, again 3 before and 0 after.

Earlier versions show how much one training cycle can change. Before we recalibrated it, our v6 head called 2.06% of a 2,931-document human pool AI, far above the cap. Version v7 called 1 of 4,546 (0.02%), and the current version 0 of 4,546 (95% upper bound 0.08%). Improvements did not spread evenly: v8d was under the cap on Medium posts while breaking it on agency prose, which is exactly the kind of concentration an average hides.

On pre-2021 Medium posts, the not-called rate rose to 0.73%, against 0.22% on the older pool. Documents in the not-called zone receive no verdict: the detector withholds a call rather than force one. We do not know why Medium posts landed there more often; the data records that they did, not the reason.

The published numbers carry limits. They are internal evaluations on held-out data, not an independent audit. The language models used for scoring have likely read old public text during their own training, which can make human text look more predictable to them. And the strongest proof, human writing that was never published anywhere, is the next dataset we are adding. Until then, the confirmation sets are the best evidence we have that the rate holds on text the model never saw.

Outside tools face the same test of consistency. In The Problem with AI Detector Companies, Tim Requarth reports that the Wall Street Journal's James Taranto ran three op-eds through Pangram, which claims a false-positive rate of 1 in 10,000, and got results that did not match the researchers' own labels; Taranto called them "wildly inconsistent." Requarth later conceded that Pangram is "quite accurate on fully AI-generated text from major models, even on short bits of text." A vendor's claimed rate is a starting point for questions, not a substitute for results you can check.

The clearest conclusion from both versions is that a single average hides where errors concentrate. The 1.26% agency rate was not spread across all writing; it sat in one register, and adding training examples of that register brought it back under the cap. A cap checked in every register exists to catch exactly that kind of hidden concentration before it reaches a specific writer's work.

What does false-positive rate actually measure, and why doesn't detector accuracy tell you?

A false-positive rate is the share of verified human documents a detector calls AI. Our current detector called 0 of 4,546 such documents AI, with a 95% upper bound of 0.08%.

Accuracy and false-positive rate are separate numbers, tied together by the threshold. Mohab A. Karim's guide sums up a point the RAID benchmark makes: you cannot fairly compare two detectors' accuracy numbers unless you know what false-positive rate each one was tuned to. A detector tuned to catch more AI text will usually flag more human writing, and one held below a fixed false-positive ceiling has to accept some misses. We saw that trade-off in our own training: adding 404 human marketing posts drove human false positives to zero but cost 13-27 points of recall on AI articles.

Accuracy is the share of all documents classified correctly, and it can look strong while false accusations pile up. James Kuhman illustrates the base-rate problem in What an AI Detector Cannot Prove (Medium, September 2026) with a hypothetical: among 1,000 submissions in which 50 break an AI-use rule, a detector that finds 40 of them but falsely flags 5% of the other 950 produces about 48 false accusations alongside 40 correct flags. By our arithmetic that detector is still about 94% accurate, yet most of the work it flags is human.

A useful frame for evaluating any detector is what I call the two-axis check. First: what share of AI text does the detector catch? Second: what share of verified human text in your specific writing register does it flag? The second question determines whether the tool is safe to use on your content.

A common misconception is that high overall accuracy implies a low false-positive rate on human writing. It does not, and careful writers can pay for the gap. A short explainer video, Turnitin AI Detection False Positives | Can AI Flag You By Mistake, warns: "if your writing is too perfect too structured or too clean it can get flagged even if it is 100% human," because skilled human writing and AI writing are starting to look similar. That is the narrator's explanation rather than a measured result, but it fits what we saw: the human writing our previous detector misread most often was neutral institutional prose.

Our detector is held to a 0.5% false-positive cap in every writing register, not just on average. The rule applies to each kind of writing we test, from client archives dated 2021 or earlier and archived marketing and SEO blogs to open-web text, sports and health copy, pre-2021 Medium posts and US federal agency prose. The current version called none of 4,546 documents across 17 registers AI, which carries a 95% upper bound of 0.08%: with 95% confidence, the true rate on writing like that pool is no higher than 0.08%. Across all 9,963 verified human documents we tested, it called 4 AI.

Specificity of evidence may also shape how a passage reads, though this result comes from AI-drafted articles, not human writing. On one sports equipment manufacturer's site, sections built on the company's own sales and shipping records read AI 37% of the time, against 71% for the other sections of the same articles. For a payments company whose articles used general industry figures, the split was 98% against 100%, so the effect is not general. A plausible explanation is that facts only one company could publish are harder to write generically, but the data does not prove it.

The question most buyers ask is whether an AI detector is accurate. The more useful question is whether its false-positive rate holds below a documented ceiling in every kind of writing it screens. Those are different questions, and the answer to the first tells you little about the second.

Some vendors now publish low headline false-positive rates: Pangram claims 1 in 10,000, and Turnitin publishes under 1% on documents with more than 20% AI text. Treat those as claims to check, not results. The question that belongs in any evaluation is not "how accurate is this tool?" but "what is the false-positive rate on the kind of writing I produce, and on what documents was it confirmed?"

The right response is not to dismiss detectors as unreliable. It is to require a documented error rate by type of writing from whoever runs them, and to check that the confirmation data was held out rather than drawn from the pool used to choose the model. Our own numbers are stated above: 0 of 4,546 verified human documents called AI and 4 across all 9,963, internal results rather than an independent audit. You can test a draft with the free AI Content Detector.

We apply the same standard of evidence to writing. The AEO Content Engine produces articles grounded in each company's own records, written to read like expert human writing and structured so AI answer engines can cite them.

This article is part of our research series on how AI writes and how humans write. The overview of the whole series is How AI Writes vs How Humans Write.