How AI Detectors Work and Where They Break

We rebuilt our detector around a rule set from day one: at most 0.5% of human documents may be called AI, in every kind of writing, not just on average. A score should never serve as an accusation unless you know how often the tool wrongly calls human writing AI. Our reading of the evidence is that general-purpose detectors mostly key on the habits of raw instruction-tuned output, such as predictable wording, uniform rhythm and stock phrases. That is a plausible explanation rather than a proven mechanism, but it makes their blind spots easier to anticipate.

The market splits between two families. Trained classifiers learn a decision boundary from labeled examples of human-written and AI-generated text. Zero-shot methods such as Binoculars and Fast-DetectGPT need no labeled data: Binoculars, for example, compares how surprising a text is to one language model with how surprising a closely related second model would expect it to be. Both fail under adversarial conditions, but not in the same way.

The RAID benchmark (ACL 2024) found detectors easily fooled by adversarial attacks, changes in sampling, repetition penalties and models they had not seen. Paraphrasing is the sharpest case: in the DIPPER study (NeurIPS 2023), rewriting cut DetectGPT's detection from 70.3% to 4.6% at a 1% false-positive rate. Trained classifiers, for their part, misfire when the writing they check differs from the writing they learned from.

This article covers both families, the evidence behind their breakdowns, and what rebuilding our own detector taught us about setting thresholds on real content.

What Does an AI Detector Actually Measure?

Trained classifiers measure how closely a text matches labeled AI and human examples; zero-shot methods measure how predictable it is to a language model. Neither observes who actually wrote it.

Knowing which family a tool belongs to is the first step toward predicting where it will fail. I call this the origin-or-predictability test: ask whether the tool learned what AI-written text looks like from labeled examples, or whether it scores each passage against a language model's own probability estimates. The test is harder to apply to closed products, and The AI Detector Dilemma on Medium notes that most detectors don't publicly disclose what their training data includes, as of September 2026.

Trained classifiers learn a decision boundary from labeled examples of AI-written and human-written text. Our own trained head held its verdicts across input format: in our 30 August audit, the same page scored 8 to 12 points differently when checked by URL versus pasted text, enough to flip a verdict, while the trained head flipped 0 of 30 verdicts between the two. The weakness is coverage. An early version of our head, trained without open-web human text, flagged about 31% of ordinary web writing as AI, the classic trap of learning "polished" instead of "machine-written". The amount of human training text mattered more than we expected: adding 404 human marketing posts drove human false positives to zero but cost 13-27 points of recall on AI articles, while 50 posts cost nothing.

Zero-shot methods, such as Binoculars and Fast-DetectGPT, score how predictable a text is under a reference language model, building on perplexity, a measure of how surprised the model is by each next word. Raw instruction-tuned output tends to be more predictable than human writing, so high predictability counts as a sign of AI. Humanized text breaks that logic. In our audit, every zero-shot method we tried (GPT-2 perplexity, and Binoculars with 0.5B and 7B model pairs) was blind to humanized output, which overshoots the human band: Binoculars scored about 1.06 for humanized output against about 1.00-1.05 for human text.

A common misconception is that detectors all react to the same surface style. Our audit showed how far a surface score can mislead: our old style score ranked humanized pipeline output as more human than real human client archives (AUROC 0.22), because it measured the same surface features that humanizing optimises. A detector is only as good as the examples and thresholds behind it.

Language is another blind spot. Karen Covey (Do AI Detectors Work for Non-English Content? Let's Test It, Medium, October 2025) ran the same short paragraph in five languages through one detector: the English version came back "likely human" and the Korean version "100% AI". A second detector reshuffled the verdicts, rating the Korean version "mostly human" and the English one "questionable". Describing a friend's classroom test, she wrote that "the detector wasn't detecting AI. It was detecting difference."

Formal human writing carries its own risk. Across 9,963 verified human documents, our current detector called 4 AI, and the errors we found cluster in formal, institutional prose: the previous version called 8 of 637 US federal agency documents AI, and the open desklib detector called 4.1% of them AI at its 1% threshold. A graduate student whose flagged assignments were a grant proposal and a literature review made a similar point about those formats in a Reddit post about a Turnitin flag.

A score tells you which pattern a text resembles to one tool. It does not tell you who wrote it.

Why Do Evasion Techniques Work on Some Detectors and Fail on Others?

Evasion results vary because each detector learned different signals and uses different thresholds. The same prompt can pass one tool and fail another, and paraphrasing remains hard for both detector families.

According to Asifa Haroon Narejo (Medium, January 2026), who tested more than 50 prompt variations against Turnitin, GPTZero, Originality.ai and ZeroGPT over two weeks, only 3 of those prompts consistently scored below 10% across the four tools. Her own figures show the spread: the prompt she calls "The Human Imperfection Protocol" scored 8% on GPTZero, 4% on Originality.ai, 0% on ZeroGPT and 12% on Turnitin. She put prompts at "70% of the way" to a low score, with manual editing doing the remaining 30%. Her explanation: "AI detectors look for three things: perfect grammar, consistent tone, and smooth transitions. This prompt intentionally breaks all three patterns." She added that the same prompts "might work differently in six months." These are self-reported results from single tests, not an independent evaluation.

That explanation is one writer's theory of what detectors look for, not a documented mechanism. Breaking grammar and tone only matters to a detector that weighted those signals in training, and most vendors do not publish what their training data includes.

Surface signals can be counted and corrected. We measured a fleet of AI-drafted articles at 12.9 dash-punctuation marks per 1,000 words, against 0.8 in one company's own pre-AI blog. An outside AI-detection review of that site reported "about 14 em-dashes per 1,000 words" on pages with no em-dash characters at all, because detectors fold the em-dash, en-dash and spaced hyphens into one signal. After we replaced the writing rule with a budget of 2 dash marks per 1,000 words, new articles measured 1.69 per 1,000 words.

Correcting those signals has a ceiling. Removing reused phrases, dashes and fixed skeletons makes articles stop looking alike, but it does not erase the underlying model style: in our September test, 81-100% of generated prose sections still read AI to a detector trained on that pipeline, even with shared phrases at 0.5% or less of each section.

The deeper point is that style and origin are different readings, and our detector reports them separately, never blended. Style describes how generic or distinctive the writing reads; origin estimates who most likely wrote it. On one sports equipment manufacturer's site, 288 human-written posts from 2009-2018 and 30 AI-drafted buying guides from 2026 scored in a similar style band (57 against 68 on our style scale), yet our detector flagged 0.7% of the human posts and 73% of the AI guides. Style overlapped; origin did not.

Institutional prose shows the risk on the human side. When we ran 2,868 pre-2021 Medium posts through the previous version of our detector, it called 4 AI (0.14%). Three of the four were institutional prose; the fourth was a list of titles. The current version called 2 of 2,868, and 2 of 637 US federal agency documents, where the previous version had called 8. We confirmed the new version on data that took no part in choosing it: 1,401 fresh Medium posts (old version 3 false positives, new 0) and 511 documents from 8 agencies never used anywhere (old 3, new 0). One plausible explanation for the pattern is that neutral, well-organised institutional prose is the register AI models imitate by default.

The arms-race framing applies to both families. Sentence-level paraphrasing remains the hard case for trained classifiers too: GPT-4 text rewritten with the DIPPER paraphraser was called AI 18% of the time by one version of our detector and 31% by the next, and adding 600 instruct-model rewrites to training moved DIPPER recall only from 8% to 9%.

How Should You Interpret an AI Detector Score?

A detector score tells you how closely a text resembles what one tool learned to flag, at that tool's threshold. It does not resolve who wrote the text.

The four open detectors that scored our held-out articles as human were not malfunctioning. With thresholds set so at most 1% (and, separately, 0.5%) of verified human documents were called AI, confirmed on 8,540 other human documents, they caught 13-80% of ordinary public AI text from HC3, Beemo, MAGE and RAID, with Fakespot at 80% and desklib at 66%. On our 223 held-out pipeline articles they called none AI and ranked the articles as more human than real human writing (AUROC 0.22-0.40). A classifier trained on our pipeline's own output separated the same articles perfectly (AUROC 1.000), so a learnable fingerprint exists; general-purpose detectors simply do not carry it. Commercial detectors such as GPTZero and Pangram were not tested. A plausible explanation is that open detectors mostly key on artefacts of raw instruction-tuned output, which careful humanizing removes.

We publish our detector's errors on human writing as well as its catches, because the false-positive side decides whether a threshold is defensible. Across 9,963 verified human documents it made 4 false positives. On 4,546 documents across 17 registers, from client archives dated 2021 or earlier and Wayback snapshots of marketing blogs to C4 open-web text and sports and health copy, it called 0 (95% upper bound 0.08%). On AI text it was never trained on, it called 222 of 223 held-out pipeline articles AI and 144 of 146 articles written after its training cut-off. Training runs vary too: retraining the identical recipe moved "not called" on humans from 0.22% to 0.66% and strict pipeline recall from 97.8% to 92.4%, so we only ship a model after confirming it on fresh data.

Small error rates also compound. According to Tim Requarth, writing on Substack, Pangram claims a false positive rate of 1 in 10,000. Princeton computer scientist Arvind Narayanan calculated that if every instructor ran a detector on all student submissions, 500 to 1,000 written works per student over four years, 5 to 10% of students would be falsely accused of cheating at some point. A University of Maryland preprint co-authored by four Pangram employees scanned 250,000 newspaper articles and claimed 9% of U.S. news contains AI-generated text; its lead author said the team reports "trends at an aggregate level." Requarth called Pangram "probably a decent tool for studying population trends" and described using it against individuals as a fundamentally different application. The Wall Street Journal's James Taranto ran three accused op-eds through Pangram's public website and got different results than the researchers' own database. Requarth later issued a correction conceding that Pangram is quite accurate on fully AI-generated text from major models, while keeping his criticism of accusations against individuals.

Running the same text through several tools and noting where they disagree reveals more than any single score. Disagreement means the tools weight different signals or set different thresholds, which is a fact about the tools, not about the text.

Our reading, labeled as such: general-purpose detectors mostly key on the habits instruction tuning leaves in raw model output, so their blind spots are predictable. Zero-shot methods were blind to humanized content in our audit; trained classifiers misfire when their training data does not cover a kind of writing, and paraphrasing remains hard for both; and any detector's false-positive risk grows when it is applied again and again to the same pool of writers.

What Should Content Professionals Expect From AI Detection Over the Next Two Years?

More institutions will write numeric score thresholds into policy, while disagreement between tools and uneven follow-through on flags remain unresolved. Detector accuracy alone will not settle how scores are used.

Based on our own measurements and the public record, three signals stand out for content operations and academic institutions over the next 12-24 months:

The contrarian read: detector accuracy is not the only limiting factor in these scenarios. At thresholds set on verified human text, the open detectors we tested caught 13-80% of ordinary public AI text, so detection is uneven even before any humanizing. What limits fair application just as much is whether institutions publish their methods, keep tools within the kinds of writing they were tested on, and act consistently on the flags they receive.

What Comes After Binary Human-vs-AI Detection?

Research is moving from whether AI wrote a text toward which model wrote it. Model attribution can already tell major AI systems apart, even after the text is rewritten.

Sun et al. (ICML 2025) reached 97.1% accuracy telling apart text from ChatGPT, Claude, Grok, Gemini and DeepSeek, and the signal persisted after rewriting, translation and summarization. That is model-level fingerprinting, not binary classification. It fits what we saw in our own tests: humanized articles passed the four open detectors we tested, but a classifier trained on our pipeline's output separated the same articles perfectly (AUROC 1.000), and commercial detectors such as GPTZero and Pangram were not part of that test. Humanized text is not untraceable.

The accountability problem Tim Requarth described persists: when the same companies co-author the research and sell the product, aggregate accuracy can end up used as evidence against individuals. What changes that is less a better score than policy that separates screening from accusation, set by institutions rather than left to individual instructors or editors.

For content operations, the working guidance holds: know each tool's false-positive rate for the kind of writing you publish, not just its default threshold; document what you measure and where you miss; treat disagreement between tools as information; and never treat a score as a verdict. To see a reading for your own text, the free AEO Content AI Detector shows one for each passage of about 300 words it scores.

For teams publishing at scale, the AEO Content Engine produces articles grounded in each company's own records, written to read like expert human writing and structured so AI answer engines can cite them.

This article is part of our research series on how AI writes and how humans write. The overview of the whole series is How AI Writes vs How Humans Write.