Can AI Fool AI? Inside the Battle Between Detectors and Humanizers
Perplexity formulas, green-list watermarking, the Sadasivan-Feizi impossibility argument, the Liang 61.3 percent bias…
Can AI Fool AI? Inside the Battle Between Detectors and Humanizers
Perplexity formulas, green-list watermarking, the Sadasivan-Feizi impossibility argument, the Liang 61.3 percent bias result, and the mathematical reason why detection of statistically-indistinguishable text by an adversary with classifier access is structurally hard. A slow, technical walkthrough of the entire stack.
Arize AI’s community-reading banner for Kirchenbauer et al.’s “A Watermark for Large Language Models” (ICML 2023). The paper is the foundational technical reference for every watermarking scheme now in production, including SynthID Text. Author John Kirchenbauer walked through the paper’s algorithm, the green-red list construction, and the statistical detection test in the linked community session. Image credits: Arize AI, “A Watermark for Large Language Models — TL;DR With Paper Author,” 2025. Source: https://arize.com/blog/a-watermark-for-large-language-models/ · Original paper: https://arxiv.org/abs/2301.10226
The Statistical Paradox at the Center of the Field
Take a paragraph that a human unambiguously wrote, run it through the most-used commercial AI detector on the market, and the result comes back as 99 percent AI-generated. Take a paragraph that GPT-5 wrote, run it through a humanizer service that charges nine dollars a month, run the rewritten output through the same detector, and the result comes back as 99 percent human-written. Both detectors are operating exactly as their training optimized them to. Both results are wrong with maximum confidence. The detector’s company will tell you, accurately, that the detector achieves 99 percent accuracy on its benchmark. The humanizer’s company will tell you, accurately, that it bypasses every commercial detector at a 95 percent rate. Both companies are telling the truth. The truths are not reconcilable.
This is the structural paradox at the heart of the entire AI detection field in 2026. It exists because “accuracy” in the AI detection literature is measured against two different populations of text unmodified frontier-model output (where detectors do well) and adversarially humanized output (where they do not) and the public number the industry reports almost always refers to the first one while the actual use case almost always involves the second. The detector benchmark and the humanizer benchmark are statistics about disjoint distributions. Both are correct; neither is informative about what the user actually wants to know, which is whether a specific suspect piece of text was authored by a person.
This article is the technical anatomy of that paradox. We will walk through the actual mathematics of how AI detectors classify text (perplexity, burstiness, the log-likelihood ratio test), the architecture of how humanizers evade those classifiers (gradient-style adversarial training against detector APIs), the watermarking response from the major labs (Kirchenbauer green-red lists, SynthID tournament sampling, statistical detection via z-scores), the empirical 2026 benchmark data, the theoretical impossibility argument from Sadasivan and Feizi, and the structural reason this competition does not have a clean technical winner. The stakes University of Chicago Booth estimates more than 100 million academic submissions per year now pass through AI detectors, Stanford’s Liang paper found 61.3 percent of non-native English speaker TOEFL essays falsely flagged as AI-generated are large, growing, and disproportionately landing on populations that did not choose to enter this race.
“We propose a statistical test for detecting the watermark with interpretable p-values, and derive an information-theoretic framework for analyzing the sensitivity of the watermark.” — Kirchenbauer, Geiping, Wen, Katz, Miers, & Goldstein, A Watermark for Large Language Models, arXiv:2301.10226, ICML 2023
The Math of Detection: Perplexity, Burstiness, and the Hypothesis Test
To see why this race has the shape it has, you need to understand what an AI detector is actually computing. Marketing materials describe detection as “spotting AI-generated text.” That description is, at the architectural level, misleading. The detector is not reading your text. It is running your text through a reference language model, extracting a small number of scalar statistics, and applying a threshold-based classifier to those statistics. There are five or six numbers that matter, and once you see what they are, you also see why they are vulnerable.
The most important statistic is perplexity. For a language model with a vocabulary V and a probability distribution P(w_t | w_1, ..., w_{t-1}) over the next token, the perplexity of a text T = (w_1, ..., w_N) is defined as:
PPL(T) = exp( -(1/N) * Σ_{t=1}^{N} log P(w_t | w_1, ..., w_{t-1}) )This is the exponential of the average negative log-likelihood per token, computed against the reference model. The intuition is straightforward: perplexity is the geometric mean of the number of equally-likely candidates the model would have considered at each position. A text where the model would have considered roughly 10 candidates per word has perplexity around 10. A text where the model is genuinely uncertain encountering rare words, unusual constructions, or unexpected syntactic choices produces higher perplexity. A text that reads like the reference model’s own output produces lower perplexity, because at every step the actual next word is one of the model’s top predictions.
The detector’s first observation is that text generated by a language model trained on similar data to the reference model will, on average, have lower perplexity than text written by a human, because the generator is sampling from approximately the same distribution the detector is using to evaluate. The detector defines a perplexity threshold τPPL, and any text with PPL(T) < τPPL is more likely to be AI-generated than human-written. This is the foundation of every classical AI detector.
The second statistic is burstiness, formalized in the AI detection literature as the standard deviation or variance of per-sentence perplexity across a passage. For a passage divided into sentences s_1, …, sM, with per-sentence perplexities PPL(s1), …, PPL(s_M), the burstiness is approximately Var(PPL(s_i)). Human writing tends to be bursty some sentences are short and predictable, some are long and surprising, and the variance is high. Language model output tends to have uniform burstiness because the sampling process produces statistically similar sentences across the passage. The detector defines a burstiness threshold τ_B, and text with Var(PPL(s_i)) < τ_B is more likely to be AI-generated.
The third and fourth statistics are more recent additions. Stylometric features average sentence length, function-word frequency, type-token ratio, n-gram pattern frequency give the detector a more granular fingerprint of writing style. The fifth, used by the more sophisticated commercial detectors, is the log-likelihood ratio between two reference models: a model trained primarily on AI-generated text and a model trained primarily on human-written text. Computing the ratio of their probability assignments to the test passage gives a more discriminating signal than perplexity alone, because it explicitly contrasts the two hypotheses rather than only thresholding against one.
Each of these statistics is a scalar function of the text. The detector’s final classification is a function f(PPL, Var, stylometric_features, log_likelihood_ratio) → {AI, human} learned from training data. The function is typically a logistic regression, a gradient-boosted decision tree, or a small neural classifier, calibrated on labeled examples. The accuracy of the function depends entirely on whether the test population resembles the training population and that is the vulnerability the humanizer industry was built to exploit.
Figure 1 — Meta-analysis of 14 academic studies on AI detection accuracy, aggregated by Originality.ai in April 2026. Six commercial detectors plus four LLM-based detectors are evaluated across 16,000+ text samples. The cross-detector spread on the same population is large enough to demonstrate that detection accuracy is not a single number; it is a property of the joint distribution over text genre, generation model, and detector training set. Any commercial claim of “99 percent accuracy” should be read as a claim about a specific test distribution, not a universal property. Image credits: Originality.ai, “AI Detection Accuracy Studies — Meta-Analysis of 14 Studies,” April 1, 2026. Source: https://originality.ai/blog/ai-detection-studies-round-up
How Humanizers Actually Work — Adversarial Optimization Against the Classifier
The humanizer industry is younger than the detection industry but, in 2026, larger and growing faster. StealthGPT, Undetectable.ai, BypassGPT, WriteHuman, HIX AI, Humbot, and a long tail of smaller competitors collectively process tens of millions of “humanization” requests per month. The mechanics of how they work are an applied case study in adversarial machine learning, and the technical pattern is the same across all the major products in the category.
The first-generation humanizers (2022 to early 2023) were naive paraphrasers. They took AI text, fed it through QuillBot or a similar synonym-substitution tool, and submitted the result. This worked for a few months because the early detectors were essentially perplexity-only classifiers; swapping synonyms with less probable equivalents raised the perplexity of the text above the detector’s threshold. The approach stopped working as soon as the detectors added burstiness and stylometric features to their classifiers. Paraphrasing changed individual word choices but not the global statistical structure of AI text, and the second-generation detectors caught up within two months of the bypass being widely publicized.
The second-generation humanizers (mid-2023 to 2024) introduced adversarial optimization against the detector’s classifier function. The architecture is straightforward to describe and computationally accessible to any well-funded startup. The humanizer service runs in-house copies, or queryable API access, to every major commercial detector GPTZero, Originality.ai, Turnitin, Copyleaks, Winston AI, ZeroGPT. The service uses a large language model (typically a fine-tuned variant of GPT-4o, Claude 3.5, Llama 3, or Qwen) as the rewriter, plus a scoring loop:
- Input AI text T_0 arrives.
- The rewriter produces a candidate T_1 from T_0, conditioned on a prompt that asks for semantic preservation plus stylistic variation.
- T_1 is scored against every detector in the panel. The output is a vector of AI-probability estimates (p_1, p_2, …, p_k).
- If max(p_i) > θ (where θ is the bypass threshold, typically 0.1 to 0.3), the rewriter re-samples with a different temperature, a different prompt, or a different model and repeats.
- The loop terminates when every detector returns p_i < θ. The final T_n is returned to the user.
This is a black-box adversarial search against an ensemble of classifiers. It is the same architecture used in adversarial examples for image classifiers, applied to text. The reason it works reliably is that the detector classifiers are continuous functions of input-derived statistics, and the humanizer LLM is capable of generating text whose statistics land anywhere within a reasonably wide feasible region of the input space. The humanizer is solving a constrained optimization problem: minimize semantic distance to T_0 subject to the constraint that the detector-score vector lies in the “human” region of feature space. Such optimization problems almost always have feasible solutions when the adversary has score-level access to the classifier which, since the major detectors are commercial APIs that return probability scores, the humanizer industry effectively has.
The third-generation humanizers (2025 to 2026) added detector-specific fine-tuning. Rather than treat the rewriter as a frozen LLM and only optimize the search loop, the service fine-tunes the rewriter on a training corpus of (AI-text, humanized-text) pairs labeled with detector-score outcomes. The rewriter learns, at the weights level, what kinds of stylistic transformations move text outside the detector’s decision boundary. This is dramatically more efficient than search-based iteration and produces bypass rates that the earlier generations could not match. EyeSift’s 2026 head-to-head benchmark reported that current-generation humanizer outputs evade most commercial detectors at rates of 80 to 95 percent a 20 to 40 percentage point drop from the same detectors’ performance on unmodified AI text. Turnitin’s August 2025 update specifically retrained on humanizer outputs, but third-party testing showed detection on freshly humanized text still well below unmodified detection rates. The arms race continues, and at any given moment the latest generation of humanizers is roughly half a year ahead of the detectors that are trying to catch them.
What makes this an adversarial machine learning problem in the formal sense is that both sides of the race are training on each other’s outputs. The detectors retrain when humanizer outputs become public. The humanizers retrain when new detector versions ship. The equilibrium is moving but the moving equilibrium itself is structurally bounded by the fact that detection is a classification problem against an adversary with classifier access. As we will see in the impossibility argument later, that class of problems has known theoretical limits.
The Watermarking Response: A Different Mathematical Game
The frontier AI labs have not been passive about this. The most consequential lab response is watermarking, and the foundational paper in this space is A Watermark for Large Language Models by Kirchenbauer, Geiping, Wen, Katz, Miers, and Goldstein, presented at ICML 2023. The Kirchenbauer paper is worth understanding in detail because it changes the structure of the detection problem from a vulnerable statistical question “does this text look like AI?” to a much more defensible cryptographic question “does this text carry a signature my key can detect?”
The Kirchenbauer construction works as follows. At each generation step t, the language model produces a probability distribution P_t over the vocabulary V for the next token. The watermark introduces a pseudorandom partition of V into two sets the green list G_t (containing roughly γ * |V| tokens, typically γ = 0.5) and the red list R_t = V \ G_t. Critically, the partition is determined by hashing the previous tokens through a pseudorandom function keyed to a secret key. Given the same key and the same prior context, anyone can recompute the same partition.
To embed the watermark, the algorithm modifies the logits before sampling. For every token v ∈ G_t, it adds a bias δ > 0 to the logit. For every token v ∈ R_t, it leaves the logit unchanged. The resulting modified probability distribution is:
P'_t(v) = exp(logit_t(v) + δ · 𝟙[v ∈ G_t]) / Σ_{v'} exp(logit_t(v') + δ · 𝟙[v' ∈ G_t])The model then samples from P’_t rather than P_t. The effect is that, over many tokens, the generated text contains a higher fraction of green-list tokens than would be expected by chance but each individual choice is still plausible, so the text remains fluent and semantically appropriate. The bias δ is small enough (typically 1 to 2 nats) that the modified text quality is essentially indistinguishable to a reader.
Figure 2 — The green-red list watermark embedding algorithm from Kirchenbauer et al. (ICML 2023). The diagram shows the modification to the token-sampling step: standard generation samples from the model’s probability distribution; watermarked generation adds a bias δ to the logits of green-list tokens before sampling. The green/red partition is derived from a hash of the prior tokens, so anyone with the secret key can reconstruct the partition for detection. This is the foundational algorithm underlying the Kirchenbauer scheme and its successors, including Google DeepMind’s SynthID Text. Image credits: Arize AI, presenting work by Kirchenbauer, Geiping, Wen, Katz, Miers, and Goldstein. “A Watermark for Large Language Models,” ICML 2023. Source: https://arize.com/blog/a-watermark-for-large-language-models/ · arXiv: https://arxiv.org/abs/2301.10226
Detection is where the construction becomes elegant. Given a candidate text and the secret key, the detector recomputes the green/red partition for each token position using the same hashing scheme. It then counts the number of green-list tokens in the text. Let T be the total number of tokens, s_G the number of green-list tokens, and γ the fraction of the vocabulary in the green list (typically 0.5). Under the null hypothesis that the text was not generated with the watermark, s_G follows a binomial distribution with mean γT and variance γ(1-γ)T. The detector computes a z-score:
z = (s_G - γT) / sqrt(T · γ(1-γ))Under the null, z is approximately standard normal. The detector applies a threshold (typically z > 4, corresponding to a p-value of about 3 × 10^-5) to decide whether the text carries the watermark. The paper’s Theorem 4.2 provides the formal analysis of how z grows with text length under the alternative hypothesis (that the text was generated with the watermark), and shows that for reasonable values of δ and entropy in the underlying distribution, detection p-values reach 10^-6 or lower within about 50 tokens of watermarked text. This is dramatically better than perplexity-based detection, which struggles to reach reliable confidence even with thousands of tokens.
Figure 3 — The watermark detection algorithm from Kirchenbauer et al. The detector reproduces the green/red partition using the secret key, counts green-list tokens in the candidate text, and computes a z-score against the null hypothesis that green tokens occur at the random baseline rate γ. Under the watermarking scheme, the z-score grows with text length; the detector applies a threshold (typically z > 4) to classify. The mathematical robustness of this approach interpretable p-values, formal sensitivity analysis, no dependence on the surface statistics of the text — is the main reason watermarking has displaced perplexity-based methods as the technical state of the art for AI detection in research settings. Image credits: Arize AI, presenting work by Kirchenbauer et al. ICML 2023. Source: https://arize.com/blog/a-watermark-for-large-language-models/
The robustness properties of the Kirchenbauer construction are graded, not binary. The paper’s Section 5 analyzes what happens under three classes of attack. First, light editing (replacing a small fraction of tokens): if the fraction of replaced tokens is ε, the expected z-score is reduced by roughly a factor of (1-ε), but for moderate ε the watermark remains detectable. Second, paraphrasing: replacing whole sentences while preserving meaning. This is more damaging because it changes many tokens at once, but Kirchenbauer’s follow-up paper (On the Reliability of Watermarks for Large Language Models, 2023) showed that for paraphrased watermarked text of length 200+ tokens, detection still operates above 80 percent accuracy. Third, discovery and removal attacks: if the adversary can identify the green-list and red-list patterns and rewrite the text to flip the balance, detection fails. The defense is to keep the secret key private and to use a sufficiently long ngram context (typically ngram_len = 5 in the SynthID implementation) so that brute-force discovery is exponentially expensive.
SynthID Text at Production Scale — Google’s Tournament-Sampling Refinement
The most consequential implementation of watermarking in production is SynthID Text, the Google DeepMind system described in their Nature paper “Scalable watermarking for identifying large language model outputs” (Dathathri et al., October 23, 2024). SynthID Text was the first watermarking scheme deployed at production scale — Google has been running it on the Gemini chatbot since 2024, applying the watermark to text shown to millions of users. The Nature publication reported testing on 20 million prompts in live deployment, with detection accuracy above 90 percent on unmodified text and graceful degradation under light editing.
The SynthID Text construction is a refinement of the Kirchenbauer scheme that addresses two limitations. First, SynthID uses tournament sampling rather than logit biasing. Instead of adding δ to green-list logits and sampling from the resulting distribution, SynthID samples several candidate tokens at each step and uses a pseudorandom function (the “g-function”) keyed to the recent context to select among them. The selection biases toward tokens that hash to favorable values under the g-function, producing the same kind of statistically detectable signature as the green-list scheme but with a more flexible parameterization that allows multiple watermark layers to be encoded simultaneously. Second, SynthID integrates with speculative sampling, an efficiency technique used in production LLM serving where a smaller “draft” model generates candidate tokens that the larger model accepts or rejects. The integration was non-trivial and is the main technical contribution of the Nature paper watermarking at production latency was an unsolved problem before SynthID.
The empirical results from the SynthID Text paper are the strongest evidence to date that watermarking is viable at scale. The text quality, as measured by human raters in blind comparisons of watermarked versus unwatermarked Gemini responses across 20 million prompts, was statistically indistinguishable. The detection accuracy on unmodified watermarked text was above 90 percent at sequence lengths above 200 tokens, climbing to above 99 percent at sequence lengths of 800 tokens or more. The Nature paper also reported degraded but non-zero detection accuracy under paraphrasing exact numbers vary by attack type, but detection holds above 70 percent for moderate paraphrasing and falls below 50 percent for aggressive paraphrasing or translation to another language.
The catch, and it is a substantial one, is industry adoption. SynthID Text only watermarks text generated by models that have SynthID enabled at the inference layer. As of early 2026, that means Gemini and any developer who has integrated SynthID through Hugging Face’s Transformers library (where it has been available since v4.46.0 in October 2024). ChatGPT, Claude, the open-weight model families from Meta, Mistral, DeepSeek, Alibaba, and the dozens of other frontier and open-source models in production deployment do not currently watermark. OpenAI has developed an internal text watermarking system but, as reported by the Wall Street Journal in August 2024 and confirmed in subsequent OpenAI public communications, has held off on deploying it for commercial reasons the concern is that users would migrate to competing services that do not watermark. Anthropic has done watermarking research but has not deployed in production for Claude.
The honest commercial reality is that watermarking is a public good. The benefit (industry-wide ability to identify AI-generated text) is shared across all participants. The cost (potentially losing customers who prefer not to be watermarked) is borne by whichever lab unilaterally deploys. Google has paid that cost. The other major labs have not. Until they do or until regulation forces them to watermarking will remain a partial solution that catches Gemini outputs and misses outputs from every other major frontier model.
The Stanford ESL Bias Problem — When Perplexity Becomes Discrimination
The most uncomfortable result in the entire AI detection literature is from a 2023 paper published in Patterns by a team at Stanford led by Weixin Liang. The paper tested seven leading commercial AI detectors on 91 TOEFL essays written by non-native English speakers and 88 essays written by native English-speaking US eighth-graders. The numerical findings re-shaped the field’s understanding of detection bias, and the mechanism the paper identified is structurally tied to the perplexity-based architecture we walked through in Section 2.
The headline numbers are stark. 61.3 percent of TOEFL essays were classified as AI-generated by at least one detector. 97.8 percent were flagged by at least one of the seven detectors. The average false positive rate across detectors on the TOEFL set was 61.22 percent. By contrast, the same detectors classified more than 90 percent of native eighth-grade essays correctly as human-written. The asymmetry was not subtle. The detectors were essentially functioning as bias amplifiers, falsely flagging the writing of non-native English speakers at near-uniform rates while letting native-speaker writing pass cleanly.
The mechanism, when the Liang team investigated, is mechanical and depressingly straightforward. Non-native English speakers tend to write with simpler vocabulary, more predictable grammatical structures, and lower text perplexity than native speakers. The same statistical properties low perplexity, low burstiness, uniform sentence structure that AI detectors were trained to associate with machine-generated text are also, by structural coincidence, the properties of writing produced by anyone whose English vocabulary is constrained. The paper explicitly showed this. When the team used ChatGPT to “enhance” the TOEFL essays with more sophisticated vocabulary (the prompt was “Enhance the word choices to sound more like that of a native speaker”), the average false positive rate dropped from 61.3 percent to 11.6 percent a 49.7 percentage point reduction. Conversely, when the team prompted ChatGPT to “simplify” the eighth-grade essays in the style of a non-native speaker, the AI-detection rate of those essays rose substantially. The bias was perfectly correlated with the perplexity of the writing, regardless of who actually wrote it.
The structural implication is that any detector using perplexity as a feature which is, currently, every commercial detector in production will be biased against any population whose natural writing has lower perplexity than the average native speaker. That includes non-native English speakers, but it also includes:
- Children and adolescents (whose vocabulary is constrained by stage of development)
- Technical writers and engineers (whose style is constrained by genre conventions toward precise, repetitive phrasing)
- Formal academic writers (whose register favors high-frequency vocabulary)
- Anyone writing in a constrained domain where word choice is bounded by terminology
The newer 2025–2026 generation of detectors has worked to close this specific gap. Pangram’s published data from April 2025 reported 0.00 percent false positive rate on the exact Liang TOEFL set. Originality.ai, GPTZero, and Turnitin have all retrained with more diverse training data and report substantially reduced bias against non-native speakers. But “substantially reduced” is not “eliminated,” and the underlying mechanical problem has not been solved. As long as low perplexity correlates with AI authorship in training data and also with non-native English writing in the world, there will be a bias-versus-detection tradeoff that no amount of retraining can fully eliminate without changing the underlying classification architecture.
This is the social-cost side of the detector arms race that the commercial accuracy numbers do not capture. The University of Chicago Booth working paper 2025–116 recommended a strict 0.5 percent false positive cap for any detector used in academic enforcement. Most of the commercial detectors meet that cap on the average native-speaker population. None of them meet it cleanly across non-native speakers. The institutional decision to deploy these tools anyway which most American universities, an increasing fraction of the K-12 system, and a growing number of professional hiring pipelines have made is producing a steady background rate of false accusations that the systems are not equipped to appeal.
The Theoretical Impossibility Argument — Sadasivan and Feizi
The deepest result in the AI detection literature is a 2023 paper by Sadasivan, Kumar, Balasubramanian, Wang, and Feizi titled Can AI-Generated Text be Reliably Detected?. The paper does not just empirically demonstrate that current detectors are vulnerable. It argues, with formal information-theoretic analysis, that no detector can reliably distinguish AI-generated text from human text in the asymptotic limit where language models converge to producing text statistically indistinguishable from human writing.
The argument runs as follows. Let D_H be the distribution over text produced by humans on a given topic, and let D_M be the distribution over text produced by a language model M on the same topic. A detection algorithm f is any function mapping a text T to a binary classification f(T) ∈ {AI, human}. The maximum achievable detection accuracy of any such f is bounded by the total variation distance between D_H and D_M:
max_f { accuracy(f) } ≤ 1/2 + (1/2) * TV(D_H, D_M)where TV(D_H, D_M) = (1/2) * ΣT |PH(T) — P_M(T)| is the standard total variation distance. This is a classical result from hypothesis testing the Neyman-Pearson lemma applied to the binary classification problem. The implication is that as D_M approaches D_H in total variation (which is the explicit training objective of every modern language model), the achievable detection accuracy approaches 1/2 random guessing.
The Sadasivan paper’s contribution is to operationalize this bound. The authors construct an “adversarial paraphraser” essentially a humanizer that transforms language model output through repeated paraphrasing rounds until the total variation distance between paraphrased AI text and human text becomes small. Empirically, they show that for several leading detectors, paraphrasing-based attacks reduce detection accuracy below 50 percent — formally, below the random baseline. The detectors do worse than coin-flipping after sufficiently aggressive paraphrasing.
The result sparked an academic controversy. Researchers at Originality.ai and elsewhere argued that the Sadasivan model assumptions are too pessimistic in practice, the total variation distance between high-quality LLM output and average human writing remains measurably non-zero, especially for domain-specific text where the LLM has been less well-tuned. The empirical evidence from 2024–2026 supports neither side cleanly. Detection has held up better than the most pessimistic predictions in some domains, particularly long-form academic and technical writing where the statistical fingerprint of generation persists across light edits. But humanizers have also held up better than the most optimistic predictions about detection, particularly against shorter texts where the statistical signal is sparse.
The structural conclusion that emerges from synthesizing the theoretical and empirical results is precise. Classical statistical detection (perplexity, burstiness, stylometry, log-likelihood ratios) is approaching a hard ceiling as language models converge toward human-indistinguishable output. Watermarking can escape that ceiling, but only for the specific lab and model combinations that deploy it - it does not solve detection for unwatermarked output from other models. Cryptographic verification at the source (provenance standards like C2PA) is the third structural approach, but it requires industry-wide coordination that has not yet been achieved.
The 2026 Independent Benchmark Reality — What Actually Works Right Now
Despite the theoretical bounds, the practical question for any institution deploying detection in 2026 is: which detector should I use, and what false positive rate should I expect? The cleanest current answer comes from the University of Chicago Booth School of Business working paper 2025–116, which tested every major commercial detector across academic and admissions essays at passage lengths from 50 to 1,500 words. The findings sort the detectors into four tiers.
The top tier is Pangram, a newer entrant that reported essentially zero false positive rate across long and medium passages the only detector meeting a strict 0.5 percent policy cap without sacrificing detection power. Pangram’s reported performance on the Liang TOEFL set was 0.00 percent false positives, suggesting the architecture has materially closed the non-native English bias gap. The second tier is Originality.ai, with approximately 1 percent false positive rate at medium-to-long passages, climbing to 2–3 percent on shorter passages. The third tier is GPTZero, with similar performance to Originality.ai on average-passage tests but slightly higher false positives on short passages and a small but persistent bias on non-native English. The fourth tier is Turnitin, the detector most widely deployed in American universities, which reports “less than 1 percent” document-level false positive rate in its own marketing but where third-party reads of its sentence-level analysis show false-flag rates closer to 4 percent. The open-source RoBERTa baseline that some free tools wrap as a product performed catastrophically, flagging between 30 and 69 percent of human text as AI-generated.
Figure 4 — Originality.ai’s January 2026 published accuracy benchmarks. The headline numbers — 99+ percent accuracy and sub-2 percent false positives — represent the public commercial baseline for the AI detection field. The independent academic literature (Booth WP 2025–116, Liang Patterns 2023, EyeSift 2026, Sadasivan arXiv:2303.11156) consistently shows that these numbers reflect performance on unmodified AI text and overstate real-world performance against humanized output by a factor of 2 to 5. Reading these benchmarks correctly requires distinguishing between the AI-text distribution the detector was trained on and the adversarially-modified distribution the detector actually sees in deployment. Image credits: Originality.ai, “We Have 99% Accuracy in Detecting AI: Originality.ai Study,” January 28, 2026. Source: https://originality.ai/blog/ai-accuracy
The single most important number in any detector evaluation, the one that should keep institutional users awake at night, is the false positive rate on the specific population the detector will be used on. For an academic enforcement tool, a 1 percent FPR sounds small but translates into hundreds of innocent students flagged per academic year across a typical university and the affected students are disproportionately non-native English speakers, technical writers, and anyone whose natural prose has below-average perplexity. For an applicant evaluation tool, one false flag can sink a college application. The Booth paper’s headline policy recommendation was that no current commercial detector meets a defensible threshold for high-stakes academic use across all student populations. The asymmetry of harm false negatives are a policy nuisance, false positives are a personal catastrophe for an innocent person means that even very low false-positive rates inflict real and concentrated damage on the populations who fall on the wrong side of the perplexity threshold.
The performance numbers also drop precipitously when humanizers are introduced into the test pipeline. EyeSift’s 2026 head-to-head benchmark reported detection accuracy on humanized text falls to 55 to 75 percent across the leading detectors. The benchmarks public detectors publish typically test against unmodified AI text and have no specific contract to perform on humanized text but the deployment environment any institutional user faces is overwhelmingly humanized text, because the people most likely to want to evade detection are also the people most likely to use a humanizer. The published number and the deployed number are measuring different things, and a careful institutional consumer of detection data needs to separate them explicitly.
Why The Game Has No Clean Winner Under Current Architectures
Stand back from the specific products and the deeper structural question becomes visible. Is the detector-versus-humanizer race winnable in principle under current architectures? The convergence of theory and empirics suggests no, for three reasons that compound rather than cancel.
The first reason is adversarial ML game theory. A classification problem in which the adversary has score-level access to the classifier and the freedom to modify inputs is, formally, an evasion attack scenario. The literature on evasion attacks for image classifiers (Madry et al., Goodfellow et al., Carlini and Wagner, going back to 2014) has consistently shown that such problems have feasible attacks under realistic conditions. The classifier can retrain to push the decision boundary; the adversary can retrain to push the attack across the new boundary. The equilibrium of this game has been studied formally and the conclusion is that neither side wins permanently the boundary moves, but the adversary always has feasible attacks at the current boundary as long as some non-trivial distance remains between the input and the boundary. For AI text classification, the input space is enormous and the distance is small. Adversarial humanization is, in this sense, structurally easy.
The second reason is the Sadasivan-Feizi information-theoretic ceiling. As we walked through in Section 7, the achievable accuracy of any detector is bounded above by 1/2 + (1/2) * TV(D_H, D_M). As language models converge to human-indistinguishable output, this bound converges to 1/2. The convergence is not at the speed of the detector arms race; it is at the speed of the language model arms race, which is dramatically faster. The detection problem is, in effect, racing against the wrong opponent. Every improvement in LLM fluency moves the achievable detection accuracy closer to random.
The third reason is structural-economic. Both the detector industry and the humanizer industry are now established markets with venture funding and paying customers. Neither industry is incentivized to surrender. The detector market serves institutional buyers universities, publishers, employers, regulators whose workflows have been redesigned around the assumption that detection works. The humanizer market serves individual users students, content marketers, writers, freelancers whose workflows have been redesigned around the assumption that bypass works. Both sets of workflows are economic facts that will continue as long as money flows, regardless of the technical reality.
Watermarking is the most promising structural alternative because it changes the problem class. Instead of post-hoc classification, watermarking does cryptographic verification at the source. The Sadasivan bound does not apply to watermarking the watermark detector is not trying to distinguish D_H from D_M, it is trying to distinguish text-with-watermark from text-without-watermark, which is a different and much easier problem because the watermark introduces a controlled, known statistical signal. The catch, again, is adoption. SynthID is open-source. Anyone can implement it. As of early 2026, only Google has deployed it at scale in a major frontier product. Until the rest of the industry follows or until watermarking standards become regulatory requirements through frameworks like the EU AI Act the watermarking solution remains partial.
“Our results call for a broader conversation about the ethical implications of deploying ChatGPT content detectors and caution against their use in evaluative or educational settings, particularly when they may inadvertently penalize or exclude non-native English speakers from the global discourse.” — Liang, Yuksekgonul, Mao, Wu, & Zou, GPT detectors are biased against non-native English writers, Patterns 4(7):100779, July 2023
What This Means
For engineers, founders, educators, and serious users of AI tools, the implications of the detector-versus-humanizer arms race translate into five concrete operational principles.
First, treat detection as evidence, not verdict. Even the best commercial detectors have measurable false positive rates, and the rates are higher on populations the detectors were not trained for. Any institutional process that treats a high AI-probability score as definitive proof is inflicting injustice on innocent users at a rate proportional to the detector’s false positive rate times the size of the user population. The Booth working paper’s central policy recommendation was to pair any detector output with a human review process for any flagged submission. That recommendation is correct and is consistently the right answer for any high-stakes deployment.
Second, no detection system is a substitute for process. If your institution depends on knowing whether content was AI-generated, the only durable answer is editorial process, writer accountability, and verifiable provenance. Detection is part of that toolkit but cannot replace it. The publishers and academic institutions that have figured this out are focusing on demonstrated capability rather than text-source verification, accepting AI assistance openly, building workflows that work regardless of authorship are building durable processes. The institutions still relying on detection as the gate are building on sand.
Third, support watermarking adoption. SynthID Text is open-source. Anyone building a language model can implement it. Every additional model that watermarks moves the industry closer to an ecosystem where AI-generated content can be reliably identified at the source rather than guessed at after the fact. If you are building on top of Claude, GPT, Gemini, Llama, or any other frontier model, ask whether the lab watermarks and advocate for adoption. If you are training your own models, implement SynthID or a successor scheme from the start. The technical bar to implementation is low; the coordination bar to adoption is the real challenge.
Fourth, design around the bias problem rather than denying it. Any system that uses AI detection on a population including non-native English speakers, technical writers, formal academic writers, or any group whose natural prose has low perplexity will produce disproportionate false flags against that group. The right design response is not to abandon detection but to calibrate the deployment carefully: lower-stakes consequences for flagged content, mandatory human review, explicit confidence-interval reporting, and clear escalation paths for users to contest decisions. The Liang paper documented the bias in 2023. Three years later, the bias is reduced but not eliminated, and it will not be without intentional design intervention.
Fifth, internalize that this is an industry-rebuilding moment. Education, publishing, journalism, marketing, hiring, legal work, scientific writing every text-based industry is being rebuilt around the technical fact that “who wrote this?” is now a question with no reliable post-hoc answer. The institutions that adapt will continue functioning. The institutions that double down on detection as the answer will find themselves in a moving arms race they cannot win, inflicting collateral damage on their own users while the actual problem remains unsolved. The strategic move, for any technical reader or institutional leader, is to redesign the systems that depend on knowing authorship so that they remain valuable even when authorship is uncertain.
The Bottom Line
Three industries. Detectors that compute perplexity, burstiness, and stylometric statistics against trained thresholds, advertising 95+ percent accuracy on unmodified AI text. Humanizers that solve a constrained optimization problem against the detector’s classifier function, advertising 95+ percent bypass rates. Labs developing watermarking schemes that change the problem class by embedding cryptographic signatures at generation time, with SynthID Text deployed at production scale on Gemini and most other frontier models still un-watermarked. All three are real. All three are technically functioning. All three are caught in a structural competition that the math suggests does not have a clean technical winner under current architectures.
The cleanest summary of where this stands in 2026 is the following. Classical statistical detection works well against unmodified frontier-model output and poorly against text run through any competent humanizer. The Sadasivan-Feizi information-theoretic argument shows the achievable detection accuracy is structurally bounded by the total variation distance between human and AI text distributions, and that bound is shrinking as language models improve. Watermarking specifically the Kirchenbauer green-red list construction and its SynthID Text refinement escapes the statistical-detection ceiling but requires industry-wide adoption that has not yet been achieved. The bias problem against non-native English speakers and other low-perplexity writers, documented by Liang et al. in 2023, has been reduced but not eliminated, and any deployment of detection in high-stakes settings will continue to inflict disproportionate harm on those populations until the architectural foundation of perplexity-based classification is replaced with something fundamentally different.
The single most strategic technical investment any reader of this article can make is to understand the mathematics, not the products. The companies will come and go. The detection startups will be acquired by the humanizer startups will be acquired by the labs. The benchmarks will keep moving. What will persist is the underlying technical problem: classifying a text as machine-generated when the machine is specifically trained to evade your classifier, when the underlying text distributions are converging, and when watermarking depends on coordination among labs that are not currently coordinating. That problem is now one of the central applied research questions in computer science. The labs are working on it. The academics are working on it. The papers are public. The math is precise. The window for serious engagement is open.
If this piece clarified the actual technical situation for you, share it with the educator, founder, or technical reader who still thinks “we just need a better AI detector” is the right framing for the problem. The problem is not that the detectors are bad. The problem is that detection of statistically-indistinguishable text by an adversary with classifier access is structurally hard, and the cleanest path forward involves rebuilding the systems that depend on detection so that they remain valuable even when detection is unreliable. That work is open. The window for participation is now.
References
메타데이터
- post_id
- ac915741aea8
- slug
- can-ai-fool-ai-inside-the-battle-between-detectors-and-humanizers-ac915741aea8
- url
- https://medium.com/data-science-collective/can-ai-fool-ai-inside-the-battle-between-detectors-and-humanizers-ac915741aea8
- canonical_url
- https://medium.com/data-science-collective/can-ai-fool-ai-inside-the-battle-between-detectors-and-humanizers-ac915741aea8
- author_url
- https://medium.com/@hayanan
- status
- ok
- fetched_at
- 2026-06-14 11:28:49
