How AI Detection Actually Works (And Why It's Often Wrong)

AI detectors have become gatekeepers — in classrooms, editorial workflows, hiring pipelines, and content platforms — so it's worth understanding, in real technical detail, what they actually do. The short version is almost a cliché by now, but it's still the most important sentence in this article: they don't detect AI. They detect statistical properties that AI-generated text tends to have, at least in the training data the detector was built on. That difference — between "detecting a cause" and "detecting a correlated pattern" — explains nearly everything else about when these tools work, when they fail, and why the failures aren't random noise but predictable, structural blind spots.

This matters because the stakes attached to a detector score keep rising while the underlying technology hasn't fundamentally changed. A score that determines whether a student faces an academic integrity hearing, whether a freelance writer gets paid, or whether a job applicant's cover letter gets read, deserves more scrutiny than "the tool said 94% AI, so it's 94% AI." That sentence isn't even a coherent way to describe what the number means, and by the end of this piece you'll see exactly why.

What A Detector Actually Receives

Before getting into the statistics, it helps to be clear about the raw material a detector works with, because the limits start here. A detector receives a string of text — words, punctuation, whitespace. It does not receive your intent, your drafting process, your outline, your research notes, or any of the context a human reader would use to judge whether a paragraph feels like your voice. It has no access to your writing history unless a platform explicitly compares your current submission to a stored baseline of your past work — which most detectors, on their own, don't do.

That's a real constraint, and it means every detector is answering a narrower question than the one people assume it's answering. The question people think they're asking is "did a person write this?" The question a detector can actually answer is "does this text's statistical fingerprint resemble the AI-generated text in my training set more than it resembles the human-generated text in my training set?" Those are different questions, and the gap between them is where every interesting failure mode in this article lives.

The Two Core Statistical Signals

Modern AI detectors, at their foundation, lean on two related ideas borrowed from computational linguistics and information theory: perplexity and burstiness. Nearly every detector on the market, from the simplest open-source classifier to the commercial tools schools license, builds on some variant of these two measurements, even when the marketing language obscures it behind talk of "proprietary AI models."

Perplexity is, roughly, a measure of how surprised a language model would be by a given sequence of words. Formally, it's derived from the probability a model assigns to each word given the words before it — take the negative log of that probability, average it across the text, and exponentiate. Practically, you can think of it as asking, word by word: how predictable was this choice? A language model generating text is, at a mechanical level, doing next-word prediction — repeatedly picking a plausible next token given everything that came before. Left to its own preferences, that process tends to select high-probability words far more often than low-probability ones, because that's literally what the underlying model was optimized to do during training. The result is text that, when you run it back through a similar model to score it, comes out with low perplexity: smooth, expected, unsurprising at nearly every turn.

Human writing behaves differently, on average. People pick odd words sometimes. We reach for a slightly wrong-footed metaphor because it's the one that occurred to us. We interrupt a sentence's expected trajectory with a clause that a probability model wouldn't have ranked highly. None of that is because humans are trying to be unpredictable — it's a side effect of how human thought and memory actually work, pulling from idiosyncratic associations rather than a globally optimized probability distribution. The upshot is that human text tends to register as higher-perplexity: more surprising, on average, to a model trying to predict it.

Burstiness adds a second dimension: not just how predictable the text is on average, but how that predictability varies across the passage. Human writing is uneven. You'll write a plain, boring, entirely predictable sentence — "The meeting starts at nine." — immediately followed by something stranger, more specific, more alive. Then back to plain again. That oscillation between low-effort and high-effort sentences, between filler and insight, is burstiness: high variance in predictability across a text. AI-generated text, especially from earlier and mid-generation models, tends to be flatter — every sentence operating at roughly the same, moderate level of predictability, without the human rhythm of easy-then-hard-then-easy. Low variance in predictability reads, to a detector, as a signal of machine origin.

Neither of these measurements looks at meaning. A detector scoring perplexity and burstiness has no model of whether your argument makes sense, whether your citations are real, or whether the essay actually answers the prompt. It is, in the most literal sense, doing math on word-choice statistics — the kind of analysis you could theoretically do by hand with a big enough table of probabilities and a lot of patience, just automated and scaled up.

From Statistics To Classifiers

Raw perplexity and burstiness scores were the first generation of detection tools, and some — GLTR, an early academic project, is a well-known example — displayed them almost literally, color-coding each word by how predictable it was. Modern commercial detectors have layered something more sophisticated on top: trained classifier models.

Here's how that typically works. Researchers assemble a large dataset of text samples labeled as either "human-written" or "AI-generated" — scraped essays, articles, and forum posts on the human side; outputs from various language models, often across a range of prompts and settings, on the machine side. A classifier — frequently a fine-tuned transformer model itself, sometimes a simpler statistical model like logistic regression trained on hand-engineered features — learns to distinguish the two classes based on whatever patterns separate them in the training data. That's not limited to perplexity and burstiness anymore; a trained classifier can pick up on dozens of subtler regularities: characteristic sentence-length distributions, particular transition-word frequencies ("moreover," "furthermore," "in conclusion" showing up at rates atypical of average human prose), punctuation habits, even stylistic tics specific to whichever model generated the training examples.

This is worth sitting with, because it explains something people often get backward: a modern detector isn't measuring "AI-ness" as some universal property of machine-generated text. It's measuring similarity to the specific AI outputs it happened to be trained on. If a new model generates text with a different statistical signature than what the classifier saw during training — because it was fine-tuned differently, prompted with unusual instructions, or built on a different underlying architecture — the classifier has no guarantee of catching it. It was never taught what that signature looks like. Detection quality is bounded by training-data coverage in a way that's easy to forget once a tool is presented to users as a single, confident percentage.

Watermarking: A Different Approach Entirely

It's worth distinguishing statistical detection — inferring AI origin after the fact from a finished piece of text — from a fundamentally different approach: watermarking, where the generating model itself embeds a detectable signal during generation, before the text ever leaves the system.

The technique, in its most-discussed academic form, works roughly like this: at each generation step, the model's vocabulary is pseudorandomly split into a "green list" and a "red list" of tokens, using a seed derived from the preceding text. The model is then nudged — subtly, in a way designed not to visibly harm text quality — toward picking green-list tokens more often than chance would predict. A detector that knows the seeding scheme can later count how often a passage favors the green list; a normal, unwatermarked text should hit roughly chance levels, while a watermarked one skews measurably higher. Researchers at labs including Google DeepMind, which has published its own text-watermarking work under the name SynthID, and independent academic groups have published peer-reviewed work on schemes along these lines, and it's a genuinely active, serious area of research — distinct from statistical detectors and, in principle, more reliable when it works, because it doesn't depend on guessing at AI-ness from surface statistics after the fact.

But watermarking has real, publicly acknowledged limits that keep it from being the neat solution it might sound like. It requires the generating model's provider to implement it and requires the checking party to have access to the corresponding detection key or scheme — it isn't something a third-party classifier can retrofit onto text after the fact if the original model didn't watermark it. It can potentially be degraded by paraphrasing, translation round-trips, or enough manual editing, since those operations disrupt the exact token sequence the watermark depends on. And it only covers models that choose to implement it; open-weight models a user runs locally, or any model whose provider hasn't adopted the scheme, produce ordinary, unwatermarked text no different from typing it by hand as far as a watermark detector is concerned. It's a promising, technically serious direction, and worth knowing about — but it is not currently the mechanism behind the popular detection tools schools and platforms use today, which remain overwhelmingly the statistical classifier approach described above.

Why False Positives Are Structurally Unavoidable

Here's the problem baked into the whole classifier approach, and it's not a bug some future version will patch away — it's a direct consequence of what's being measured. If AI text tends to be smooth, predictable, and low-variance, then any human who happens to write smooth, predictable, low-variance prose will resemble AI text on exactly the dimensions the detector is scoring. The detector has no way to tell "a machine produced this" apart from "a human produced something with similar statistical texture," because it was never looking at causation — only correlation with a training set.

Who writes that way, honestly and without any AI involvement at all? A few groups show up again and again in the research on this, and in the practical experience of institutions that have tried leaning on these tools:

Non-native English speakers frequently write with more conventional sentence structures and more common vocabulary than native speakers do — not from any deficiency, but because when composing in a second language, the safer, more standard construction is the one you're confident is grammatically correct. That caution produces exactly the low-perplexity, low-burstiness texture detectors associate with machine generation. A peer-reviewed study out of Stanford, examining detector performance on TOEFL essays written by non-native English speakers, found substantially elevated false-positive rates for that group compared to essays from native speakers — a result that's been discussed widely in both academic and journalistic coverage of detector reliability, and that lines up with the underlying mechanics described above rather than being some anomaly.

Neurodivergent writers, including some autistic writers, report a similar pattern: writing styles shaped by particular processing differences can trend toward more literal, structured, formulaic phrasing — again, statistically adjacent to what a classifier has learned to flag.

Technical and scientific writers are often trained, explicitly, to write in a plain, consistent, low-variance register — the opposite of literary flourish, on purpose, because clarity and repeatability are the actual goals in a methods section or an engineering spec. That trained plainness is a false-positive magnet.

Students taught formulaic structures, like the five-paragraph essay format that's a staple of American secondary education, are producing exactly the kind of uniform, predictable paragraph lengths and stock transitional phrases that read as machine-like to a classifier trained to associate uniformity with AI origin.

None of these writers did anything wrong. They wrote the way they were taught to write, or the way their brain naturally organizes language, or the way their second language made them cautious enough to write. The detector doesn't know any of that history — it only sees the finished statistical texture, and the texture happens to overlap with what it learned to call "AI."

Why False Negatives Are Just As Real

The reverse failure gets less attention in the discourse but is at least as common, and arguably more consequential for anyone actually trying to use detectors as an enforcement tool. AI-generated text that's been lightly edited by a human — even a handful of manual sentence rewrites — often drifts far enough from the training distribution to slip under classifier thresholds, because the classifier was trained on raw, unedited model output and never saw the edited version's altered statistics.

Newer, larger, or differently fine-tuned models present the same problem in a different form: if a detector's training data is even six months old, and a new generation of models produces text with a meaningfully different statistical signature — more natural burstiness by default, less formulaic transition-word usage — the detector's accuracy on that new model's output can degrade substantially, sometimes without any warning to the people relying on the score, because the detector's confidence display doesn't know its own training data is stale.

Unusual prompting compounds this further. A model explicitly instructed to "write with varied sentence length and an informal, first-person voice" produces text with a different statistical fingerprint than the same model given a bare, generic prompt — and that shift alone, with zero human editing afterward, can be enough to change a detector's verdict. None of this requires any deliberate attempt to defeat detection; it can happen as an incidental side effect of someone just trying to get better-sounding output from a chatbot.

Doing The Arithmetic On "99% Accurate"

Vendor marketing loves a number like "99% accurate," and it's worth actually doing the math on what that number means once it's deployed at any real scale, because the intuition most people have about it is wrong.

Picture a university with 10,000 essays submitted across a term, of which — a generous, detection-favorable assumption — 500 involved some meaningfully unauthorized AI use. With a genuinely excellent 99% accuracy rate applied uniformly (real-world classifiers rarely hit this on both false-positive and false-negative rates simultaneously, but grant it for the sake of the arithmetic), a 1% false-positive rate applied to the 9,500 legitimately human-written essays produces roughly 95 falsely flagged students. Ninety-five students, each facing an accusation they did not deserve, generated by a single term's normal operation of a "highly accurate" tool. Meanwhile, on the AI-use side, a 1% false-negative rate would mean only about 5 of the 500 actual violations slip through — so the tool would look, in aggregate, like it's doing its job extremely well, while quietly generating an entire cohort of falsely accused students as a side effect nobody chose deliberately.

This is the base-rate problem, and it isn't specific to AI detection — it's the same statistical trap that shows up in medical screening test debates, spam filter design, and airport security theater discussions. When the thing you're screening for is comparatively rare, even a small false-positive rate produces a large absolute number of wrongly flagged cases, because the false positives are drawn from the much larger pool of true negatives. A 99%-accurate test sounds nearly perfect until you multiply it against a large population and realize the "1% wrong" bucket contains real people with names, facing real consequences, who did nothing to deserve the flag.

And the accused student is in a uniquely bad position here: proving you didn't use AI is proving a negative, against a tool whose internal reasoning is opaque even to the institution deploying it, while the accuser holds a number that feels objective and quantified — 94%, 87%, whatever the dashboard displays — even though, as everything above should make clear, that number is a similarity estimate from a black-box classifier trained on a specific, dated, incomplete dataset, not a measured fact about who typed the words.

Why Institutions Are Backing Away

This isn't a hypothetical concern raised only by critics outside the industry — it's why a number of major universities have publicly walked back or disabled AI-detection features in their plagiarism-checking software, and why a growing number of institutions now explicitly instruct faculty not to treat a detection score as standalone evidence in an academic integrity case. The International Center for Academic Integrity publishes guidance for institutions navigating exactly this question, generally counseling a process-based approach over reliance on any single automated score. Even detector vendors themselves, in their own documentation, frequently caveat that scores shouldn't be used as sole grounds for disciplinary action — a notable admission from companies whose product is, functionally, that exact score.

The pattern repeating across institutions looks the same everywhere it happens: early enthusiastic adoption of a detection tool, a wave of disputed and sometimes publicized false-positive cases — often involving the exact groups named above, non-native speakers and formulaic technical writers most visibly — followed by a walk-back toward "detection scores are one input among several, considered alongside a student's writing history and a conversation with the student," which is a considerably more modest claim than "our tool tells you who cheated." That's a reasonable, evidence-driven recalibration, and it's the direction the field is visibly moving, even as the marketing on some vendor homepages hasn't caught up to it.

What Detection Looked Like Before Language Models

It's easy to assume AI detection is an entirely new category of problem invented alongside ChatGPT, but the underlying instinct — comparing a piece of writing against a known reference to judge its origin — is much older, and looking at that history clarifies what's genuinely new here versus what's a familiar problem in new clothing.

Plagiarism detection, the closest older cousin, works on an entirely different mechanism: it compares submitted text against a database of existing documents looking for direct textual overlap — matching strings of words, not statistical texture. That's a fundamentally more solvable problem, because it's checking a verifiable fact (does this sequence of words already exist somewhere else) rather than inferring an unverifiable one (did a human or a machine originate this specific sequence of words for the first time). A plagiarism checker can, in principle, be right or wrong in a way you can independently confirm by finding the matching source. An AI detector's classification has no equivalent ground truth to check it against, short of a confession or a verified drafting record — which is exactly why detector scores carry the structural uncertainty this whole article has been describing.

Stylometry — the academic study of authorship attribution through writing style, used for decades in contexts like disputed historical authorship or forensic linguistics — is a closer ancestor to modern AI detection than plagiarism checking is. Stylometric analysis looks at measurable features of a writer's style: sentence length distributions, function-word frequencies, vocabulary richness, and uses those features to argue that two documents share (or don't share) an author. Modern AI detectors are, in a real sense, applying a version of that same statistical toolkit to a different question — not "did the same person write these two documents" but "does this document's statistical fingerprint resemble a machine's fingerprint more than a human's." The tools share an intellectual lineage, and stylometry's decades of academic use are worth knowing about if you want context for why "statistical analysis of writing style" is a legitimate field of study — while also knowing that stylometry has always been treated by careful practitioners as suggestive evidence, not standalone proof, which is exactly the caution AI-detection scores deserve today and often don't get.

How Sampling Settings Change What A Model Produces

One detail that rarely makes it into detection discourse, but that matters directly for understanding why detector accuracy is so inconsistent across different AI-generated samples, is that a single language model doesn't produce one fixed statistical signature — it produces a whole range of possible signatures depending on how it's configured to generate text.

Language models generate text through a sampling process, and that process has adjustable parameters. "Temperature" controls how much randomness is injected into word selection — a low temperature setting pushes the model hard toward its highest-probability next word at every step, producing exactly the smooth, low-perplexity text detectors are tuned to catch. A higher temperature setting allows the model to select lower-probability words more often, producing more varied, less predictable — and, per the mechanics described above, more human-statistically-shaped — output from the identical underlying model, with no editing involved at all. "Top-p" (nucleus) sampling and "top-k" sampling are related settings that constrain which words are even eligible for selection at each step, similarly affecting the output's statistical texture.

The practical implication: two people using the identical AI model, with identical prompts, can produce text with meaningfully different detectability purely by adjusting generation settings neither of them may even be aware exists, let alone deliberately tuning. This is part of why detector accuracy is inherently inconsistent even before any human editing enters the picture — the "AI-generated text" category detectors are trying to identify isn't one statistical signature, it's a whole family of signatures, some of which sit much closer to human-typical statistics than others by default.

What Detectors Are Actually Good For

None of this means detectors are useless — that would be an overcorrection in the opposite direction, and not an honest one either. Used the right way, for the right decision, they're a legitimate tool with a real, bounded purpose.

Aggregate, population-level analysis is a genuinely sound use: tracking what fraction of submissions to a platform, over a large volume, show elevated AI-similarity scores, to understand a trend line over a semester or a year. At that scale, individual false positives and false negatives wash out into noise around a broader signal, which is exactly the kind of question statistical tools are built to answer well.

Triage, not verdict, is the other legitimate use: an editor with 500 submissions and finite reading time can use scores to decide which pieces get a slower, closer human read first — not to reject anything automatically, but to allocate scarce attention. A high score becomes a prompt to look more carefully, not a conclusion.

A conversation starter, in an educational context specifically, can be a defensible use if handled with real care: a score prompting an instructor to ask a student to walk through their drafting process, rather than a score alone triggering a disciplinary referral. The difference between those two uses of the identical number is the difference between a reasonable safeguard and a due-process failure.

What detectors are not good for, based on everything above, is functioning as an automated, individual, high-stakes verdict — expelling a student, rejecting a freelancer's invoice, or denying a job applicant an interview — on the strength of a single opaque percentage, with no appeal process and no consideration of who that particular writer is and how they typically write.

Where This Leaves Writers

If you're someone whose text might pass through a detector — a student, a freelance writer, a content marketer, an applicant — a few honest conclusions follow directly from the mechanics described above, rather than from wishful thinking on either side of this debate:

• Detectors are informative in aggregate and unreliable as verdicts about any single piece of writing. Both of those things are true simultaneously, and neither cancels the other out.
• If you write with AI assistance in a context where that's permitted, the goal worth pursuing is editing the output into something you'd actually stand behind as your own voice — text that reads well to a human reader, which is a different and more durable target than text engineered to slip past a specific classifier's specific thresholds this month.
• If you're a naturally formulaic, plain, or careful writer — which, per the research above, disproportionately includes non-native English speakers and people trained in technical writing — know that this isn't a flaw in your writing. It's a known, documented blind spot in how these tools work, and it's worth being able to point to that research if you're ever asked to explain a false flag.
• If you're subject to detector-based judgment in any formal setting, keep your drafts, your revision history, and any planning notes. Process evidence — the messy, human trail of actually writing something — is a stronger defense than any argument about statistics, because it demonstrates the thing a detector was never able to observe in the first place.
• If you're building writing skill generally, rather than reacting to a specific flag, resources like Purdue's Online Writing Lab remain a genuinely useful, free foundation — a reminder that good writing instruction predates AI detection by decades and doesn't depend on any classifier's opinion of your prose.

And for what it's worth, on our end of this: Humanizerly exists to make AI-assisted text read naturally, because that has real value to human readers regardless of what any detector says about it. We don't promise detector outcomes, and no honest tool can — we'd rather explain the actual machinery, as this article has tried to do, so you can reason about detection yourself instead of taking either a vendor's confident marketing or a detector's confident-looking percentage at face value.

How This Plays Out For Specific Kinds Of Writers

The abstract statistics above land differently depending on who you are and what you're writing, so it's worth walking through a few concrete situations rather than leaving this entirely theoretical.

If you're a student, the practical takeaway is that a detector score is not a verdict, and per the pattern of institutional walk-backs described above, a growing number of schools already treat it that way officially. That doesn't mean detectors are irrelevant to your situation — it means the thing worth protecting is your ability to explain your process, which is exactly the guidance covered in more depth in our guide for students and in the fuller academic-writing piece.

If you're a blogger or content marketer, detection anxiety usually shows up as a worry about search rankings or platform policies rather than academic discipline, and it's worth separating those concerns clearly: search engines have said publicly that they don't penalize content for being AI-assisted per se, they penalize low-quality content regardless of its origin — a distinction covered in more detail in our guide for SEO writers and our guide for bloggers.

If you're a freelance or agency writer, a client running your submission through a detector is, functionally, applying the triage-not-verdict logic above whether they realize it or not — and the strongest response isn't trying to guess which detector they'll use, it's writing (or editing AI-assisted drafts into) prose that would read as clearly, specifically yours to a human reader who knows your work, which is the actual, durable goal our guide to sounding natural is built around.

Frequently Asked Questions

Can a detector tell the difference between GPT-generated text and text from a different model? Not reliably, and often not at all. Classifiers are trained on whatever labeled data their developers assembled, and most don't distinguish output by originating model — they're built to answer "human or AI," not "which AI." A detector might perform differently across models simply because different models produce statistically different text, but that's an incidental side effect, not a designed feature.

Does a longer piece of text get scored more accurately than a short one? Generally, yes — longer texts give a statistical classifier more signal to work with, and perplexity/burstiness measurements stabilize with more data points, the same way any statistical estimate gets more reliable with a larger sample. Very short texts — a paragraph, a single tweet-length passage — are notoriously unreliable to score either direction, which is part of why some detectors refuse to score text under a minimum word count at all.

If I write with AI assistance and then heavily revise the output myself, does that reliably lower a detector score? Often, yes, because heavy revision changes the exact statistical properties — word choice, sentence rhythm, transition patterns — that a classifier is measuring. But "often" isn't "always," and it isn't the actual goal worth pursuing anyway; the goal worth pursuing is a piece of writing that reads like you, which happens to correlate with different statistics but isn't the same target as gaming a score.

Are detectors getting better over time, or is this a permanently unsolved problem? Both, in a sense. Individual detectors do improve as their training data expands and their classifiers get retrained. But the fundamental cat-and-mouse structure — generation models keep evolving, detectors keep training on yesterday's version of that evolution — means there's no static endpoint where the accuracy problem gets solved once and stays solved. It's an ongoing, moving target on both sides, which is precisely why treating any single score as a permanent, reliable fact is the wrong mental model from the start.

Should I ever tell someone their detector score is wrong? If you have reason to believe it — genuinely human-written work flagged as AI-generated — yes, and the research cited throughout this piece (the Stanford study on non-native speakers, the broader literature on classifier false-positive rates) is legitimate, citable evidence for that conversation, not a rationalization. The goal isn't to argue detectors are worthless; it's to argue, correctly, that a single score isn't proof of anything on its own.

Do detectors work the same way on languages other than English? Not necessarily, and this is an underexplored corner of the research. Most widely used commercial detectors were trained predominantly on English-language text, both on the human and the AI-generated side, which means their accuracy on other languages is less studied and, where it has been studied, often worse. If you're evaluating a detector's claims for a non-English context, treat the accuracy figures on its marketing page as referring to English performance unless it explicitly states otherwise.

Can I ask an institution which detector they use and how they interpret scores? Yes, and it's a reasonable question to ask directly rather than guessing. Many institutions publish their academic integrity procedures, including whether and how AI-detection scores factor into a case, and asking a program administrator or writing center directly is a legitimate way to understand your specific situation rather than relying on general information like this article.

The deeper point underneath all of this, worth carrying forward into how humanized text specifically interacts with these tools and how humanizers and detectors compare as tools, is that detection is genuinely useful math applied to a question it can only partially answer. Knowing the math — perplexity, burstiness, classifier training, watermarking, and the base-rate arithmetic that turns "99% accurate" into dozens of falsely accused people at scale — is what lets you use these tools responsibly instead of either worshipping or dismissing the number on the screen.