How AI Detectors Work
Detectors don’t see the prompt, the model, or the time stamp. Detectors see the words; therefore, a detector estimates how closely those words align with the statistics of machine-generated text.
How AI Detectors Work: The Basics
In a finished sentence, nothing shows where it came from. Detectors compare your text to what generated text looks like and return a number. Two families are the most popular. Zero-shot statistical methods read the numbers and score the text using a reference language model. Supervised classifiers are neural networks trained on large labeled sets of human and machine texts and learn a way to separate the two piles.
Perplexity is the first family’s workhorse. Feed one token at a time of a passage through a language model and ask at each position how surprised the model was to see that word. The average across the passage is perplexity. Low perplexity means text that is highly predictable. Text that is generated will always score low perplexity almost by construction because part of the decoding setting is to artificially set a low temperature or top-p. Essentially, this tail of the distribution is cut off before a word is selected.
Burstiness refers to the rhythm inherent in human writing where a short sentence may be followed by a long one. Throwaway lines may come after dense paragraphs of arguments. This creates significant differences in the length of sentences and perplexity across the document, in stark contrast to outputs by machines. This contrast is the basis for the first public explanation by GPTZero, and most statistical detectors refer to it by a different name.
- Perplexity: measures the average intrinsic uncertainty of a language model for predicting each token
- Burstiness: measures how much perplexity changes across sentences and paragraphs
- Token rank: how often the chosen word was the model’s first or second guess
- Probability curvature: based on the observation by DetectGPT that most machine-generated text sits on a local probability peak, and that slight changes to the text result in a large decrease in its log probability
- Stylometry: the spread of vocabulary, punctuation habits, syntax depth, and the use of function words
- How the text within each document is proven to have entered the document at the time of writing as opposed to having become known to a chronicler later.
Why How AI Detectors Work Matters
Understanding how something works helps you understand how it can break, and, more importantly, knowing the failure mode helps you fully understand the mechanism. An explanatory justification written to a standardized template, such as a regulatory document, an API, an elaborate product description, or even a listicle written to a template will appear machine-like and boring to most people. Many forms of writing, including regulatory, API, product descriptive, Listicle, or even written English (under certain conditions), will appear machine-like, and, moreover, boring, to most people. All of this is meant to be predictable. None of this is actually generated by a machine.
Many arguments surrounding the classification of material as ‘AI’ or ‘human written’ can be attributed to the use of thresholds by vendors. Many classifiers assign a confidence score to each classification and the vendor decides where to draw the line at which the classifier’s output is considered AI. Classifiers then treat everything above the line as AI and everything below as human written. Moving the line to higher confidence scores increases the number of cases of generated text the classifier will consider AI. Moving the line the opposite way will allow generated text to slip through. As a result, two classifiers with similar models, but implemented by different vendors, can differ greatly in the classification of a given text.
Drift is also an issue. A supervised detector learns the model’s fingerprint from the generations it was trained on. If you use new models, new defaults for decoding, or fine-tune other models, it shifts the fingerprint. These shifts mean that the accuracy measured a year ago might not apply to the texts produced this year. A detection system is trying to hit a moving object while it is chasing an even faster moving object. This is why vendors continuously have to re-train their models and why benchmark numbers deteriorate over the years.
What the number is
A detector score conveys a likelihood estimate from a statistical model, calibrated on someone else’s test set. It should be treated as evidence, but is not the type one should base a conviction on.
How Articled Approaches How AI Detectors Work
We view most detectors as a tripwire on an automated process. When we build or revise a process, we train a person to use tools at each stage of the process. We go out of our way to confirm that detectors are superfluous and harmful. At this stage of the process, a person researches and drafts a piece, a person edits the draft, and only then do tools run. Every draft goes through Originality.ai, GPTZero, Turnitin, Copyleaks, Winston AI, ZeroGPT, Sapling, Content at Scale, Writer.com AI Detector, Crossplag, Grammarly Authorship and Copyscape, and every report is attached to the delivery email, regardless of whether it is complimentary to us or not.
One of the twelve does something different from the other eleven. Grammarly Authorship does not analyze the final text. Rather, Authorship captures how text was recorded in a document while it was being authored to distinguish manuscript text from text that was pasted or was inserted as a generated response. This is a process rather than a statistical analysis, and it is likely closer to what the client actually wants to know. Copyscape and the plagiarism side of Originality.ai answer a third question that is different than the other two: has this passage been published elsewhere before?
We would never write to please a classifier. If a submission performs poorly, and if the writer’s drafts, notes, and sources check out, we examine the process instead of smoothing the sentence. Humanizer apps, which exist to push these numbers and are a complete waste of time to the writer, are banned. A verification report matters only if people aren’t trying to game against it.
- Twelve tools on every draft, before delivery, no exceptions
- All reports attached to the delivery email, including unflattering ones
- No tuning, rewriting or humanizing to improve a score
- Drafts and notes must be maintained so provenance can be substantiated
How AI Detectors Work FAQs
Detectors can be confidently wrong because they estimate a likelihood from the statistics of the words alone. Articled runs twelve of them on every draft to cross-check the processes that already exclude generative AI at every stage.
Detectors can be confidently wrong because they estimate a likelihood from the statistics of the words alone. Articled runs twelve of them on every draft to cross-check the processes that already exclude generative AI at every stage.
It is the average amount a language model is surprised by the next word in your text, a low perplexity suggests a sentence was easy to predict and is, in part, indicative of a machine output, but also of clear and cohesive, well-edited prose.
Poorly. Perplexity and burstiness are statistical averages, and averages over a few sentences are noisy. Most vendors quietly recommend a few hundred words as a floor, and scores on a single paragraph or a tweet should be treated as close to meaningless.
Some guess at a family, and those guesses are less certain than the human-versus-machine call on which they’re based. When attributing models, it is the harder question to answer with less information. Treat a named model in a report as a hint, and not a finding.
Only where the generator cooperates. Watermarking a model introduces a bias that increases the probability of certain words appearing due to a secret pattern. This allows a detector to find the watermark, however this only works for a company’s output that actually watermarks their models. Text generated by unwatermarked models will not show the watermark.
Often, yes, which is one reason detection cannot carry much weight on its own. Paraphrasing tools change the token distribution enough to raise perplexity past a threshold. It also leaves the underlying content unchanged, so it solves nothing about the writing itself.
Do not get caught up in which tool you should buy. The point is every technique mentioned here finds a pattern and assigns a cause, but a pattern can come from many different sources. If you want to be sure of the author, you need evidence that the author created along with the writing and not evidence that you extracted after the writing process.
Content a person actually wrote
$10 per 100 words, and the writer keeps all of it. Our 1% sits on top, 0.5% goes to trees, and no generated text appears anywhere in the process.