AI-generated text detection

Overview

The question is whether a given passage was produced by a language model rather than a person. The evaluation literature groups the approaches into watermarks added while the model writes, trained classifiers, zero-shot scores computed from the model's own probabilities, and retrieval against stored model outputs 2303.11156 §1 §2.

Detectors often look accurate when nobody tries to evade them. Under deliberate paraphrasing or spoofing, the reported accuracy of several of these families falls sharply 2303.11156 §1 §2.3 §2.4. Read every number below as author-reported and tied to its own setup. Seven of the cards are about detection: three evaluate detectors directly, one adapts a watermark to a new model family, one uses an AI-text classifier as a measuring tool, one is a position paper, and one tests which surface linguistic features separate human and AI text 2301.11305 §5 2303.11156 §2 2305.13661 §5 2509.24368 §4.1 2603.18161 §3.1 2303.13367 p. 3 2407.03646 §1.2.

Two more cards are included. One is a human rating study that asks whether untrained people can spot model text, and the other is a 2023 survey that summarises detection as an open problem 2107.00061 §2.4 2307.10169 §2.13. In total, the page draws on nine cards.

Variants

Zero-shot curvature score (DetectGPT)

The score is the log probability of the passage under the suspect model, minus the average log probability of several small rewrites of it. The rewrites come from a T5 mask-filling model. A large positive gap points to model text, on the idea that model samples sit on a local peak of the model's probability landscape 2301.11305 §1 §4. The method needs no training data, but it needs the token log probabilities of the suspect model, so it is white-box or API-with-log-probs only 2301.11305 §3. Each passage costs about k T5 generations and k+1 model passes 2301.11305 §6. The decision threshold is not stated 2301.11305 alg. 1.

Author-reported AUROC on 500 temperature-1 samples per dataset, for five models of 1.5B to 20B parameters, averages 0.97 on XSum, 0.92 on SQuAD and 0.97 on WritingPrompts 2301.11305 tab. 1. On GPT-3 and Jurassic-2, scored through their APIs, the average AUROC is 0.83, against 0.82 for a supervised RoBERTa-large detector 2301.11305 tab. 2. Top-p and top-k sampling raise the scores further 2301.11305 §5.2 tab. 3. Card: DetectGPT.

Model-side watermark (red-green lists)

The generator is biased toward a secret "green" subset of the vocabulary, chosen from the preceding context. The detector counts green tokens and runs a one-sided binomial test 2509.24368 §3.2. This only identifies text from a generator that embeds the watermark, so it is not a general detector.

The known red-green scheme needs the preceding tokens to pick the green list. Diffusion language models often fill a position before its neighbours are fixed, so the paper biases each step by the expected green count over the unknown context, and drops repeated (context, token) pairs at detection time 2509.24368 §3.1 §3.2. Author-reported, with the recommended settings on 600 WaterBench long-answer prompts, detection at 1% false positives reaches 0.99 TPR for LLaDA-8B and Dream-7B, against 0.49 to 0.83 for the naive adaptation depending on the context set 2509.24368 tab. 1. On LLaDA, the average score on six benchmarks falls from 59.4 to between 53.7 and 56.0 2509.24368 tab. 1. Detection stays strong until up to 30% of the words are deleted or substituted 2509.24368 §4.2. Card: Watermarking Diffusion Language Models.

The adversarial results for the original red-green watermark, on OPT-13B text, follow in the next variant 2303.11156 §2.3.

Adversarial evaluation: paraphrasing and spoofing

This variant is a stress test of the detectors above. The attacker paraphrases the output, feeds the result back in, and repeats for five rounds. The main paraphraser is DIPPER (11B); LLaMA-2-7B-Chat is an alternative rewriter 2303.11156 §2.1.

• Watermark. On OPT-13B text, TPR at 1% false positives drops from 99.8% to 80.7% after one DIPPER round, and to below 20% after five rounds 2303.11156 §2.3. For DIPPER paraphrases the content-preservation rating averages 4.0, with 70.4% of ratings at 4 or 5 2303.11156 tab. 1.
• Zero-shot. A single round with a T5-based paraphraser (Parrot) reduces DetectGPT's AUROC from 96.5% to 59.8% 2303.11156 §2.4.
• Trained. A RoBERTa-based detector from OpenAI keeps about 92% TPR at 1% false positives after one round, and about 80% when the attacker keeps the best of ten paraphrases 2303.11156 §2.4.
• Spoofing. The authors query a watermarked model about a million times on nonsense word lists, learn approximate green lists, and then let a person write text that the watermark detector flags. Its AUROC falls from 99.8% to 1.3% 2303.11156 §3 app. D.1. A targeted paraphrase also makes a retrieval detector flag every human text in the study 2303.11156 §3.
• Bound. The paper proves that a detector's AUROC is at most one half plus the total variation distance between the AI and human text distributions, minus half of that distance squared 2303.11156 §4 Thm. 1. The authors estimate that distance only roughly, so the bound is a ceiling, not a measurement 2303.11156 §4 app. C.5.
• Survey figure. The 2023 survey quotes Krishna et al. for DetectGPT accuracy falling from 70.3% to 4.6% under adversarial paraphrasing. It gives no setup for this number, and it was not re-measured here 2307.10169 §2.13.

Card: Can AI-Generated Text be Reliably Detected?.

Trained classifier and domain shift

The paper is about misinformation in retrieval corpora, and it uses a detector as a defense. A RoBERTa sequence classifier is fine-tuned to separate generated passages from human ones 2305.13661 §5 app. A. Training and test data come from the same generator, GPT-3.5, and the same questions. With in-domain training (the first 80% of NQ-1500 queries), the author-reported AUROC is 99.7 for the Gen fakes, 91.4 for Imi and 99.8 for Hack 2305.13661 tab. 3. Imi fakes edit real passages, and they are the lowest of the three in-domain scores 2305.13661 tab. 3.

Trained on GPT-3 Wikipedia completions instead, the AUROC falls to 64.8, 50.7 and 52.6 for Gen, Imi and Hack 2305.13661 tab. 3. The Imi value is close to chance. The paper tests one generator and one training source, so it does not show how the detector transfers to other models. Card: On the Risk of Misinformation Pollution with Large Language Models.

Detector as a measuring tool

Some studies do not evaluate a detector; they use one to label data. The ICLR 2026 analysis in 2603.18161 §3.1 labels reviews with the Pangram AI-text classifier, which labels about 21% of roughly 75,000 reviews as LLM-generated, and compares the groups it creates. The authors note that the classifier may make errors and correlate with other features [arxiv:2603.18161 §3.1]. The card has no accuracy figure for the classifier, so group-level results rest on labels whose error rate is not known from the paper. Card: How LLMs Distort Our Written Language.

Separately, the paper finds that LLM edits shift meaning even under grammar-only prompts 2603.18161 §4.2. That finding is about edits, not detection.

Stylometric feature profiles

This variant does not produce a score from the model or a trained classifier. It describes each text by counts of linguistic features (sounds, word classes, syntax and word difficulty), then tests which features differ between the two groups. A web profiling tool turns each text into 94 measures. The study keeps counts and normalised measures present in at least 80% of texts, runs a Wilcoxon rank-sum test with Hedges' g on each one, and fits one LASSO model per linguistic domain 2407.03646 §2.1 §2.2 p. 5–6.

The sample is small. It has five IELTS task essays written by people and five GPT-4 essays matched in length 2407.03646 §2.1 p. 5. The author reports that the GPT-4 essays have more nouns, alveolar consonants and difficult words, and fewer pronouns and function words 2407.03646 tab. 2 tab. 3. The difficult-word result has g = 2.90 at p = 0.0122, and pronouns have g = −3.21 at p = 0.0119 2407.03646 tab. 2 p. 8–9. The sign convention is read from the Results text, not stated in the table 2407.03646 §3 p. 7.

Caveats for reuse: the paper states no LASSO penalty value, fold count or seed, and it fits the models on unscaled features, so the selected features may change on a rerun 2407.03646 §2.2 tab. 3. The author calls the study exploratory and warns that surface cues may shift with newer models and decoding strategies, and that detectors built on them risk false positives 2407.03646 §1.2 §5 p. 14. No code or data is released 2407.03646 p. 15. Card: Differentiating Between Human-Written and AI-Generated Texts Using Automatically Extracted Linguistic Features.

Untrained human judgement

This is a human baseline, not a detector. Crowd raters on Amazon Mechanical Turk read 100-word-plus stories, news articles and recipes and say whether a person or GPT-3 wrote each one. Untrained raters were at chance on GPT-3 text, with 49.9% correct overall 2107.00061 §2.4 tab. 1. On GPT-2-XL text they scored 57.9%, which is above chance 2107.00061 tab. 1. Three short training conditions were tried on GPT-3 text. Only the one that showed labelled examples gave a significant overall gain, to 55%, and no domain showed a significant gain on its own 2107.00061 §3.2 tab. 2. Inter-rater agreement is near zero in every condition (Krippendorff's alpha at most 0.11) 2107.00061 §3.2. The authors advise against small, untrained human evaluations of current models 2107.00061 §5. Card: All That's 'Human' Is Not Gold.

Policy alternatives and proposed detector (untested)

A position paper on ChatGPT in academic publishing proposes a detector that compares a submission with papers that a model writes from the submission's keywords, and flags high similarity 2303.13367 p. 12. The keyword extractor, generator, number of papers, sampling procedure, similarity measure and threshold are all not stated 2303.13367 p. 12. The paper does not discuss false positives on human papers about the same topic. It also proposes non-technical responses: more encouragement of original research, and tenure criteria based on impact rather than paper count 2303.13367 p. 12–13. Card: ChatGPT and a New Academic Reality.

When to use which

Implementation sketch

Zero-shot curvature score, as in 2301.11305 alg. 1. It is written in our own words and omits the threshold, which the paper does not state.

# Curvature score for one passage [arxiv:2301.11305 alg. 1]
def curvature_score(passage, suspect_model, mask_filler, k):
    # Draw k small rewrites made by a mask-filling model [arxiv:2301.11305 §5]
    rewrites = [mask_filler(passage) for _ in range(k)]
    # Mean token log probability of the passage under the suspect model
    base = mean_token_logprob(suspect_model, passage)
    # Same statistic for each rewrite
    alt = [mean_token_logprob(suspect_model, r) for r in rewrites]
    # Gap between the passage and its rewrites, scaled by their spread
    gap = base - mean(alt)
    return gap / std(alt)  # compare with a threshold; not stated in the paper

Dividing by the spread of the rewrites raises AUROC by about 0.02 on average, which is why the paper uses the normalised score 2301.11305 §4.

Contradictions

• Zero-shot accuracy. DetectGPT reports an average AUROC of 0.97 on temperature-1 samples 2301.11305 tab. 1. The stress test reports 59.8% AUROC for DetectGPT after one round of T5-based paraphrasing, down from 96.5% 2303.11156 §2.4. The two setups differ in sampling, models and attack, and neither paper resolves the gap.
• Watermark robustness. The diffusion watermark reports 0.99 TPR at 1% false positives and robustness to up to 30% word edits 2509.24368 §4.2 tab. 1. The red-green watermark on OPT-13B falls below 20% TPR after five paraphrase rounds 2303.11156 §2.3. The schemes, models and attacks differ, so the numbers are not directly comparable.
• Trained detectors across attacks and domains. The OpenAI RoBERTa detector keeps about 92% TPR at 1% false positives after one paraphrase round 2303.11156 §2.4. A RoBERTa classifier trained on other generators' output reaches only 50.7 to 64.8 AUROC on the misinformation fakes 2305.13661 tab. 3. These are different detectors, metrics and distribution shifts, so neither paper resolves the gap.
• DetectGPT under paraphrasing. The survey quotes Krishna et al. at 70.3% falling to 4.6% accuracy 2307.10169 §2.13. The stress test reports AUROC falling from 96.5% to 59.8% after one round of T5-based paraphrasing 2303.11156 §2.4. The metric, paraphraser and number of rounds differ, and the survey gives no setup, so neither figure can be checked against the other.

Papers

• DetectGPT: Zero-Shot Machine-Generated Text Detection using Probability Curvature: zero-shot curvature score from the suspect model's log probabilities and T5 rewrites 2301.11305 §4.
• Can AI-Generated Text be Reliably Detected?: stress test of watermark, trained, zero-shot and retrieval detectors under paraphrasing and spoofing 2303.11156 §2–§4.
• On the Risk of Misinformation Pollution with Large Language Models: GPT-3.5 fake passages in a retrieval corpus, and a RoBERTa detector tested in- and out-of-domain 2305.13661 §5.
• Watermarking Diffusion Language Models: red-green watermark adapted to diffusion LMs that fill tokens in any order 2509.24368 §3.
• How LLMs Distort Our Written Language: empirical study of LLM edits and an AI-text classifier used to label ICLR reviews 2603.18161 §3.1.
• ChatGPT and a New Academic Reality: Artificial Intelligence-Written Research Papers and the Ethics of the Large Language Models in Scholarly Publishing: non-empirical position paper with an untested keyword-regeneration detector and policy proposals 2303.13367 p. 12–13.
• All That's 'Human' Is Not Gold: Evaluating Human Evaluation of Generated Text: crowd raters' ability to tell GPT-2 and GPT-3 text from human text, with three training conditions 2107.00061 §2–§3.
• Challenges and Applications of Large Language Models: 2023 survey of open LLM problems, including detection of generated text as an unsolved challenge 2307.10169 §2.13.
• Differentiating Between Human-Written and AI-Generated Texts Using Automatically Extracted Linguistic Features: five human and five GPT-4 essays profiled into 94 linguistic measures, with per-domain LASSO 2407.03646 §2.2.