---
kind: concept
slug: ai-generated-text-detection
title: AI-generated text detection
summary: >-
  Deciding whether a text was written by a language model. Covers zero-shot likelihood-curvature scoring (DetectGPT), trained classifiers and how they transfer across domains, model-side watermarks and their extension to diffusion LMs, and how paraphrasing and spoofing break detectors. Accuracy figures are author-reported and depend heavily on whether an adversary edits the text.
tags: [detection, watermarking, adversarial, scholarly-publishing, ethics, llm-text]
papers: ["2301.11305", "2303.11156", "2305.13661", "2509.24368", "2603.18161", "2303.13367", "2107.00061", "2307.10169", "2407.03646"]
related: [adversarial-robustness, adversarial-text-generation, llm-ethics, text-watermarking, data-poisoning, retrieval-augmented-generation, human-evaluation, llm-evaluation, text-classification]
status: draft
updated_at: 2026-11-01
---

## Overview

The question is whether a given passage was produced by a language model
rather than a person. The evaluation literature groups the approaches into
watermarks added while the model writes, trained classifiers, zero-shot scores
computed from the model's own probabilities, and retrieval against stored model
outputs [arxiv:2303.11156 §1] [§2].

Detectors often look accurate when nobody tries to evade them. Under deliberate
paraphrasing or spoofing, the reported accuracy of several of these families
falls sharply [arxiv:2303.11156 §1] [§2.3] [§2.4]. Read every number below as
author-reported and tied to its own setup. Seven of the cards are about
detection: three evaluate detectors directly, one adapts a watermark to a new
model family, one uses an AI-text classifier as a measuring tool, one is a
position paper, and one tests which surface linguistic features separate human
and AI text [arxiv:2301.11305 §5] [arxiv:2303.11156 §2] [arxiv:2305.13661 §5] [arxiv:2509.24368 §4.1] [arxiv:2603.18161 §3.1] [arxiv:2303.13367 p. 3] [arxiv:2407.03646 §1.2].

Two more cards are included. One is a human rating study that asks whether
untrained people can spot model text, and the other is a 2023 survey that
summarises detection as an open problem [arxiv:2107.00061 §2.4] [arxiv:2307.10169 §2.13].
In total, the page draws on nine cards.

## Variants

### Zero-shot curvature score (DetectGPT)

The score is the log probability of the passage under the suspect model,
minus the average log probability of several small rewrites of it. The rewrites
come from a T5 mask-filling model. A large positive gap points to model text,
on the idea that model samples sit on a local peak of the model's probability
landscape [arxiv:2301.11305 §1] [§4]. The method needs no training data, but it
needs the token log probabilities of the suspect model, so it is white-box or
API-with-log-probs only [arxiv:2301.11305 §3]. Each passage costs about k T5
generations and k+1 model passes [arxiv:2301.11305 §6]. The decision threshold
is not stated [arxiv:2301.11305 alg. 1].

Author-reported AUROC on 500 temperature-1 samples per dataset, for five
models of 1.5B to 20B parameters, averages 0.97 on XSum, 0.92 on SQuAD and
0.97 on WritingPrompts [arxiv:2301.11305 tab. 1]. On GPT-3 and Jurassic-2,
scored through their APIs, the average AUROC is 0.83, against 0.82 for a
supervised RoBERTa-large detector [arxiv:2301.11305 tab. 2]. Top-p and top-k
sampling raise the scores further [arxiv:2301.11305 §5.2] [tab. 3]. Card:
[DetectGPT](/papers/2301.11305).

### Model-side watermark (red-green lists)

The generator is biased toward a secret "green" subset of the vocabulary, chosen
from the preceding context. The detector counts green tokens and runs a
one-sided binomial test [arxiv:2509.24368 §3.2]. This only identifies text from
a generator that embeds the watermark, so it is not a general detector.

The known red-green scheme needs the preceding tokens to pick the green list.
Diffusion language models often fill a position before its neighbours are fixed,
so the paper biases each step by the expected green count over the unknown
context, and drops repeated (context, token) pairs at detection time
[arxiv:2509.24368 §3.1] [§3.2]. Author-reported, with the recommended settings
on 600 WaterBench long-answer prompts, detection at 1% false positives reaches
0.99 TPR for LLaDA-8B and Dream-7B, against 0.49 to 0.83 for the naive
adaptation depending on the context set [arxiv:2509.24368 tab. 1]. On LLaDA, the
average score on six benchmarks falls from 59.4 to between 53.7 and 56.0
[arxiv:2509.24368 tab. 1]. Detection stays strong until up to 30% of the words
are deleted or substituted [arxiv:2509.24368 §4.2]. Card:
[Watermarking Diffusion Language Models](/papers/2509.24368).

The adversarial results for the original red-green watermark, on OPT-13B text,
follow in the next variant [arxiv:2303.11156 §2.3].

### Adversarial evaluation: paraphrasing and spoofing

This variant is a stress test of the detectors above. The attacker paraphrases
the output, feeds the result back in, and repeats for five rounds. The main
paraphraser is DIPPER (11B); LLaMA-2-7B-Chat is an alternative rewriter
[arxiv:2303.11156 §2.1].

- **Watermark.** On OPT-13B text, TPR at 1% false positives drops from 99.8%
  to 80.7% after one DIPPER round, and to below 20% after five rounds
  [arxiv:2303.11156 §2.3]. For DIPPER paraphrases the content-preservation
  rating averages 4.0, with 70.4% of ratings at 4 or 5 [arxiv:2303.11156 tab. 1].
- **Zero-shot.** A single round with a T5-based paraphraser (Parrot) reduces
  DetectGPT's AUROC from 96.5% to 59.8% [arxiv:2303.11156 §2.4].
- **Trained.** A RoBERTa-based detector from OpenAI keeps about 92% TPR at 1%
  false positives after one round, and about 80% when the attacker keeps the best
  of ten paraphrases [arxiv:2303.11156 §2.4].
- **Spoofing.** The authors query a watermarked model about a million times on
  nonsense word lists, learn approximate green lists, and then let a person
  write text that the watermark detector flags. Its AUROC falls from 99.8% to
  1.3% [arxiv:2303.11156 §3] [app. D.1]. A targeted paraphrase also makes a
  retrieval detector flag every human text in the study [arxiv:2303.11156 §3].
- **Bound.** The paper proves that a detector's AUROC is at most one half plus
  the total variation distance between the AI and human text distributions,
  minus half of that distance squared [arxiv:2303.11156 §4 Thm. 1]. The authors
  estimate that distance only roughly, so the bound is a ceiling, not a
  measurement [arxiv:2303.11156 §4] [app. C.5].
- **Survey figure.** The 2023 survey quotes Krishna et al. for DetectGPT
  accuracy falling from 70.3% to 4.6% under adversarial paraphrasing. It gives
  no setup for this number, and it was not re-measured here
  [arxiv:2307.10169 §2.13].

Card: [Can AI-Generated Text be Reliably Detected?](/papers/2303.11156).

### Trained classifier and domain shift

The paper is about misinformation in retrieval corpora, and it uses a detector
as a defense. A RoBERTa sequence classifier is fine-tuned to separate generated
passages from human ones [arxiv:2305.13661 §5] [app. A]. Training and test data
come from the same generator, GPT-3.5, and the same questions. With in-domain
training (the first 80% of NQ-1500 queries), the author-reported AUROC is 99.7
for the Gen fakes, 91.4 for Imi and 99.8 for Hack [arxiv:2305.13661 tab. 3]. Imi
fakes edit real passages, and they are the lowest of the three in-domain
scores [arxiv:2305.13661 tab. 3].

Trained on GPT-3 Wikipedia completions instead, the AUROC falls to 64.8, 50.7
and 52.6 for Gen, Imi and Hack [arxiv:2305.13661 tab. 3]. The Imi value is close
to chance. The paper tests one generator and one training source, so it does not
show how the detector transfers to other models. Card:
[On the Risk of Misinformation Pollution with Large Language Models](/papers/2305.13661).

### Detector as a measuring tool

Some studies do not evaluate a detector; they use one to label data. The
ICLR 2026 analysis in [arxiv:2603.18161 §3.1] labels reviews with the Pangram
AI-text classifier, which labels about 21% of roughly 75,000 reviews as
LLM-generated, and compares the groups it creates. The authors note that the
classifier may make errors and correlate with other features [arxiv:2603.18161
§3.1]. The card has no accuracy figure for the classifier, so group-level
results rest on labels whose error rate is not known from the paper. Card:
[How LLMs Distort Our Written Language](/papers/2603.18161).

Separately, the paper finds that LLM edits shift meaning even under grammar-only
prompts [arxiv:2603.18161 §4.2]. That finding is about edits, not detection.

### Stylometric feature profiles

This variant does not produce a score from the model or a trained classifier.
It describes each text by counts of linguistic features (sounds, word classes,
syntax and word difficulty), then tests which features differ between the two
groups. A web profiling tool turns each text into 94 measures. The study keeps
counts and normalised measures present in at least 80% of texts, runs a
Wilcoxon rank-sum test with Hedges' g on each one, and fits one LASSO model per
linguistic domain [arxiv:2407.03646 §2.1] [§2.2] [p. 5–6].

The sample is small. It has five IELTS task essays written by people and five
GPT-4 essays matched in length [arxiv:2407.03646 §2.1] [p. 5]. The author
reports that the GPT-4 essays have more nouns, alveolar consonants and difficult
words, and fewer pronouns and function words [arxiv:2407.03646 tab. 2] [tab. 3].
The difficult-word result has g = 2.90 at p = 0.0122, and pronouns have g = −3.21
at p = 0.0119 [arxiv:2407.03646 tab. 2] [p. 8–9]. The sign convention is read
from the Results text, not stated in the table [arxiv:2407.03646 §3] [p. 7].

Caveats for reuse: the paper states no LASSO penalty value, fold count or seed,
and it fits the models on unscaled features, so the selected features may
change on a rerun [arxiv:2407.03646 §2.2] [tab. 3]. The author calls the study
exploratory and warns that surface cues may shift with newer models and
decoding strategies, and that detectors built on them risk false positives
[arxiv:2407.03646 §1.2] [§5] [p. 14]. No code or data is released [arxiv:2407.03646 p. 15].
Card: [Differentiating Between Human-Written and AI-Generated Texts Using Automatically Extracted Linguistic Features](/papers/2407.03646).

### Untrained human judgement

This is a human baseline, not a detector. Crowd raters on Amazon Mechanical
Turk read 100-word-plus stories, news articles and recipes and say whether a
person or GPT-3 wrote each one. Untrained raters were at chance on GPT-3 text,
with 49.9% correct overall [arxiv:2107.00061 §2.4] [tab. 1]. On GPT-2-XL text
they scored 57.9%, which is above chance [arxiv:2107.00061 tab. 1]. Three short
training conditions were tried on GPT-3 text. Only the one that showed labelled
examples gave a significant overall gain, to 55%, and no domain showed a
significant gain on its own [arxiv:2107.00061 §3.2] [tab. 2]. Inter-rater
agreement is near zero in every condition (Krippendorff's alpha at most 0.11)
[arxiv:2107.00061 §3.2]. The authors advise against small, untrained human
evaluations of current models [arxiv:2107.00061 §5]. Card:
[All That's 'Human' Is Not Gold](/papers/2107.00061).

### Policy alternatives and proposed detector (untested)

A position paper on ChatGPT in academic publishing proposes a detector that
compares a submission with papers that a model writes from the submission's
keywords, and flags high similarity [arxiv:2303.13367 p. 12]. The keyword
extractor, generator, number of papers, sampling procedure, similarity measure
and threshold are all not stated [arxiv:2303.13367 p. 12]. The paper does not
discuss false positives on human papers about the same topic. It also proposes
non-technical responses: more encouragement of original research, and tenure
criteria based on impact rather than paper count [arxiv:2303.13367 p. 12–13].
Card: [ChatGPT and a New Academic Reality](/papers/2303.13367).

## When to use which

| Situation | Use | Why |
|---|---|---|
| You can read token log probabilities from the suspect model and have no labelled data | Zero-shot curvature score | Needs no training data [arxiv:2301.11305 §3]; costs about k extra model passes per passage [arxiv:2301.11305 §6] |
| The model exposes no token log probabilities (ChatGPT, per the paper) | Zero-shot scores are unavailable | The paper notes this exception to the API-with-log-probs case [arxiv:2301.11305 §3] |
| You control the generator and can change its sampling | Watermark | Detection is a plain statistical test [arxiv:2509.24368 §3.2]; the paper's stated strength does not reproduce from its released configs, so calibrate on your own texts [arxiv:2509.24368 §4.1] [app. A.1] |
| You can collect labelled generated text from your own generator and domain | Trained classifier, calibrated in-domain | In-domain AUROC of 91.4 to 99.8 on one QA setup [arxiv:2305.13661 tab. 3]; the paper does not test transfer to other generators |
| Your generator or domain differs from the labelled data | Re-measure before relying on a trained classifier | Out-of-domain AUROC of 50.7 to 64.8 in the same paper [arxiv:2305.13661 tab. 3] |
| Users may paraphrase or edit the text | Plan for large drops | Watermark, zero-shot and trained detectors all lose much of their accuracy under paraphrasing [arxiv:2303.11156 §2.3] [§2.4] |
| You work in a domain other than news, Wikipedia or fiction | Re-measure first | Supervised detectors fall well behind DetectGPT on English scientific writing and fail on German [arxiv:2301.11305 §5.1] [fig. 4] |
| Editors or readers must judge by eye whether a text is machine-written | Do not rely on untrained judgement | Untrained raters were at chance on GPT-3 text (49.9%) [arxiv:2107.00061 tab. 1]; labelled-example training reached 55% overall, with no significant gain within a domain [arxiv:2107.00061 tab. 2] |
| You want features a reader can inspect, and you can label only a handful of texts | Stylometric feature profile, as a hypothesis generator | Five texts per group in the one study; the author calls it exploratory and warns that surface cues may shift with new models [arxiv:2407.03646 §1.2] [§5] |
| You are writing a journal or institutional policy | Policy alternatives | The paper argues for them, but offers no evidence of their effect [arxiv:2303.13367 p. 12–13] |

## Implementation sketch

Zero-shot curvature score, as in [arxiv:2301.11305 alg. 1]. It is written in
our own words and omits the threshold, which the paper does not state.

```pseudocode
# Curvature score for one passage [arxiv:2301.11305 alg. 1]
def curvature_score(passage, suspect_model, mask_filler, k):
    # Draw k small rewrites made by a mask-filling model [arxiv:2301.11305 §5]
    rewrites = [mask_filler(passage) for _ in range(k)]
    # Mean token log probability of the passage under the suspect model
    base = mean_token_logprob(suspect_model, passage)
    # Same statistic for each rewrite
    alt = [mean_token_logprob(suspect_model, r) for r in rewrites]
    # Gap between the passage and its rewrites, scaled by their spread
    gap = base - mean(alt)
    return gap / std(alt)  # compare with a threshold; not stated in the paper
```

Dividing by the spread of the rewrites raises AUROC by about 0.02 on average,
which is why the paper uses the normalised score [arxiv:2301.11305 §4].

## Contradictions

- **Zero-shot accuracy.** DetectGPT reports an average AUROC of 0.97 on
  temperature-1 samples [arxiv:2301.11305 tab. 1]. The stress test reports
  59.8% AUROC for DetectGPT after one round of T5-based paraphrasing, down from
  96.5% [arxiv:2303.11156 §2.4]. The two setups differ in sampling, models and
  attack, and neither paper resolves the gap.
- **Watermark robustness.** The diffusion watermark reports 0.99 TPR at 1%
  false positives and robustness to up to 30% word edits [arxiv:2509.24368 §4.2]
  [tab. 1]. The red-green watermark on OPT-13B falls below 20% TPR after five
  paraphrase rounds [arxiv:2303.11156 §2.3]. The schemes, models and attacks
  differ, so the numbers are not directly comparable.
- **Trained detectors across attacks and domains.** The OpenAI RoBERTa detector
  keeps about 92% TPR at 1% false positives after one paraphrase round
  [arxiv:2303.11156 §2.4]. A RoBERTa classifier trained on other generators'
  output reaches only 50.7 to 64.8 AUROC on the misinformation fakes
  [arxiv:2305.13661 tab. 3]. These are different detectors, metrics and
  distribution shifts, so neither paper resolves the gap.
- **DetectGPT under paraphrasing.** The survey quotes Krishna et al. at 70.3%
  falling to 4.6% accuracy [arxiv:2307.10169 §2.13]. The stress test reports
  AUROC falling from 96.5% to 59.8% after one round of T5-based paraphrasing
  [arxiv:2303.11156 §2.4]. The metric, paraphraser and number of rounds differ,
  and the survey gives no setup, so neither figure can be checked against the
  other.

## Papers

- [DetectGPT: Zero-Shot Machine-Generated Text Detection using Probability Curvature](/papers/2301.11305): zero-shot curvature score from the suspect model's log probabilities and T5 rewrites [arxiv:2301.11305 §4].
- [Can AI-Generated Text be Reliably Detected?](/papers/2303.11156): stress test of watermark, trained, zero-shot and retrieval detectors under paraphrasing and spoofing [arxiv:2303.11156 §2–§4].
- [On the Risk of Misinformation Pollution with Large Language Models](/papers/2305.13661): GPT-3.5 fake passages in a retrieval corpus, and a RoBERTa detector tested in- and out-of-domain [arxiv:2305.13661 §5].
- [Watermarking Diffusion Language Models](/papers/2509.24368): red-green watermark adapted to diffusion LMs that fill tokens in any order [arxiv:2509.24368 §3].
- [How LLMs Distort Our Written Language](/papers/2603.18161): empirical study of LLM edits and an AI-text classifier used to label ICLR reviews [arxiv:2603.18161 §3.1].
- [ChatGPT and a New Academic Reality: Artificial Intelligence-Written Research Papers and the Ethics of the Large Language Models in Scholarly Publishing](/papers/2303.13367): non-empirical position paper with an untested keyword-regeneration detector and policy proposals [arxiv:2303.13367 p. 12–13].
- [All That's 'Human' Is Not Gold: Evaluating Human Evaluation of Generated Text](/papers/2107.00061): crowd raters' ability to tell GPT-2 and GPT-3 text from human text, with three training conditions [arxiv:2107.00061 §2–§3].
- [Challenges and Applications of Large Language Models](/papers/2307.10169): 2023 survey of open LLM problems, including detection of generated text as an unsolved challenge [arxiv:2307.10169 §2.13].
- [Differentiating Between Human-Written and AI-Generated Texts Using Automatically Extracted Linguistic Features](/papers/2407.03646): five human and five GPT-4 essays profiled into 94 linguistic measures, with per-domain LASSO [arxiv:2407.03646 §2.2].