Guide

How AI Detectors Work in 2026 (And Why They Get It Wrong)

A plain-English 2026 guide to how AI detectors work: perplexity, burstiness, trained classifiers and watermark reading, what a percentage score actually measures, what the independent accuracy research finds, and the five structural reasons detectors flag human writing as AI.

August 29, 2026 · The AI Rankings

Quick answer: An AI detector works by measuring how predictable a piece of text is to a language model, then converting that measurement into a probability score. The two classic signals are perplexity — how surprised a reference model is by each word you chose — and burstiness — how much that surprise varies from sentence to sentence; AI writing tends to score low on both, because a language model samples high-probability tokens at a steady rate. The leading commercial detectors have since moved past those two metrics to deep-learning classifiers trained on millions of labelled human and machine passages, and a fourth, entirely different method reads a watermark deliberately embedded by the model’s maker. The reason they get it wrong is structural rather than fixable: predictable, low-variance writing is also what you get from non-native English speakers, formulaic academic prose and heavily edited drafts, so a detector cannot separate “written by a machine” from “written in a machine-like way”.

This guide explains the mechanism, then explains the failure modes. It does not rank tools — for that, with independent accuracy scores and pricing, see best AI detectors.

What an AI detector actually does

An AI detector does not read text for meaning, check it against a database of AI output, or know which model produced it. It estimates one thing: how likely a language model would have been to produce this exact sequence of words.

That framing explains almost every behaviour that confuses people. A detector has no access to your document’s history, no record of what ChatGPT generated yesterday, and no ground truth. It has a statistical model of what machine-written text looks like, and it measures the distance between your text and that model. Everything else — the percentage, the highlighted sentences, the confidence band — is presentation layered on top of that single measurement.

Four detection approaches exist, and only the last one has access to real evidence rather than an inference.

The first three guess. The fourth checks. That distinction is the single most useful thing to hold on to.

Perplexity: how surprised the model is by your words

Perplexity measures how predictable a passage is to a reference language model — low perplexity suggests machine authorship, high perplexity suggests a human.

Run a passage through a language model and, at every position, the model has an opinion about what should come next. If the text says “the capital of France is Paris”, the model was expecting “Paris” and is barely surprised. If it says “the capital of France is a fried egg”, the model is very surprised. Perplexity aggregates that surprise across the whole passage into one number.

Language models generate text by sampling from their own probability distribution, and they tend to pick from the high-probability end of it. So machine-written text is, on average, text that a language model finds unsurprising — which is exactly what a low perplexity score means. GPTZero, which popularised the metric for detection, describes perplexity as a measure of how likely an AI model would have been to choose the exact same set of words found in the document, with higher perplexity implying a human source.

The problem arrives immediately. Perplexity does not measure “written by a machine”. It measures “predictable”. Clear, plain, conventional writing is predictable. Writing by someone with a smaller working vocabulary in English is predictable. A well-structured five-paragraph essay taught to a template is predictable. All of them score like AI.

Burstiness: how much that surprise varies

Burstiness measures the variation in perplexity and sentence structure across a document — human writing tends to be uneven, machine writing tends to be uniform.

Humans write in bursts. A long, clause-heavy sentence gets followed by a short one. A dense paragraph gets followed by a throwaway line. Some sentences are surprising, others are boilerplate. Plot the perplexity of each sentence in a human essay and you get a jagged line.

A language model applies the same sampling rule at every step, so its output tends to plot as a flatter line — consistent sentence lengths, consistent register, consistent level of surprise. GPTZero describes burstiness as how much writing patterns and text perplexities vary over the entire document, and identifies writing at a very consistent level of AI-likeness as a fingerprint of language models.

Burstiness is the weaker of the two signals in 2026, for two reasons. Frontier models have got markedly better at stylistic variation, so the flatness that defined 2023-era output has partly gone. And burstiness is trivially gameable — a prompt asking for varied sentence length raises it, and so does ordinary human editing.

Trained classifiers: what the commercial tools actually run

A trained classifier is a model fine-tuned on millions of labelled examples of human and AI writing, which outputs a probability that a new passage belongs to the AI class.

Every major commercial detector is now a classifier, not a raw perplexity meter. The tool ingests a large corpus of confirmed-human text (usually pre-2022 writing, which cannot contain modern AI output) and a large corpus of generated text, then learns whatever separates them. That “whatever” is not restricted to perplexity — it includes phrasing habits, punctuation patterns, transitional structures and any other statistical regularity in the data.

The clearest evidence of the shift comes from the tool that started it. GPTZero pioneered perplexity-and-burstiness detection, and now states on its own explainer page that it no longer uses perplexity and burstiness for AI detection, having migrated to a deep-learning architecture in autumn 2023; the same page describes the two metrics as one of seven indicators in the upgraded model, alongside text search and deep-learning detection. Originality.ai explains its own detector as binary classification: the model outputs a probability, a threshold is chosen, and text above the threshold is flagged.

That matters for how you read explainers, including older ones on the vendors’ own sites. Perplexity and burstiness are the honest way to understand detection, because they are interpretable and they explain the failure modes. They are no longer how the leading tools actually decide. Classifiers post the highest accuracy figures in the category, and they earn them — on data that resembles their training set. Their characteristic failure is the mirror image of that strength, and it is covered below.

The research methods underneath

Commercial tools are products; the methods they build on are published. Four papers define the technical landscape, and knowing them makes vendor claims much easier to read.

Binoculars is the number most often quoted at people who claim detection is impossible, and it is a real result — but it is a laboratory result, measured on unmodified generations. The gap between that and a classroom is the subject of the rest of this guide.

Watermark reading: the one method that is not a guess

Watermark detection reads a signal that the model’s maker deliberately embedded at generation time, which makes it evidence rather than inference — but it only works on content from providers that watermark.

A statistical text watermark biases the model’s choice among near-equivalent words in a secret, key-dependent pattern. The text reads normally; a detector holding the key can measure the bias. Because there is a real planted signal, detection is far more reliable than style-guessing.

As of August 2026 this method covers a growing but still partial slice of AI text. Google watermarks Gemini output with SynthID and runs a SynthID Detector portal, access to which has been gated to journalists and researchers. Anthropic announced on 11 August 2026 that Claude models launched on or after 2 August 2026 embed a statistical text watermark, applied worldwide rather than only where the law requires it; it has not released a public detector. ChatGPT text carries no watermark, and open-weight models you run yourself never will. Our AI watermarking guide covers the mechanism, the coverage table and the EU AI Act Article 50 rules that forced the timing.

The practical consequence for anyone using a detector: the absence of a watermark proves nothing at all, because most AI text was never marked in the first place.

What the percentage score actually means

A detector’s percentage is a model’s confidence that text resembles its AI training class. It is not the probability that a person cheated, and it is not the proportion of the document written by AI.

This is the most consequential misreading in the whole category, and it is worth stating in four parts.

• It is not a probability of guilt. An 80% score does not mean there is an 80% chance the writer used AI. It means the classifier’s output crossed a threshold the vendor selected.
• It is not a percentage of the document. Some tools do report the share of sentences flagged, which is a different number from the confidence score, and the two are routinely conflated in screenshots.
• The threshold is a business decision. Tuning a detector to catch more AI text necessarily flags more human text; tuning it to protect innocent writers necessarily lets AI text through. Vendors pick a point on that curve, and can move it.
• Vendors know this and hedge in their own documentation. Turnitin suppresses the score entirely for documents in the 1–19% range specifically because false positives cluster there.

How accurate are AI detectors?

On clean, unedited AI text from models the detector has seen, the best tools are genuinely accurate. On edited, paraphrased, mixed or non-native writing, published accuracy figures fall apart. Both halves of that sentence are supported by peer-reviewed work, and the gap between them is where every real-world dispute happens.

Independent findings, oldest to newest:

Two things follow. First, the Chicago Booth result is real and should not be dismissed — accurate detection of unmodified AI text is a solved problem for at least one tool. Second, the 2026 explainability work is the most uncomfortable finding in the table: a detector can post a 0.97 F1 score while keying on how your text is formatted rather than who wrote it.

Vendor claims sit above all of this and should be read as claims. Originality.ai states that its Turbo 3.0.2 model exceeds 99% accuracy on leading flagship models from OpenAI, Google, Anthropic and DeepSeek; Turnitin publishes a document-level false-positive rate below 1% for documents containing 20% or more AI writing, validated against more than 700,000 pre-ChatGPT papers. Both figures are plausible for the conditions the vendor tested. Neither describes a paraphrased, co-written or second-language document.

Why AI detectors get it wrong

The failures are not bugs awaiting a patch. Each one falls directly out of the mechanism described above.

They flag non-native English writing

The best-documented failure in the field. Liang et al., published in Patterns, ran seven detectors over 91 TOEFL essays written by non-native English speakers and 88 essays by US eighth-graders: the detectors produced a mean false-positive rate of 61.3% on the TOEFL essays, unanimously flagging 19.8% of them, while the US student essays were classified near-perfectly. The authors’ proposed explanation is exactly the mechanism — writers working in a second language use less lexical variety, which produces lower perplexity, which reads as machine output.

This is why the bias is not fixable by retraining. The detector is correctly measuring predictability; predictability is simply not the same thing as authorship.

Paraphrasing and humanisers strip the signal

Every signal a detector uses lives in specific word choices, so replacing the words removes the signal. Sadasivan et al. reported a 71% degradation in accuracy for zero-shot classifiers such as DetectGPT under a T5-based paraphraser, and RAID found detectors easily fooled by adversarial attacks across eleven attack types at scale. The NeurIPS 2025 adversarial paraphrasing work went further, using a detector’s own scores to steer the rewrite — an attack that needs no training and transfers between detectors. Commercial AI humanisers productise the same idea.

Mixed human and AI writing is the hardest case

Most real documents are neither purely human nor purely machine — someone drafts, an assistant polishes, the human edits back. Detectors are trained on clean examples of each class and have no class for the blend.

Turnitin’s own data shows where this breaks. Its sentence-level false-positive rate is around 4%, and the errors are not randomly scattered: 54% of falsely flagged human sentences sit directly next to an AI-written sentence and a further 26% sit two sentences away. False positives concentrate at the seams, which is precisely where a document that was genuinely co-written lives.

They learn the dataset, not the authorship

This is the newest finding and the most damaging to benchmark-based marketing. Pudasaini et al., revised in April 2026, built a detector on 30 linguistic features that scored an F1 of 0.9734 on the PAN CLEF 2025 and COLING 2025 benchmarks, then ran explainability analysis on what it was actually using. The decisive features turned out to differ from dataset to dataset, leaning on surface cues such as text length and formatting — artefacts of how each corpus was assembled rather than a stable signal of machine authorship. Cross-domain and cross-generator evaluation showed the score degrading substantially.

A high leaderboard number therefore tells you a detector separates that dataset. It does not establish that it separates human writing from machine writing.

The overlap problem is theoretical, not practical

The most fundamental limit. Sadasivan et al. proved an impossibility result: as the distribution of machine-generated text converges on the distribution of human text, the accuracy of the best possible detector converges on a coin flip. There is no algorithmic escape, because the two classes stop being distinguishable in principle.

Models have spent every year since 2023 getting closer to human text distributions. Detection is running against the direction of model development, and the papers above are the sound of that gap closing.

What is replacing detection

The interesting movement in 2026 is away from scoring finished text and towards recording how it was written.

• Process evidence. Turnitin Clarity, generally available since 15 July 2025, gives students a writing space that records how a document was produced — a writing report with timestamps and time-on-task — rather than scoring the finished text, and in May 2026 Turnitin added customisable settings that let instructors define the role its AI assistant may play, from brainstorming and outlining through to structural revision. Grammarly Authorship and Cadmus take the same approach from the writing-tool side, categorising text as typed, pasted or AI-generated and replaying the session.
• Provenance at the source. Watermarking and C2PA Content Credentials attach a signal at generation, which is checkable rather than inferable. EU AI Act Article 50, enforceable from 2 August 2026, requires machine-readable marking of synthetic output wherever technically feasible, which is why 2026 is the year every major lab shipped something.
• Consolidation of the detection market itself. On 23 June 2026 Superhuman, the company formerly known as Grammarly, announced it was acquiring GPTZero — the best-known consumer detector, with a reported 19 million users and roughly $30 million in annual recurring revenue — to build what it calls an authenticity layer, with GPTZero continuing as a standalone product (BusinessWire). Detection is becoming a feature of writing platforms rather than a standalone product category.
• Institutions opting out. Universities that have looked closely at the evidence are increasingly switching detection off: Curtin University in Australia disabled Turnitin’s AI writing detection across all campuses and study periods from 1 January 2026, citing reliability concerns, while retaining Turnitin for text matching. It is one of dozens of institutions across the US, UK, Canada, Australia and South Africa to have banned, disabled or discouraged the tools — our detector guide names them.

What to do with a detector score, by situation

If you are a teacher or marker

Treat any score as a prompt to open a conversation about process, never as a finding. Ask for drafts, notes and an explanation of the argument. The Turnitin sentence-level data shows false positives clustering exactly around genuine human editing, and the Liang study shows them clustering on your international students.

If you are a student who has been falsely flagged

Ask which tool produced the score, what its published false-positive rate is, and whether the institution’s policy allows a score to stand as sole evidence. Then produce process evidence: version history in Google Docs or Word, notes, search history, drafts. Process evidence beats a probability score, because it is a record rather than an inference.

If you are a student checking your own work before submitting

Use a free detector as a rough smoke test, understand that a flag means “this reads predictably” rather than “this is AI”, and do not rewrite good work to fool a classifier. See best AI detectors for the free tiers.

If you are a publisher or editor

Your risk is different: you care about volume, not individuals, so a detector used at the batch level to triage suspicious submissions is defensible in a way that an individual verdict is not. Pair it with contributor policy and disclosure requirements.

If you need actual proof

You do not have a detection problem, you have a provenance problem. Check for a watermark or C2PA credentials, and check the document’s edit history. Everything else is a probability estimate. Our watermarking guide sets out what is currently checkable.

Frequently asked questions

How do AI detectors work?

AI detectors estimate how predictable a passage would be to a language model and convert that estimate into a probability score. The two classic signals are perplexity, which measures how surprised a reference model is by each word chosen, and burstiness, which measures how much that surprise varies across the document; machine-written text tends to score low on both. The leading commercial tools have since moved to deep-learning classifiers trained on millions of labelled human and AI passages, which learn whatever separates the two corpora rather than any single interpretable metric. A separate method, watermark reading, checks for a signal the model’s maker embedded at generation, and is the only approach based on evidence rather than inference.

What is perplexity in AI detection?

Perplexity measures how predictable text is to a reference language model — specifically, how surprised the model is by each word actually chosen. Language models sample from the high-probability end of their own distribution, so their output tends to have low perplexity. A detector treats low perplexity as evidence of machine authorship. The flaw is that perplexity measures predictability rather than authorship, so plain, conventional or second-language English writing scores like AI for reasons that have nothing to do with a machine.

How accurate are AI detectors?

Accuracy depends entirely on the conditions. On clean, unedited output from a model the detector has seen, the best tools are strong: a University of Chicago Booth study by Jabarian and Imas (working paper, September 2025) found Pangram was the only detector to hold false positives at or below 0.5% while still detecting AI text reliably. On edited, paraphrased, co-written or non-native English text, published figures do not hold — the RAID benchmark found detectors easily fooled by adversarial attacks and struggling to generalise to unseen models, and a 2026 explainability study found a detector scoring 0.9734 F1 in-domain while leaning on surface cues such as text length and formatting rather than stable authorship signals.

Why do AI detectors flag human writing as AI?

Because they measure predictability, not authorship, and a lot of genuine human writing is predictable. The best-documented case is non-native English: a study published in Patterns ran seven detectors over TOEFL essays by non-native speakers and recorded a mean false-positive rate of 61.3%, while the same detectors classified US eighth-grade essays near-perfectly. The authors’ explanation is that writing in a second language uses less lexical variety and therefore has lower perplexity. Formulaic academic structures, technical writing and heavily edited prose produce the same effect.

Can AI detectors detect paraphrased or humanised text?

Mostly not. Every signal a detector uses lives in specific word choices, so replacing those words removes the signal. Sadasivan et al. reported a 71% degradation in accuracy for zero-shot classifiers such as DetectGPT under a T5-based paraphraser, and a NeurIPS 2025 paper demonstrated “adversarial paraphrasing” — using a detector’s own scores to steer a rewrite — that transfers across detection systems without any training. Commercial humaniser tools sell the same technique. Detection can win individual rounds against specific tools, but the mechanism gives the evasion side the structural advantage.

What does an 80% AI score actually mean?

It means a classifier’s confidence output crossed a threshold the vendor selected. It does not mean there is an 80% chance the writer used AI, and it usually does not mean 80% of the document was AI-written — some tools report that share as a separate, different number. Because raising the threshold catches more AI text and also flags more human text, the number reflects a commercial decision about where to sit on that trade-off. Turnitin suppresses scores in the 1–19% range altogether because false positives concentrate there.

Can AI detectors tell which model wrote something?

Generally no. A classifier is trained to separate a broad “AI” class from a broad “human” class, not to attribute text to ChatGPT rather than Claude or Gemini. Some tools report a most-likely model, but that is a secondary inference from stylistic resemblance and is much weaker than the primary human-versus-AI judgement. The only method that identifies a specific source is watermark reading, because a watermark is keyed to one provider — and that requires the provider to have watermarked the text and the checker to hold or have access to the key.

Do AI detectors work on ChatGPT, Claude and Gemini output?

They work on all three in the sense that a classifier will return a score for any text, and on unmodified output from current frontier models the better detectors do flag a substantial share of it. But the newer and more capable the model, the closer its output sits to human text distributions, and detectors trained before a model’s release perform worse on it — the RAID benchmark found that detectors have substantial difficulty generalising to models and domains they have not seen. Watermark checking is more reliable where it is available, which as of August 2026 means Gemini and, for key-holders, Claude — but not ChatGPT text, which OpenAI does not watermark.

Is there any way to prove text was written by AI?

Not from the text alone. The reliable routes are provenance and process: a watermark or C2PA credential embedded by the generating model, or a record of how the document was written, such as document version history or a process-capture tool like Turnitin Clarity, Grammarly Authorship or Cadmus. Sadasivan et al. proved an impossibility result showing that as machine text converges on human text distributions, the best possible detector converges on a coin flip — which means no future detector fixes this by being better. A detector score is a signal worth investigating; it is not proof.

Written 29 August 2026. Accuracy figures are reported with the study and conditions that produced them; vendor accuracy claims are labelled as claims and are not independently verified here. Detection is a fast-moving field and the research cited reflects work published to this date. For tool-by-tool rankings, pricing and free tiers, see our best AI detectors guide.

← All guides