Machine-generated text detection

Machine-generated text detection is the problem of deciding whether a given passage of text was written by a person or produced by a large language model. Interest in the problem is nearly as old as neural text generation itself, but it became a mainstream concern after ChatGPT launched in late 2022 and teachers, editors, and platform operators suddenly needed a way to tell student essays, news copy, and reviews apart from model output.

Three families of techniques dominate the field: statistical (zero-shot) detectors that score text against a language model's own probability estimates, trained classifiers such as GPTZero and Turnitin's detector, and watermarking schemes that alter how a model samples tokens so its output carries a hidden, checkable signal. A fourth approach sidesteps inspection of the text entirely and relies on provenance records or retrieval against logs of what a model actually generated.

The area is contested. OpenAI shipped its own AI text classifier in January 2023 and withdrew it less than six months later for low accuracy ^[7]. Detectors misfire disproportionately on text written by non-native English speakers ^[15], universities have switched detection features off over false-positive worries ^[16], and theoretical work argues that as model text becomes more human-like, any detector's advantage over random guessing shrinks toward zero ^[18]. Accuracy claims in this field, especially vendor claims, deserve caution.

Early work

Detection research predates ChatGPT by several years and was driven by fear of machine-written disinformation rather than homework. In 2019, Gehrmann, Strobelt, and Rush released GLTR, a visual tool that colors each token of a document by how highly the language model ranked it; because sampled text draws heavily from the head of the model's distribution, the pattern is visible to the eye. In their study, access to GLTR raised untrained readers' ability to spot fake text from about 54 percent to 72 percent ^[1].

The same year, Zellers and colleagues built Grover, a model trained to generate propaganda-style news articles, and found that the best defense was Grover itself: it identified its own generations with 92 percent accuracy, while the best conventional discriminators managed 73 percent ^[2]. When OpenAI released the full 1.5 billion parameter GPT-2 in November 2019, it also released a RoBERTa-based detector, reporting detection rates of roughly 95 percent against GPT-2 output while cautioning that this was "not high enough accuracy for standalone detection" ^[3].

Statistical and zero-shot methods

Zero-shot detectors need no training data. They exploit the fact that model-generated text is, by construction, high probability under the model, whereas human writing routinely takes low-probability turns. The simplest version scores a document's perplexity: implausibly smooth, low-perplexity text is flagged as machine output.

DetectGPT, introduced by Eric Mitchell and colleagues at Stanford in January 2023, sharpened this idea with probability curvature. The method perturbs a passage many times with a mask-filling model such as T5 and compares the log probability of the original against its perturbed variants. Model-generated text tends to sit in regions of negative curvature (small rewrites almost always lower its log probability), while human text does not. On fake news articles generated by the 20B parameter GPT-NeoX, DetectGPT reached 0.95 AUROC against 0.81 for the strongest prior zero-shot baseline ^[4]. The paper appeared at ICML 2023.

Follow-up work attacked DetectGPT's main weakness, its cost. Fast-DetectGPT replaced the perturbation step with conditional probability curvature computed by sampling, reporting a roughly 340-fold speedup along with higher accuracy ^[5]. Binoculars, published in January 2024, contrasts two closely related language models to compute its score and reported detecting over 90 percent of ChatGPT-generated samples at a 0.01 percent false positive rate, without any ChatGPT training data ^[6].

Trained classifiers

The commercial detection market is built almost entirely on supervised classifiers: models trained on labeled corpora of human and machine text.

OpenAI's entry, the AI Text Classifier, launched on January 31, 2023. Its own launch numbers were modest: it correctly labeled 26 percent of AI-written text as "likely AI-written" and mislabeled human text as AI 9 percent of the time. On July 20, 2023 OpenAI shut it down, stating in an update note that the classifier was withdrawn "due to its low rate of accuracy," and said it was researching more effective provenance techniques for text ^[7].

GPTZero, built by Princeton undergraduate Edward Tian, went live in January 2023 and drew about 30,000 uses in its first week. It scores documents on perplexity and "burstiness," the variation in complexity across sentences, on the theory that human writing swings between plain and surprising sentences while model output stays even. The company raised over 3.5 million dollars in seed funding in May 2023, a 10 million dollar Series A in 2024, and reported 4 million users by July 2024 ^[8]. In June 2026 it was acquired by Superhuman, the productivity software company, which said it would fold GPTZero into its AI assistant ^[9].

Turnitin, whose plagiarism software is embedded in coursework workflows worldwide, switched on AI writing detection on April 4, 2023, making it available to more than 2.1 million educators across over 10,700 institutions ^[10]. The company said at launch that it had tuned the system to minimize false positives, and it claimed a false positive rate of about 1 percent ^[16]. What that means at scale became the crux of the debate, discussed below.

Watermarking

Watermarking moves the problem from forensics to cooperation: the model provider embeds a statistical signal at generation time, so detection later is a hypothesis test rather than a guess.

The reference scheme is the "green list" watermark of Kirchenbauer, Geiping, Wen, Katz, Miers, and Goldstein (January 2023, published at ICML 2023). Before each token is generated, a pseudorandom function seeded by the preceding context splits the vocabulary into green and red lists, and the sampler softly boosts green tokens. Human writers, ignorant of the lists, use green tokens at chance rates; watermarked output overuses them, and a z-test over a short span of tokens yields an interpretable p-value. Detection requires only the hash function, not access to the model ^[11].

Google DeepMind took watermarking to production with SynthID-Text, described in a Nature paper published on October 23, 2024 (Dathathri et al.). Its "tournament sampling" runs candidate tokens through a knockout bracket judged by pseudorandom watermarking functions, biasing output toward tokens that score well without measurably degrading quality. In a live experiment covering roughly 20 million watermarked and unwatermarked Gemini responses, user thumbs-up and thumbs-down rates differed by only 0.01 and 0.02 percentage points respectively, and the non-distortionary configuration added about 0.57 percent generation latency on Gemma 7B. Google open-sourced the scheme through the SynthID Text repository ^[12]. The SynthID family also covers images, audio, and video.

OpenAI has confirmed building a text watermark for ChatGPT but has not deployed it. In an August 2024 blog update the company said the method is "highly accurate and even effective against localized tampering, such as paraphrasing," but is defeated by globalized tampering such as running text through a translation system, rewording it with another model, or asking the model to insert and then delete a special character between words. It also cited the risk of stigmatizing AI as a writing aid for non-native English speakers, and said it is weighing cryptographically signed metadata, which cannot produce false positives, as an alternative ^[13].

Watermarking's structural limits are shared across schemes: only text from cooperating providers carries the mark, open-weight models can be run without it, and determined paraphrasing degrades it.

Retrieval and provenance

Krishna and colleagues proposed that API providers keep a database of everything their models generate and answer detection queries by semantic search: if a candidate passage closely matches a logged generation, it is machine text even after rewording. In their experiments over a corpus of 15 million generations, retrieval caught 80-97 percent of paraphrased generations at a 1 percent false positive rate ^[14]. The approach requires provider cooperation and raises retention and privacy questions. Related provenance efforts, such as C2PA credentials and signed metadata, attach a verifiable history to content rather than inspecting the words themselves; see content provenance.

False positives and fairness

The strongest empirical criticism of detectors is not that they miss machine text but who they wrongly accuse. A Stanford study by Weixin Liang, Mert Yuksekgonul, Yining Mao, Eric Wu, and James Zou, published in Patterns in July 2023, ran seven widely used GPT detectors on 91 human-written TOEFL essays from a Chinese educational forum and 88 essays by US eighth graders. The detectors were near-perfect on the US student essays but misclassified more than half of the TOEFL essays as AI-generated, with an average false positive rate of 61.22 percent. All seven detectors unanimously flagged 18 of the 91 essays (19.8 percent), and 89 of 91 (97.8 percent) were flagged by at least one detector. When ChatGPT was prompted to enrich the essays' word choice, the average false positive rate fell to 11.77 percent, evidence that the detectors were keying on the lower linguistic variability, and hence lower perplexity, typical of non-native writing ^[15].

Individual accusations made news throughout 2023. In May 2023 an instructor at Texas A&M University-Commerce pasted student essays into ChatGPT, asked the chatbot whether it had written them, and threatened to fail the class on its say-so; all but one student, who admitted using the software, were cleared ^[17].

Institutions began backing away. On August 16, 2023, Vanderbilt University disabled Turnitin's AI detector "for the foreseeable future," calculating that even at the vendor's claimed 1 percent false positive rate, roughly 750 of the 75,000 papers it had run through Turnitin in 2022 could have been wrongly labeled, and citing the bias findings against non-native speakers and OpenAI's shutdown of its own classifier ^[16]. OpenAI's withdrawal notice itself remains the most cited vendor admission that classifier-based detection underdelivers ^[7].

Fundamental limits and evasion

Sadasivan, Kumar, Balasubramanian, Wang, and Feizi asked in March 2023 whether AI-generated text can be reliably detected at all. Their answer, published in Transactions on Machine Learning Research, bounds any detector's AUROC by a function of the total variation distance between the human and model text distributions: as models improve and the distributions converge, the best possible detector approaches a coin flip. They also demonstrated recursive paraphrasing attacks that erode watermark and classifier accuracy, and spoofing attacks in which an adversary infers watermark patterns well enough to make human text look watermarked, framing false attribution as an attack surface of its own ^[18].

Empirical stress tests point the same direction. Krishna et al. showed that a single pass through their 11B parameter DIPPER paraphraser dropped DetectGPT's detection accuracy from 70.3 percent to 4.6 percent, and that paraphrasing also evaded watermarking, GPTZero, and OpenAI's classifier ^[14]. Weber-Wulff and colleagues tested 14 tools (12 public plus Turnitin and PlagiarismCheck) for the International Journal for Educational Integrity in 2023 and concluded the tools were "neither accurate nor reliable," skewed toward calling text human-written, and further degraded by obfuscation such as paraphrase or machine translation ^[19]. The RAID benchmark (ACL 2024) evaluated 12 detectors over more than 6 million generations spanning 11 generator models, 8 domains, 4 decoding strategies, and 11 adversarial attacks, and found that detectors advertised at 99 percent-plus accuracy are "easily fooled" by sampling changes, repetition penalties, unseen generators, and adversarial edits ^[20].

A practical consequence: detection scores are probabilistic signals, not evidence. Sensible deployments treat them as one input among several, never as standalone proof of misconduct.

Regulation

Lawmakers have largely bet on watermarking and labeling rather than after-the-fact detection. Under Article 50 of the EU AI Act, providers of systems that generate synthetic text, audio, images, or video must ensure outputs are "marked in a machine-readable format and detectable as artificially generated," with the marking required to be effective, interoperable, and robust so far as technically feasible; deployers must additionally disclose AI-generated text published to inform the public on matters of public interest, unless a human exercises editorial responsibility. These transparency obligations apply from August 2, 2026 ^[21].

China moved earlier. The Measures for Labeling AI-Generated Synthetic Content, issued in March 2025 by the Cyberspace Administration of China together with three other agencies, took effect on September 1, 2025. They require both explicit labels (visible notices in or around the content) and implicit labels (provider and content identifiers embedded in file metadata) on AI-generated content including text, encourage digital watermarks, and oblige platforms to check metadata and warn users about suspected unlabeled synthetic content ^[22].

Timeline

Scroll sideways for more →

Current state

As of 2026 the field has settled into an uneasy division of labor. Zero-shot and classifier detectors remain widely used in education and publishing because they work on any text, but every rigorous third-party evaluation has found them brittle under paraphrase and unfair to some writer populations, and vendors' headline accuracy numbers rarely survive contact with adversarial benchmarks ^[19][20]. Watermarking is the technically strongest option and now ships in production at Google scale ^[12], but it only covers cooperating providers, and OpenAI has held its own watermark back over evasion and equity concerns ^[13]. Regulators in the EU and China are mandating machine-readable marking anyway ^[21][22], which will test how far provenance-based approaches can carry the load that pure detection could not.

See also

• Watermarking
• SynthID
• GPTZero
• AI-generated content
• Content provenance
• Natural language generation

References

1. ^Gehrmann, S., Strobelt, H., Rush, A. M. "GLTR: Statistical Detection and Visualization of Generated Text." ACL 2019 (demo). arxiv.org/...1906.04043
2. ^Zellers, R., Holtzman, A., Rashkin, H., Bisk, Y., Farhadi, A., Roesner, F., Choi, Y. "Defending Against Neural Fake News." NeurIPS 2019. arxiv.org/...1905.12616
3. ^OpenAI. "GPT-2: 1.5B release." November 2019. openai.com/...gpt-2-1-5b-release
4. ^Mitchell, E., Lee, Y., Khazatsky, A., Manning, C. D., Finn, C. "DetectGPT: Zero-Shot Machine-Generated Text Detection using Probability Curvature." ICML 2023. arxiv.org/...2301.11305
5. ^Bao, G., Zhao, Y., Teng, Z., Yang, L., Zhang, Y. "Fast-DetectGPT: Efficient Zero-Shot Detection of Machine-Generated Text via Conditional Probability Curvature." ICLR 2024. arxiv.org/...2310.05130
6. ^Hans, A., Schwarzschild, A., Cherepanova, V., Kazemi, H., Saha, A., Goldblum, M., Geiping, J., Goldstein, T. "Spotting LLMs With Binoculars: Zero-Shot Detection of Machine-Generated Text." January 2024. arxiv.org/...2401.12070
7. ^OpenAI. "New AI classifier for indicating AI-written text." January 31, 2023, with July 20, 2023 withdrawal note. openai.com/...ifier-for-indicating-ai-written-text
8. ^Wikipedia. "GPTZero." en.wikipedia.org/...GPTZero
9. ^Engadget. "Superhuman has acquired AI authenticity service GPTZero." June 23, 2026. engadget.com/...ed-ai-authenticity-service-gptzero
10. ^Caren, C. "The launch of Turnitin's AI writing detector and the road ahead." Turnitin, April 4, 2023. turnitin.com/...riting-detector-and-the-road-ahead
11. ^Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., Goldstein, T. "A Watermark for Large Language Models." ICML 2023. arxiv.org/...2301.10226
12. ^Dathathri, S., et al. "Scalable watermarking for identifying large language model outputs." Nature 634, 818-823, October 23, 2024. nature.com/...s41586-024-08025-4
13. ^OpenAI. "Understanding the source of what we see and hear online." Updated August 4, 2024. openai.com/...ource-of-what-we-see-and-hear-online
14. ^Krishna, K., Song, Y., Karpinska, M., Wieting, J., Iyyer, M. "Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense." NeurIPS 2023. arxiv.org/...2303.13408
15. ^Liang, W., Yuksekgonul, M., Mao, Y., Wu, E., Zou, J. "GPT detectors are biased against non-native English writers." Patterns 4(7), 2023. arxiv.org/...2304.02819
16. ^Vanderbilt University. "Guidance on AI detection and why we're disabling Turnitin's AI detector." August 16, 2023. vanderbilt.edu/...-disabling-turnitins-ai-detector
17. ^Wikipedia. "Artificial intelligence content detection." en.wikipedia.org/...intelligence_content_detection
18. ^Sadasivan, V. S., Kumar, A., Balasubramanian, S., Wang, W., Feizi, S. "Can AI-Generated Text be Reliably Detected?" Transactions on Machine Learning Research. arxiv.org/...2303.11156
19. ^Weber-Wulff, D., Anohina-Naumeca, A., Bjelobaba, S., Foltynek, T., Guerrero-Dib, J., Popoola, O., Sigut, P., Waddington, L. "Testing of detection tools for AI-generated text." International Journal for Educational Integrity 19, 26 (2023). arxiv.org/...2306.15666
20. ^Dugan, L., Hwang, A., Trhlik, F., Ludan, J. M., Zhu, A., Xu, H., Ippolito, D., Callison-Burch, C. "RAID: A Shared Benchmark for Robust Evaluation of Machine-Generated Text Detectors." ACL 2024. arxiv.org/...2405.07940
21. ^EU Artificial Intelligence Act, Article 50: Transparency Obligations for Providers and Deployers of Certain AI Systems. artificialintelligenceact.eu/...50
22. ^China Law Translate. "Measures for Labeling AI-Generated Synthetic Content." Effective September 1, 2025. chinalawtranslate.com/...ai-labeling