AI-Generated Text Detection: How It Works, Where It Fails, and How to Use It Responsibly

1. The starting point: why AI-generated text is easy to spot

Many people treat “AI score” as something mystical. In reality, it is an explainable and measurable statistical phenomenon, and understanding the underlying causes matters far more than hunting for ways to dodge detection.

1.1 Probabilistic fingerprints: low perplexity and low burstiness

The training objective of a large language model is to maximize the conditional probability of the next token, so its output naturally follows high-probability paths. This shows up as two measurable traits:

• Low perplexity: the text is “too easy to predict” for a language model, with almost no surprising word choices.
• Insufficient burstiness: human writing alternates between long and short sentences, and between common and rare words, producing high variance. Model output has low variance in sentence length and an even rhythm.

A rough approximation looks like this:

import numpy as np
def perplexity(token_logprobs):
    """token_logprobs: log probability of each token in the sequence"""
    nll = -float(np.mean(token_logprobs))     # mean negative log-likelihood
    return float(np.exp(nll))                 # perplexity; lower means more "templated"
def burstiness(sentence_lengths):
    """Sentence-length variability: std / mean. Human text is usually much higher."""
    arr = np.asarray(sentence_lengths, dtype=float)
    return float(arr.std() / (arr.mean() + 1e-9))

1.2 Semantic fingerprints: high correctness, low information density

Models tend to produce sentences that are “never wrong but carry no information”: terminology is neatly stacked, yet there is no verifiable specificity. No concrete numbers, no dates or places, no counterexamples, no judgment from the author. Experienced human reviewers sense the emptiness; a detection model turns that emptiness into a feature.

1.3 Discourse-level fingerprints: templated argument loops

Models favor a fixed skeleton: “intro–body–conclusion,” “first/second/finally,” “in summary.” Paragraph lengths are evenly balanced, and the text rarely shows the traces of real thinking, such as going off-topic, correcting oneself, or adding a qualification after an example fails. Once the academic chain of “argument–challenge–response” is missing, the discriminative signature of the text becomes very obvious.

2. How detection technology actually works: four mainstream paths

2.1 Probability-curve discrimination

Hypothesis testing on the two candidate distributions (“human-written” vs. “model-written”) using statistics such as perplexity and token-probability curvature. This family requires no training and is highly explainable, but it nearly fails on short text and on highly formatted text.

2.2 Supervised discriminative models

Large sets of human-written and machine-written samples train a text classifier that learns combinations of features such as lexical distribution, syntactic habits, and punctuation patterns. This is the most common form in engineering practice today. Its advantage is that it adapts well to a specific domain; its drawback is weak cross-domain transfer: a detector trained on novels will misclassify legal clauses or lab reports at a noticeably higher rate.

2.3 Generation-side watermarking and provenance

During decoding, a detectable statistical bias is applied to token sampling so that the output of a specific model carries a verifiable mark. This path depends on cooperation from the generation side and does nothing for existing historical text, but it is very practical for enterprise audits that need to answer “which model generated this document?”

2.4 Retrieval and fact-consistency checking

Rather than asking “does this look like AI,” this checks “is what it says correct”: assertions, numbers, and citations in the text are compared against the original sources. It is the most reliable class of method and also the most expensive to build, requiring three capabilities: a retrieval index, citation parsing, and assertion extraction.

Path	Strength	Main failure scenario
Probability curve	No training needed, explainable	Short text, template-style official documents
Discriminative classifier	Good domain adaptation	Cross-domain transfer, adversarial rewriting
Watermarking / provenance	Auditable, traceable	Historical text, unwatermarked generation sources
Fact checking	Directly targets content reliability	Text with no citations or retrievable sources

3. Do not treat a detection score as a verdict: confidence boundaries must be explicit

The most commonly overlooked point in implementation is this: a detection score is a probabilistic signal, not a conclusion. False positives are common in the following situations:

• Non-native authors writing formal prose with conservative word choice and regular sentence structure;
• Genres that inherently require heavy templating, such as manuals, regulations, standards, and experimental procedures;
• Human-written text that has gone through multiple rounds of “unify terminology, unify tense” polishing.

Metrics therefore have to be read in pairs: recall alone is meaningless, and the false positive rate (FPR) must be reported alongside it, together with a threshold sweep curve. The threshold should not be a single value but three bands:

LOW, HIGH = 0.35, 0.75
def route(score: float) -> str:
    if score < LOW:
        return "likely_human"        # low score: pass through
    if score > HIGH:
        return "needs_review"        # high score: route to human review, don't judge directly
    return "inconclusive"            # gray zone: no conclusion, log only

A threshold evaluation report should include at least the following:

import numpy as np
def threshold_report(labels, scores, grid=np.linspace(0.0, 1.0, 101)):
    """labels: 1 means machine-written; returns FPR and recall at each threshold"""
    labels = np.asarray(labels)
    scores = np.asarray(scores)
    rows = []
    for t in grid:
        pred = scores >= t
        fpr = float(pred[~labels.astype(bool)].mean()) if (~labels.astype(bool)).any() else 0.0
        recall = float(pred[labels.astype(bool)].mean()) if labels.any() else 0.0
        rows.append((round(float(t), 2), round(fpr, 4), round(recall, 4)))
    return rows

4. The right posture: put the model in the “assistant” seat, not the “ghostwriter” seat

The genuinely sustainable approach is to divide labor between humans and models by responsibility.

Structure layer (hand it to the model): breaking down the topic, three-level outlines, research-question lists, review-criteria checklists, possible counterarguments. Models are good at enumerating structure and bad at owning facts.

Information layer (semi-automated): unifying a glossary, checking abbreviation consistency, first-pass literature screening and abstract clustering. Every citation must be verified against the original. Hallucinated references produced by a model are a hard red line.

Expression layer (model rewrites, human owns content): turning a colloquial draft into formal prose, compressing verbose sentences, checking subject–verb agreement and logical connectives. The human owns content and conclusions; the machine only touches form.

Verification layer (what models do best): regexes and data-cleaning scripts, unit tests, plotting code, step-by-step checking of formula derivations. These tasks have objective right and wrong answers and a short feedback loop.

Non-delegable parts: judgment about whether a research question is worth pursuing, the real provenance of data, causal interpretation of results, attribution of novelty, and any AI-usage disclosure required by your institution.

5. Putting it into production: a reusable writing-quality pipeline

5.1 Layered architecture

• Ingestion layer: text import and export, format parsing, batch job submission;
• Orchestration layer: outline generation → section-by-section writing → terminology consistency check → citation verification → quality evaluation;
• Model layer: a unified wrapper around general LLM services and text-understanding capabilities, so backends can be swapped or degraded easily;
• Audit layer: full-text and per-section provenance, score records, human review conclusions.

For the underlying dependencies, generic cloud capability categories are sufficient: object storage for drafts and artifacts, a message queue for asynchronous decoupling and peak shaving, a container platform to run inference and batch jobs, a logging service to record requests and decision inputs, and monitoring and alerting to track score-distribution drift and failure rates. For model access you can use an LLM service such as the large model capabilities on Baidu AI Cloud, hiding differences between backends behind a single adapter layer.

5.2 Batch inference and human-review routing

def run_batch(docs, score_fn, workers=8):
    """docs: [{doc_id, text}]; returns results annotated with review routing"""
    from concurrent.futures import ThreadPoolExecutor
    def handle(doc):
        score = score_fn(doc["text"])          # unified scoring interface, easy to swap detection implementation
        return {**doc, "score": round(score, 4), "route": route(score)}
    with ThreadPoolExecutor(max_workers=workers) as pool:
        return list(pool.map(handle, docs))

5.3 Structured output and prompt constraints

Requiring the model to return a checkable structure instead of free text sharply reduces downstream parsing cost:

Polish the paragraph below for academic style. Adjust expression only; do not add
facts, data, or citations.
Return JSON:
{
  "revised": "the rewritten paragraph",
  "changed_terms": ["terms that were normalized"],
  "needs_human_check": ["statements you think the author should confirm"]
}
If the original text contains an assertion you cannot verify, put it in
needs_human_check instead of completing it yourself.

5.4 Provenance is the evidence

In any dispute over “I wrote this myself,” the strongest evidence is not a detection score but the process record: outline versions, successive drafts, the revision timeline, data and experiment scripts, and correspondence with advisors. Writing drafts and the scoring chain into the audit layer costs very little and is worth a great deal.

6. Four frequent misconceptions

1. Treating “push the detection score to zero” as the goal. This is a false goal. The score is a probabilistic output, and chasing an extreme low value pushes the text toward poor expression, which damages readability and professionalism.
2. Repeatedly “washing” and rewriting the draft. Multiple rounds of synonym substitution cause semantic drift, inconsistent terminology across the document, and sometimes outright factual errors and fabricated citations. The risk far outweighs the benefit.
3. Uploading unpublished manuscripts to online services of unknown origin. When unpublished data, corporate material, or personal information is involved, first confirm the data-handling and data-retention terms, and prefer services that offer no-persistence processing, private deployment, or dedicated instances.
4. Confusing similarity checking with AIGC detection. The former compares overlapping text fragments; the latter infers the generation source. They work on different principles, require different responses, and cannot substitute for each other.

7. Go-live checklist

• The model handles outlines, structure, and checklists; the human handles the argumentation in the main text;
• Every citation is verified back to the original, and any reference supplied by the model is treated as a lead to be confirmed;
• The glossary and abbreviation list are fixed before writing starts and checked for consistency by script;
• Detection scores are routed into low/gray/high bands, with the gray zone left unconcluded and high scores sent to human review;
• Evaluation reports both false positive rate and recall, and states which genres the detector applies to;
• Drafts, scores, and review records are fully logged and traceable;
• AI usage is disclosed in line with the requirements of your institution;
• Score-distribution drift is monitored, and thresholds are recalibrated after any change to the detection strategy.

The conclusion is straightforward: LLMs are best suited to structural, mechanical, and verifiable work. Judgment, facts, and accountability must stay on the human side. Instead of studying how to defeat detection models, make the process solid. A verifiable evidence chain is the one asset no detector can take away.