How Do AI Detectors Work?
An AI detector does not find AI. It checks for one of four things: a maker’s label, a hidden watermark, habits a trained model links with machine output, or a language model’s statistical fingerprint. The first two are exact when present. The last two are estimates, so a good detector shows an “uncertain” band.
By FreeAIDetector.org · Published
Four ways to tell, and how far each can be trusted
Every detector is built on one or more of these. Knowing which one a tool uses tells you what its answer can mean.
| Signal | What it can and can’t tell you |
|---|---|
| Labels. Content Credentials and metadata that a tool attaches to what it makes | Exact when present and valid: they state what a tool says it did. Silent when stripped, and unsigned metadata can be edited by anyone. |
| Watermarks. A pattern the maker builds into the output itself | Survives more edits than a label, and only the maker’s own detector can read it. Silent for output from any other model. |
| Trained classifiers. A model shown many human and machine examples | Strong on material like its training data. Weaker on newer generators, edited work, and writing unlike what it learned from. |
| Statistical tests. How predictable a text is to a language model | Need no training examples. Mistake plain, formulaic human writing for machine writing. |
Labels and watermarks are the more reliable signals when they exist, and the first section below covers them briefly. Most of the guessing, and most of the mistakes, happen in the last two.
Labels and watermarks: checking a signal someone added
A label is a record that travels with the file. Content Credentials, the C2PA standard, attach a signed record of which tool made the content and what was done to it, so a change to the file or the record makes the check fail (C2PA specification). A watermark is hidden in the content itself. Google’s SynthID marks images, audio, video and text made by its products, and it can be checked with Google’s own tools (Google DeepMind). Our guide to telling if an image is AI-generated shows how to check both.
Text watermarks work on the statistics of word choice. In the scheme proposed by Kirchenbauer and colleagues, the model is nudged before each word toward a pseudo-random “green” part of its vocabulary, and a detector that knows the recipe counts green words and runs a statistical test, without needing the model itself. Google’s SynthID-Text changes only the sampling step, so it does not affect how the model is trained, and Google reported a live experiment on nearly 20 million Gemini responses.
Both come with the same limit: they exist only where the maker chose to add them. Text that never went through a watermarking model carries nothing to find, and paraphrasing can weaken a text watermark: Krishna and colleagues rewrote machine text with a purpose-built paraphraser and evaded watermark detectors as well as several statistical and commercial ones.
Trained classifiers: learning from examples
Most detectors you can try online are classifiers. Someone collects a large set of human-written and machine-written examples and trains a model, often a fine-tuned language model such as RoBERTa, to output a score for how machine-like a new text looks. The score is only as good as the examples: the model learns whatever separates them, which may be the style of one generator, or of one kind of human writing.
A long text is split into overlapping windows, each window is scored, and the scores are combined. Turnitin describes the same design: it breaks a submission into overlapping segments, gives each a value between 0 and 1, lets each sentence inherit its segment’s value, and pools the results into a document score (Turnitin). Splitting matters because one passage of machine text inside a human essay should not decide the whole result.
Three things follow from this design:
- A classifier is only reliable on text like its training data. RAID, a benchmark of over 6 million machine texts, found that current detectors are easily fooled by adversarial attacks, by changes in how the text is sampled, and by generators they had not seen.
- The raw score is not a probability of being AI. It is a number that tends to be high for machine text. Turning it into a verdict means choosing cut-offs on data the detector was not tuned on, so that no more than a chosen share of human texts is flagged.
- Short texts leave little to go on. Turnitin says that for a document of a few hundred words its prediction is mostly “all or nothing”, because there is a single segment and no overlap to average over.
Statistical tests: how predictable is the text?
A language model writes by choosing probable next words, so its output tends to be more predictable to another language model than human writing is. Perplexity, how surprised a model is by a text, and burstiness, how much that surprise varies from sentence to sentence, turn the idea into a score. They need no training examples, which is their appeal.
Two research methods sharpen it. DetectGPT observes that text sampled from a model tends to sit near a peak of that model’s probability curve, so small rewrites of it usually make it less probable. Binoculars compares how two closely related models score the same text; its authors report detecting over 90% of ChatGPT samples at a false-positive rate of 0.01% on their benchmarks.
The weakness is the assumption. Plain, formulaic writing is predictable too. In a study of seven detectors, Liang and colleagues found that on average they flagged 61.22% of 91 TOEFL essays by non-native English speakers as AI-generated, while judging US eighth-grade essays almost perfectly. The essays that all seven flagged had significantly lower perplexity than the rest.
Images and audio: looking for traces of the generator
Image detectors are classifiers too. Some look for physical traces that generators leave in the pixels, others learn the difference from examples. In 2019, Wang and colleagues showed that a standard classifier trained on the images of one GAN, with careful augmentation, generalised surprisingly well to other GANs. Diffusion models then changed the picture: Ojha and colleagues found that such a classifier fails on newer generators because the “real” class becomes a sink for anything that is not a known kind of fake. They proposed comparing images in the feature space of a large pretrained model instead, which generalised much better to unseen diffusion models.
Audio follows the same path. The SONICS benchmark gathered over 97,000 songs, more than 49,000 of them synthetic songs from Suno and Udio, to train and test detectors on whole songs, and proposed an architecture that models long-range structure across a song rather than short clips.
The traces are fragile. Compression, resizing, screenshots and re-recording smear pixel and audio patterns, and a new generator makes patterns the detector has never met. Labels and watermarks don’t have this weakness, but they exist only when someone added them.
From a score to a verdict
A classifier’s score runs from 0 to 1. A verdict needs cut-offs, and where you put them trades one kind of mistake for another: a lower cut-off catches more machine text and flags more honest writers, and a higher one does the reverse. The right place is chosen on data the detector was not tuned on, aiming at a false-positive rate the tool can defend.
- Human texts (1,189)
- Machine texts, unedited (1,135)
Two tall groups with a thin tail between them. Of 1,189 human texts, 812 score below 0.05 and 15 score above 0.95, with a few dozen in most bins between. Of 1,135 unedited machine texts, 1,128 score above 0.95 and only 7 score anywhere else. Two dashed lines mark the cut-offs used in this run: “Uncertain” begins at 0.50 and “Likely AI” at 0.974.
The figure is our own run of an open-source detector, a RoBERTa model fine-tuned on human and machine text, on a sample of the benchmark: 1,189 human texts and 1,135 machine texts that had not been edited. The two groups separate almost completely, and the thin tail in between is the whole difficulty. 90 of the human texts (7.6%) score above 0.5, and 8 (0.7%) score above the upper cut-off of 0.974, where a “Likely AI” verdict begins. Rules on top of the score, such as never saying “Likely AI” for a text under 250 words, left 2 of the 1,189 human texts labeled “Likely AI”.
Between the two cut-offs is the “uncertain” band. It is not a failure to answer. It is where the evidence does not separate human from machine, and forcing those texts into one of two boxes is how honest writers get accused. The benchmark holds older generators and no non-native writers, so read the figure as an illustration of how cut-offs work, not as a claim about accuracy. Are AI detectors accurate? says what the evidence supports.
Why detectors get it wrong
- Text unlike the training data. New generators, other genres and other languages all move text away from what the detector learned. RAID found unseen generators among the things that fool current detectors.
- Short text. Turnitin says its accuracy increases with more text and that submissions under 300 words may get a score that is likely less accurate (Turnitin).
- Edited or paraphrased text. The paraphraser in Krishna and colleagues’ study cut DetectGPT’s detection rate from 70.3% to 4.6% at a 1% false-positive rate. In our own RAID run, inserting paragraph breaks into machine text made 24% of it (7 of 29 texts) read as “Likely human”.
- Plain, formulaic or non-native writing. Predictable human writing looks like machine writing to a statistical test, as the TOEFL result above shows.
- Mixed authorship. Turnitin reports that its wrongly highlighted sentences are more common in documents that mix human and machine writing, and that 54% of them sit right next to real AI writing (Turnitin).
- Deliberate evasion. “Humanizer” tools rewrite machine text to slip past detectors. Turnitin added detection of text likely modified by such tools in August 2025, for English only.
How to read a detector’s answer
- Read the score and the cut-offs, not just the label. A text just over the line and a text far over it are very different findings.
- Treat “uncertain” as an answer. It means the evidence does not decide.
- Trust a whole document more than a sentence, and a long text more than a short one.
- Ask what it was tested on, and by whom. A number without a test set, a date and a false-positive rate tells you little.
- Never let a detector be the only evidence about a person. Turnitin itself says its indicator should not be the sole basis for action.
How our detectors work
The AI image detector reads a file’s labels first: Content Credentials markers, IPTC and EXIF data, and generation settings. It then measures the pixels for grain, sharp detail and flat areas and, when those are not conclusive, sends the image to a vision model on our server. It shows the evidence from each layer next to its verdict.
Sources
- C2PA Technical Specification 2.2. How Content Credentials records are structured, signed and validated.
- Google DeepMind: SynthID. What SynthID marks and how it can be checked.
- Kirchenbauer and colleagues (2023): A Watermark for Large Language Models. The green-word watermark for text and its statistical test.
- Dathathri and colleagues (2024), Nature: Scalable watermarking for identifying large language model outputs. SynthID-Text and the live experiment on nearly 20 million Gemini responses.
- Krishna and colleagues (2023): Paraphrasing evades detectors of AI-generated text. How a paraphraser defeats watermark, statistical and commercial detectors.
- Mitchell and colleagues (2023): DetectGPT. The probability-curvature test for machine text.
- Hans and colleagues (2024): Spotting LLMs With Binoculars. The two-model zero-shot test and its authors’ reported results.
- Liang and colleagues (2023): GPT detectors are biased against non-native English writers. False-positive rates for TOEFL essays versus US eighth-grade essays.
- Dugan and colleagues (2024): RAID. A benchmark of over 6 million machine texts, and how detectors fail on it.
- Wang and colleagues (2019): CNN-generated images are surprisingly easy to spot… for now. A classifier trained on one GAN generalising to others.
- Ojha and colleagues (2023): Towards Universal Fake Image Detectors. Why GAN-trained detectors fail on diffusion models, and a feature-space fix.
- Rahman and colleagues (2024): SONICS. A benchmark of over 97,000 songs for detecting synthetic music.
- Turnitin: AI writing detection capabilities FAQs. How Turnitin segments, scores and pools text, and what it says about short documents.
- Turnitin: AI writing detection model (release notes). The 300-word note and the August 2025 bypasser detection.
- Turnitin: Understanding the false positive rate for sentences. Document-level and sentence-level false positives, and where they occur.
Facts and figures were checked against these sources on September 30, 2026. If something is out of date or wrong, tell us.