The AI Journal

A submission form asks for a writing sample and, beside it, a screenshot from an AI detector showing the text scored as human. The requirement treats the detector as an authorship test. The student who must run an essay through one, the applicant whose statement is checked, the author asked to certify provenance: all are being asked to prove not that the writing is theirs but that it looks a certain way to a classifier. Those are different questions, and the gap between them is where the damage happens.

The unreliability of these instruments is by now well documented. Sadasivan and colleagues (2023) set out why detection is fragile in principle rather than merely unpolished in practice: for any detector an adversary can paraphrase around it, because the perturbation needed to change a classifier’s verdict need not change a text’s meaning, while low-entropy passages such as boilerplate, definitions and formulae are hard to score either way. Weber-Wulff and colleagues (2023) tested fourteen detectors against a common corpus and found none that could be relied upon, with reported accuracy collapsing on text drawn from outside the tools’ training distribution. A detector that works on a benchmark and fails on a real submission is not a weak check on provenance, to be tightened later. It is a check on something else, sold under the wrong name.

Unreliability alone might still be tolerable if the errors were symmetric, falling on machine-written and human-written text alike. They are not. Liang and colleagues (2023) tested seven widely used detectors on essays written by non-native English speakers and found that more than half of those human-written essays were flagged as machine-generated, while comparable essays by native speakers were not. The detectors were not registering a model. They were registering fluent but formulaic prose, of the kind second-language writers are taught to produce, and then relabelling it. The cost of that mislabelling does not fall on the accused in general. It falls on the writers whose English is marked, which is to say on the applicants, students and authors with the least standing to overturn a machine’s verdict.

Read the two findings together and the detector’s real object comes into view. What such a tool measures is conformity to a style it has learned to associate with machines, and what it penalises is prose that is plain, regular, or produced under instruction. A venue that demands a detector pass is therefore not verifying authorship. It is requiring that a writer sound a particular way, and calling the result honesty. That is a harder charge than simple inaccuracy, because the requirement does not merely fail; it fails selectively, in a direction that tracks existing disadvantage.

None of this is an accident of imperfect training data, and the requirement is not neutral even before a single verdict is wrong. A writer who knows a classifier will scan the work has an incentive to write for the classifier: shorter sentences, ordinary vocabulary, nothing stylistically distinctive, nothing that might read as too smooth. A rule meant to catch machine writing thus teaches human writers to imitate the lowest common denominator of human prose, and penalises the ones who write with a recognisable voice. The instrument’s failure is not only that it flags the wrong people; it shapes behaviour toward the very sameness it was built to detect. The burden of being flagged is one-sided in the same way. The detector issues an accusation without a case, and the accused must assemble a case against it, usually by proving a negative about their own process. Institutions rarely price that work, and it is done by the person with the least power to refuse it. A verdict that costs nothing to issue and a great deal to answer will always be issued too freely.

The obvious reply is that the instrument is young and improving, and that the answer to a bad detector is a better one. Work on watermarking is the strongest form of this reply. Kirchenbauer and colleagues (2023) show that a model can embed a statistical signal in its own output which a matching detector can recover at scale, which would answer the adversarial and low-entropy objections at a stroke by moving verification back to the point of generation. The reply deserves taking seriously, because it concedes the right thing: reliable detection, if it arrives, will come not from scanning finished prose but from marking text where it is made. But even a perfect detector of that kind would answer only the question it was built for, namely whether this string was produced by a model. That is not the question most institutions actually have in front of them. A journal, a school, an employer is not asking about a token sequence. It is asking who is answerable for the text, who can be asked to defend a claim, revise a paragraph, stand behind a number. Provenance is a proxy for that, and a poor one, as anyone can see by noting that a text drafted by a model and then checked, cut and owned by a person is that person’s, while a text typed by a person from a model’s output is not thereby more honest. No classifier can draw that line, because the line does not live in the words.

A narrower objection has more force, and it is worth meeting rather than dodging. Some institutions do want provenance rather than responsibility: an examination, or a prize reserved for unassisted work, may simply stipulate a rule about tools and seek to enforce it. That is fair, but it narrows the case rather than rescuing detection. Where provenance genuinely is the rule, the honest instrument is a declaration, because a classifier cannot distinguish compliance from coincidence; a rule enforced by an unreliable device is not a rule but a lottery with a thumb on one side of the scale. Where an institution’s real interest is responsibility, detection is not a weak instrument but the wrong instrument, and improving it only makes the error more confident.

Disclosure of exactly this kind is already ordinary elsewhere. Journals require authors to declare funding, competing interests, and increasingly the use of generative tools, and the declaration is trusted because the author signs it and can be held to it. The model is not exotic; it is the standard apparatus of scholarly accountability, extended to a new instrument. What it needs is not a classifier but a norm, and norms of this kind are enforced by consequences for the signer rather than by a scan of the finished page.

What would replace it is unglamorous, and it asks more of institutions than buying a licence does. A venue can require a plain statement of how a piece was made, what was drafted, by what, and what the named author changed, and make that statement the thing under scrutiny, backed by real consequences for lying about it. That is checkable in a way no classifier is, it separates the two questions the detector conflates, and it does not systematically accuse writers whose English is marked. The appeal of detection was always that it promised an automatic verdict on honesty. No such verdict was ever available. Authorship is a relation between a person and a text, and it has to be established by asking, not by scoring.