How do AI detectors work? Perplexity, watermarks and accuracy explained (2026)

AI detectors work by measuring how predictable a piece of writing is. Most of them run your text through a language model, check how likely each word was to come next, and combine that with a trained classifier that has seen millions of human and AI examples; a few newer systems instead look for a hidden watermark the AI left on purpose. The result is a probability, not proof, and that difference matters more than most people realise.

Here is a fact worth keeping in mind before trusting any score. In early 2023, OpenAI released its own detector for text written by its own models. On its test set it correctly flagged only 26% of AI-written text and wrongly labelled 9% of human text as AI, and the company withdrew it on 20 July 2023 "due to its low rate of accuracy." If the people who built the model struggled, it is fair to ask what everyone else is measuring.

The short answer: what do AI detectors look for?

They look for statistical fingerprints. Language models write by choosing likely next words, so their output tends to be smooth, even and unsurprising. Detectors try to spot that smoothness. There are four main approaches, and most commercial tools now blend several of them.

How AI detectors work, step by step

To see why this works at all, it helps to remember how AI writing happens. A large language model (if you want the basics, our guide to what an AI model is covers it) reads your prompt and then predicts the next word, one word at a time, based on patterns from its training data. It is extremely good at picking a plausible next word. Detectors exploit exactly that habit.

Perplexity: how surprised is the model?

Perplexity is a measure of surprise. A detector feeds your text into a language model and asks, word by word, how likely that word was. GPTZero, one of the best-known tools, describes it as "a measure of how likely an AI model would have chosen the exact same set of words." Low perplexity means the text is the sort of thing a model would write. High perplexity means it took turns the model did not expect.

Think of finishing a friend's sentences. If your friend says "I'll have a cup of..." you guess "tea" or "coffee" and you are usually right. If they say "a cup of thunder," you are surprised. AI text is full of tea and coffee. Human text has more thunder in it, at least some of the time.

Burstiness: does the surprise vary?

Burstiness looks at the rhythm across a whole document. GPTZero defines it as "a measure of how much writing patterns and text perplexities vary over the entire document." People write a long, winding sentence, then a short one. They get excited, then flat. Models tend to hold a steady middle level of predictability throughout, like a metronome rather than a drummer.

Classifiers: learning the difference from examples

Perplexity and burstiness are hand-picked signals. Classifiers take a different route: they are themselves AI models, trained on huge piles of text labelled "human" or "AI," and they learn whatever patterns separate the two, including ones no human would think to name. This is now the main engine behind commercial tools. GPTZero says on its own explainer page that it moved to a deep-learning architecture in 2023, with perplexity and burstiness reduced to a few signals among several. The catch is that a classifier is only as good as its training data. If a new model, genre or writing population was not well represented, accuracy can drop without warning.

Watermarks: a signal planted on purpose

Watermarking flips the problem around. Instead of guessing after the fact, the AI provider nudges its word choices while writing so that a hidden statistical pattern appears. In a widely cited 2023 paper, researchers at the University of Maryland proposed splitting the vocabulary into a "green list" and a "red list" at each step and quietly favouring green words; a detector that knows the rule can then count green words and spot the pattern, while readers notice nothing. Google DeepMind's SynthID-Text, described in a paper in Nature, uses a related idea that, in the authors' words, "modifies only the sampling procedure." According to a summary of the paper, a live test across nearly 20 million Gemini responses found no statistically significant change in how users rated the answers. The limitation is obvious: a watermark detector can only find watermarks, and only from providers that use them.

Real examples: what the evidence says about accuracy

So do AI detectors actually work? The honest answer is that it depends heavily on which tool, what kind of text and who wrote it. Here is what we know from published research and institutional decisions, as of late October 2026.

The bias problem. In 2023, Stanford researchers ran 91 essays written by non-native English speakers for the TOEFL exam through seven detectors. The detectors labelled 61.22% of them as AI-generated, all seven agreed on 19% of them, and 97% were flagged by at least one tool, while essays by US eighth-graders were classified almost perfectly. The paper links this to perplexity: people writing in a second language often use a narrower, more predictable vocabulary, which is exactly what the detectors read as machine-like.

Vendor claims. Turnitin, widely used in schools and universities, has said its document-level false positive rate is under 1% for documents with 20% or more AI writing, but that its sentence-level false positive rate is "around 4%", with many errors clustered where human and AI text meet. In August 2025 it added "AI bypasser detection" aimed at humanizer tools; Plagiarism Today noted that "outside testing will be required to evaluate the effectiveness of this tool."

Independent benchmarks. A 2025 working paper from the University of Chicago's Becker Friedman Institute tested three commercial detectors and an open-source baseline on 1,992 passages across six genres. It found that Pangram had near-zero error rates on medium and long passages, GPTZero and Originality.ai sat in a second tier, and the open-source RoBERTa model wrongly flagged roughly 30 to 78% of human text depending on the scenario. After text was run through a humanizer, GPTZero's miss rate rose to around 50% or more in most genres. The lesson is not that one brand is magic; it is that tools differ enormously, so a generic "AI detector says so" tells you very little. Our roundup of AI detectors compares the current options if you need to pick one.

Universities pulling back. The University of Waterloo switched off Turnitin's AI detection in September 2025, saying its own testing "flagged human written text as 100% generated by AI." In February 2026, Washington State University cancelled its Turnitin AI detection contract, noting that between 2023 and 2025, 33% of its AI-use hearing cases ended in "not responsible" findings where detection was used without other evidence. Yale, Johns Hopkins and others have limited how detector scores can be used in misconduct cases.

Benefits and limitations

We should be fair to the tools. On long, unedited text from a mainstream chatbot, good detectors can be very accurate, and the Chicago study suggests the best ones have improved a lot since 2023. They can act as a useful prompt for a conversation, and for publishers screening large volumes of low-effort content, a rough filter has real value.

The limitations are structural, though, not just teething problems. First, everything is a probability, and small error rates become large numbers at scale. Picture a lecturer with 500 honest students. A 1% false positive rate means about five of them are flagged anyway. WSU did this sum for its own campus and estimated that a 1% rate would have meant roughly 1,485 wrongly flagged assessments in a single semester. Second, short texts carry too little signal. Third, editing, paraphrasing and mixed human-AI drafts blur the pattern, which is where Turnitin says its sentence-level errors cluster. Fourth, the people most likely to write "predictably" (second-language writers, those following rigid templates, some neurodivergent students) are the most exposed to false accusations.

Where do we land? Detectors measure something real, but what they measure is predictability, and predictability is not the same thing as dishonesty.

What it means for you

If you are a student, keep your drafts, notes and version history. A Google Docs or Word history showing a document growing over days is far stronger evidence than any detector score. If you used AI in a way your course allows, say so. Many schools and publishers ban passing off AI text as your own, so tools sold to "beat" detectors are a risk, not a fix; if you want to know what humanizers can legitimately do, such as making an AI-assisted draft read naturally, see our guide to humanize AI tools.

If you are a teacher or editor, treat a score as a reason to ask questions, never as the verdict. Ask the writer to talk through their argument, compare the piece with earlier work and check the edit history. Be especially careful with second-language writers.

If you are a writer worried about being flagged, the best defence is your own voice: specific examples, opinions, varied sentences and details only you would know. That is good writing anyway, and it is the opposite of the even, generic style detectors are tuned to catch.

What happens next

The biggest shift is regulatory. Under the EU AI Act, Article 50 transparency obligations took effect on 2 August 2026, requiring providers of generative AI to mark AI-generated text, images, audio and video in a machine-readable way. The final code of practice says no single technique is enough and asks signatories to use at least two layers, such as metadata and watermarks, and to offer detection tools. Systems already on the market before August have until 2 December 2026 to add marking, and watermark detection interoperability is due by 2 February 2027.

That points to a future where detection relies less on guessing from style and more on checking for signals the provider put there deliberately. What we do not know yet is how well those watermarks will survive paraphrasing, translation or open-source models that never add them. For now, it is safest to assume detection will stay an arms race between generators, humanizers and detectors, and to keep human judgement at the centre.

FAQ

How does AI work?

Modern AI systems learn patterns from very large amounts of data instead of following hand-written rules. A language model like ChatGPT is trained on huge amounts of text and learns to predict the next word in a sequence. Repeated word by word, that prediction produces fluent answers. Our explainer on what AI is covers the basics.

How AI works?

In simple terms, AI works in three stages: it is trained on examples, it builds a statistical model of the patterns in them, and it then uses that model to make predictions about new input. For text, the prediction is the next likely word. That same predictability is what AI detectors try to measure.

How AI?

If you mean "how is AI made," it starts with data and computing power. Engineers collect a large dataset, choose a model architecture such as a transformer, and train it by adjusting billions of internal settings until its predictions improve. They then fine-tune it with human feedback so its answers are more useful and safer.

How do AI checkers work?

AI checkers score how predictable your text is to a language model (perplexity), how much that predictability varies (burstiness), and what a trained classifier thinks based on labelled examples. Some also look for watermarks. They return a probability, not proof, and published studies show false positives happen, especially with non-native English writing.

What is AI and how does it work?

AI, or artificial intelligence, is software that performs tasks that usually need human judgement, such as writing, recognising images or answering questions. Most of today's AI uses machine learning: it learns patterns from data, then applies them to new situations. Generative AI goes a step further and produces new text, images or audio.