How AI Detectors Actually Work: Passive Guessing vs. Active Watermarks

There are two completely different technologies both marketed under the word “detection,” and almost nobody tells you which one you are looking at. The first reads a finished piece of text and guesses whether a machine wrote it, using nothing but the words on the page. The second reads a signal that was deliberately built into the text at the moment it was generated — a mark left by the model itself. These are not two versions of the same tool. They are opposites: one works after the fact with no cooperation from the AI, the other works only if you controlled the AI in the first place. Every argument about whether AI detectors can be trusted collapses into confusion because people mix the two up. Sort them apart and the whole field makes sense.

The academic literature already draws this line cleanly. In a 2025 review that maps the entire field, Lingyun Xiang and colleagues split every existing method into exactly two paradigms: “passive detection, which relies solely on analyzing the generated text, and active detection, which requires embedding auxiliary signals into the generation process” (Xiang et al., 2025, p. 6). That single distinction is the most useful thing you can know about how these tools work. Passive detection is a detective examining a corpse. Active detection is a bank inserting a UV-ink thread into a banknote before it ever leaves the mint. One is forensics; the other is provenance.

How passive detection works — the guess

Nearly every tool a student or teacher has ever touched — GPTZero, ZeroGPT, the old Turnitin AI indicator, Copyleaks — is passive. It never talks to ChatGPT. It gets a block of text and hunts for statistical fingerprints that machine writing tends to leave behind. Xiang’s team describes the approach as discriminating between human and AI text “by analyzing linguistic features, statistical patterns, or semantic coherence” without any access to the generation process (Xiang et al., 2025, p. 2). That independence is passive detection’s one real virtue: it works on text “from unknown or untrusted sources,” which is to say, on anything (Xiang et al., 2025, p. 6).

Under the hood, passive methods run on a few families of signal. The oldest is pure statistics. Patit Santra and Debasis Majhi, testing detectors against 80 AI-written academic samples in 2023, list the giveaways plainly: machine text may show “a different distribution of word lengths or frequencies of certain words,” a more “formal or repetitive style,” and predictable patterns of phrasing that a statistical model can flag (Santra & Majhi, 2023, p. 180). This is where perplexity lives — the measure of how surprising each next word is. Machine text optimizes for the probable word, so it reads as statistically calm, and low perplexity became the field’s favorite proxy for “AI.”

The second family is zero-shot detection, which needs no training data at all. It borrows a language model and checks whether the suspect text sits where that model would expect its own output to sit. Aounon Kumar and colleagues describe the technique: these methods “evaluate the expected per-token log probability of texts and perform thresholding,” building on the observation that “AI-generated passages tend to lie in negative curvature of log probability” (Kumar et al., 2024, p. 3). In plain terms, the detector asks: does this text look like something a model would happily have written? If yes, it flags it.

The third family is the trained classifier — a neural network fine-tuned on piles of human and machine text until it learns the boundary itself. OpenAI’s own GPT-2 detector was a RoBERTa model fine-tuned exactly this way (Kumar et al., 2024, p. 3). The newest research pushes further into hybrid features: a 2026 model by Hao Chen and colleagues fuses deep semantic embeddings with “surface-level features, including pronunciation-related textual cues and handcrafted statistical descriptors” to catch stylistic regularities the older tools missed (Chen et al., 2026, p. 1). But note what every one of these shares. They all study the text and infer backwards. None of them knows. They estimate a probability and dress it up as a verdict.

Why the guess is structurally fragile

Passive detection has a problem that no amount of engineering removes, because it is baked into the premise. If the only evidence is the text itself, then anything that changes the text changes the evidence — and a paraphrase changes the text.

Kumar’s team measured this precisely. Running AI output through a lightweight paraphraser — a neural rewriter several times smaller than the model that wrote the original — dropped detector accuracy from 97% to 80% with a light pass and to 57% with a heavier one, while the perplexity of the text barely moved (Kumar et al., 2024, pp. 4, 6). A 57% accuracy is a coin flip with a limp. Chen’s team confirms the same weak spot from the other side, noting that existing detectors “exhibit limited robustness, particularly when texts are paraphrased or rewritten” — the entire motivation for their fusion approach (Chen et al., 2026, p. 1).

Worse, Kumar proved this is not a temporary engineering gap but a mathematical ceiling. As language models get better at imitating human writing, the statistical distance a passive detector depends on shrinks toward zero, so “the performance of even the best possible detector decreases” while its false-positive rate climbs (Kumar et al., 2024, p. 11). Detection does not get easier as models improve. It gets provably harder. And the failure runs in both directions: by feeding paraphrased human essays into a retrieval-based detector’s database, the researchers made it falsely classify all 100 human passages as AI-generated (Kumar et al., 2024, p. 19).

This fragility is exactly why passive tools misfire on real people. Because low perplexity is their core evidence, they flag any writer whose prose is naturally predictable — and second-language English is predictable by design. The Stanford team behind the landmark bias study found seven passive detectors posting an average 61.22% false-positive rate on TOEFL essays by non-native writers, then reproduced the effect on purpose by having a model “simplify word choices as if written by a non-native speaker,” which spiked misclassification of genuine human essays from 5.19% to 56.65% (Liang et al., 2023, p. 2). That is the same machinery examined in depth in our piece on why detectors flag non-native English writers: the passive signal cannot tell a careful non-native writer from a language model, because both produce statistically calm text.

How active detection works — the receipt

Active detection throws out the guessing entirely. Instead of inferring origin from style, it plants a signal while the text is being generated, then later checks whether that signal is present. Xiang’s team defines it as methods that “embed identifiable signals into text either during the generation process or after the text has been produced,” serving as “embedded markers, such as watermarks or semantic signatures, that facilitate provenance verification” (Xiang et al., 2025, p. 7). The mark is not a guess about the writing. It is a receipt the model left behind.

The dominant technique is generation-time watermarking, and its mechanics are elegant. A language model picks each word by sampling from a probability distribution over its vocabulary. A watermark quietly rigs that sampling. Xiang describes it as modifying “the token-sampling distribution (e.g., logit biasing, vocabulary partition, entropy-gated selection) so that generated text carries statistically testable traces” (Xiang et al., 2025, p. 7). The classic scheme — WLLM, from 2023 — secretly splits the vocabulary into a “green list” and a “red list” using a hidden key, then nudges the model to prefer green words (Xiang et al., 2025, p. 20). To a reader, the output looks normal. But anyone holding the key can count the green words: far more than chance means the text is watermarked, with a false-positive rate you can calculate rather than merely hope for.

There are two other active flavors. Post-generation watermarking embeds a hidden identifier after the fact through “semantically constrained synonym substitution or controlled paraphrasing while preserving meaning” (Xiang et al., 2025, p. 7). And retrieval-based detection stores every output a model produces in a database, then checks a suspect passage for a near-match — the “AI vs AI” future Santra and Majhi anticipated, where the platform that generated the text is also the one that catches it (Santra & Majhi, 2023, p. 178). All three share the defining trait: they require access to, or control over, the generation system, which makes them “more suitable for platform-level deployment or proprietary model settings” (Xiang et al., 2025, p. 17). You cannot watermark a model you do not own.

Why active detection barely exists in your life

If active detection is so much stronger, why has no teacher ever handed you a watermark reading? Because the two conditions it needs — control of the model and cooperation of its maker — almost never hold at the same time.

The clearest real-world case is Google’s SynthID-Text. It is a production implementation of exactly the scheme Xiang describes: a logits processor that augments the model’s token probabilities with a pseudorandom function to embed a detectable pattern, without meaningfully degrading quality (Google DeepMind, 2024). Google deployed it live inside Gemini and open-sourced the algorithm in late 2024 so other developers could watermark their own models. As of 2026 it remains the only major production text watermark shipping in a consumer chatbot.

And the most telling case is the watermark that doesn’t exist. OpenAI has had a working text-watermarking system for ChatGPT — internally reported as 99.9% effective when enough text is generated — ready for roughly a year, and chose not to ship it (Montti, 2024). The reasons are the whole story of this technology’s limits. A company survey found nearly 30% of users said they would use ChatGPT less if their output were watermarked, and OpenAI flagged that watermarking would disproportionately stigmatize non-native English speakers using the tool as a legitimate writing aid (Montti, 2024). On top of that, the mark is defeatable: run the text through a translator or a paraphraser and the signal washes out — the same paraphrase attack that breaks passive detectors also degrades watermarks (Kumar et al., 2024, p. 6). A watermark that determined cheaters can strip but honest users cannot mostly catches the honest users. OpenAI now says it is looking instead at metadata and cryptographic provenance rather than in-text watermarks (OpenAI, 2024).

So the strong method is locked behind ownership and rarely deployed, and the deployed method is the weak one. That inversion — active detection works but you can’t use it, passive detection you can use but it doesn’t work — is the real reason the public conversation is such a mess.

What this means when a score lands on your desk

Once you can name the two paradigms, every detector output becomes readable. A GPTZero or Turnitin percentage is a passive guess — a probability estimated from how statistically ordinary your writing is, breakable by a five-minute paraphrase and biased against anyone whose prose is naturally plain. A SynthID hit is an active receipt — far more reliable, but only meaningful to the party holding the key, and only present if the text came from a model that watermarks. Neither is what institutions treat them as. As the evidence on whether AI detectors are accurate shows, the passive score is a probability wearing the costume of a verdict, and even the active mark proves provenance, not intent — a watermarked passage could be a quote, a translation, or an outline a human then rewrote from scratch.

The practical rule follows directly from the mechanism. If someone waves a detector result at you, the first question is not “what percentage?” but “passive or active?” If it is passive, you are looking at a guess that gets weaker as models improve and lands hardest on the people least able to fight it. If it is active, you are looking at a receipt that only its issuer can truly read. In neither case are you looking at proof — and treating either one as proof is how honest writers end up defending work they actually did.