The limits of AI detection

Four documented limits

1 · Non-native English bias

Stanford HAI, Liang et al. 2023 (Patterns) tested 7 leading AI detectors on 91 TOEFL essays written entirely by non-native English speakers. The detectors flagged 61.3% of these human essays as AI on average. 97.8% were flagged by at least one detector; 19.8% were flagged by all seven. The mechanism is structural: detectors learn that limited lexical diversity and simple syntax look like AI, but those are also the surface features of L2 English. The authors found that improving word choice in the TOEFL essays reduced misclassification and that simplifying native-speaker essays increased their misclassification, confirming the mechanism.

2 · Paraphrase evasion

Krishna et al. NeurIPS 2023 (arXiv:2303.13408): the DIPPER paraphraser dropped DetectGPT's true-positive rate from 70.3% to 4.6% at a 1% false-positive rate. Sadasivan et al. 2023 showed the same dynamic generalizes: light paraphrasing defeats neural-net detectors, zero-shot classifiers, and watermarking schemes. Copyleaks's own data shows their accuracy collapsing from 100% to 50% on text rewritten through QuillBot.

How we measure up on the same test

We ran the same exercise on our own calibration set. The three high-slop anchors (AI marketing, LinkedIn listicle, corporate jargon memo) put through Claude with a prompt that explicitly preserves register and tone (i.e. surface paraphrase, no register change) shift our composite score by an average of −17 points (one of three stayed inside its calibration band). The same anchors put through a prompt that genuinely improves voice (vary sentence length, drop tricolons, add one named example) shift the score by an average of −33 points(zero of three stayed in band). The reword-only delta is about half the substantive-rewrite delta, which is what we'd hope for: the score tracks stylistic register rather than surface tokens, so reworded slop still reads as slop.

That isn't the same as "our score survives paraphrase". It drops. It just drops less than the published failures of classifier-based detection under the same test pattern. The benchmark is open in the repo; rerun any time the engines change.

3 · Memorized canonical texts

A failure pattern that has been documented across multiple leading classifiers in 2023–2025: foundational public-domain texts — the US Constitution, the Bible, the Declaration of Independence — get flagged as AI-generated. The mechanism is structural: large language models are so heavily trained on these documents that the model has learned to produce text statistically similar to them, and any detector using perplexity or similar statistical signatures will inherit the resemblance. Better training data won't fix it; the resemblance is baked into the approach.

4 · A theoretical bound

Sadasivan et al. 2023 (arXiv:2303.11156, University of Maryland, 186+ citations): an information-theoretic argument that as language models converge on the human writing distribution, the upper bound on any detector's accuracy converges toward random. Better training data won't close this gap. It is a limit on the problem itself. The closer LLMs get to writing like humans, the less any classifier can do.

What's happened in the press and the courts

These failure modes have consequences off the page. Detection-driven academic suspensions have produced legal proceedings in 2024–2025 (publicly searchable; coverage in Poets & Quants, university dailies, and legal commentary), often centered on the non-native-English false-positive rate Liang et al. quantify. Courts have generally declined to enjoin schools mid-case, but discovery records and the policy debate around them are public.

Marketed accuracy figures across the category are commonly in the 99% range. The gap to independently measured accuracy on broad test sets is significant; the gap on the specific failure modes above (non-native English, paraphrased input, canonical public-domain text) is larger still. Marketing accuracy and measured accuracy are not the same number.

Why we built something different

Forensic AI detection sells a binary verdict to gatekeepers (teachers, recruiters, publishers). The verdict is consequential, the methodologies are opaque, and the failure modes are in the published literature. The gap between marketing claims and reproducible measurements is widening.

We're not in that game. deslopify scores stylistic register on a 0–100 continuous scale and shows the spans of text that drive the score, layer by layer. That changes what the tool can and can't do:

• No false-accusation risk. There's no "you used AI" verdict to falsely accuse anyone of.
• The Liang bias problem is decomposable. A non-native English writer can see that their lexical layer fired and that structural and epistemic stayed clean, and read that as a register signal, not an AI accusation. None of the binary classifiers expose that.
• The memorized-text problem doesn't apply. The Slop Score isn't a claim about authorship. Slop in a foundational document would still be slop; the actual score (low) reflects voice and specificity, not statistical fingerprints.

The honest read

AI detectors have narrow uses: bulk content moderation, first-pass triage. The more carefully-built ones will acknowledge this when pushed. They are not courtroom-grade or grade-book-grade evidence. The published failure modes above are why. Anyone using a detector to make a high-stakes decision about a specific person should read the Liang paper first.

If you came here looking for a detector recommendation: don't use one to punish individuals. Use it as a soft signal, paired with the close reading you'd do anyway. For writers, a diagnostic is a more useful tool than a verdict: it tells you what your prose sounds like rather than what side of a guess it falls on. The limitations page covers where this tool is wrong.