How Do AI Detectors Work? The Complete 2026 Guide

Every AI detector on the market, ours included, is making an educated guess. The interesting part is how that guess gets made — and why a tool can be right about millions of documents yet flag the US Constitution as machine-written. This guide walks through the four approaches behind modern AI detection and the evidence on where each one holds up.

AI detectors work by measuring statistical patterns in text, not by reading meaning. Most combine four approaches: perplexity and burstiness metrics that gauge predictability, trained classifiers that recognize machine-writing patterns, watermark checks for signals embedded at generation time, and provenance inspection of file metadata. Each produces evidence rather than proof, and each fails in known, documented ways.

What AI detectors are actually measuring

A large language model writes by repeatedly picking a probable next word. That mechanical fact leaves fingerprints: AI text tends to be smoother, more evenly paced and more statistically predictable than the average human's writing. A detector's core question is not "does this sound like a robot?" but "how likely is it that a probability machine assembled this exact sequence?"

Think of a forensic accountant. She doesn't need to witness fraud; she knows that naturally occurring books have certain numerical textures, and cooked books deviate from them. AI detectors apply the same logic to prose.

In practice, detection signals come in two families:

• Intrinsic signals live in the text itself: word predictability, sentence rhythm, structural repetition. They work on any pasted text but are probabilistic by nature.
• Extrinsic signals live around the text or file: cryptographic watermarks, C2PA manifests, EXIF data, generation parameters. They can be near-certain when present — and silent when missing.

The four methods below split across those families.

Perplexity and burstiness: the statistical core

Perplexity measures how surprised a language model is by each successive word. "The coffee was hot" is low-perplexity; "the coffee was judgmental" is high. Because AI systems literally generate text by favoring high-probability words, their output scores low. Human writers, with our tangents and odd word choices, usually score higher.

Burstiness measures variation, mainly in sentence length and structure. People write in bursts: a 40-word sentence, then a four-word one. Models tend to even things out. Low variance reads as a machine signal.

Put the two side by side and you can feel the difference. "The meeting was scheduled for Tuesday. The agenda covered three topics. Each topic received equal time." Low perplexity, low burstiness — every word expected, every sentence the same shape. Compare: "Tuesday's meeting ran long. Why? Because the third agenda item, which everyone swore would take five minutes, ate the whole afternoon." Higher surprise, wildly varied rhythm. Neither sample proves anything about its author — but a detector's raw statistics prefer the second one as "human."

These two metrics powered the first wave of detectors, and they still matter — we unpack both, with worked examples, in our guide to perplexity and burstiness.

They also fail in predictable ways. Formulaic human writing is low-perplexity too: lab reports, legal boilerplate, cover letters, and prose by writers working in a second language. A July 2023 Stanford study in Patterns (Liang, Zou and colleagues) found seven detectors flagged an average of 61.3% of TOEFL essays by non-native English speakers as AI, while scoring near-perfectly on essays by US 8th-graders. And text a model has memorized from training data scores as maximally predictable, which is how ZeroGPT famously rated the US Constitution 92.15% AI-generated in a 2023 test reported by Ars Technica.

Classifier models: teaching a machine to spot machine text

The second generation of detectors treats detection as a supervised learning problem. Take hundreds of thousands of confirmed human texts and confirmed AI texts, train a classifier (often a fine-tuned transformer) to separate them, and let it discover its own features — stock phrasings, discourse patterns, punctuation habits, things no human engineer specified.

Classifiers outperform raw perplexity because they capture subtler regularities, and they can be retrained as new models ship. But they inherit two weaknesses. First, domain shift: a classifier trained mostly on essays and news copy gets shakier on poetry, code comments or chat logs. Second, adversarial pressure: the RAID benchmark (Dugan et al., ACL 2024, University of Pennsylvania), built on over 10 million documents and 12 adversarial attack types, found commercial detectors degrade sharply under paraphrase and homoglyph attacks — we cover the paraphrasing problem in detail in do AI detectors catch paraphrased text.

The cautionary tale here is OpenAI's own classifier. Despite unmatched access to AI-generated training data, OpenAI retired it in July 2023 for "low accuracy": it caught only 26% of AI-written text while false-flagging 9% of human writing.

Classifiers are also what runs at industrial scale, which raises the stakes on their error rates. Turnitin's detector processed over 200 million papers in its first year (April 2023 to April 2024), reporting 11% of them at 20% or more likely AI writing and 3% at 80% or more. At that volume, even a false positive rate the vendor can honestly call "under 1%" translates into a very large absolute number of wrongly flagged documents.

Watermarks: detection built in at the source

Watermarking flips the problem. Instead of inspecting text after the fact, the generator embeds a signal at creation time — subtly biasing word or pixel choices in a pattern that's invisible to readers but verifiable by whoever holds the key.

Google's SynthID is the most deployed example: it watermarks all Gemini-generated images, with versions for text, audio and video. When a watermark is present and the verifier finds it, that's about as close to certainty as this field gets.

The catches are practical rather than theoretical:

• Coverage. Watermarks only exist where a provider chose to embed them. Open-source models, and any tool that opts out, produce unwatermarked output.
• Verification silos. There's no public third-party API to check SynthID; verification runs through Google's own tools. A detector outside Google can't confirm or rule out that watermark for you.
• Fragility. Paraphrasing text or re-encoding media weakens embedded signals, a failure mode confirmed repeatedly in the adversarial-robustness literature.

There's also a durability gap between media types. Image watermarks like SynthID's are engineered to survive cropping, filtering and compression reasonably well; text watermarks live in word choices, so ordinary paraphrasing or translation can dissolve them entirely.

Regulation is now pushing this approach forward anyway: the EU AI Act's Article 50 transparency obligations, applicable since August 2, 2026, require AI-generated content to be marked in a machine-readable format and deepfakes to be disclosed. Expect more watermarked content each year — and a long tail of unwatermarked content indefinitely.

Provenance: checking the receipt instead of the writing

The fourth method ignores style entirely and asks where the file came from. C2PA Content Credentials attach a cryptographically signed manifest recording what created a file and how it was edited. OpenAI has embedded C2PA in its image outputs since February 2024; Adobe Firefly, Microsoft's Bing and Designer tools, and Google's Nano Banana image models (2026) do the same.

A valid manifest saying "created by DALL·E" settles the question. The weakness is the opposite direction: social platforms routinely strip this metadata on upload, so most files you encounter in the wild carry no credentials at all. Missing provenance is not evidence of anything.

This is also where multimodal detection earns its keep. When you scan an image or video with AI Detector 360, the report includes provenance signals — C2PA, EXIF, generation parameters — alongside the statistical analysis, plus likely-generator attribution for images. Two independent kinds of evidence beat one.

So how do AI detectors work when you hit "scan"?

Here's the pipeline a modern detector runs, usually in a few seconds:

1. Normalize the input: strip formatting, segment sentences, detect language.
2. Compute intrinsic features: perplexity-style predictability, burstiness, repetition and structure metrics.
3. Run classifier models, often several, each voting on the probability of machine authorship.
4. Check extrinsic signals where the input allows: watermarks it can verify, provenance manifests, metadata.
5. Calibrate everything into a score, ideally with a confidence level attached.

Method	What it checks	Strongest when	Fails when
Perplexity & burstiness	Predictability and rhythm	Long, unedited raw AI text	Formulaic human prose; memorized texts
Trained classifiers	Learned machine-writing patterns	Domains close to training data	New models, paraphrased text, niche genres
Watermarks	Signals embedded at generation	Provider watermarks and you can verify	No watermark; content re-encoded or paraphrased
Provenance (C2PA)	Signed origin metadata	Credentials survive intact	Platforms strip metadata; honest files lack it

The step that separates careful tools from careless ones is the last one. When multiple engines agree, confidence should rise; when they split, the tool should say so instead of averaging quietly. That disagreement is exactly what AI Detector 360's engine breakdown and sentence-level heatmap expose, so you can see which signals fired and where — the reasoning behind that design is documented on our methodology page.

The honest limits

No method above is reliable alone, and no combination is infallible. Detection error runs in both directions: human writing flagged as AI (we've documented why false positives happen and who they hit hardest) and AI text that slips through, especially after paraphrasing. Independent testing consistently lands between those poles — the full numbers are in our review of how accurate AI detectors really are.

Machines aren't the only detectors in the room, either. A 2025 ACL study by Russell, Karpinska and Iyyer found that human annotators who frequently use ChatGPT for writing tasks reached 99.3% accuracy identifying AI-generated articles — competitive with the best software, and notably robust against evasion tricks that fool statistical tools. The strongest real-world workflows pair both: software to triage at scale, informed human judgment on anything that matters.

So treat any detector, including ours, as an instrument that produces evidence with a stated margin of error. A 90% score on a 2,000-word document with high confidence and agreeing engines is strong evidence. The same number on 80 words of formal prose is barely a hint. The technology is genuinely useful in 2026; it's the certainty that's fake.

If you want to see the four methods working together, paste something into the free scanner and read the full report — heatmap, engines, confidence and all.