Why perplexity-based AI detection stopped working
The first generation of detectors measured how surprised a small language model was by your writing. Three things changed at once, and the signal they were reading went away.
In early 2023, you could build a usable AI-text detector in an afternoon. You loaded GPT-2, ran a document through it, and computed how probable the model thought each word was given the words before it. Machine-written text came out predictable. Human writing did not. One threshold, one number, and you had a classifier that beat coin-flipping by a wide margin on the essays people were actually turning in.
That method — perplexity, usually paired with a variance measure someone marketed as “burstiness” — is still what most free detectors run, and still what most people picture when they hear “AI detector.” It no longer works. Not “works less well”: on text from a current frontier model, a perplexity threshold tuned for high recall lands close to where a coin would, and it fails in the direction that hurts most, flagging careful non-native writers and formulaic professional prose as machine-generated.
Understanding why is worth the twenty minutes, because the same reasoning tells you which detection claims to believe now.
What perplexity actually measured
A language model reads a sequence and outputs a probability distribution over the next token. Feed it text that already exists and you can ask, for every token, what probability the model assigned to the word that actually came next. Average the logs of those probabilities, negate, exponentiate, and you have perplexity: roughly, how many equally-likely options the model felt it was choosing between at each step.
The trick is that this is not a property of the text alone. It is a property of the text as scored by one particular model — the surrogate. Perplexity detection is a bet that the surrogate’s sense of what is likely resembles the generator’s sense of what is likely, and that human writers systematically violate both.
What broke, in the order it broke
The method did not decay gradually. Three independent things moved between 2023 and 2026, and each one alone would have been enough.
Decoding stopped being greedy
Early samples were generated at low temperature, which by construction picks high-probability tokens — the exact thing perplexity measures. Today’s defaults sample at temperature near 1.0 with nucleus truncation, and post-training pushes models toward varied, hedged, human-shaped phrasing. The generator now deliberately spends probability mass on less likely tokens. Higher perplexity is not a side effect; it is what the sampler is for.
The surrogate stopped resembling the generator
Perplexity detection needs a scoring model whose intuitions match the writer’s. In 2023 nearly all machine text came from two model families, and GPT-2 was a decent proxy for both. Now the text in front of you might come from any of forty widely used models, several of them fine-tuned in-house on a specific voice. A surrogate that mispredicts the generator by even a little produces scores that drift across model families, and a threshold calibrated on one family silently misfires on the next.
Evasion became a single sentence
Because the signal is one scalar and the direction of attack is obvious, defeating it costs nothing. “Vary your sentence length and avoid predictable phrasing” raises measured perplexity. A round-trip through a paraphraser raises it further. Light manual editing of the first and last paragraphs raises it most, because short documents put nearly all their weight on a handful of tokens. None of these change the fact that a model wrote the text.
Perplexity was never a fingerprint of machine authorship. It was a fingerprint of a decoding strategy, and that strategy went out of fashion.
— on why the 2023 detectors aged in months, not years
Overlap cuts both ways
The overlap in Fig. 1 is usually discussed as missed detections, which is the forgiving half of the problem. The other half is that plenty of human writing is genuinely low-perplexity. A second-language writer working from a smaller, safer set of English constructions produces predictable text. So does a paralegal, a technical writer following a style guide, a student who has memorised the five-paragraph form, and anyone writing in a register where the next word is nearly determined by convention.
Those writers were being flagged in 2023 too. The difference is that the trade was defensible when the true-positive rate was near-perfect, and it stopped being defensible the moment real machine text slid under the curve. You end up with a detector that catches the careless and punishes the cautious.
One percent is not a small number
Accuracy is the wrong headline metric, because the class balance in deployment is nothing like the balance in a benchmark. What matters is the false positive rate at the recall you actually need, multiplied by how much text you run.
Take a mid-sized university: 40,000 submissions a term, and suppose a fifth of them contain substantial machine text. A detector at 1% FPR and 85% recall produces 6,800 true flags — and 320 accusations against students who wrote their own work. Every one of those is a hearing, an appeal, and a person who has to prove a negative.
This is why we report FPR at fixed recall on out-of-domain text and refuse to publish a single accuracy figure. It is also why a document-level score is not enough: a defensible flag has to say which spans it is talking about, so a human can check the claim instead of taking it.
# mean per-token log-prob under a surrogate # — the whole of the 2023 method logp = model(ids).log_softmax(-1) tok = logp.gather(-1, ids[1:]) score = tok.mean() # higher = flag # measured on 500-word samples human, first-language -2.94 human, second-language -2.31 gpt-2, temperature 0.2 -1.04 frontier, default sampling -2.52 + one paraphrase pass -3.17 # illustrative figures
Discriminative models, trained on the mess
The replacement is unglamorous: stop hand-designing the statistic and learn it. Train a supervised classifier on a large corpus of paired documents — human text and machine text on the same prompts, in the same domains, from every generator you can get access to, at a range of temperatures, with paraphrase and hybrid human-plus-model editing included as their own training conditions.
What such a model picks up is not perplexity. It is the accumulation of small distributional habits: which discourse connectives get used and at what rate, how often a clause is qualified, the length profile of noun phrases, the particular flatness of machine paragraph structure, the reluctance to leave a thought unfinished. None of those are legible as a single number, which is exactly why they survive an instruction to “write less predictably” — the writer does not know which knobs to turn, and neither does the paraphraser.
Two practices matter more than architecture. Hold out entire generators, not just documents, so your reported numbers say something about the model that ships next month. And train against the hard negatives that perplexity got wrong: second-language writing, formulaic professional prose, heavily edited drafts, translated text. A detector that has never seen a low-perplexity human will keep accusing one.
The same four methods, old and new text
| Method | AUROC vs 2019 output | AUROC vs 2026 output | FPR @ 85% recall |
|---|---|---|---|
| Mean log-prob threshold | 0.98 | 0.61 | 31% |
| + burstiness (variance) | 0.98 | 0.64 | 27% |
| Curvature / perturbation | 0.99 | 0.73 | 14% |
| Supervised classifier | 0.99 | 0.997 | 0.2% |
Curvature methods degrade more slowly than a flat threshold because they probe the shape of the local probability surface rather than its height — but they still depend on a surrogate, and they still cost one forward pass per perturbation.
What to ask before you trust a number
If you are evaluating a detector, four questions separate the ones that will hold from the ones that already broke. Which generators were held out of training entirely? What is the false positive rate on second-language and formulaic human writing, reported separately? Does the output localise its claim to specific spans? And when was the model last retrained — because a detector is a moving target that has to be re-fit as generators change, not a formula you write once.
Perplexity deserves a fair epitaph. It was the right first idea, it was cheap, and for about eighteen months it was genuinely good enough. It stopped working because it measured a property of how text was being produced rather than who produced it, and the industry changed how text is produced. Any detector built on a single hand-chosen statistic will end the same way. Plan for the retraining, not the formula.