Why perplexity-based AI detection stopped working
The statistic behind the first generation of detectors measured a model's surprise, not a document's authorship — and both sides of that line have moved.
For about two years you could build a passable AI-text detector in an afternoon. Take a small language model — GPT-2 was the standard choice — feed it the document, and ask how surprised it was. Surprise had a number: perplexity, the exponentiated average negative log-likelihood the model assigned to each token given the ones before it. Machine text scored low. Human text scored high. You picked a threshold somewhere in the gap and shipped.
That gap is gone. Detectors still built on it are not merely less accurate than they were; they fail in a specific and unfair direction, flagging the people who write plainly — students working in a second language, engineers writing documentation, anyone whose prose is clear enough to be predictable.
What perplexity actually measures
Perplexity is a property of a model, not of a text. When you score a paragraph with GPT-2 you learn exactly one thing: how well GPT-2 predicted that paragraph. The detection story built on top of that measurement carried two hidden premises, and both were true by accident in 2022.
The first premise was that language models decode near the mode. Sampling at a low temperature, or from a tight nucleus, keeps a generator inside the high-probability region of its own distribution, so its output is almost by construction easy for another model to predict. The second premise was that human writing is uniformly unpredictable — that people digress, mistype and reach for the fourth-most-likely word often enough to keep their perplexity comfortably high.
Every refinement inherited both premises. DetectGPT replaced the raw score with local curvature: perturb the passage, rescore it, and check whether the original sits on a probability peak. Binoculars-style methods divide perplexity under one model by cross-perplexity under a second, which normalizes away some of the topic effects. Better statistics, same signal. All of them assume the generator hugs the mode and the human does not.
Three things broke at once
Post-training moved models off the mode
Instruction tuning and preference optimization do not make a model more predictable to an older model; they make it more useful to a person. A 2026 assistant reply is full of structure a 2019 base model rarely saw — scaffolded lists, hedges, section headers, second-person address, a consistent register. Scored under GPT-2, a modern assistant answer often lands above the median human paragraph. The signal did not just weaken. It sometimes inverted.
The scorer fell behind the generator
Perplexity is always measured under some proxy model, and proxies age. A scorer trained before 2020 has never seen most of the proper nouns, tool names and idioms in a document written this year, and it assigns them low probability regardless of who typed them. Domain drift alone — legal filings, clinical notes, anything code-heavy — moves raw perplexity further than authorship does.
Human text stopped being a clean control
Autocomplete, grammar checkers, machine translation and a quick "tidy this up" pass are ordinary parts of writing now; most real documents are mixtures. Meanwhile the humans whose writing is naturally low-perplexity, because they use a smaller and higher-frequency vocabulary, cross the threshold first. A 2023 study in Patterns found that detectors misclassified TOEFL essays written by non-native speakers roughly 61% of the time while clearing native-written essays almost perfectly.
Perplexity never measured whether a machine wrote the text. It measured whether the text was predictable. — the failure mode, in one line
There is also the matter of adversaries. A single round trip through a paraphraser raises perplexity by whatever margin you like; the cost is a few seconds and a little fluency. Any detector whose decision reduces to one scalar can be walked across the threshold by anyone who can measure that scalar, and the scalar is not a secret — it is computable by anyone with an open-weights model and a GPU.
What carries the signal now
The replacement is unglamorous: stop measuring surprise and start training directly on the discrimination task, with data built so the classifier cannot cheat.
- Paired documents, not scraped pilesEvery human document is matched with machine documents on the same prompt, topic and length. Without pairing, a classifier learns that essays about climate policy are machine-written, because that is what the scrape contained.
- Mirror the whole familyFor each pair, generate across many models and decoding settings — greedy, nucleus, high temperature, and paraphrased variants. The target is the family of generators, not one member of it.
- Calibrate to a false-positive ratePick the operating point first: one false accusation per 10,000 human documents, say. Then report accuracy at that point. Accuracy quoted without an FPR is a number about the test set, not about your inbox.
The old signal, seen up close. Four documents scored under a GPT-2 proxy, threshold set at the classic PPL < 25:
$ ppl-score --scorer gpt2-medium --threshold 25 samples/
document tokens mean_logp ppl call truth
human/lab-notes.md 412 -3.11 22.4 machine human FP
human/forum-reply.txt 308 -3.98 53.5 human human ok
machine/gpt2-2020.txt 396 -2.24 9.4 machine machine ok
machine/assistant-2026.txt 401 -3.42 30.6 human machine FN
4 documents, 2 errors, FPR 0.50, TPR 0.50Two of four wrong, and the two failures are the expensive ones: a terse lab notebook flagged as machine, a current assistant answer cleared as human. Nothing about the threshold fixes this — move it down and the notebook is still caught; move it up and the assistant is still missed. The distributions overlap.
None of this makes detection easy. It makes it measurable. A trained detector still needs enough text to decide — below roughly fifty words there is not enough evidence for anyone, and the honest answer is to abstain — and it still needs a refresh each time a new generator ships. But its errors can be counted, bounded and reported, which is the part perplexity could never offer.
What to ask before trusting a detector
Most detection claims are still quoted the way perplexity-era claims were: one accuracy number, no operating point, no description of the negative set. Four questions separate a measured system from a threshold with marketing on it.
- 01At what false-positive rate is that accuracy quoted?
"99% accurate" on a balanced set can still mean one in a hundred innocent documents is flagged.
- 02Who is in the negative set?
Non-native writers, heavily edited drafts, technical documentation and translated text are where false positives concentrate.
- 03What happens after one paraphrase pass?
If performance collapses, the system is measuring surface statistics rather than provenance.
- 04Is the output a decision or a percentage?
A per-sentence percentage invites over-reading. A calibrated document-level call, with an abstain option, does not.
Perplexity was a reasonable idea in the year it was proposed, and it is worth remembering why it worked: for a brief window, machine text really was the most predictable text on the internet. That window closed the moment models were tuned to sound like people rather than to maximize likelihood. The tell was never in the surprise. It was in the fingerprint — and fingerprints only mean something when you have a reference set to match them against.