Detection Evasion Risks When Using a Single LLM Repeatedly
Repeated use of the same LLM compounds detection risk across your entire body of work.
Detection Evasion Risks When Using a Single LLM Repeatedly.
KGW watermarking's embedding of a statistical signature into every generated token
KGW is the scheme most of the current watermark detection debate is built around, and understanding its mechanics matters before anything else here makes sense. At each generation step, the model looks at the tokens that came just before, runs them through a hash function, and uses that hash to split the entire vocabulary into two groups: a green list and a red list. The model then nudges its own logits, adding a fixed bias to every green-listed token, so that over the course of generation, green tokens turn up more often than chance alone would produce.
Detection doesn't need access to the model itself. A detector only needs the public hash function and a suspect piece of text, and it runs a z-test against the fraction of green tokens in that sequence. If the green-token count sits far enough above what a truly random, unwatermarked text would produce, the null hypothesis, that the text is human-written or otherwise unwatermarked, gets rejected.
Length is the detail that matters most for everything downstream. The z-score scales with the number of tokens under examination, so more text means more observations. More observations mean a sharper, more statistically confident signal. That one mathematical fact, that confidence climbs with token count, is the seed of everything the rest of this piece is about.
Repeated use of one model creates a compounding corpus, not one detectable document
Treating each new piece of content from a single watermarked model as its own isolated event makes the risk look manageable, maybe even negligible per document. Isolated-event framing understates the risk: every document generated by the same model, using the same hash function and the same watermark key, adds another set of green-token observations to what is, functionally, a single ongoing statistical... Every document generated by the same model, using the same hash function and the same watermark key, adds another set of green-token observations to what is, functionally, a single ongoing statistical test.
A detector doesn't have to look at documents one at a time. It can pool them, or run stylometric comparisons across a whole body of work, and when it does, the aggregate signal gets cleaner and stronger than any single piece could offer on its own. What sits below a detection threshold in isolation can clear that threshold easily once the corpus adds up.
Most teams get this backwards: they treat detection risk as something reset with every new post. The statistical risk does not reset with every new post, since the odds shift with every new page indexed and every new week of output added to the pile, because the test that drives it is cumulative by design. The odds shift with every new page indexed, every new week of output added to the pile, because the statistical test that drives it is cumulative by design.
Commercial detectors' capabilities with a consistent single-model corpus in 2026
The commercial detection market has consolidated rather than fragmented. One of the largest detection platforms was acquired by an email and productivity company in June 2026, and the resulting business now claims a user base north of 17 million. That kind of scale means detection tooling sits inside enterprise workflows and runs against real corpora at real volume, not against isolated test documents.
On clean, unmodified single-model text, the leading detectors are good, though not uniformly so. On the Chicago Booth 2026 benchmark, one major detector hit 99.5% accuracy, while a competing platform landed at 85.0%. Against GPT-5 output specifically, the gap widens further: one detector caught all of it, the other caught roughly a third. Paraphrase-resistant detection shows a similar spread, with GPTZero's paraphraser shield pulling 93.5% recall against paraphrased text, versus 50.2% for Pangram and 57.3% for Originality.ai.
Model choice matters just as much as detector choice. Claude 3.5 output is the hardest of the major models to catch, with a 22.4 percentage point gap between the best- and worst-performing detectors on it. GPT-3.5, by contrast, gets flagged reliably, with detection rates above 95% across the board. Which model a team leans on, and which detector happens to be checking, produces meaningfully different odds of getting caught, so the risk is not flat across the industry.
Detection has also stopped being purely statistical. Process-based verification, the kind that tracks typing cadence, copy-paste events, and how long a document sat open before publishing, now runs alongside the z-test as a second layer rather than a replacement for it. A document that beats the statistical test can still get flagged by the behavioral metadata attached to how it was actually produced.
The limits of editing and paraphrasing in single-model evasion attempts
The instinct most teams reach for first is editing. Taking the model's draft, changing some phrasing, adding a personal aside, and restructuring a sentence or two leads teams to assume the watermark signal is gone. A light, thirty-second edit can knock detection rates down from north of 90% to under 10%. That looks like a win, and on a single document, it is one.
The trouble is that the corpus doesn't grade on a per-document curve. The light edit fixes what's visible on that one page while leaving the structural problem, the accumulating green-token signal across everything else published under the same key, fully intact.
Paraphrasing runs into a subtler version of the same wall. Research assessing KGW's robustness against modern paraphrasing tools found that the scheme's resistance had been overstated, and that detection metrics like AUC and true positive rate fall sharply once the paraphraser is strong enough. The catch sits in that qualifier. Weak or moderate paraphrasing, the kind most workflows actually use because it's fast and keeps the meaning intact, leaves the underlying signal largely where it started.
A further complication comes from how these models get trained. When a model is trained on text that was itself watermarked, it can inherit that watermark signal into its own output, a phenomenon researchers call radioactivity. Standard, untargeted paraphrasing fails to strip that inherited signal out. Only targeted paraphrasing, or a neutralization step applied at inference time, works, and both require knowing the specific rules of the watermark scheme in the first place. That's not a tool sitting on most content teams' desks. Detector accuracy drops to 60-80% on heavily humanized or paraphrased content, but "heavily humanized" describes almost nobody's actual workflow at scale.
The BIRA result reveals where watermark evasion works
A paper published in September 2025 and revised through May 2026 offers the clearest evidence yet of what evasion that actually works looks like.
The theory behind it explains something bigger than the attack itself. Reducing the average conditional probability of sampling a green token by even a modest margin is enough to make detection probability collapse, and it collapses exponentially fast as that margin grows. BIRA doesn't need to reverse-engineer the hash function or guess the green list. It just needs to suppress green-token logits during rewriting, and the statistical foundation the detector depends on falls apart on its own.
BIRA works precisely because the rewriting model is a different model. It doesn't share the first model's hash key, so it isn't sampling from the same green-biased distribution, and it doesn't accumulate green tokens at anywhere near the same rate. The evasion follows directly from model diversity itself.
Other approaches populate the same research space. A watermark removal method called De-mark appeared at ICML 2025, and a 2026 survey comparing watermarking approaches found that cryptographic, "undetectable" watermarking schemes can survive roughly 40% of edits before their signal degrades, a meaningfully higher bar than KGW-family schemes clear, though these cryptographic approaches haven't seen wide deployment yet. The throughline across all of it holds steady: the mechanisms that actually break watermark detection operate on the sampling distribution itself, not on the surface wording of the text.
How a multi-model pipeline disperses the watermark signal structurally
BIRA's finding generalizes cleanly into a design principle that most single-model workflows miss. Every model in serious deployment right now uses its own watermark key, or possibly no watermarking scheme at all, and no shared hash function runs across providers. A pipeline that routes work across those providers inherits the same disruption BIRA achieves deliberately, except it arrives as a side effect of normal task assignment rather than as an explicit attack.
Picture the structure directly: Model A drafts a piece, Model B edits it, Model C rewrites the closing section. At each handoff, the green-token accumulation tied to Model A's key gets interrupted, because Model B and Model C aren't sampling from that same key-biased distribution. The z-score that would otherwise climb steadily across a single-model corpus never gets the continuity it needs to grow.
The same logic holds for stylometric detection, which runs on a separate but related signal. A Frontiers study found that individual LLMs carry reliably distinguishable stylistic fingerprints, detectable enough that a classifier can often tell which model produced a given passage. Blend output from several models into one piece, though, and the resulting composite doesn't cleanly match any single model's fingerprint profile, which denies the classifier the clean signature it needs. Watermark dispersal and stylometric dispersal turn out to be two faces of the same architectural fact: diversity at the model level breaks continuity at the detection level.
Evaluation criteria for choosing a multi-model writing architecture
A multi-model claim is only as strong as the actual dispersal behind it: does the token output really spread across providers carrying different keys and different training distributions, or does it just look that way on a slide? A pipeline that alternates between two models from the same provider, running the same underlying watermark scheme, hasn't achieved any of this. It's still one key, one accumulating signal, dressed up as variety.
A handful of concrete checks separate real dispersal from marketing language. Cross-provider diversity comes first: are the models involved actually built by different organizations, with different keys and different training data, or are they just different checkpoints of the same underlying system? Granularity of mixing comes second. Swapping in a different model for an entire draft versus an entire revision is a document-level switch, and it's considerably weaker than blending contributions at the sentence or line level, where green-token accumulation gets interrupted far more often within a single piece.
Third, and this is the one that separates real engineering from vendor claims, is measurable proof: does the architecture actually produce a lower z-score when it's run against a real KGW detector, or is the multi-model claim resting entirely on description rather than a number anyone can check? A claim without a benchmark attached to it is marketing copy. It's marketing copy, and teams should treat it that way.
Two further considerations round this out, and they cut in the opposite direction from pure architecture. Workflow preservation matters just as much: a team with a functioning brief-to-draft process shouldn't have to tear it down just to gain the structural benefit of model diversity.
Provenance standards add a second axis to this evaluation, separate from detection risk. The Coalition for Content Provenance and Authenticity attaches cryptographically signed metadata at the moment content is created, recording which AI tools were declared as involved, and its second version has been fast-tracked toward international standard status as ISO/DIS 22144, with a membership base above 6,000 organizations as of January 2026. The EU AI Act, separately, requires that AI-generated outputs be clearly identifiable as such. A content operation whose multi-model dispersal is documented, and whose z-score reduction is something it can actually point to and measure, sits in a far stronger compliance position than one relying on ad hoc, post-publication editing that leaves no provenance trail behind. That gap, between an architecture that can prove what it did and one that can only hope its edits were enough, is where the real risk now lives. BIRA achieves over 99% evasion success while preserving the semantic content of the original text across recent watermarking methods https://arxiv.org/abs/2509.23019. A 2026 ICLR paper on domain-specific watermark fingerprinting achieved 100% detection rate under finetuning, quantization, pruning, sampling variations, and active adversaries https://arxiv.org/pdf/2505.16723. A Stanford finding reported a false positive rate of 61.3% for non-native English writers detected as AI-generated https://fritz.ai/gptzero-review/. GPTZero's paraphraser shield achieves 93.5% recall versus 50.2% for Pangram and 57.3% for Originality.ai https://fritz.ai/gptzero-review/. GPTZero detects 100% on GPT-5 model outputs https://fritz.ai/gptzero-review/. On the Chicago Booth 2026 benchmark, GPTZero achieved 99.5% detection accuracy https://fritz.ai/gptzero-review/. On the Chicago Booth 2026 benchmark, Originality.ai achieved 85.0% detection accuracy https://fritz.ai/gptzero-review/. Originality.ai detects 31.7% of GPT-5 outputs on the Chicago Booth 2026 benchmark https://fritz.ai/gptzero-review/. Originality.ai achieved perfect accuracy (100%) across all LLMs and human texts in a study published by the Journal of Advances in Information Technology https://originality.ai/blog/ai-detection-studies-round-up. Accuracy of AI detection tools drops to 60 to 80% on heavily humanized or paraphrased content https://fritz.ai/gptzero-review/. A 30-second edit drops detection rates from 90%+ to under 10% https://thestacc.com/blog/ai-writing-benchmarks-2026/. Claude 3.5 remains the hardest to detect, with a 22.4 percentage point spread between the best and worst detectors https://thestacc.com/blog/ai-writing-benchmarks-2026/. GPT-3.5 is the easiest to detect at 95%+ across detectors https://thestacc.com/blog/ai-writing-benchmarks-2026/. GPTZero claims over 17 million users as of 2026 https://fritz.ai/gptzero-review/. Undetectable watermarks using cryptographic sampling survive roughly 40% edits in a 2026 survey comparison https://www.emergentmind.com/topics/kgw-watermark. The LDiet detection method achieves over 90% accuracy in distinguishing between infringing and clean models https://proceedings.iclr.cc/paper_files/paper/2025/file/8fba406323cb3930aeaccc9aa64c83a8-Paper-Conference.pdf. Invisible Entropy (IE) reduces parameter size by 99% while achieving performance on par with state-of-the-art watermarking methods https://arxiv.org/pdf/2505.14112.