False Positive Rates in Commercial AI Content Detectors

False positives in commercial AI content detectors are a predictable consequence of measuring writing style as a proxy for authorship. Perplexity and burstiness can identify predictable, consistent prose, but they cannot establish who wrote it. For content teams, that distinction changes both how detector claims should be evaluated and how provenance risk should be managed within production pipelines.

Why perplexity and burstiness became the foundation of commercial AI detection

Commercial detectors assign AI-probability scores using two linguistic properties, perplexity and burstiness. Perplexity measures how easy it is to predict each token choice from its context, while burstiness describes how much sentences in a passage vary in length and how complex their structures are. The rationale is that LLMs, optimizing for fluency, tend toward high-probability token sequences and relatively consistent structures. Human writing is assumed to vary more, so low perplexity and low burstiness are taken as signs that a machine wrote the text.

That inference is the source of the problem. Neither property records authorship, and neither distinguishes a model seeking fluent phrasing from a human deliberately choosing conventional language. When a detector treats predictability as evidence of machine origin, it places clear human prose within the same statistical region as generated text. Calibration determines where the boundary falls, but it does not make the underlying signals exclusive to AI.

KGW-family watermark detectors provide a related example of systematic token bias, although their mechanism differs from style-based inference. They split vocabulary tokens into green and red lists, then give green tokens a logit boost during generation. Detection checks whether the z-score of green-token density is above a threshold. Both approaches depend on statistical patterns in the resulting text, but a low-perplexity passage does not, by itself, demonstrate an intentionally embedded watermark.

What writing styles fall inside the detector's AI zone by construction

Formal structure, lexical consistency and syntactic uniformity can produce low perplexity and low burstiness regardless of authorship. These are properties of a register. Technical documentation, legal prose and formulaic genre writing use repetition and predictable construction to maintain precision. A detector that interprets those features as machine origin can therefore treat competent execution of the genre as suspicious. The writing satisfies its professional purpose while also satisfying the detector’s proxy for AI.

Karr et al. found that unmodified peer-reviewed abstracts from 2023–2025 were flagged at measurable rates, with non-STEM disciplines flagged significantly more often than STEM disciplines, at p < 0.001. The study linked higher scores to long-token density and Academic Word List density. Those features describe the language of academic writing. Non-STEM prose can be more lexically formal and less domain-specific, placing it closer to the detector’s flagged region without establishing a difference in authorship. The result connects a measurable stylistic feature to a predictable classification risk.

Liang et al. (2023) found the same problem for non-native English writers, whose clear, simple sentence structures can produce the low-perplexity signal linked to LLMs. Careful writing becomes a source of exposure. This is why the problem cannot simply be tuned away by moving a threshold. Human and machine text overlap on the very features used to distinguish them. A different boundary can change which passages are flagged, but it cannot turn register into reliable evidence of origin.

How the measurement gap between vendor claims and independent results reflects the same structural flaw

Vendor benchmarks that omit vulnerable writing styles do not measure the risk those styles face in production. Their accuracy figures are best-case bounds. A corpus containing little formal, non-native or domain-specific writing can make separation look easier than it is for an enterprise content team. The benchmark has excluded much of the overlap. Its result may describe performance on that selection of text without describing performance on the documents an organization actually publishes.

Park et al. found that false positive responses varied widely across detectors when professional editing changed the form of human-written manuscripts while preserving their content and authorship. The same edits increased scores in some detectors and decreased them in others. That divergence is consistent with different thresholds and training corpora acting on shared stylistic ambiguity. It is not merely random variation around a dependable authorship test.

OpenAI retired its own classifier because of its low accuracy. That outcome illustrates the difficulty of separating fluent human prose from fluent machine prose, even for an organization closely familiar with its model’s output. Improvements over time remain relevant, but their scope is limited. Better overall accuracy on general corpora does not show that the gains are as large for underrepresented registers. For practitioners, an evaluation must include the kinds of writing that create ambiguity.

Why light AI assistance raises false positive risk more than full AI generation evades it

Detectors cannot reliably tell AI editing from AI drafting when both produce fluent, consistent text. The distinction is central to many institutional policies, yet it is absent from the linguistic signal being measured. A detector sees the finished passage. It can therefore assign a high score to human-authored material that received limited assistance without establishing that a model supplied the underlying ideas or draft.

Karr et al. found that light AI refinement of human-authored abstracts produced substantially elevated flagging rates, while evasion-optimized rewrites were flagged at very low rates. The study treated light refinement as a proxy for assistance that institutional guidelines commonly permit. Its comparison exposes an inversion between policy and measurement. Transparent, limited assistance can create greater sanction risk than rewriting designed to obscure extensive AI use. The detector responds to the remaining signal.

This is more than an inconvenient classification error. When detector scores drive consequences, the system can penalize permitted assistance while failing to identify deliberate concealment. Raising or lowering the threshold does not supply the missing distinction between editing and drafting. Evasion-oriented rewriting targets the token-level and perplexity signals being tracked, whereas ordinary refinement seeks clarity and consistency. The two activities have different goals, so good editing need not lower a detector score.

For content teams, the same mechanism applies when a human editor improves an AI draft. More consistent writing may reduce burstiness and make the passage’s formal register stronger, putting it further into the flagged region. A higher score need not mean that a machine did more of the work. Conversely, a lower score after rewriting does not establish greater human ownership. Treating either movement as proof of policy compliance gives a stylistic measurement authority it cannot support.

What false positive rates mean at institutional and enterprise scale

Even when the overall false positive rate is low, a large document corpus can have many wrongly flagged texts. When a detector influences content rejection or compliance decisions, a mistaken classification is no longer just a misleading score. It becomes a disputed judgment about a document and, potentially, its contributor. The instrument’s error frequency, the concentration of those errors and the decisions that follow therefore all matter.

Content teams that work across countries face more of this risk because formal prose from non-native English contributors can look like the detector’s AI-associated register. Equivalent work can receive unequal scrutiny within the same workflow. Legitimate assistance for translation, clarity or polish can further complicate the relationship between authorship and linguistic form. Karr et al. discuss that governance concern, but their English-abstract findings do not establish performance across multilingual or non-English writing. The low-perplexity finding for non-native writers comes from the separate work of Liang et al.

The distribution of error is therefore as important as the aggregate rate. An overall result can obscure repeated exposure among contributors whose work is especially formal or linguistically consistent. For organizations making consequential decisions, the lesson is to avoid treating detector output as standalone evidence for rejection, compliance flags or misconduct findings. Such decisions require evidence beyond the score to establish authorship, even when a vendor reports strong average performance, because uncertainty remains about a particular flagged document.

Why multi-model pipelines compound provenance ambiguity without solving the false positive problem

Enterprise content pipelines increasingly route work through sequential or parallel model calls. One model may draft, another refine tone and another check factual consistency. As a result, its stylistic residue need not resemble the output of any single provider, making attribution more difficult than in a single-model workflow. The production process introduces another gap between the document’s history and the signals visible in its final wording.

A pipeline can dilute a single model’s token-level fingerprint while still producing highly consistent, low-perplexity prose. Different detectors may then return conflicting judgments because they are calibrated against different model-family signatures, none of which accurately represents the hybrid output. The text can become harder to assign to a particular generator while remaining easy for a style-based detector to flag.

Tamim and Khan found that every initially detected KGW-watermarked text in their paraphrase evaluation lost its detectable watermark after paraphrasing. That finding concerns the tested rewriting conditions, rather than proving that every production rewrite removes a watermark. It nevertheless shows how a later transformation can degrade an earlier provenance signal without changing the text’s underlying origin. In a multi-step pipeline, such degradation need not imply deliberate evasion. Content teams consequently face two distinct problems, formal register can trigger style-based detection, while rewriting and model mixing can weaken watermark-based attribution.

These failures do not cancel each other out. A missing watermark cannot establish human authorship, just as a low-perplexity score cannot establish machine authorship. Combining ambiguous outputs from different instruments does not automatically reconstruct the production history. The multi-model environment makes that limitation more pronounced because its final text is the product of several interventions rather than a single, stable signature.

What structural compliance looks like when detector reliability cannot be assumed

The architectural response is to manage detector exposure within the content pipeline rather than depend on appeals after publication or rejection. This shifts the intervention from individual wording to output structure. Surface-level rewriting can weaken some signals while leaving an underlying single-model signature in place. Architectural dispersal instead aims to keep a coherent single-model signature from forming in the text that is delivered. The aim is provenance risk management, with legitimate authorship requiring evidence independent of undetectability.

That distinction also limits what architecture can promise. An output-layer design must therefore be tested against the relevant detector, since using several models is no guarantee that it works. Teams do not need to discard good briefs, approved outlines or reliable drafting practices to make that change.

KGW mechanics make the narrower technical standard explicit. Because detection depends on green-token density exceeding a z-score threshold, a pipeline’s claim of resistance can be assessed through reproducible z-score benchmarks. Compliance by construction, in this limited sense, means output remaining below the relevant detection threshold by design. A below-threshold result is still only a result against that test. It does not prove human authorship, satisfy every policy or establish resistance to a separate perplexity-based detector.

The governance boundary must remain explicit throughout. Reproducible output benchmarks address exposure to a detector, while decisions about permitted assistance concern how the work was produced. Conflating those questions would reproduce the original error in reverse, treating a favorable statistical signal as proof of acceptable conduct. Structural risk management is defensible only when its claims stay within what the measurement demonstrates. Detector scores can characterize text, but they cannot substitute for a sound judgment about provenance.