Step one: perplexity
Feed a sentence to a language model one word at a time and ask, at each step, how likely the next word was. "The cat sat on the ___" makes "mat" extremely likely and "tuba" extremely unlikely. Average that surprise across a passage and you get its perplexity.
Models generate text by choosing likely continuations, so their output sits at low perplexity almost by construction. That is the core signal. It is also the core weakness: plenty of human writing is highly predictable, and being predictable is not a form of dishonesty.
Step two: burstiness
Perplexity alone flags too much, so detectors add a second measure. Burstiness looks at the variation in sentence length and structure across a document. People write unevenly — a long clause-heavy sentence, then a blunt four-word one. Models hold a steadier rhythm.
A passage that is both low-perplexity and low-burstiness is what a detector considers machine-like.
Step three: the threshold
Those measurements produce a continuous number, but users want an answer. So every vendor picks a cutoff: above this line, report "likely AI". That threshold is a business decision, not a scientific constant, and it is where most of the disagreement between tools comes from.
Set the threshold low and you catch more AI text but falsely accuse more people. Set it high and you miss more. There is no setting that avoids both, which is why the same paragraph can come back "98% AI" from one tool and "12% AI" from another. Both can be operating exactly as designed.
What about watermarking?
Watermarking is a genuinely different approach: the model biases its own word choices at generation time in a pattern that a matching detector can later recognise. It is far more reliable than perplexity analysis — and almost irrelevant in practice, because it only works if the model provider implements it and the text has not been paraphrased since.
Effectively every detector you will encounter in an academic or professional setting is doing after-the-fact statistical analysis with no watermark to read.
The ceiling this method has
The approach has a structural problem that better engineering does not remove. Detectors infer process from product: they look at finished text and try to work backwards to how it was made. But the same text can arrive by many routes — written from scratch, drafted by a model and rewritten, written by a person and polished by a grammar tool, or written by someone whose natural style is simply regular.
The strongest evidence for that ceiling is OpenAI's own experience. It shipped a detector for its own model in January 2023 and withdrew it that July, citing low accuracy: 26% of AI text correctly identified, 9% of human text wrongly flagged. The company with the most information about how the text was generated could not make detection work well enough to keep it running.
What the accuracy research shows · Why human writing gets flagged