Can AI detectors detect paraphrased text?

Detectors built on perplexity are measuring how predictable a text is under a language model. A paraphraser rewrites the passage into different words, which changes exactly the statistical shape the detector was reading — so the signal degrades not because anything was hidden, but because the thing being measured was replaced.

The Krishna et al. work is the standard citation here and it is usually quoted at half length. It did demonstrate that paraphrase attacks defeat a range of detectors, including watermarking and perplexity-based methods. It also demonstrated a defence: retrieval over a database of previously generated passages, which finds semantically similar text even after rewording, and which held up where the others did not.

Quoting only the first half turns a paper about an attack and its remedy into a claim that detection is hopeless. It is a real and serious weakness in the detectors of that period; it was not presented as unanswerable.

For anyone on the receiving end of a score, the practical implication runs the other way from how it is usually sold. If paraphrasing moves a detector's output, then the output was tracking surface statistics — which is also why plain human writing trips it.