Can you actually make AI writing undetectable?

00 Two different games

"AI detection" and "AI humanizing" sound like two sides of one coin. They aren't. They're wildly asymmetric, and conflating them is the first mistake.

Detection asks: given a piece of text, how likely is it AI-written? Evasion asks: can I rewrite AI text so a detector calls it human — without wrecking it?

Detection is a classification problem with a clear right answer and lots of signal. Evasion is an adversarial generation problem where you're fighting a moving target and a second, quieter constraint — keeping the meaning. One of these we cracked in a few days. The other we chased for two weeks and came away with a much more interesting result than "we did it."

We used GPTZero as our primary arbiter throughout — it exposes a clean API and bills per word, so every score is a real, logged measurement — and cross-checked the hard results against Pangram, a separate state-of-the-art detector, so we weren't just learning the quirks of one vendor.

01 Detection is (quietly) solved

We built our own detector by distilling GPTZero: score a large corpus of human and AI text, then train a small local model to predict the verdict from cheap features.

That's good enough to ship as a free, instant, offline check. The load-bearing discovery underneath that number is worth stating plainly, because it's where a lot of published detection work quietly underperforms:

The single most predictive feature is the "surprise" of the text under a modern reference model.

Detectors are, at heart, measuring how predictable your word sequences are. The classic academic approach uses an old, weak language model (GPT-2) as the yardstick — and it's too weak. When we swapped in a current small model to measure predictability, our detector's accuracy jumped and everything else became secondary. The deep, sequence-level distribution of the text is the signal. Remember that phrase — it's the key to the whole piece.

02 The "tells" you've been told to fix are a myth

Search "how to make AI writing sound human" and you'll get the same list every time: remove em-dashes, add contractions, vary your sentence length, kill the "in today's fast-paced landscape" clichés, stop using curly quotes.

We tested this directly. We took clean, genuinely human documents and injected every one of those tells — stripped the contractions, added em-dashes, chopped and varied the paragraphs, inserted headings. Then we scored them.

The reason connects straight back to the last section: detectors don't read your punctuation or your vocabulary. They read the deep word-sequence distribution — the statistical fingerprint of which model, if any, tends to produce these exact sequences. Contractions and em-dashes are correlated with AI writing (they show up as markers), but they aren't causal. Fixing them changes what a human notices and nothing a detector measures.

This has a sharp practical edge in both directions. If you're detecting, surface tells are fine for explaining a flag to a person ("this reads AI-ish") but they are not a checklist that, once fixed, makes content pass. Any tool that says "you have 4 em-dashes, remove them to pass" is selling you a fix that doesn't work. If you're evading, editing the surface is a dead end. The only thing that moves a detector is changing how the text was generated — which is where the real story starts.

03 Evasion is real, but it lives in a very small room

If surface edits don't work, what does? We ran a census: 326 different language models, each asked to rewrite the same detectable-AI text, each result scored on the real detector.

The result was more lopsided than we expected. Every flagship you'd name — the big proprietary models, the mainstream open-weight ones — reliably produced text the detector flagged as AI. And the handful that could evade weren't the "creative" fine-tunes you'd guess. The predictor turned out to be a specific, almost counterintuitive property of the model's training, not its personality or its size — a large model and a small one from the same family evaded equally.

We'll keep the specifics of which models and how to chain them out of this write-up — that's the recipe, and it's beside the point. The mechanism is the finding:

Detectors are largely catching the fingerprint of instruction-tuning — the "helpful assistant" polish — not some abstract essence of "AI-ness."

This is why almost every model is caught: nearly all of them are heavily aligned to be helpful, agreeable, and well-structured, and that alignment leaves a consistent statistical signature. The handful that slip through are the ones trained least in that direction — their raw output looks more like an idiosyncratic human and less like a polished assistant. It also re-explains the tell-myth from a different angle: "structured, enumerated, helpful, perfectly coherent" is the tell — and that's the exact register most marketing copy is written in, whether a human or a machine wrote it.

So yes — evasion is possible. It exists in a small room with about four models in it. But possible-to-evade is not the same as usable, and that's where two weeks of work turned into a genuine finding rather than a product demo.

04 The honest wall — evade, or keep the facts

Here's the part the "humanizer" vendors don't put on the landing page. Once we had models that could evade, we tried to make them evade while preserving the source content — same facts, numbers, and claims, just rewritten to read as human. We threw everything at it: best-of-many-samples selection, decoding-temperature sweeps, and fine-tuning our own rewriters (supervised and preference-based) on a rented B200 GPU, against corpora we built and cleaned ourselves.

Every approach slid along the same trade-off curve:

The cleanest measurement came from a controlled test on genuine AI-vs-human data. A model trained to evade did so perfectly — 20 out of 20 documents fooled both GPTZero and Pangram, the independent SOTA detector. It looked like a total win. Then we measured faithfulness with a validated fact-checker:

We confirmed the same shape from every other direction:

Temperature is a slider, not a solution.

Turning up the "creativity" knob buys evasion and costs faithfulness in lockstep — fabrication rises monotonically as evasion improves. There's no sweet spot in the middle; we swept the whole range and it's a straight trade the entire way.

Training doesn't escape it.

When we fine-tuned a model to be faithful, it became an excellent faithful rewriter (recall ~98%) — and its evasion dropped to zero. Training it to track the source anchors the very sequence-structure the detector keys on. The knob that fixes the facts is the same knob that gets you caught.

Length makes it worse.

Short passages — a paragraph, an ad, a section — are the friendly case; best-of-many-samples got most short pieces to pass with acceptable quality. Full articles were a wall: zero of six made it through four different stitch-and-repair architectures. Detectors score a document holistically, so individually-passing sections drift back into the flagged zone once you glue them together.

Step back and the mechanism is consistent with everything above. The detector reads the deep generative distribution. To evade, a model has to genuinely deviate from the source into its own distribution — which means dropping and reshaping content. To stay faithful, it has to hug the source — which re-imposes the structure that gets flagged. Evasion and faithfulness aren't opposed by accident. They're opposed because they're the same variable pointed in opposite directions.

For low-stakes text where the exact facts don't matter — a generic intro paragraph, filler — a "humanizer" can work. For anything with claims, numbers, names, or a point of view you need preserved — which is most content worth publishing — the one-click promise is currently writing a check the technology can't cash.

What this means if you make content for a living

1. AI detection is trustworthy enough to act on — as a zone, not a verdict. A good detector will reliably tell you "clearly human," "borderline," or "clearly machine." Treat the borderline band as the signal to have a human genuinely rework a passage, not as a number to game.
2. Ignore the "tells" checklists. Removing em-dashes, adding contractions, and swapping curly quotes for straight ones changes nothing a detector measures. Editorial time spent there to "pass" is spent for nothing.
3. Be skeptical of "99% undetectable" tools — and specifically ask about the facts. The honest question is never "did it pass?" It's "did it pass without dropping or inventing content?" Run any humanizer's output through a fact-check against the original before you trust it.
4. There's a positioning risk baked in, too. Mass-producing "passes AI detectors" content onto a site runs straight at search engines' scaled-content-abuse policies. Evading a detector and building durable content are not the same goal — and optimizing for the first can undermine the second.
5. The honest workflow is assistive, not automated. Detect where the machine fingerprint is strongest, then have a person actually rewrite those spans — rework the ideas, not the punctuation — and re-check. That preserves your facts and moves the score, because a human genuinely changes the deep distribution. Slower than a button. It also works.

How we measured this — and where we could be wrong

We take methodology seriously because it's easy to fool yourself here, and we fooled ourselves several times before building the controls that caught it.

• Real detectors, real money. GPTZero bills per word (~$90–150 per million words retail), so every score in this piece is a logged, paid measurement, not a guess. We cross-checked the decisive evasion results against Pangram, an independent state-of-the-art detector, so a result isn't "true" because one vendor said so.
• We validated our fact-checker before trusting a single faithfulness number. Early on, our "faithfulness" scores came from a lenient AI grader, and the same texts swung from "recall 91" to "recall 63" just by rewording the grading prompt. We threw those numbers out, built a stricter grader that decomposes a source into individual claims and checks each one, then validated it against 50 planted cases (20 with deliberately introduced errors, 30 clean). It caught 20 of 20 planted defects with zero false alarms. Every faithfulness figure above rests on that grader.
• The one trap that cost us days: we tried optimizing rewrites against our own fast detector instead of the real one. It worked beautifully against ours (AI-probability crushed from 0.89 to 0.03) and did nothing against the real GPTZero (1.00 → 1.00). Optimizing against a proxy just finds the proxy's blind spots. The one methodological lesson: the real detector has to be the judge, or you're measuring nothing.
• Honest limits. Several comparisons run on tens of documents, not thousands — noisy at the margins, though the direction was consistent across every method. Much of our test content came from a single generation source, and our corpus skews toward marketing and web writing, which sits unusually close to the detector's "AI zone" to begin with (structured, enumerated, helpful — the exact register detectors fire on). A cleaner-distribution domain like news or fiction may behave differently at the edges. The core findings — detection works, surface tells don't move it, evasion-versus-faithfulness is a real trade — held up across every cut we ran.

Where we landed

We kept the capabilities that survive the trade-off: a fast, free detector that zones content reliably, and — for the short, low-stakes cases where it's honest to use one — an assistive rewriter with the validated fact-checker wired in, so you always see what a rewrite did to your claims. We did not build a one-click "make this 2,000-word article undetectable and keep every fact," because after two weeks of trying every method we know, that tool doesn't exist yet. Not for lack of effort — because of the wall.

That's the real headline. Detection is solved and getting better. "Humanization" is a genuine capability trapped inside a genuine trade-off, and anyone selling it as free of that trade-off is either not measuring faithfulness or hoping you won't.