Inside our benchmark: 15,899 documents, 30 generators, and the number we almost got wrong

Most AI-detector accuracy claims are inflated. Not usually on purpose, it's just easy to measure detection badly, and hard to measure it honestly. This post is about how we built a benchmark that fights back against the usual mistakes, and about the moment we caught ourselves making one.

The number we almost published

Early on, our mixture-of-experts detector scored 0.965. That number was real, in the narrow sense that a script produced it. It was also misleading, for three reasons we only admitted after we forced ourselves to measure honestly:

1. It was AUROC, not accuracy, a ranking metric that sounds like a grade but isn't.
2. It came from cross-validation on a small dev subset, not a held-out test set.
3. The text vectorizer had been fit on all the data, including the documents it was

later scored on, a subtle leak that quietly flatters the model.

When we rebuilt the evaluation properly, the honest number was 0.91 accuracy (0.97 AUROC). Still strong, but the gap between "0.965" and "0.91 accuracy" is exactly the gap between marketing and measurement. We'd rather ship the smaller, true number.

How to measure a detector honestly

Here's the setup we settled on, and why each choice matters.

A frozen, leak-free split. We hash every document's ID and assign it permanently to train, validation, or test. Nothing, not the model, not even the text vectorizer , ever touches the test set until the final score. If your vectorizer sees the test vocabulary during training, your number is inflated and you won't know by how much.

Many generators, not one. Our corpus is 15,899 documents from 30 generator models (GPT-3.5/4o/4.1, Claude, LLaMA, OPT, FLAN-T5, GPT-NeoX, BLOOM, and more) across 22 domains and two languages. Why it matters: a detector tested only on ChatGPT looks near-perfect and then falls apart in the wild. Which brings us to the most important slide in AI detection.

The surrogate gap. Cheap "zero-shot" detectors, the ones that need no training , score 0.99 at telling ChatGPT from human on clean data. On our diverse 30-generator set, the same methods score about 0.55: barely better than a coin flip. That's not a bug; it's the well-documented surrogate gap, and it's why a single impressive demo number tells you almost nothing.

Report every slice, including the bad ones. We publish accuracy, AUROC, and, the metric that actually matters for a real product, true-positive rate at a 1% false-positive rate. On modern GPT-4o and Claude text, that number is 0.86: at a threshold where we wrongly flag only 1 in 100 human documents, we still catch 86% of AI text.

The part that surprised us

We built a second benchmark specifically to make our own detector fail. We took AI text it catches and asked other models to rewrite it nine different ways, paraphrase, casual register, compression, back-translation, restructuring, and more, then kept only the rewrites that preserved meaning and measured how many now slipped through.

The result was not what we expected: meaning-preserving rewrites mostly don't work. Our detector held 94% against single neutral rewrites, and even three rewrites chained together barely moved it. It turns out that to make AI text read as human, you have to change what it says, not just how it says it, and once you do that, it's arguably not the same text anymore.

Where our detector did struggle was the opposite direction: false positives on unusual human writing. On a set of the most AI-looking genuine human documents we could find, it wrongly flagged up to 44% at a loose threshold (13% at our strict operating point). That's the honest frontier, and it's why our next work is focused on the case that matters most: not falsely flagging real academic papers.

Why we're telling you the weak parts

Because for the job we care about, screening scholarly papers, the cost of a false accusation is far higher than the cost of a miss. A detector that hides its false-positive rate is not a tool you should trust with someone's reputation.

So here's the standing promise: every number we publish is measured on data the model never saw, every accuracy claim comes with its false-positive rate, and we treat a score as a signal to look closer, never proof. If we ever get one wrong, we'll say so.

Try the tool, and read the full leaderboard, at Verdict. Next up: the nine ways we tried to fool it, in detail.