Academic integrity currently rests on a technology that does not work, and the field knows it.
In July 2023, OpenAI withdrew its own AI Text Classifier six months after launch, citing a "low rate of accuracy." That is the company with the most direct possible knowledge of how its models write, concluding it could not reliably identify their output. The tools still being sold to universities are attempting the same thing with less information.
The failure is not evenly distributed, which is the part that should end the argument.
False-positive rate of seven AI detectors on writing known to be human
Average across detectors. Every essay measured here was written by a person.
Near-perfect accuracy. The detectors work, on this group.
| 97.8% | of the non-native essays were flagged by at least one of the seven detectors |
|---|---|
| 19.8% | were flagged as AI-written by all seven, unanimously |
| ↓ | the flagging largely disappeared once the same essays were rewritten with richer vocabulary, which is the tell: the detectors were scoring linguistic sophistication, not authorship |
Sixty-one percent, on writing produced by people. The same detectors were near-perfect on native-speaker essays, so this is not noise. It is a systematic penalty applied to writers with smaller English vocabularies, and the mechanism is understood: detectors key on how predictable each next word is, and non-native writing is less lexically varied. The researchers demonstrated it directly by rewriting the same essays with richer vocabulary, after which the flags largely disappeared. The detector was never measuring who wrote the text.
We build a workspace whose users routinely write in their second or third language. This is not a competitive observation about someone else's product category. It is a description of our users being failed by tools their institutions bought on their behalf.
Some of it is not failure. It is the business model.
In March 2026, AFP's fact-checkers tested three of these detectors. They fed them human-written text in Dutch, Greek, Hungarian and English. Everything came back flagged as heavily AI-generated, including a passage from an acclaimed Hungarian novel published in 1916.
Two details from that investigation are worth sitting with. The tools returned AI flags regardless of the input, including for nonsensical text. And two of them appeared to keep working with no internet connection at all, which suggests the verdict was never the product of analysis.
One tool flagged a human-written report as "88% AI content" and then offered to scrub the AI out of it, behind a paywall charging up to $9.99. Debora Weber-Wulff, a German academic who researches detection tools, put it to AFP plainly: "These are not AI detectors but scams to sell a 'humanizing' tool."
We want to be careful about the boundary here, because it matters. That investigation concerns a specific fraudulent segment, and it would be unfair to extend it to every vendor in the category. But there is a second, broader problem that requires no bad actors at all: a company selling both a detector and a humanizer is paid twice for the same false positive, once for raising the alarm and once for selling relief from it. No intent needs to be alleged for that incentive to be pointed the wrong way. Some vendors recognise this and deliberately build their humanizer so it cannot defeat their own detector. Most do not.
And there is a quieter admission inside the humanizer product itself. If the detector worked, the bypass could not exist. A company selling both is publicly conceding that its own detection is defeatable, which the security literature had already established: motor-signal and timing-based detectors have been shown to be evadable in over 99% of attempts.
The recursion has a punchline. The Stanford researchers found that the way to stop being flagged as AI was to enrich your vocabulary, and the enrichment they used was ChatGPT. So the escape from being accused of using AI is to use more AI, sold to you by the same industry that raised the accusation. The student most likely to pay for that escape is the one already sitting at a 61% chance of being falsely flagged: the one writing in a language that is not their first.
We think the question is wrong
"Does this text look machine-written" cannot be answered from the text, because fluent human prose and fluent machine prose are the same object. Models were trained to produce the former.
The answerable question is how was this written. A document that grew across fourteen sittings over three weeks, with sources added before the paragraphs citing them and passages rewritten twice, has a shape. A document pasted in at 23:40 has a different shape. That evidence exists and nobody has to guess at it.
But it is worthless unless the record itself can be trusted. A timeline you could generate on a quiet Sunday proves nothing about the three weeks it claims to describe. So the problem we set ourselves was not recording the writing process. It was making the recording impossible to manufacture afterwards.
What we built
While you write, your editor periodically sends us a fingerprint of the document. Not the document: a digest, computed in your browser. Your words never leave your machine on this path.
Each time we receive one, we stamp it with our clock, link it to the previous one, and hand back a fresh random number. The next fingerprint you send has to carry that number, and we reject it otherwise.
That last part is the whole design. The number did not exist until we issued it, so the next link in your record could not have been built before we did.
Checkpoint 0 · Mon 09:14
seq 0 · prev GENESIS · nonce a3f9…
Each link carries the nonce the server issued on the previous round. Your words never leave the browser: only a digest does.
Consider someone in April who wants a record claiming January. They need January's numbers. Those were random values generated on our servers in January and handed only to whoever was writing at the time. They cannot be derived, guessed, or recomputed, because they were never a function of anything. A three-week record takes three weeks to produce. There is no faster path at any budget, because the missing ingredient is not computation.
The full specification, including the exact field set, the concurrency handling, and the failure modes, is published as a technical reference. We would rather you could check our work than take our word for it.
What it withstands, and what it does not
We would rather state the limits ourselves than have someone find them.
Two of these are taxes rather than walls. We list them because a security claim that hides its own limits is not a security claim.
Two of those are taxes rather than walls, and we think that is the honest shape of the problem. Someone determined to retype a generated essay over three days will produce a record showing three days of writing, because that is what happened. What we remove is the cheap path. Contract cheating is a market, and markets respond to unit costs.
Nor does any of it prove comprehension. It records that a document took shape over time, in a particular rhythm. A person can write steadily and understand none of what they wrote.
The scale of the underlying problem argues for that humility. Newton's review of 65 studies covering 54,514 students put historical self-reported contract cheating at 3.5%, rising to 15.7% in samples taken since 2014, and self-report almost certainly understates it. No mechanism takes that to zero. Our goal is narrower and more achievable: make honest work easy to demonstrate, so the burden stops falling on the students least equipped to carry it.
Why we published it instead of patenting it
We considered filing. We decided publishing was the better instrument, for three reasons.
A patent would protect the wrong thing. The value here is not the mechanism, which is a page of code any competent engineer could write once they know its shape. The value is a verify link that means something to a professor who installed nothing. That is a convention, and conventions spread by adoption rather than exclusion. Certificate Transparency did not become universal because somebody owned it.
Publishing settles the risk that actually mattered. It was never that a competitor implements this. It is that someone else claims it and constrains everyone, ourselves included. A public description detailed enough to build from ends that permanently, which is why our technical reference contains the field list and the edge cases rather than a gesture at them. Vague disclosure protects nobody.
And the alternative would have been incoherent. We tell universities that provenance should be open and independently checkable rather than asserted by a vendor and taken on faith. Keeping our own mechanism secret underneath that argument is a contradiction we would have had to keep explaining. We would rather not have one.
So: take it. We would consider it a good outcome if a competitor shipped this next quarter. A field where authorship is demonstrable is worth more to us than a monopoly on one way of demonstrating it.
If you are building in this space, or running an institution that has to make decisions about it, we would like to hear from you.
Attested writing is opt-in per document. The certificate it produces is verifiable by anyone at a public link, with no account and no software.