AI Generated Text Explained: Signals, Detection and Limits

If a detector says a passage looks human, does that prove a person wrote it? Most explainers treat that result as a verdict, but a negative score only shows that one tool didn't find one signal under one set of conditions. Separating hidden characters, statistical watermarks, detector scores and provenance records makes the gaps clear.

Table of Contents

• What AI Generated Text Is and How Models Write It
  • The token loop
• Four Signals That Hint at AI Generated Text
  • Hidden Unicode characters
  • Statistical watermarks
  • Detector scores
  • Draft history and provenance
• How Watermarks Are Embedded During Generation
  • Four steps inside generation
  • The n-gram trade-off
  • What survives editing
• How Accurate Detectors Are Under Real Conditions
  • How to test before trusting a score
• What a Negative Detection Result Does Not Prove
  • Three claims readers mix up
  • What changes the result
• How to Clean Hidden Characters Without Rewriting
  • Step-by-step cleanup
  • What each layer does and doesn't do
• Choose a Disclosure and Review Policy Before You Publish
  • A decision sequence that holds up
  • Processing routes, limits and costs

What AI Generated Text Is and How Models Write It

AI generated text is any passage a language model produced, fully or partly, by predicting one token, a word or word fragment, at a time from the text before it.

The token loop

1. Read the context: The model reads the prompt and everything generated so far.
2. Score candidates: It scores every candidate next token.
3. Sample one token: It selects one token according to those scores.
4. Append and repeat: It adds that token to the text and repeats until the response ends.

Think of a very fast autocomplete that has read a large library and keeps choosing the next note that fits the phrase, like a musician improvising over a chord. It doesn't retrieve a finished sentence. It builds one choice at a time.

Scale changed what that loop could do, because the history of large language models notes that GPT-3, described on May 28, 2020, had 175 billion parameters, roughly ten times more than earlier non-sparse language models. That scale made general-purpose writing possible without a separate system for each task.

Use is now routine in classrooms and content teams alike. In 2024, 64.2% of surveyed students reported using large language models for a writing assignment, up from 31.2% in 2023, according to The Peer Review. Teams scaling that work often need process guidance too, such as SEO content automation explained by Outrank, which covers how automated drafting fits into a publishing workflow.

Readers should separate three cases. A passage can be fully generated, AI-drafted and heavily edited by a person, or human-drafted and polished with AI. Say a 600-word article starts as a model draft and the writer rewrites the middle sections line by line. No single label fits that piece.

AI generated text has no fixed fingerprint. Reviewers can only work from indirect signals, and each signal has limits.

Four Signals That Hint at AI Generated Text

Four evidence types are often blurred together, although they show very different things.

Signal	What it is	What it can show	What it cannot show
Hidden Unicode characters	Zero-width or direction-control characters in pasted text	Possible copy-paste or processing residue	Who or what wrote the passage
Statistical watermark	Token-choice bias added during generation, such as SynthID on Gemini	Whether a watermark signal remains after editing	That a passage is human-written when no signal is found
Detector score	Classifier estimate from style and probability patterns	A confidence estimate under the tested conditions	A verdict on authorship
Draft history and provenance	Drafts, version history, prompts and research notes	How the text developed over time	The exact share of AI assistance in a single passage

Hidden Unicode characters

Hidden Unicode characters are invisible code points, such as zero-width spaces and direction controls. They arrive through copy-paste, word processors, web editors and processing pipelines. Their presence shows that text passed through a path that left residue. It doesn't show whether a person, a model or both wrote the visible words, because human-written text picks up the same characters when it's copied between tools.

Statistical watermarks

A statistical watermark is different. A provider that deploys watermarking biases token choices during generation, as SynthID does for Gemini outputs. A later check can show whether that pattern still remains in the passage. It can't show that an unwatermarked passage is human-written, since many models and settings add no watermark at all.

Detector scores

A detector score comes from a classifier that weighs style and probability patterns. It's a probability estimate under specific test conditions, not a record of how the text was made. Short, edited, translated or mixed-authorship passages strain that estimate most.

Draft history and provenance

Draft history includes early drafts, version records, prompts, research notes, comments and source files. For a specific piece, that record usually gives the strongest evidence because it shows development over time. Even a good record can't assign an exact percentage of AI help to one paragraph.

Reading rule: The more a signal depends on exact words, the more easily editing removes it. The strongest case combines several signals with records, rather than relying on any one check.

How Watermarks Are Embedded During Generation

Watermarking happens while the model writes, not as a label pasted on afterward.

Four steps inside generation

1. Filter candidates: The model computes scores for candidate next tokens after top-k and top-p filtering.
2. Adjust the scores: A watermarking step, acting as a logits processor, uses a pseudorandom function driven by secret keys to nudge candidate scores up or down.
3. Build a bias: Across many tokens, those nudges form a statistical bias rather than a visible mark or hidden character string.
4. Test with the key: A detector holding the correct key compares observed token choices against the expected pattern.

A watermark works like a slight tilt in a long sequence of coin flips. One flip proves nothing. Across hundreds of flips the tilt becomes measurable, which is why passage length matters and why a few sentences rarely carry enough signal for a confident result.

The n-gram trade-off

Configuration includes an n-gram length, the window of preceding tokens used to drive the pseudorandom choices. Longer windows improve detectability but tie the signal more tightly to exact wording, so edits break more of the pattern. Google identifies 5 as a practical default for this resilience and detectability trade-off in its SynthID documentation.

What survives editing

Mild paraphrasing, deleting some text or changing a few words may preserve enough pattern for detection. Thorough rewriting or translation can substantially reduce detector confidence because token choices change throughout. Removing zero-width characters doesn't by itself alter that token-choice distribution, a distinction spelled out in the guide to hidden Unicode versus statistical watermarks.

Scope is the final warning. Watermarking applies only where a provider deploys it, so many outputs carry none. It is never safe to say all ChatGPT outputs are watermarked. Any dated claim about a provider's current watermarking status should be checked against that provider's own current documentation before it is repeated. A missing signal can mean no watermark was ever added.

How Accurate Detectors Are Under Real Conditions

A detector score works like a photograph of the text at test time: it captures the signal still visible under one detector, one threshold and one editing history. According to a 2025 arXiv benchmark summary, detectors can exceed 90% accuracy on direct, unmodified LLM outputs, fail severely after iterative paraphrasing, and reach 80–97% detection of paraphrased generations with retrieval-based checking while still flagging about 1% of human text. Those figures come from different setups, so no single percentage travels across every draft.

Test condition	Reported result	What it tells you
Direct, unmodified LLM output	Above 90% accuracy	Strongest condition for detectors
Iterative paraphrasing	Severe failures after repeated rewriting	Shift from raw output to edited text
Paraphrased text with retrieval checking	80–97% detected; about 1% of human text flagged	Extra checking helps and still errs
Simple manipulation, 2024 study	17.4 percentage point drop	Light editing alone can shift scores
Adversarial manipulation, 2024 study	22.14% average accuracy	Spelling changes and burstiness were effective
Human participants judging AI text, 2025 evaluation	10% accuracy	Judging by eye performs poorly
Human participants judging human text, 2025 evaluation	17% accuracy	Familiar style can also be misread

Manipulation alone moves scores a long way. A 2024 study in the International Journal of Educational Technology in Higher Education reported detector accuracy fell by 17.4 percentage points under simple manipulation techniques and dropped to 22.14% on average after adversarial techniques. Human judgment doesn't rescue the process either. In a 2025 evaluation, participants identified AI-generated written content with only 10% accuracy and human-written content with 17% accuracy, according to Advances in Simulation.

Read the table as a map of test conditions. Four kinds of evidence often get blurred together: hidden Unicode characters are extra code points left in copied text, a statistical watermark is a pattern in token choices, a detector score is the result a checking tool reports, and a provenance record is metadata about origin. Each can be present or absent on its own. Removing invisible characters can clean the pasted text while leaving token-choice patterns unchanged. Rewriting can disturb those patterns while leaving any provenance record untouched. The accuracy figures above apply only to the exact signal each test measured.

How to test before trusting a score

• Split by edit state: Evaluate raw, lightly edited and heavily rewritten samples separately.
• Use human controls: Measure the false-positive rate on human-written text from the same domain.
• Separate the evidence: Keep hidden characters, statistical watermark patterns, detector scores and provenance records apart, a distinction covered in the comparison of AI watermarks versus AI detectors.
• Record the setup: Log detector version, dataset, threshold and date.
• Report uncertainty: Present every result as a confidence estimate with its method.

A raw draft can score high, then the same draft can score low after a line-by-line edit. The author has not changed. The evidence has. The first score measured token patterns before editing, and the second measured what remained after editing.

A detector score tells a reviewer how text behaves under a test. It does not replay how the text was created.

What a Negative Detection Result Does Not Prove

One evaluation makes the risk concrete, because an arXiv evaluation of SynthID detection found meaning-preserving paraphrasing removed detection from 98.3% of initially detected SynthID samples, while 5.4% of paraphrased human-written controls were falsely flagged. Editing moved results in both directions. AI text stopped being detected, and some human text started being flagged.

Three claims readers mix up

• Signal present: This supports only that the tested signal remains in this passage, under this detector and configuration.
• No signal detected: This supports only that this detector, with this key and threshold, found nothing strong enough to report.
• Human-authored: This is a historical claim about how the passage was produced, and no current detector can certify it.

The middle claim is where most mistakes happen. "No signal detected" gets rewritten in reports, emails and disciplinary notes as "human-written," although the test never proved that. The passage may have come from a model without watermarking, from a watermarked model after heavy editing, or from a person. The negative result can't separate those histories.

What changes the result

Results shift with passage length, model and watermark configuration, language, entropy, editing history and whether the checker holds the correct key. Predictable text with little token choice gives a watermark fewer places to hide a bias. Short passages give any detector fewer observations. Reporting should therefore state the method, version, threshold, dataset and uncertainty band, especially since 80% of pristine SynthID outputs fell into an uncertainty range in that same arXiv evaluation.

Cleaning doesn't erase history either. A passage that no longer triggers a check may still require disclosure under a school, publisher or client policy, because the policy governs how the work was made, not whether a signal survives. Rewriting can defeat a watermark without changing the authorship history that a reviewer may need to disclose.

Before acting, a reviewer should ask one question. What claim does this result legitimately support?

How to Clean Hidden Characters Without Rewriting

Start with inspection, not rewriting. The free invisible character inspector and local text tools run in the browser with no signup, no credits and no upload, and the inspector lists supported characters by code point. Users paste text into one box with nothing to set up, and the browser scans for hidden characters as they type.

Simple Unmark offers three free browser-local utilities at that tools page, the Invisible character remover, Remove line breaks and the Plain text converter. They require no signup, credits or content upload, they don't rewrite wording, and they don't verify statistical watermark removal.

Step-by-step cleanup

1. Paste and inspect: Paste the passage into the inspector to see which hidden characters are present and where. Don't guess from how the text looks, since these characters are invisible by definition.
2. Check the common code points: Look for zero-width spaces (U+200B), zero-width joiners (U+200D) and bidirectional controls such as U+202E, which copy-paste from editors and web pages often leaves behind.
3. Remove invisible characters: Delete them, because they carry no visible wording. Watch joiners in scripts and emoji sequences where a character can affect rendering, and check the result visually.
4. Normalize Unicode: Apply standard Unicode normalization so look-alike variants of the same character become consistent. This fixes mixed forms that break search, sorting and word counts.
5. Remove hard line breaks: Unwrap lines that were broken by a PDF, email or narrow editor column, while keeping optional paragraph breaks. Line-break cleanup preserves those paragraph breaks when that option is selected.
6. Convert to plain text: Turn rich or HTML-pasted content into plain text, and save as .txt if a file is needed. The plain text converter accepts rich pasted text or HTML and supports .txt download, and both line-break removal and plain-text conversion run locally.
7. Read the result: Check for shifted meaning, names, numbers, links and punctuation. Cleanup shouldn't change wording, but pasted content can hide surprises that only a read-through catches.
8. Rewrite only if wording must change: If the goal involves token-choice patterns, run a model-assisted rewrite and review it line by line. That step aims to preserve meaning and always requires human review.

What each layer does and doesn't do

Cleaning layer	What it changes	What it leaves unchanged
Invisible character removal	Zero-width and direction-control characters	Wording, punctuation and token choices
Unicode normalization	Compatibility variants of the same characters	Wording and token choices
Line-break removal	Hard wraps, with optional paragraph breaks preserved	Wording and token choices
Plain text conversion	Rich text and HTML formatting from pasted content	Wording and token choices
Model-assisted rewrite	Phrasing and token-choice patterns	Requires human review to keep meaning, facts and names

Two limits matter. Hidden characters don't prove AI authorship, because editors, browsers and documents add them to human writing too. Steps 1 to 6 also don't remove a statistical watermark, because they never touch the token choices that carry it. A clean Unicode file can still contain a watermark pattern, and a watermarked passage can contain no hidden characters at all.

Choose a Disclosure and Review Policy Before You Publish

Three myths cause most publishing problems. The first says a clean detector result proves human authorship. The second says removing visible formatting removes a watermark. The third says a rewrite makes disclosure unnecessary. A written policy, decided before a dispute, prevents all three, and broader guidance on governance for AI-assisted content creation from Narrareach helps teams turn those rules into day-to-day editorial practice.

A decision sequence that holds up

1. Preserve the original: Keep the first draft, version history and prompts before any edit or cleanup. Cleaning doesn't erase a draft's history, and records created afterward can't reconstruct what was overwritten.
2. Check the governing policy: Read the publisher, school or client rule for required disclosure wording, and disclose AI assistance where that rule requires it. Don't let a detector score decide whether disclosure applies.
3. Verify against sources: Check every fact, number, name and quotation after any rewrite, because rephrasing can subtly change a date, swap a name or soften a claim. The reviewer, not the tool, owns accuracy.
4. Document each transformation: Record the tool, mode and date for every cleanup or rewrite, plus who reviewed the output. That log turns a later dispute into a checkable timeline.
5. Choose the route by sensitivity: Prefer local steps that need no rewrite for confidential material. If a rewrite is justified, know exactly where the text goes before pasting it anywhere.

Processing routes, limits and costs

Simple Unmark currently supports text only, combining deterministic Unicode cleanup with model-assisted rewriting. It doesn't offer media upload, image, video or audio cleaning, visible-watermark removal or a working AI detector, and its rewrites don't promise an undetectable result, plagiarism removal or a detector verdict.

Guests get 3 cleans of up to 100 words each. Accounts get 10 starter credits and up to 5,000 words per clean, and credits never expire, and there's no subscription. Deterministic character inspection is free and runs only in the browser, so the sensitivity-first choice costs nothing to try.

The paid routes differ in where the text travels. Private costs 0.1 credit per started 100 words, rounds partial blocks up, and sends text through the app, the ordinary HTTPS and load-balancer path, the Python workload and DeepInfra, which reads submitted text to perform the rewrite. Confidential costs 0.2 credit per started 100 words: the browser verifies the cleaning service before encrypting text to it, so the Simple Unmark app never receives the text, while DeepInfra still performs the rewrite inside that protected workload. Confidential AI, planned at 0.4 credit per started 100 words, is coming soon and isn't yet available. It's designed to keep both cleaning and the rewrite inside a protected environment without sending text to an external AI provider, and selecting it registers interest only without submitting text or spending credits. Text and output aren't stored in the Simple Unmark database or analytics.

That route choice is a disclosure decision in itself. A team handling a client's unpublished manuscript shouldn't send it through an external rewrite provider if local Unicode cleanup solves the actual problem. A team cleaning its own marketing draft may accept that route after review. The policy should name who decides, for which document types, before anyone pastes.

Firm rule: For decisions about people, grades, contracts or publication, require human review and provenance evidence before acting on any detector result.

---

For AI generated text that needs inspection before any rewrite, Simple Unmark offers free local tools for invisible characters, line breaks and plain-text conversion, plus a meaning-preserving rewrite when wording itself must change. Start with the local inspector, keep the original and the review log, and let a person make the final call.