Do AI humanizers work? Detector claims, studies and what changes

What the evidence says in short

Whether a humanizer works depends on three things the sources keep coming back to: which detector reads the text, how the text was rewritten, and when the test was run. Turnitin says its AI writing detection includes AI bypasser detection, and GPTZero says it can flag text rewritten to hide where it came from. Both are statements by companies that sell detectors. The Turnitin pages we read do not give an accuracy figure for the feature, and the benchmark GPTZero publishes is its own.

The studies point in different directions because they tested different detectors in different years. Two papers first posted in March 2023 found that paraphrasing lowered the detection rates of the detectors they tried. A paper from June 2025 found that simple paraphrasing raised detection on two detectors, while paraphrasing guided by a detector lowered it sharply. A preprint dated 30 October 2026 found that a general-purpose decision model separated humanized rewrites from human originals better than three other detectors did, and also called 24% of the human originals AI. The same preprint found that commercial rewrites often changed numbers, names or quotations. The sections below take these in turn, and our page on AI detectors covers how the detectors themselves work.

What humanizers promise and what the detectors say

Turnitin defines AI bypassers as AI tools that rewrite AI-generated text with the intention of evading detection, and says they are also known as humanizers. Its blog says many humanizers were first built to improve the readability and flow of AI-generated text, and that some began marketing themselves to students, freelancers and content writers for their ability to beat detection as institutions restricted generative AI. Turnitin describes an arms race of four kinds of tool: those that generate text, those that paraphrase it, those that detect it and those that disguise it.

Turnitin’s own record shows the feature arriving in steps. Its guide to the AI writing detection model says that on 6 December 2023 it began detecting likely AI-generated text even if it had been paraphrased with an “AI word spinner”, and that from 16 July 2024 the report separated AI-generated text from AI-generated text that was AI-paraphrased. Its release notes say that on 27 August 2025 the detection was extended to the likely use of leading AI bypasser tools (the release note says “leading”, so coverage is of selected tools, not all), and that on 4 August 2026 the two categories were combined into a single AI-generated category, while the model continues to detect likely AI-generated content that may have been further modified by paraphrasers or bypassers. The press release of 27 August 2025 says the bypasser feature was trained and tested for English only, and is available with the Originality add-on and with the AI capabilities add-on for iThenticate 2.0 customers.

Turnitin also states limits. Its July 2024 note says scores from 1% to 19% are no longer shown, and an asterisk appears instead, because false positives are possible. Its December 2023 note says a submission under 300 words may get a less accurate score, and that a score should not be the sole basis for adverse action against a student. It updated its AI writing detection model on 12 February 2026, and its English AI writing model again on 14 October 2026, and says reports already generated do not change unless the file is submitted again. The Turnitin pages we read do not give an accuracy figure for the bypasser feature.

GPTZero’s support page says it can detect AI-written text that was rewritten to disguise that origin, whether the text went through a bypasser or humanizer or was reworded by a person. In that case the result says the model is highly confident the text was originally AI but rewritten by AI or a human, and the result card still marks the feature as beta. The page gives a false-positive rate below 0.1% for AI-paraphrased text from certain popular AI tools, says coverage of bypasser tools is still improving, and adds that “Detection is not infallible”, pointing to a record of how a document was written.

A GPTZero post dated 26 January 2026 describes humanizers as designed to reduce the statistical patterns common in AI text and to alter syntax and vocabulary, and says detectors that rely on “surface-level features” can lose a lot of performance. It reports a benchmark of 1000 paraphrased examples made with more than 12 tools. On it, GPTZero’s AI recall was 93.5%, against 57.3% and 50.2% for two competing detectors, and the post says competing detectors often classify paraphrased text as human-written. These are the company’s measurements on its own test set, for a model version it names. The pages we read do not mention a replication by an independent group.

What the studies found when text was paraphrased

Four papers on arXiv test paraphrasing against detectors, and their dates matter. Krishna and colleagues first posted theirs on 23 March 2023 and last revised it on 18 October 2023. They built a paraphrasing model with 11 billion parameters and used it on text from three large language models. They report that it evaded several detectors, including watermarking, GPTZero, DetectGPT and OpenAI’s text classifier, and that DetectGPT’s detection accuracy fell from 70.3% to 4.6% at a constant false-positive rate of 1%, without appreciably changing the meaning. They also describe a defense that searches a database of earlier generations kept by the model provider, which found 80% to 97% of paraphrased generations in their tests and depends on the provider keeping those generations.

Sadasivan and colleagues first posted in March 2023 and last revised on 17 January 2025. They tested recursive paraphrasing on passages of about 300 tokens, and write that it can significantly reduce detection rates while only slightly degrading text quality in many cases. They also give a theoretical framework that links the best possible detector’s AUROC to the distance between human and AI text distributions.

The paper by Cheng and colleagues, posted in June 2025 and revised on 29 October 2025, starts from a different picture. It says recent detectors have shown greater robustness against basic paraphrasing, and reports that simple paraphrasing raised the true-positive rate at a 1% false-positive rate by 8.57% on RADAR and by 15.03% on Fast-DetectGPT. Paraphrasing guided by a detector went the other way: it reduced that rate by 64.49% on RADAR and 98.96% on Fast-DetectGPT, and by 87.88% on average across a diverse set of detectors.

The DAMAGE paper, posted in January 2025, studied 19 humanizer and paraphrasing tools, assessed their effect on meaning qualitatively, and reports that many existing AI detectors fail to detect humanized text. Its authors also describe training a detector that handles humanized text with a low false-positive rate, and say it held up against an attack built against it. The abstract we read gives no percentages, so we give none.

These are test benches. The papers measure detection on sets of passages under stated settings, and the pages we read do not report how often a real student’s work is flagged after a humanizer. The GPTZero tested in the 2023 paper and the model version named in the January 2026 post are three years apart, so we do not set the two results side by side.

What happens to the text itself

A newer line of evidence asks a different question: when a humanizer rewrites a text, do the numbers, names and quotations survive? A preprint posted to arXiv on 30 October 2026, with three authors and still a first version, checked this. It compared each source text with its rewrite and looked at numbers, dates, person and organization names, and spans in quotation marks, using a rule-based checker validated by two AI annotators; the authors state that no human annotation was used. In the October 2026 cycle of a public leaderboard, all 11 commercial tools changed or dropped at least one of those units in 35% to 65% of the documents that contained one. The September cycle gave 19% to 50%.

Most of the changes were to quoted spans, and the preprint is careful about what that means. No tool kept more than 4 of the 15 quoted spans word for word. The authors say those spans were often sample phrasings, terms or rhetorical questions rather than reported speech, so rewording one changes text the source put in quotation marks without necessarily making the rewrite false. Counting numbers and names alone, 10 of the 11 tools still altered at least one in 20% or more of the documents. The authors also state what the check does not measure: it tracks the retention of specified units, not the accuracy of the whole text.

The preprint also asked whether tools that evade detectors better keep fewer of these units. It found the two not clearly related, with a Spearman correlation of −0.46 and a 95% confidence interval from −0.65 to 0.08. The evasion scores are the leaderboard’s own, taken from the human-probability scores of seven commercial detectors on each output.

Why a score is not proof

On detection, the same preprint tested a general-purpose decision model as a zero-shot detector on rewrites of U.S. federal agency prose. It separated human originals from humanized rewrites with an AUROC of 0.864, which is 0.18 to 0.22 higher than three other detectors, but it called 24% of the human originals AI at a threshold of 0.5. On rewrites styled as AI prose by 2026 models, the two perplexity-based detectors scored below chance, with an AUROC of 0.37 and 0.39. The authors list their limits: one genre, one open humanizer, one decision model, and no commercial detector tested directly on these rewrites, whose scores come from the leaderboard.

UCLA’s humanities technology group calls AI detectors “deeply flawed” and says UCLA declined to adopt Turnitin’s AI detection software, citing “concerns and unanswered questions” about accuracy and false positives. It reports that OpenAI shut its own detector after it correctly identified 26% of AI-written text and falsely flagged 9% of human writing, and it reports a study in which accuracy on ChatGPT text fell from 74% to 42% after minor tweaks. Those figures are UCLA’s account, and we did not check them at their original sources.

Turnitin and UCLA say a score should not be the sole basis for action, Turnitin for adverse action against a student and UCLA for an academic integrity concern, and GPTZero says that detection is not infallible and points to a record of how a document was written. Our pages on false accusations, how accurate detectors are and what a score means go further into that.

What the sources suggest doing with this

Turnitin’s blog suggests that educators use flagged reports as conversation starters, ask students to explain how they composed their work or to share drafts, and make clear that AI tools are not banned but that how they are used matters. It says the report is meant to support meaningful conversations, not to “catch” students.

UCLA names a direct conversation with the student as the most effective first step, focused on process and thinking rather than on an accusation based on detection output. It also lists alternatives to detection: assignments that require students to show their process through drafts, outlines, annotations and revision notes, and in-class writing or oral components.

The pages we read do not offer guidance on getting past a check, and we give none. Whether using a humanizer is allowed is a rule set by a course or an institution; our page on where the line is reads what a university and a major publisher wrote down, and our page on paraphrasing tools covers the older tool class.

The pages we read do not say how often a real student is flagged after using a humanizer, or whether a humanized text stays detectable months later, a question made harder by Turnitin’s model updates of 2026. We tested no humanizer and no detector.