Almost everything written about how to spot AI prose is folklore. We built the instrument, ran two corpora of real human writing against a 2022 model and seven 2026 models, and found that the famous tells are mostly noise — while the signal moved somewhere nobody is looking.
There is a canonical list — em dashes, “delve”, the rule of three, “it’s not just X, it’s Y” — and it is repeated everywhere with total confidence and almost no numbers behind it.
That matters commercially, because a humanizing engine built on the folk list optimises against the wrong thing. It strips em dashes from text whose actual problem is that its sentences are all the same length, and it leaves the real signal untouched. Every shipping humanizer we could find works this way: a general-purpose model told to “rewrite this so it sounds human”, with no measurement before or after.
So we measured. Two things had to be true for a claim to survive: it had to be checkable against a rendered corpus, and the corpus had to contain human writing that predates the contamination. Everything below traces to a number the instrument produced. Where the instrument found nothing, we say so — including for the tells we expected to confirm.
Human arm: 1,154 answers from the Human ChatGPT Comparison Corpus (Reddit ELI5, finance, medicine, Wikipedia CS — all written before 2023) plus 894 real work emails from the Enron/AESLC corpus, written around 2000 and therefore incapable of contamination. Machine arm: the paired ChatGPT-3.5 answers from 2022, plus fresh generations from seven 2026 frontier models answering the same questions at matched length, and writing work emails from the same subject lines. 75 surface features per document, all rates or dimensionless ratios so documents of different lengths compare. Separation reported as AUROC — 0.5 is a coin flip; below 0.5 means the feature is higher in humans.
The 2026 models were told to write prose without headings or bullets, which deliberately removes formatting from the comparison and isolates sentence-level style. Formatting is a real and strong tell; it is simply not what this measurement is about. The human arms are Q&A and work email, so the numbers are register-specific and should not be read as universal constants. The 2026 sample is smaller than the 2022 one and its confidence intervals are correspondingly wider.
Not because they are imaginary. Because they are rare. A construction that appears once every ten thousand words cannot separate two corpora however damning it looks when you meet it.
This is the single most useful distinction in the whole subject, and the folk discourse collapses it entirely. There are two different failure modes wearing one name:
An engine has to fix both, and the two jobs need opposite instruments: a span-level rule catches the rare construction, a distributional target fixes the common one. Fixing only the famous ones produces text that still trips every classifier. Fixing only the distribution produces text that still makes a human wince at the second paragraph.
The most-cited property of machine prose — that it is repetitive and lexically thin — was true of ChatGPT-3.5 and is now false in the opposite direction. The 2026 models overshot.
Read the direction, not just the size. Against the same 1,154 human documents, lexical diversity moved from a strong machine-is-lower signal in 2022 to a stronger machine-is-higher signal in 2026. Trigram self-repetition, the single best feature in the 2022 comparison, has crossed over: today’s models repeat themselves less than people do.
This is what post-training optimisation looks like from the outside. Each generation is tuned away from the criticism of the last, and the tuning overshoots, so the tell does not vanish — it flips sign. Anything built on a fixed 2024 wordlist or a fixed “AI has low perplexity” assumption is now wrong in a way that is worse than being merely out of date: it will push text in exactly the direction that makes it more machine-like.
The engine cannot ship a static rulebook. It ships an instrument, and the instrument is re-fit against fresh generations on a schedule. A humanizer is a measurement product with a rewriting front end, not a rewriting product.
Between a 2022 model and seven 2026 ones, most individual features moved a lot. These four held their direction, and they are what the engine targets.
Bars diverge from a coin flip at the centre. Reaching right means the feature is elevated in machine text; reaching left means it is elevated in human text. Length is the strength of the separation.
| Feature | Human | GPT-3.5 2022 | AUROC | Frontier 2026 | AUROC | Signal 2022 / 2026 |
|---|
AUROC is the probability that a randomly chosen machine document scores higher on that feature than a randomly chosen human one. 0.50 is no information. Values are means. Rates are per 1,000 words unless the label says otherwise.
Answering identical questions at matched length, the seven 2026 models disagree with each other about punctuation and rhythm by more than some of them disagree with people.
| Model | n | em dashes /1k | MTLD | sentence length CV | commas /sentence | marker words /1k | tricolon /1k | short sentences |
|---|
The human reference row is the same 1,154 documents throughout. Note the em dash column in particular: this is the most confidently repeated tell in circulation, and across our models it ranges from a rate below the human mean to many times it. Whether an em dash implicates you depends entirely on which model wrote the text — which means it is a per-vendor post-training artefact, not a property of machine writing.
The practical reading: a detector tuned on one model family carries much less information about another, and a humanizer tuned on one family’s output is optimising against a moving, vendor-specific target. Both of these are well documented in the literature; our measurement is that the spread is already wide enough to matter at the level of a single punctuation mark.
Asked to write a work email from a real subject line, the models fail in the opposite direction to the one everybody expects. They are not too stiff. They are too casual, and not specific enough.
Real work email — 894 messages from the Enron corpus, written by people with no idea anyone would ever read them — is dense with proper nouns at almost three times the machine rate: names of colleagues, deals, systems, cities, attachments. That is the strongest human-side signal in the register, and it is structural. The specifics are simply not in the model’s context, so it writes around them.
Everything else runs the other way. Machine email is more lexically varied than real email, more heavily contracted, and carries em dashes at a rate real employees never touch — the human arm’s mean is zero. This is a model reaching for informality it has been tuned to associate with email, and overshooting every marker of it at once. Nobody writing to a colleague on a Tuesday afternoon is working this hard.
On the composite score the separation is close to total: median 0.1 for real email against 27.0 for machine email, on documents the scorer never saw. This is also the clearest argument for voice profiles over a generic “human” target. The distribution for an ELI5 answer and the distribution for a Tuesday email are different targets, and a humanizer with one setting is wrong for both — most obviously here, where the correct edit is to make the text less casual and more concrete, the reverse of what every humanizer on the market does.
Seventy features, a logistic regression, and a set of coefficients that fit in a JSON file. It runs at the edge for the cost of a string parse.
This is a deliberate architectural bet. Every competitor’s detector-side and humanizer-side products call a neural model, which sets a floor under their marginal cost and a ceiling over their latency. Ours is arithmetic on counts. It is not as accurate as a fine-tuned transformer classifier and it never will be — but it is accurate enough to steer a rewrite, which is the only thing we need it for, and it is fully interpretable, which is the thing customers actually want and nobody sells.
The interpretability is the product. A competitor returns “87% AI”. Ours returns the sentence, the construction, the reason, and the number the sentence has to hit instead. That output is a defensible artefact — something a writer can act on, an editor can review, and an institution can put in a file — where a bare percentage is not.
Naive paraphrase is documented to make text more detectable, not less. The loop below never asks a model to “sound human”; it hands the model arithmetic.
This operation has already published 84 audit pages containing false claims, and drafted cold emails where 7 of 10 said something untrue about a real business’s website. Both were caught by a verification gate, not by care. Independent testing of commercial humanizers finds introduced typos and fabricated citations in their output; on the fluency measure, even the best tier of tools loses a head-to-head against the unmodified machine text about three times in four. A humanizer without a fidelity gate is a machine for confidently saying false things in someone else’s voice. We already know exactly what that costs.
A cold email of the kind this operation actually sends, before and after a single round. Score is the instrument’s composite, 0 = indistinguishable from the human reference corpus, 100 = maximally machine.
The fidelity gate passed both candidates in this round: no invented numbers, no invented entities, no dropped figures, content overlap 0.67. The five-minute claim, the og:image tag and the grey-box consequence all survive intact — they are the facts, and the gate exists to keep them.
Machine-written work emails drawn at random from the generated corpus, each put through two rounds against the Enron-derived voice profile.
This is a score reduction measured by our own instrument, on eight documents. It is evidence the loop closes and the gate holds — it is not evidence the output beats GPTZero, Pangram or Originality, because we have not yet run it against them. Optimising against your own scorer and then reporting your own scorer is the oldest self-deception in this field, and every competitor's marketing does exactly that. The next build step is a third-party evaluation harness, and no efficacy claim leaves this building before it exists.
The category leader is a $10-a-month rewriter with declining traffic. The money in this space has gone to the other side of the fight — GPTZero was acquired at $30M ARR. That asymmetry is the opportunity.
Set before the first customer, not after the first complaint.