Detecting DeepSeek and Other Open-Weight Models

Case one: a student opens a hosted chat assistant built on open weights, types an essay prompt, copies the answer without touching a word, and submits it. Modern detectors usually flag that. Case two: someone downloads the same family of weights, fine-tunes on a few hundred of their own emails, raises the sampling temperature, and generates the same essay on a laptop. Detectors usually miss it, and often miss it confidently.

DeepSeek AI detection, and detection of open-weight models generally, is not harder because the models write better. It is harder because open weights let the user change the output distribution after release, and every statistical detector on the market is trained to recognize distributions it has seen. Move the distribution and the detector loses its footing.

What "open-weight" actually changes

A hosted model is a service. You send text to a provider, the provider runs generation under settings it controls, and the output you get back reflects those settings. The provider can watermark, log, rate-limit and attach provenance metadata, because the provider owns the machine doing the work.

Open-weight models invert every part of that. The parameters are published and downloadable, so the generation happens on hardware the user controls. Four levers move as a result, and all four matter for detection: the sampling configuration, the system prompt, any fine-tuning applied on top of the base weights, and any post-processing in the pipeline. None of them are visible to anyone downstream.

The detection consequence is specific rather than vague. Detectors read statistical properties of text, chiefly how predictable each token is given what came before, plus how that predictability varies across a passage. Our explainer on perplexity and burstiness covers the mechanics. Every one of those four levers changes those exact properties. A higher temperature flattens predictability. Fine-tuning on a person's own corpus pulls the output toward that person's phrasing. A system prompt demanding short, uneven sentences produces short, uneven sentences.

Why DeepSeek AI detection is structurally harder

Here is the part that gets glossed over in vendor marketing. A detector is a classifier, and a classifier is only as general as its training data. Most commercial detectors were built primarily on text from a handful of widely used hosted models, because that is where the volume was and where labeled data was easy to generate at scale.

That produces a mismatch with three layers. The first is model coverage: a detector may simply have seen little text from a given open-weight family. That layer is fixable, and vendors do fix it by adding data.

The second layer is not fixable the same way. There is no single output distribution for an open-weight model, because "the model" is a starting point rather than a product. A base checkpoint, three community fine-tunes of it, and someone's private adaptation trained on their own writing are four different generators wearing the same name. A detector can be trained on the first and still be looking at an unfamiliar distribution when it meets the fourth.

The third layer is adversarial and applies to everything. The RAID benchmark from Dugan and colleagues at ACL 2024, covering more than ten million documents and twelve adversarial attacks, found that commercial detectors degrade sharply under paraphrase and homoglyph attacks. Someone running weights locally can apply those attacks inside their own pipeline, without a round trip to any service that might log it.

What the numbers do when detection degrades

Abstract talk about degradation hides how quickly the arithmetic turns ugly. Use real figures rather than hypotheticals: when OpenAI retired its own AI text classifier in July 2023 for low accuracy, it disclosed that the tool caught 26% of AI-written text while falsely flagging 9% of human text.

Apply those two numbers to a batch of 1,000 submissions in which 100 were actually machine-written. The classifier catches 26 of the 100. It also wrongly flags about 81 of the 900 human submissions. Of roughly 107 flagged documents, fewer than one in four is a true positive, and 74 machine-written submissions pass through untouched.

That is what a detector looks like when its recall collapses against text it was not built for. Today's better tools are far above that floor on hosted-model output. The point of the example is directional: as recall drops on unfamiliar distributions while the false-positive rate stays roughly constant, the flagged pile fills with innocent people faster than it fills with the thing you were looking for. Screening a population where open-weight and fine-tuned generation is common moves you toward that regime, not away from it.

Why watermarking cannot rescue this

Watermarking is the most commonly proposed fix and the least applicable one here, for a reason that is architectural rather than technical.

A statistical watermark is embedded during generation by biasing token selection in a pattern a verifier can later recognize. That requires control of the generation step. Google's SynthID watermarks images produced by Gemini models, and as of mid-2026 there is no public third-party API to verify SynthID; verification runs through Google's own tools. Note what both halves of that sentence assume: a provider operating the model, and a provider operating the verifier.

Neither assumption survives open weights. Anyone running downloaded parameters on their own hardware controls the sampling loop, so no watermark is applied unless they choose to apply one, and nothing stops them from removing code that would.

Provenance metadata has the same shape of limitation with a different failure mode. C2PA Content Credentials, embedded by OpenAI since February 2024 and supported by Adobe Firefly, Microsoft's imaging tools and Google's 2026 Nano Banana models, travel with a file rather than inside the content. That is genuinely useful when present, and platforms routinely strip metadata on upload, so absence proves nothing at all.

Regulation runs into the same wall. The EU AI Act's Article 50 transparency obligations become applicable on August 2, 2026, requiring machine-readable marking of AI-generated content, disclosure of deepfakes, and notice when people are interacting with an AI system. Those duties attach to providers and deployers, which is the right design for a service and an awkward one for a file someone runs on a laptop in a jurisdiction the rule does not reach.

What still works

Detection did not become useless. It became one input among several, with a narrower claim attached. Here is how the available signals hold up.

The bottom two rows are the ones worth internalizing, because they are the only ones that do not care which model produced the text. Process evidence, meaning drafts, timestamps and revision trails, answers the question detection is trying to approximate. And a 2025 ACL study by Russell, Karpinska and Iyyer found that expert annotators who frequently use ChatGPT identified AI-generated text with 99.3% accuracy, holding up against evasion tactics that defeat automated tools. Experienced human readers who know an author's previous work remain the strongest single detector available, which is an uncomfortable finding for our industry and a true one.

A scenario makes the ordering concrete. An editor at a trade publication receives a 2,400-word feature from a freelancer she has commissioned twice before. The scan comes back low, around 12%, high confidence. Two paragraphs still read wrong to her, because the reporting is thinner than his previous pieces and one attributed quote is phrased in a way no source talks. Under the old habit, the low score closes the question. Under a multi-signal habit, it does not: she asks for interview recordings and the working draft, which either exist or do not. That request costs one email and settles what no classifier could, whichever way it lands.

Publications that want to make that request routine can put it in the commissioning terms up front:

Contributors may use AI tools for research and editing. All reporting, quotes and factual claims must be independently verified by you, and we may ask for interview recordings, notes or draft history for any submission before publication.

Multi-signal scoring is the practical response. AI Detector 360 runs several engines rather than a single classifier, reports an explicit confidence level instead of a bare percentage, and returns a sentence-level heatmap so you can see which passages drive a score rather than arguing about an average. Our ChatGPT detector and the no-signup free scanner both surface those confidence labels, and the methodology page sets out how they are calibrated and where we expect them to fail. A vendor that will not publish the second half of that sentence is worth avoiding.

What nobody can verify yet

We would rather mark the gaps than fill them with plausible numbers.

Nobody publishes reliable per-model accuracy figures for detectors against specific open-weight families, and the ones vendors do publish are self-reported on datasets they chose. That includes us, which is why AI Detector 360 publishes its calibration approach and confidence bands rather than a single headline accuracy number that would flatter the tool and mislead the reader. There is no public benchmark tracking how detection performs against user fine-tunes, which is the case that actually matters, because the space of possible fine-tunes is unbounded. Nobody knows what share of AI-assisted writing now comes from locally run models rather than hosted services, and there is no measurement path that would produce that number honestly.

What follows for policy is a preference for rules about conduct over rules about tools. A policy that bans a named product needs rewriting every few months and was never enforceable anyway. A policy that describes what assistance is permitted, what must be disclosed, and what process evidence a person should be able to produce keeps working when the model list changes. Our guides to whether tools can identify which model wrote a text and to detecting GPT-5-class writing take the same position from different angles.

One closing note, offered without much comfort. The trend line runs against pure statistical detection, because capability keeps spreading outward to hardware nobody supervises. That does not make scanning worthless; it makes an unexamined score dangerous. Evidence, not proof, and never the only thing in the file.