Do AI Detectors Catch Paraphrased or "Humanized" Text?

Ask an AI to write your essay, then ask another AI to rewrite that essay so no one can tell. That's the entire premise of the "humanizer" industry, and whether it works is probably the most consequential open question in AI detection. The research gives a clear, uncomfortable answer — with some important fine print.

Sometimes, and far less reliably than on raw AI output. Paraphrasing measurably degrades AI detection accuracy: in one NeurIPS 2023 study, a paraphrase model dropped a leading detector's accuracy from 70.3% to 4.6%. Detectors have adapted since, but heavily paraphrased AI text still evades statistical detection often enough that no negative result should be treated as clearance.

Why paraphrasing hits detectors where they live

Everything a statistical detector measures sits on the text's surface. Perplexity tracks word-level predictability. Burstiness tracks sentence rhythm. Classifier features encode phrase habits and token patterns. Watermarks bias specific token choices. (The full tour of those mechanisms is in how AI detectors work.)

A paraphraser's whole job is replacing surfaces while preserving meaning. Swap the vocabulary and perplexity rises. Restructure the sentences and the rhythm changes. Substitute tokens and the watermark pattern shatters. The paraphraser doesn't need to know anything about the detector; it destroys the evidence incidentally, the way repainting a stolen car defeats a description of its color.

That asymmetry is why researchers took paraphrasing seriously as an attack long before "humanizer" became a product category.

Do AI detectors detect paraphrasing? The research record

Three studies frame the honest answer.

Krishna et al. (NeurIPS 2023) built DIPPER, an 11-billion-parameter paraphrase model, and ran it against major detection approaches. The headline: DIPPER dropped DetectGPT's detection accuracy from 70.3% to 4.6% at a fixed 1% false positive rate, and successfully evaded watermarking, GPTZero and OpenAI's classifier as well.

Sadasivan et al. (University of Maryland, 2023) went further with recursive paraphrasing — rewriting the rewrite — and reported breaking every detector family they tested, including watermark-based schemes. They also proved a sobering theoretical bound: as AI text distributions approach human ones, even the best possible detector loses its edge.

The RAID benchmark (Dugan et al., ACL 2024) made it systematic: across 10 million-plus documents and 12 adversarial attack types, commercial detectors that looked strong on clean text degraded sharply under paraphrase and homoglyph attacks. Notably, RAID also found detectors varied a lot in how much they degraded — some held up meaningfully better than others.

The homoglyph result deserves a sidebar, because it's the cheapest attack in the set: swap ordinary letters for identical-looking Unicode characters and a naive detector's tokenization falls apart without a single word changing. It's also the most fixable — input normalization neutralizes it, and mature tools now do exactly that. Paraphrasing is the opposite case: not a parsing trick but a genuine rewrite of the evidence itself, which is why it remains the attack that matters.

So the answer to the keyword question is: partially. Detectors catch some paraphrased AI text, miss a lot of it, and the miss rate depends heavily on which detector, which paraphraser and how many passes.

The humanizer arms race

Since those papers, an entire market has formed around the attack. General-purpose paraphrasers like QuillBot exist for legitimate rewriting; alongside them, dozens of tools now market themselves explicitly as "AI humanizers" whose only value proposition is beating detectors.

The detection side hasn't stood still. Vendors retrain on humanizer output, add features that survive rewording (discourse structure, semantic patterns), and ensemble multiple engines so one scrubbed signal doesn't clear the whole document. Each humanizer update then probes for the new gaps. Neither side wins permanently; the equilibrium just shifts every few months.

Two practical consequences follow. First, any specific claim of the form "detector X catches humanizer Y" has a short shelf life, which is why we won't make one here. Second, the deeper question of whether AI text can be made reliably undetectable deserves its own analysis; we've written that up in can AI text really be made undetectable, and the short version is: evasion is easier than most institutions think and less certain than most humanizer ads claim. For raw, unparaphrased output the picture is very different — see is ChatGPT detectable.

Regulation has raised the stakes on this race. Under the EU AI Act's Article 50, applicable since August 2, 2026, AI-generated content must carry machine-readable marking. Paraphrasing is precisely the operation that dissolves text watermarks — Sadasivan's recursive attacks broke watermark schemes years before the mandate landed — so deliberate humanizing now doesn't just dodge a scanner; in covered contexts it strips a legally required disclosure. Expect that legal angle, not detector quality, to become the sharpest deterrent.

What paraphrased AI text still can't hide

Statistical surface signals die in paraphrase. Several other kinds of evidence don't:

• Retrieval. The same Krishna et al. paper that broke detectors with DIPPER also showed the strongest defense: if a provider stores what its model generated, matching a suspect text against those records survives paraphrasing well. Only the AI companies themselves can run this — but it's a reminder that "undetectable to a public scanner" isn't "untraceable."
• Expert human readers. In a 2025 ACL study (Russell, Karpinska and Iyyer), annotators who frequently use ChatGPT reached 99.3% accuracy identifying AI text, including against evasion tactics that beat automated detectors. Machine rhythm can be scrubbed; machine substance — hedged claims, generic examples, sourceless confidence — is harder to launder.
• Process evidence. Version history, drafts and research trails exist for real writing and don't exist for laundered output. No paraphraser can fabricate a Tuesday-night editing session.
• Quality itself. Recursive paraphrasing degrades precision and factual reliability. Text that's been through two rewriting models often reads worse: hedges pile up, terminology drifts, numbers get mangled. An editor who knows the subject usually notices something is off before any scanner does — they just couldn't have told you it was AI, only that it was bad.

Where that leaves teachers, editors and platforms

If you screen writing for a living, three rules keep you on the right side of the evidence:

1. Never treat a clean score as proof of human authorship. Paraphrase evasion is exactly the case where detectors under-flag. A low score on suspicious work means "no statistical evidence," not "verified human."
2. Weigh flags by confidence, and use tools that show their reasoning. A ChatGPT detector report from AI Detector 360 includes the engine breakdown and sentence heatmap, so you can see whether a borderline score comes from one weak signal or several agreeing ones — and our methodology documents how paraphrased text affects those signals.
3. Anchor decisions in process, not percentages. Ask for drafts. Compare against the writer's known voice. Check claims and sources. The independent accuracy record — collected in how accurate AI detectors are — supports detection as one input among several, never the whole case.

The paraphrase problem is the strongest argument against blind faith in any detector, AI Detector 360 included. It's also a solvable workflow problem for anyone willing to treat scores as evidence rather than verdicts.