# C — Open-Source & GitHub: AI Text Detection & Evasion

**Research value: high** — Deep open-source ecosystem on both sides (detectors and humanizers). Public code + public benchmarks + public attacks means every claim in this space is independently reproducible, and the "arms race" between detectors and evaders is already fully visible in the commit graph.

**Scope:** Open-source repositories on GitHub (and a handful of model-hub companions) that ship runnable code for (a) detecting AI-generated text, (b) watermarking LLM output, (c) benchmarking detectors, and (d) humanizing / paraphrasing / adversarially modifying AI text to evade detection. Research-oriented repos are prioritized over commercial SaaS clones.

**Method:** Phased web search → targeted queries → README fetches for the repos that carry the most weight in the category. Quotes below are verbatim from each project's README unless noted. Star counts and dates reflect the snapshots returned during research in April 2026.

---

## 1. Detector implementations

### 1.1 `baoguangsheng/fast-detect-gpt` — Fast-DetectGPT
- **Link:** https://github.com/baoguangsheng/fast-detect-gpt
- **License / stars:** MIT, ~388★
- **Paper:** ICLR 2024, Bao et al.
- **What it is:** Zero-shot detector based on *conditional probability curvature* — a 340× speedup over the original DetectGPT without losing accuracy.
- **README quote:**
  > "Fast-DetectGPT: Efficient Zero-Shot Detection of Machine-Generated Text via Conditional Probability Curvature … Fast-DetectGPT 0.9887 (relative ↑ 74.7%) … 340x [speedup]."
  >
  > "1/31/2026: We find that Fast-DetectGPT with Llama3-8B/Llama3-8B-Instruct as the sampling/scoring models substantially outperforms falcon-7b/falcon-7b-instruct, especially on LRM-generated texts."
- **Notes for a humanizer project:** This is the strongest open-source *white-box-ish* detector you will be evaluated against. Anything a humanizer produces needs to be tested here with the Llama3-8B scoring model, not just the old GPT-Neo / Falcon defaults.

### 1.2 `BurhanUlTayyab/DetectGPT` — Canonical DetectGPT port
- **Link:** https://github.com/BurhanUlTayyab/DetectGPT
- **License / stars:** MIT, ~226★
- **README quote:**
  > "DetectGPT is an amazing method to determine whether a piece of text is written by large language models (like ChatGPT, GPT3, GPT2, BLOOM etc). However, we couldn't find any open-source implementation of it. Therefore this is the implementation of the paper."
- **Notes:** Useful as a reference baseline — pure PyTorch, no API dependencies. Older (2024) and slower than Fast-DetectGPT.

### 1.3 `Mamba413/AdaDetectGPT` — AdaDetectGPT
- **Link:** https://github.com/Mamba413/AdaDetectGPT
- **License / stars:** open-source, ~71★ (NeurIPS 2025)
- **What it is:** Adaptive extension of Fast-DetectGPT built on a learned witness function. Provides finite-sample statistical guarantees on FPR, TPR, FNR, TNR — the first zero-shot detector with provable false-positive control. Outperforms Fast-DetectGPT by 12.5–37% AUC across datasets. NeurIPS 2025 poster. A humanizer that benchmarks only against Fast-DetectGPT is now under-tested.

### 1.4 `ahans30/Binoculars` — Binoculars
- **Link:** https://github.com/ahans30/Binoculars
- **Paper:** ICML 2024, Hans et al.
- **What it is:** Zero-shot detector using the ratio of perplexity between a paired "observer" and "performer" model (Falcon-7B + Falcon-7B-Instruct by default).
- **README quote:**
  > "We introduce Binoculars, a state-of-the-art method for detecting AI-generated text. Binoculars is a zero-shot and domain-agnostic (requires no training data) method. It is based on a simple idea: most decoder-only, causal language models have a huge overlap in pretraining datasets, for e.g. Common Crawl, Pile, etc."
  >
  > "Please note, this implementation comes with a fixed global threshold that is used to classify the input as AI-generated or not. This threshold is selected using _Falcon-7B_ and _Falcon-7B-Instruct_ models for scoring."
- **Notes:** Minimal Python package (`pip install -e .`, then `Binoculars().predict(text)`). The fixed threshold + fixed model pair makes it trivially reproducible — and therefore the de facto go-to detector for adversarial evaluation (see StealthRL below).

### 1.5 `vivek3141/ghostbuster` — Ghostbuster
- **Link:** https://github.com/vivek3141/ghostbuster (data: `vivek3141/ghostbuster-data`)
- **Paper:** NAACL 2024, Verma/Fleisig/Tomlin/Klein (UC Berkeley)
- **README quote:**
  > "We introduce Ghostbuster, a state-of-the-art system for detecting AI-generated text. Our method works by passing documents through a series of weaker language models, running a structured search over possible combinations of their features, and then training a classifier on the selected features to predict whether documents are AI-generated."
  >
  > "Ghostbuster does not require access to token probabilities from the target model, making it useful for detecting text generated by black-box models or unknown model versions."
  >
  > "No AI-generated text detector is 100% accurate; we strongly discourage incorporation of Ghostbuster into any systems that automatically penalize students or other writers for alleged usage of text generation without human intervention."
- **Notes:** Unusual in that the disclaimer explicitly lists *"For AI-generated text that has been edited or paraphrased by a human"* as a known failure case — i.e. the repo itself documents that humanizers beat it.

### 1.6 `HendrikStrobelt/detecting-fake-text` — GLTR
- **Link:** https://github.com/HendrikStrobelt/detecting-fake-text (https://gltr.io/)
- **Paper:** ACL 2019 demo (Strobelt, Gehrmann, Rush — MIT-IBM / HarvardNLP)
- **README quote:**
  > "GLTR: Giant Language Model Test Room. Detecting text that was generated from large language models (e.g. GPT-2)."
- **Notes:** Historically important (first widely used "color the tokens by rank" detector). Predates ChatGPT-era models and now mostly useful as a visualization baseline, not a production detector. Still ~497★ from sustained educational use.

---

## 2. Watermarking implementations

### 2.1 `jwkirchenbauer/lm-watermarking` — KGW watermark
- **Link:** https://github.com/jwkirchenbauer/lm-watermarking
- **License / stars:** Apache 2.0, ~663★
- **Papers:** "A Watermark for Large Language Models" (ICML 2023) + "On the Reliability of Watermarks for Large Language Models" (ICLR 2024)
- **README quotes:**
  > "Official implementation of the watermarking and detection algorithms presented in the papers: 'A Watermark for Large language Models' by John Kirchenbauer*, Jonas Geiping*, Yuxin Wen, Jonathan Katz, Ian Miers, Tom Goldstein."
  >
  > "The core implementation is defined by the `WatermarkBase`, `WatermarkLogitsProcessor`, and `WatermarkDetector` classes in the files `watermark_processor.py`, for a minimal implementation and `extended_watermark_processor.py` for the more full featured implementation (recommended)."
  >
  > "**TL;DR**: As a baseline generation setting, we suggest default values of `gamma=0.25` and `delta=2.0`. Reduce delta if text quality is negatively impacted. For the context width, h, we recommend a moderate value, i.e. h=4, and as a default PRF we recommend `selfhash`."
- **Notes:** Reference green-list / red-list token watermark. Plugs in as a Hugging Face `LogitsProcessor`. Also ships `homoglyphs.py` / `normalizers.py` to harden detection against obvious text-level attacks — worth knowing about because it means a naïve homoglyph-based humanizer may be silently normalized before detection.

### 2.2 `google-deepmind/synthid-text` — SynthID-Text
- **Link:** https://github.com/google-deepmind/synthid-text
- **License / stars:** Apache 2.0, ~813★
- **Paper:** Dathathri et al., *Nature*, 2024.
- **README quotes:**
  > "This repository provides a reference implementation of the SynthID Text watermarking and detection capabilities for the research paper published in *Nature*. It is not intended for production use."
  >
  > "Detects the watermark. This can be done either with the simple Weighted Mean detector which requires no training, or with the more powerful Bayesian detector that requires training."
  >
  > "NOTE: The `synthid_text.hashing_function.accumulate_hash()` function, used while computing G values in this reference implementation, does not provide any guarantees of cryptographic security."
- **Notes:** Production version lives in Hugging Face Transformers (`huggingface.co/blog/synthid-text`). Deployed at Google scale on Gemini output — meaning any humanizer that targets only Kirchenbauer-style watermarks will be under-tested against the class of scheme most likely to be deployed on "real" AI text in the wild.

### 2.3 `THU-BPM/Robust_Watermark` — Semantic-invariant robust watermark (SIR)
- **Link:** https://github.com/THU-BPM/Robust_Watermark
- **What it is:** Research implementation of a paraphrase-robust watermark and a broader watermarking playground. Shows up repeatedly as the current baseline for "watermark that actually survives paraphrasing."

### 2.4 `XuandongZhao/WatermarkAttacker` — Regeneration attack on watermarks
- **Link:** https://github.com/XuandongZhao/WatermarkAttacker
- **Paper:** "Invisible Image Watermarks Are Provably Removable Using Generative AI" (NeurIPS 2024).
- **README quote:**
  > "We propose a family of **regeneration attacks** to remove invisible watermarks. The attack method effectively removes invisible watermarks. Our attack first maps the watermarked image to its embedding, which is another representation of the image. Then the embedding is noised to destruct the watermark. After that, a regeneration algorithm reconstructs the image from the noisy embedding."
- **Notes:** Primary target is *image* watermarks, not text, but the same structural attack (embed → noise → reconstruct) has been ported to text via encoder-paraphraser-decoder pipelines (DIPPER + back-translation — see below). Included because this is where the attack template originates.

### 2.5 `hzy312/Awesome-LLM-Watermark` — Curated watermark paper list
- **Link:** https://github.com/hzy312/Awesome-LLM-Watermark
- **What it is:** Actively maintained curated list covering watermarking, robustness attacks, and detection schemes; the watermark-specific equivalent of Awesome_papers_on_LLMs_detection. Best single entry point for the 2025-onward watermarking literature.

### 2.6 `Allencheng97/Self-information-Rewrite-Attack` — SIRA attack code
- **Link:** https://github.com/Allencheng97/Self-information-Rewrite-Attack
- **Paper:** Cheng et al., ICML 2025 — "Revealing Weaknesses in Text Watermarking Through Self-Information Rewrite Attacks" (arXiv 2505.05190).
- **What it is:** The SIRA attack: calculates self-information (entropy) of each token, masks high-entropy positions where watermark patterns embed, then fills them in with any LLM. ~100% attack success rate on 7 watermarking schemes at $0.88/million tokens. No access to the watermark algorithm or generating model required. The most damaging single open-source release for the watermarking research program since Jovanović's watermark-stealing attack.

---

## 3. Paraphrase / adversarial attacks on detectors

### 3.1 `martiansideofthemoon/ai-detection-paraphrases` — DIPPER
- **Link:** https://github.com/martiansideofthemoon/ai-detection-paraphrases
- **Model:** https://huggingface.co/kalpeshk2011/dipper-paraphraser-xxl
- **License:** Apache 2.0
- **Paper:** NeurIPS 2023, Krishna et al.
- **README quote:**
  > "This is the official repository for our NeurIPS 2023 paper, 'Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense'."
  >
  > "Since DIPPER is a 11B parameter model, please use a GPU with at least 40GB of memory to reproduce the experiments in the paper."
  >
  > "Our model uses `<sent>` ... `</sent>` tags instead of `<p>` ... `</p>` tags … The lexical and order diversity codes used by the actual model correspond to 'similarity' rather than 'diversity'. For a diversity of X, please use the control code value `100 - X`."
- **Notes:** The gold-standard *academic* paraphrase attack. 11B T5-XXL fine-tune, with two scalar knobs — lexical diversity and order diversity — that humanizers can expose directly. Also ships *detector-side* code (`detect_retrieval.py`) showing that the paper's own proposed defense is corpus retrieval, i.e. "did this paraphrase come from a document we've seen before?".

### 3.2 `google-research/google-research/tree/master/dipper` — Google Research DIPPER
- **Link:** https://github.com/google-research/google-research/tree/master/dipper
- **Notes:** T5X / Jax version of DIPPER. Useful if you want to retrain or distill into a smaller humanizer model.

### 3.3 `ACMCMC/silverspeak` — SilverSpeak (homoglyph attack)
- **Link:** https://github.com/ACMCMC/silverspeak
- **Paper:** "SilverSpeak: Evading AI-Generated Text Detectors using Homoglyphs" (GenAIDetect 2025).
- **README quote:**
  > "SilverSpeak offers significant advantages over existing homoglyph replacement libraries … Advanced Context Matching: SilverSpeak analyzes the surrounding text to select homoglyphs that match the local context in terms of Unicode properties (script, block, category, bidirectional, east_asian_width), ensuring visually coherent replacements."
  >
  > "SilverSpeak was specifically designed to enable text to evade AI-generated text detectors while maintaining human readability, a capability not found in any other homoglyph library."
- **Notes:** Python library, `pip install silverspeak`. Works against ArguGPT, Binoculars, DetectGPT, Fast-DetectGPT, Ghostbuster, and OpenAI's detector (paper reports MCC dropping from 0.64 to −0.01). Also ships **attack reversal** strategies — a humanizer that uses naïve homoglyph swaps can be automatically normalized by the same library.

### 3.4 `suraj-ranganath/StealthRL` — RL-trained paraphrase attack
- **Link:** https://github.com/suraj-ranganath/StealthRL
- **Paper:** Ranganath et al., arXiv:2602.08934 (2026).
- **README quote:**
  > "StealthRL, a reinforcement learning framework that stress-tests detector robustness under realistic adversarial conditions. StealthRL trains a paraphrase policy against a multi-detector ensemble using Group Relative Policy Optimization (GRPO) with LoRA adapters on Qwen3-4B, optimizing a composite reward that balances detector evasion with semantic preservation."
  >
  > "StealthRL achieves near-zero detection on three of the four detectors and a 0.024 mean TPR@1%FPR, reducing mean AUROC from 0.79 to 0.43 and attaining a 97.6% attack success rate. Critically, attacks transfer to two held-out detectors not seen during training, revealing shared architectural vulnerabilities rather than detector-specific brittleness."
- **Notes:** Most important *methodological* repo on the attacker side right now. The "methods" taxonomy (M0–M5) is a ready-made evaluation protocol: M0 no-op, M1 simple paraphrase, M2 StealthRL, M3 detector-guided, M4 AuthorMist, M5 character-level obfuscation. Any humanizer should position itself relative to M1–M5 rather than inventing a new label.

---

## 4. End-user "humanizer" repos (practitioner side)

These are lower-stature than the academic repos above but matter because they define the expected UX of a humanizer product and because they cite the same detectors (GPTZero, ZeroGPT, Originality.ai, Turnitin).

### 4.1 `itsjwill/humanizer-x` — HUMANIZER X
- **Link:** https://github.com/itsjwill/humanizer-x
- **License / date:** MIT, updated 2026. Packaged as a Claude Code skill.
- **README quote:**
  > "4-pass humanization engine that strips 30 AI writing patterns AND manipulates the statistical fingerprints (perplexity, burstiness) detectors actually measure."
  >
  > "Pass 1: PATTERN REMOVAL → Strip 30 AI tells (severity-ranked — worst first). Pass 2: VOICE INJECTION → Personality, opinions, cognitive artifacts, sensory anchoring. Pass 3: STATISTICAL TUNING → Manipulate perplexity, burstiness, entropy signatures. Pass 4: VERIFICATION → 8-point automated checklist with confidence score."
  >
  > "Most humanizers only address the vocabulary layer. HUMANIZER X addresses all three [perplexity, burstiness, entropy]."
- **Notes:** Pure prompt engineering — no model training. Ships a severity-ranked catalog of 30 "AI tells" (em-dash overuse, rule-of-three, "serves as", "delve", etc.) and six voice modes (casual / professional / academic / creative / voice / sdr). Interesting primarily as a taxonomy of the signals competitors believe detectors actually use.

### 4.2 `Mohit1053/Humanizer` — Ollama/Llama3 humanizer
- **Link:** https://github.com/Mohit1053/Humanizer
- **License / date:** MIT, updated 2026.
- **README quote:**
  > "AI Humanizer is a powerful tool that transforms AI-generated text into natural, human-sounding content. Built on research findings about what bypasses AI detectors in 2025, it focuses on: Perplexity variation — Unpredictable word choices. Burstiness — Mixing short and long sentences dramatically. Human quirks — Contractions, filler words, incomplete thoughts. Emotional authenticity — Personal voice and natural speech patterns."
  >
  > "Model Used: Llama3 8B (free, runs locally). AI Detection Score: Typically 0-10% on GPTZero and ZeroGPT."
- **Notes:** Pure prompting with local Llama3-8B through Ollama. Useful as a minimal reference implementation of "humanizer = carefully crafted system prompt + batch runner over a CSV".

### 4.3 `ADEMOLA200/Humanize-AI` — T5-based humanizer service
- **Link:** https://github.com/ADEMOLA200/Humanize-AI
- **What it is:** Dual-service architecture — Python/Flask paraphrasing service using `Vamsi/T5_Paraphrase_Paws`, plus a Go rewriting service that does synonym replacement, sentence restructuring, and "natural noise insertion". Exposes REST endpoints. Representative of the "API-shaped humanizer" pattern.

### 4.4 `vardhin/Humanizer` — Multi-model web humanizer
- **Link:** https://github.com/vardhin/Humanizer
- **What it is:** Python Flask + SvelteKit frontend, swappable T5 / BART / PEGASUS paraphrasers, with a built-in AI detector for before/after comparison.

### 4.5 `fatimaazfar/Pegasus-Paraphraser` — PEGASUS reference wrapper
- **Link:** https://github.com/fatimaazfar/Pegasus-Paraphraser
- **What it is:** Thin wrapper around `tuner007/pegasus_paraphrase` with beam-search + temperature controls. The canonical "PEGASUS humanizer" snippet that gets copy-pasted into bigger systems.

### 4.6 `tuner007/pegasus_paraphrase` (Hugging Face model)
- **Link:** https://huggingface.co/tuner007/pegasus_paraphrase
- **Notes:** Not a GitHub repo but ubiquitous upstream dependency; the "default paraphraser" in most open-source humanizers that aren't using DIPPER.

### 4.7 `rudra496/StealthHumanizer` — TS / multi-provider humanizer
- **Link:** https://github.com/rudra496/StealthHumanizer (README not served at time of fetch; description from mirror)
- **What it is (from listing):** TypeScript humanizer with 13 AI provider connectors, 4 rewrite levels, 13 tone presets, multi-pass "ninja mode" pipeline, and a 12-metric in-app detection engine (perplexity, burstiness, vocabulary diversity, sentence variation, etc.). Representative of the SaaS-clone side of the ecosystem.

---

## 5. Benchmarks & survey repos

### 5.1 `liamdugan/raid` — RAID benchmark
- **Link:** https://github.com/liamdugan/raid (dataset: https://raid-bench.xyz)
- **Paper:** ACL 2024.
- **README quote:**
  > "RAID is the largest & most comprehensive dataset for evaluating AI-generated text detectors. It contains over 10 million documents spanning 11 LLMs, 11 genres, 4 decoding strategies, and 12 adversarial attacks."
  >
  > "Adversarial Attacks: Article Deletion, Homoglyph, Number Swap, Paraphrase, Synonym Swap, Misspelling, Whitespace Addition, Upper-Lower Swap, Zero-Width Space, Insert Paragraphs, Alternative Spelling."
  >
  > "attack_name = 'homoglyph'; a = get_attack(attack_name); print(a.attack('Hello World')) # → {'generation': 'Ηеllо Wоrld', 'num_edits': 4, …}"
- **Notes:** `pip install raid-bench`. Has an open leaderboard. The included attack catalog (11 techniques + paraphrase) is effectively a *pre-built humanizer test suite*.

### 5.2 `xinleihe/MGTBench` and `Y-L-LIU/MGTBench-2.0`
- **Links:** https://github.com/xinleihe/MGTBench, https://github.com/Y-L-LIU/MGTBench-2.0
- **Paper:** ACM CCS 2024.
- **README quote:**
  > "MGTBench provides the reference implementations of different machine-generated text (MGT) detection methods … Metric-based methods: Log-Likelihood, Rank, Log-Rank, Entropy, GLTR Test 2 Features, DetectGPT, LRR, NPR. Model-based methods: OpenAI Detector, ChatGPT Detector, ConDA, GPTZero, LM Detector."
- **Notes:** MGTBench 2.0 adds 16 academic categories across STEM, Humanities, Social Sciences, and covers GPT-3.5, Mixtral, Llama3, GPT-4o-mini, etc. Together with RAID these are the two benchmarks you will be asked to report against.

### 5.3 WaterPark / "Watermark under Fire" — Robustness Evaluation Platform
- **Paper / code:** Liang, Wang et al. — EMNLP 2025 Findings. arXiv 2411.13425.
- **Link:** https://arxiv.org/abs/2411.13425
- **What it is:** First unified platform integrating 10 watermarkers × 12 representative attacks × 8 metrics. Key finding: no single watermark is robust across all attacks; distribution-transform watermarks resist text-mixing; explicit-signal watermarks resist linguistic variation. The RAID equivalent for watermarking. "Did you evaluate on WaterPark?" is now a standard review question for watermarking papers.

### 5.4 `Xianjun-Yang/Awesome_papers_on_LLMs_detection`
- **Link:** https://github.com/Xianjun-Yang/Awesome_papers_on_LLMs_detection
- **What it is:** ~286★ curated paper list covering training-based detection (black-box + white-box), zero-shot methods, watermarking, fingerprinting, code-detection, datasets 2019–2024. Last push June 2025. The best single entry-point into the literature.

### 5.5 `datamllab/awsome-LLM-generated-text-detection`
- **Link:** https://github.com/datamllab/awsome-LLM-generated-text-detection
- **README quote:**
  > "A curated, but probably biased and incomplete, list of LLM-generated text detection resources … we group existing methods into two categories: **black-box detection** and **white-box detection**. Black-box detection methods are limited to API-level access to LLMs … An alternative is white-box detection, in this scenario, the detector has full access to the LLMs and can control the model's generation behavior for traceability purposes."
- **Notes:** Paired with a companion survey paper and a sibling repo `The-Science-of-LLM-generated-Text-Detection`. Good for building a literature map fast.

### 5.6 `junchaoIU/LLM-generated-Text-Detection`
- **Link:** https://github.com/junchaoIU/LLM-generated-Text-Detection
- **What it is:** NeurIPS 2024 survey companion, ~82★. Organizes detectors by family (zero-shot, fine-tuning, adversarial learning, LLM-as-detector) and aggregates datasets, benchmarks, metrics.

---

## Patterns & trends

1. **Detectors converge on ratios of model probabilities, not classifiers.** Fast-DetectGPT (curvature), Binoculars (observer/performer ratio), and Ghostbuster (features over *multiple* weak models) all avoid training a dedicated classifier and instead exploit that human text sits on a different point of the likelihood manifold than model text. This is the "theoretically principled" branch of the ecosystem and it's where academic papers keep landing. Classifier-based detectors (OpenAI detector, RoBERTa fine-tunes) are increasingly treated as legacy baselines.

2. **Watermarking has fractured into two camps.** KGW-style (Kirchenbauer) and SynthID (Google DeepMind) are both open-sourced *reference* implementations with explicit "not for production" caveats — production SynthID lives inside Transformers proper. Robustness research (`THU-BPM/Robust_Watermark`, `XuandongZhao/WatermarkAttacker`) shows that the *paraphrase attack* is the single biggest weakness: back-translation + DIPPER alone drops KGW detection AUC from ~0.95 to ~0.52.

3. **Paraphrase attacks are the universal solvent.** Every serious evasion repo — DIPPER, StealthRL, and the reliability pages of `lm-watermarking` itself — frames paraphrase (not homoglyph, not synonym swap) as the primary attack. Character-level tricks like SilverSpeak are effective on *today's* detectors but are explicitly reversible; the `lm-watermarking` README even ships a `normalizers.py` / `homoglyphs.py` pair to strip them before detection.

4. **Humanizers have split into two castes.** The academic caste (DIPPER, StealthRL) trains or RL-optimizes a dedicated paraphrase model against a detector ensemble. The practitioner caste (humanizer-x, Mohit1053/Humanizer, ADEMOLA200/Humanize-AI, vardhin/Humanizer) is almost entirely *prompt-engineering on top of an off-the-shelf LLM* (Llama3-8B, Ollama, T5, PEGASUS). None of the practitioner repos RL-train anything; most don't even fine-tune. The gap between the two castes is the most obvious opportunity for a new humanizer project.

5. **Shared vocabulary of "AI tells" is crystallizing.** `itsjwill/humanizer-x` and `Mohit1053/Humanizer` independently converge on the same axes: perplexity variation, burstiness, contractions/fillers, severity-ranked pattern lists (em-dash overuse, "serves as", rule-of-three, "delve", etc.). Wikipedia's "Signs of AI writing" maintained by WikiProject AI Cleanup is now cited by these humanizers as a primary source. This is effectively a folk taxonomy that predates any formal academic classifier.

6. **Benchmarks are becoming attack-inclusive by default.** RAID ships 12 adversarial attacks in the box and exposes them as a Python API (`get_attack("homoglyph")`). MGTBench 2.0 covers 16 academic domains and ~10 generator models. "Did you evaluate on RAID + an attack split?" is quickly becoming the first review question a new detector paper gets.

7. **Transferability is the new robustness.** StealthRL's central claim — that a paraphrase policy trained against four detectors transfers to *held-out* detectors it never saw — implies "shared architectural vulnerabilities rather than detector-specific brittleness". That reframes evasion from "beat detector X" to "exploit a family-level weakness", which is what a production humanizer actually needs.

## Gaps

- **No open-source humanizer ships a self-calibrating detector panel.** Every humanizer claims sub-10% GPTZero scores. None of them *automatically* round-trip the output through Fast-DetectGPT + AdaDetectGPT + Binoculars + Ghostbuster + RAID-style attacks before returning. StealthRL is the closest thing to this on the research side but it is not packaged as a product.
- **No humanizer currently targets SynthID, and SIRA changes the calculus.** All public humanizers test against GPTZero / ZeroGPT / Originality. SynthID is deployed on Gemini output at scale. SIRA (ICML 2025) now makes SynthID removal a commodity operation at $0.88/million tokens — but no humanizer product has incorporated it, likely for regulatory/PR reasons. The ETH SRI Lab black-box probing of SynthID confirms it is easier to scrub than other SOTA schemes.
- **No open humanizer has a trained policy model newer than DIPPER (2023).** Distilling DIPPER into a smaller model (3–7B), or RL-training a new Qwen/Llama variant against a modern detector ensemble à la StealthRL, remains an unclaimed slot. AdaDetectGPT's formal guarantees raise the bar for what a trained evasion policy must defeat.
- **Attribution/retrieval defenses are under-attacked.** The original DIPPER paper itself argues retrieval is the strongest defense against paraphrase. Very few evasion repos attack retrieval defenses — they assume a stateless detector. A real deployment will have both.
- **Evaluation thresholds are inconsistent.** Binoculars ships a fixed global threshold, RAID reports TPR@FPR=1%, StealthRL reports TPR@1%FPR and AUROC. Humanizer README claims ("<10% on GPTZero") are not comparable to academic numbers. A shared eval harness that reports the same metrics as RAID / StealthRL / WaterPark across all humanizers does not yet exist.
- **WaterPark covers watermark attacks, not humanizer attacks.** The humanizer-vs-watermark evasion space (i.e., using SIRA or DIPPER specifically to defeat SynthID in a production pipeline) is not covered by RAID, WaterPark, or any existing benchmark. This is the specific measurement gap a watermark-aware humanizer would live in.

## Cross-domain analogy

The structural similarity to the **adversarial examples / robustness** literature in image classification holds well: a cat-and-mouse loop between a detector (classifier) and an attacker (paraphraser), with the attacker training explicitly against an ensemble to get transferability. StealthRL's GRPO-against-an-ensemble is essentially the text-domain version of the "ensemble adversarial training" recipe from Tramer et al. 2017. Treating a humanizer as an *adversarial attack generator* rather than a "rewriter" gives immediate access to 8 years of prior art on transferability, query-efficiency, and black-box attacks.

## Sources

- https://github.com/baoguangsheng/fast-detect-gpt — Fast-DetectGPT reference implementation
- https://github.com/BurhanUlTayyab/DetectGPT — DetectGPT PyTorch port
- https://github.com/Mamba413/AdaDetectGPT — AdaDetectGPT (NeurIPS 2025)
- https://github.com/ahans30/Binoculars — Binoculars zero-shot detector
- https://github.com/vivek3141/ghostbuster — Ghostbuster detector (UC Berkeley)
- https://github.com/HendrikStrobelt/detecting-fake-text — GLTR visualization / detector
- https://github.com/jwkirchenbauer/lm-watermarking — KGW watermark reference
- https://github.com/google-deepmind/synthid-text — SynthID-Text reference
- https://github.com/THU-BPM/Robust_Watermark — SIR paraphrase-robust watermark
- https://github.com/XuandongZhao/WatermarkAttacker — regeneration attack on watermarks
- https://github.com/martiansideofthemoon/ai-detection-paraphrases — DIPPER (NeurIPS 2023)
- https://huggingface.co/kalpeshk2011/dipper-paraphraser-xxl — DIPPER model weights
- https://github.com/google-research/google-research/tree/master/dipper — Google Research DIPPER (T5X)
- https://github.com/ACMCMC/silverspeak — SilverSpeak homoglyph evasion + reversal
- https://github.com/suraj-ranganath/StealthRL — RL paraphrase attack, ensemble-trained
- https://github.com/itsjwill/humanizer-x — 4-pass prompt-based humanizer (Claude Code)
- https://github.com/Mohit1053/Humanizer — Ollama/Llama3 humanizer
- https://github.com/ADEMOLA200/Humanize-AI — T5 + Go REST humanizer service
- https://github.com/vardhin/Humanizer — multi-model web humanizer (T5/BART/PEGASUS)
- https://github.com/fatimaazfar/Pegasus-Paraphraser — PEGASUS reference wrapper
- https://huggingface.co/tuner007/pegasus_paraphrase — canonical PEGASUS paraphrase model
- https://github.com/rudra496/StealthHumanizer — TypeScript multi-provider humanizer
- https://github.com/liamdugan/raid — RAID benchmark (+ 12 adversarial attacks)
- https://github.com/xinleihe/MGTBench — MGTBench v1 (CCS 2024)
- https://github.com/Y-L-LIU/MGTBench-2.0 — MGTBench 2.0 (academic domains)
- https://github.com/Xianjun-Yang/Awesome_papers_on_LLMs_detection — curated paper list
- https://github.com/datamllab/awsome-LLM-generated-text-detection — curated paper list
- https://github.com/junchaoIU/LLM-generated-Text-Detection — NeurIPS 2024 survey companion
- https://github.com/hzy312/Awesome-LLM-Watermark — curated LLM watermark paper list (actively maintained 2025)
- https://github.com/Allencheng97/Self-information-Rewrite-Attack — SIRA watermark attack (ICML 2025)
- https://arxiv.org/abs/2411.13425 — WaterPark / Watermark under Fire (EMNLP 2025)
