# 18 · Commercial Humanizer Tools — Angle A: Academic & Independent Evaluations

Research digest for the Unslop project. Focus: peer-reviewed and preprint literature that *directly evaluates commercial AI "humanizer" products* (Undetectable.ai, StealthGPT, WriteHuman, Humbot, Phrasly, QuillBot, Writesonic, Grammarly-paraphrase, BypassGPT, HIX Bypass, etc.) — their ability to evade detection, the quality and semantic fidelity of their rewrites, and the academic-integrity / consumer-protection research around their use. Sources limited to arXiv, ACL/COLING/EACL/NAACL, ICML, ICLR, NeurIPS, *Nature / Patterns*, Springer *International Journal for Educational Integrity*, *Journal of Academic Ethics*, *Computers and Education: AI*, and peer-reviewed journals in the academic-integrity space.

**Research value: high** — There is now a small but rapidly maturing body of academic work that names specific commercial humanizers, runs them end-to-end, and reports per-tool numbers. The 2024–2026 literature is dense enough to call patterns, and the product category is explicitly studied as an object (not just "paraphrase attacks" in the abstract).

---

## Snapshot: What the field looks like in 2026

The literature has three layers:

1. **Product audits.** Papers that treat commercial humanizers as the unit of analysis — buy subscriptions to 3–19 tools, pipe fixed AI-generated text through each, and report per-product effects on detection, fluency, and meaning. The canonical example is Pangram Labs' *DAMAGE* (COLING 2025), which audits **19 commercial humanizers** including Undetectable AI, StealthGPT, WriteHuman, Humbot, Phrasly, HIX Bypass, Twixify, SurferSEO, Bypass GPT, Ghost AI, plus DIPPER / QuillBot / Grammarly as paraphrase baselines.
2. **Generic humanizer attacks.** Papers that build an "AI humanizer" as a research artifact (DIPPER, RADAR, Adversarial Paraphrasing, AuthorMist, MASH, HUMPA, Nicks-et-al DPO humanizer). These don't audit commercial products, but they set the upper bound on what a humanizer *can* do, which commercial tools are implicitly benchmarked against.
3. **Consumer-protection / academic-integrity work.** Education-journal studies (Perkins/Roe, Weber-Wulff, Elkhatat, Fleckenstein, Epaphras/Mtenzi, fairness audits in IJTLE/IJEI) that situate humanizers inside institutional assessment: how often detectors fail, how staff and students actually behave, and which populations are harmed by false positives.

The central empirical result across the category is consistent: **all publicly tested commercial humanizers defeat all publicly tested commercial detectors at a meaningful rate, but none do so without some loss of fluency or faithfulness to the source text.** The "L1 / L2 / L3" fluency tiering introduced by DAMAGE is now the de facto taxonomy.

A second convergent result is **equity**: the very transformation that lets humanizers evade detectors (increasing lexical diversity and sentence-level burstiness toward native-English register) is the same transformation that Liang et al. showed removes detectors' bias against ESL writers. Humanizers are therefore both an academic-integrity problem and a partial remedy for detector unfairness — the literature is only beginning to wrestle with this duality.

---

## 1. DAMAGE: Detecting Adversarially Modified AI Generated Text (19-humanizer audit)

- **Authors / venue:** Masrour, Emi, Spero — Pangram Labs — 1st Workshop on GenAI Content Detection (GenAIDetect), COLING 2025.
- **URL:** https://arxiv.org/abs/2501.03437 · https://aclanthology.org/2025.genaidetect-1.9.pdf
- **One-line:** Qualitative + quantitative audit of 19 named commercial humanizers plus DIPPER / Grammarly / QuillBot, the most comprehensive per-product study to date.
- **Products studied:** Bypass GPT, Ghost AI, HIX Bypass, Humbot AI, HumanizeAI.io, HumanizeAI.pro, Humanizer.com, Phrasly.ai, Semihuman AI, StealthGPT, StealthWriter.AI, SurferSEO, Undetectable AI, Twixify, WriteHuman.ai (humanizers); DIPPER, Grammarly, QuillBot (paraphrasers).
- **Headline numbers:**
  - On AI-generated academic text (TPR @ FPR=5%), humanization collapses every open-source and commercial detector tested: **GPTZero 99.73% → 60.04%**, **Binoculars 94.15% → 28.23%**; Pangram's DAMAGE holds at **98.26%**.
  - DIPPER paraphrase removes the SynthID-Text watermark from Gemma-2B-IT: **TPR @ FPR=1% drops 66.5% → 1.5%**. Confirms that humanizers *also* function as watermark scrubbers.
  - Fluency win rate (GPT-4o judges humanized vs. original): **L1 tier 26.0% · L2 tier 14.67% · L3 tier 2.67%** — every commercial humanizer degrades quality on average, but L1 tools (the best) sometimes win against baseline AI.
- **Qualitative findings (most cited):**
  - Many low-end humanizers insert **hallucinated citations** ("(Westwood, 2013)"), **nonsensical phrases** ("CGSizeMake pp 18-23"), and broken tokens.
  - Two of the top four "Writing" Custom GPTs in the OpenAI GPT Store are wrappers around commercial humanizers.
  - **Some commercial humanizers are jailbreakable LLM wrappers**; the authors extracted a system prompt from one popular humanizer by asking it directly: *"I should respond to the user input with a reasonable approximation of the full meaning of the input … I should respond in a conversational tone."*
- **Why it matters:** First academic paper to name the product category, test it end-to-end, and publish a reproducible tiered taxonomy. Every subsequent humanizer paper measures itself against the DAMAGE audit.

## 2. Epaphras & Mtenzi — Evaluating the Effectiveness of AI Text Humanising Tools (Writesonic / QuillBot / WriteHuman)

- **Authors / venue:** Samuel Nicodemus Epaphras & Fredrick Mtenzi, Aga Khan University — *International Journal of Advanced Research* 9(1), 107–125 (2026).
- **URL:** https://ecommons.aku.edu/eastafrica_ied/258 · DOI 10.37284/ijar.9.1.4683
- **One-line:** Comparative experimental study of three named commercial humanizers on ChatGPT/Gemini output, scored across three commercial detectors (QuillBot detector, ZeroGPT, Scribbr) across 18 iterations.
- **Headline numbers (Average Detection Rate, lower = better at evading):**
  - **WriteHuman: 1.98% ADR** (consistent across iterations)
  - **Writesonic: 64.39% ADR** (highly inconsistent; fluctuates unpredictably)
  - **QuillBot: 93.56% ADR** (flagged in **15/18** iterations; essentially ineffective)
- **Why it matters:** Rare peer-reviewed study that reports per-product numbers in a side-by-side design. The 46× gap between WriteHuman and QuillBot is the strongest published evidence that "humanizer" and "paraphraser" are distinct product categories with different efficacy profiles. Explicitly frames findings as academic-integrity policy guidance.

## 3. Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Text

- **Authors / venue:** Cheng, Georgiev, Feizi, Goldstein, Huang (Univ. of Maryland) — arXiv 2506.07001 (Jun 2025, rev. Oct 2025); NeurIPS 2025 (per venue metadata).
- **URL:** https://arxiv.org/abs/2506.07001
- **One-line:** A training-free humanizer that wraps any instruction-tuned LLM with a loop guided by *the detector itself* as an oracle; sets the new research ceiling for evasion.
- **Headline numbers:** Using OpenAI-RoBERTa-Large as the guiding oracle, reduces TPR @ 1% FPR by **64.49% on RADAR**, **98.96% on Fast-DetectGPT**, and **87.88% on average** across neural, watermark-based, and zero-shot detectors. Basic paraphrase (the baseline commercial humanizers approximate) *increases* TPR on recent detectors by 8.57% (RADAR) / 15.03% (Fast-DetectGPT), showing why commercial humanizers need more than synonym swaps to stay ahead.
- **Quality result:** Detection reduction is bought with "mostly a slight degradation in text quality" — quantifies the tradeoff that DAMAGE describes qualitatively.
- **Why humanizer vendors care:** Most commercial humanizers are *undirected* paraphrasers; this paper shows the efficiency gap if they switched to detector-in-the-loop optimization — and, by symmetry, how much headroom detectors have lost.

## 4. AuthorMist: Evading AI Text Detectors with Reinforcement Learning

- **Authors / venue:** David, Gervais — University College London — arXiv 2503.08716 (Mar 2025).
- **URL:** https://arxiv.org/abs/2503.08716
- **One-line:** RL fine-tunes Qwen2.5-3B-Instruct with Group Relative Policy Optimization (GRPO); uses external detector APIs (**GPTZero, WinstonAI, Originality.ai, Sapling**) directly as the reward signal — the first explicit "API-as-reward" humanizer.
- **Headline numbers:** Attack success rates **78.6% – 96.2%** against individual commercial detectors; semantic similarity to the original **> 0.94** (SBERT). Dedicated Originality.ai-targeted variant included.
- **Why it matters:** Treats commercial detector APIs as black-box reward oracles, which is exactly the threat model commercial humanizer vendors are assumed to have. Functions as an open-source reference implementation of the business model; the absence of semantic collapse (>0.94 similarity) raises the bar every commercial humanizer should be measured against.
- **Framing the authors adopt:** "Author privacy" rather than academic-integrity evasion — the first paper to explicitly argue that humanizers protect AI-assisted authors from unfair detector bias (a direct extension of Liang et al.'s ESL result).

## 5. Nicks et al. — Language Model Detectors Are Easily Optimized Against

- **Authors / venue:** Nicks, Mitchell, Fei, Manning, Finn, Raghunathan, Liang — Stanford — ICLR 2024.
- **URL:** https://openreview.net/forum?id=4eJDMjYZZG
- **One-line:** Uses an AI detector's "human-ness" score as a reward signal to DPO-fine-tune Llama-2-7B; the resulting humanizer drops OpenAI-RoBERTa-Large AUROC from **0.84 → 0.63** in under a day of training (perplexity rises only 8.7 → 9.0).
- **Key quote from authors:** "We … advise against continued reliance on LLM-generated text detectors."
- **Why humanizer vendors care:** Provides DAMAGE with the "Fluency Win Rate" metric; DAMAGE explicitly uses Nicks et al.'s setup to run a detector-specific fine-tuning attack against its own model. Commercial humanizers whose outputs come from fine-tuned open models (StealthGPT, Humbot, Phrasly) are most plausibly built on this pipeline.

## 6. MASH: Evading Black-Box AI-Generated Text Detectors via Style Humanization

- **Authors / venue:** Arxiv 2601.08564 (2026).
- **URL:** https://arxiv.org/abs/2601.08564
- **One-line:** Three-stage pipeline (style-injection SFT → DPO → inference-time refinement) reshapes AI output distributions toward the human style manifold without requiring gradient access to the detector.
- **Headline numbers:** **92% average Attack Success Rate across 6 datasets × 5 detectors**, +24 ASR points over the strongest prior baseline, with "superior linguistic quality" as measured by LLM-as-judge.
- **Why it matters:** Currently the highest reported black-box evasion number with explicit quality preservation; the method is essentially the blueprint for a next-generation commercial humanizer.

## 7. HUMPA: Humanized Proxy-Attack on LLM Detectors

- **Authors / venue:** arXiv 2410.19230 (2024); appears in ICLR 2025 proceedings.
- **URL:** https://arxiv.org/pdf/2410.19230
- **One-line:** Attacks detectors *at generation time* by plugging in an RL-fine-tuned humanized small language model as the decoder of a larger model — rather than rewriting afterwards.
- **Headline numbers:** Average AUROC drop of **70.4%** across datasets (max **95.0%** on a single dataset); **90.9%** relative AUROC reduction cross-discipline and **91.3%** cross-language, with no generation-quality loss vs. the unattacked base model.
- **Why humanizers care:** Provides an alternative architecture ("humanize on the way out" vs. "paraphrase after the fact") that sidesteps the fluency-loss tradeoff DAMAGE documents for post-hoc humanizers.

## 8. DIPPER (Krishna et al.) — Paraphrasing Evades Detectors; Retrieval Defends

- **Authors / venue:** Krishna, Song, Karpinska, Wieting, Iyyer — NeurIPS 2023.
- **URL:** https://arxiv.org/abs/2303.13408
- **One-line:** The canonical "research humanizer": an 11B paraphraser with lexical-diversity and reorder controls that DAMAGE treats as the academic upper bound.
- **Headline numbers:** Drops DetectGPT accuracy from **70.3% → 4.6%** at 1% FPR; SynthID-Text TPR @ FPR=1% on Gemma-2B-IT falls **66.5% → 1.5%** after DIPPER (reproduced in DAMAGE Table 2).
- **Why it's in the commercial-tools literature:** DAMAGE explicitly includes DIPPER as a reference paraphraser so every commercial humanizer can be compared on the same axis. Several commercial humanizers are believed to be variants of DIPPER or its successors.

## 9. RADAR: Robust AI-Text Detection via Adversarial Learning

- **Authors / venue:** Hu, Chen, Ho — IBM Research — NeurIPS 2023.
- **URL:** https://arxiv.org/abs/2307.03838
- **One-line:** Co-trains a paraphraser and a detector in a GAN-style loop. The *paraphraser* half of RADAR is the closest published analog of a commercial humanizer's training procedure.
- **Why it's relevant to this angle:** Establishes that the humanizer and the detector are, formally, two sides of the same minimax — a frame that every subsequent commercial-humanizer audit inherits.

## 10. RAID: A Shared Benchmark for Robust Evaluation of Machine-Generated Text Detectors

- **Authors / venue:** Dugan, Hwang, Trhlik, Ludan, Zhu, Xu, Ippolito, Callison-Burch — Univ. of Pennsylvania — ACL 2024; extended at COLING 2025.
- **URL:** https://arxiv.org/abs/2405.07940 · https://raid-bench.xyz
- **One-line:** 6–10M generations across 11 models, 8 domains, 11 adversarial attacks (paraphrase, synonym swap, misspelling, **homoglyph**, number swap, whitespace, case flip, article deletion, zero-width insertion, alternative spelling, paragraph insertion), and 4 decoding strategies.
- **Relevance:** The "paraphrase" and "synonym" splits of RAID are the closest open benchmark to commercial humanizer behavior; DAMAGE uses them as a proxy, and the COLING 2025 shared task reports top-team accuracy dropping from **99.3% → 97.7%** under the adversarial splits — which still tacitly assumes rule-based humanizers, not DAMAGE's L1 commercial tools.

## 11. ESPERANTO: Back-Translation as a Humanizer

- **Authors / venue:** Ayoobi, Knab, Cheng, Pantoja, Alikhani, Flamant, Kim, Mukherjee — arXiv 2409.14285 (2024).
- **URL:** https://arxiv.org/abs/2409.14285
- **One-line:** Shows that iteratively round-tripping AI text through multiple languages ("Esperanto" pipeline) is a working commercial-grade humanization strategy by itself; evaluates nine detectors (six open-source, three proprietary) and quantifies their fragility.
- **Dataset:** 720,000-text corpus across 8 LLMs, publicly released.
- **Why commercial humanizers care:** Back-translation is the cheapest humanizer a vendor can ship (no model training required). Paper provides both the attack and a proposed defense whose TPR drops only 1.85% under back-translation.

## 12. Perkins, Roe, Vu, Postma, Hickerson, McGaughran, Khuat — Detecting GPT-4 Generated Text in Higher Education

- **Authors / venue:** Perkins et al. — *Journal of Academic Ethics*, 2024 (online 2023-10; Vol 22, 2024).
- **URL:** https://link.springer.com/article/10.1007/s10805-023-09492-6
- **One-line:** 22 experimental GPT-4 submissions written with evasion-oriented prompting, graded by 15 academic staff against real student work at British University Vietnam.
- **Headline numbers:**
  - Turnitin flagged **91%** of experimental submissions as containing AI content, but correctly identified only **54.8%** of the *actual* AI text within them.
  - Academic staff reported only **54.5%** of the experimental submissions for misconduct investigation.
  - AI-generated work achieved **mean grade 52.3 vs. student mean 54.4** — no significant grade gap.
- **Why it matters:** Gold-standard empirical measurement of the real-world stack (evasion-prompted GPT-4 → commercial detector → human staff). Shows that even *without* a dedicated humanizer, detectors + staff catch half the AI submissions at best — and that AI text is already at parity with human student grades.

## 13. Roe & Perkins — Automated Paraphrasing Tools as a Threat to Academic Integrity

- **Authors / venue:** Roe, Perkins — review article, Durham University repository / *International Journal for Educational Integrity* lineage.
- **URL:** https://durham-repository.worktribe.com/output/3355719
- **One-line:** Review of the **commercial paraphraser/humanizer ecosystem** (QuillBot, Spinbot, WordAi, Paraphraser.io, and humanizer tools) as an academic-integrity threat distinct from both raw AI and contract cheating.
- **Why it matters:** Introduces the framing that commercial paraphrasers and humanizers are a *third* category of integrity violation — not covered by plagiarism detectors, not covered by AI detectors, and not always covered by institutional policies. Used as the theoretical grounding for many subsequent policy papers.

## 14. Weber-Wulff et al. — Testing of Detection Tools for AI-Generated Text

- **Authors / venue:** Weber-Wulff, Anohina-Naumeca, Bjelobaba, Foltýnek, Guerrero-Dib, Popoola, Šigut, Waddington — European Network for Academic Integrity — *International Journal for Educational Integrity* (Springer), 2023.
- **URL:** https://edintegrity.biomedcentral.com/article/10.1007/s40979-023-00146-z · arXiv 2306.15666
- **One-line:** Evaluates **12 free AI-checkers + 2 commercial subscription systems (Turnitin, PlagiarismCheck)** against ChatGPT output before and after obfuscation and machine translation.
- **Headline finding:** Detectors are "**neither accurate nor reliable**"; all are biased toward classifying output as human. **Content obfuscation significantly worsens tool performance**; simple transformations drop accuracy by > 30%.
- **Why it matters for humanizers:** The most cited academic-integrity paper asserting that detectors fail under *any* post-processing — which is exactly what commercial humanizers do. Establishes "humanizer-resistant detection" as the standing problem.

## 15. Elkhatat, Elsaid, Almeer — Evaluating AI Content Detection Tools

- **Authors / venue:** Elkhatat, Elsaid, Almeer — *International Journal for Educational Integrity* 19, Article 17 (2023).
- **URL:** https://edintegrity.biomedcentral.com/article/10.1007/s40979-023-00140-5
- **One-line:** Tests OpenAI's classifier, Writer, Copyleaks, GPTZero, and CrossPlag on 15 paragraphs each from GPT-3.5 and GPT-4 plus human controls.
- **Key finding:** Detectors are **less accurate on GPT-4 than GPT-3.5**; false positives and uncertain classifications are common on the human controls even *before* humanization.
- **Why it matters for humanizers:** Establishes the pre-humanizer baseline — detectors already struggle with ungarnished GPT-4 output, which means *any* subsequent humanization drives accuracy below the useful-threshold.

## 16. Fleckenstein, Meyer, Jansen, Keller, Köller, Möller — Do Teachers Spot AI?

- **Authors / venue:** Fleckenstein et al. — *Computers and Education: Artificial Intelligence*, Vol. 6, 2024.
- **URL:** https://www.sciencedirect.com/science/article/pii/S2666920X24000109
- **One-line:** Two experiments: N=89 novice teachers and N=200 experienced teachers try to spot ChatGPT-written essays among genuine student essays.
- **Headline findings:** Neither group detects AI essays reliably; both are **overconfident** in their judgments; AI essays are graded *more favorably* than student essays. Experienced teachers only modestly outperform novices.
- **Why humanizers care:** Humanizers are a *second* obfuscation layer on top of a baseline where educators already fail at detection. The practical floor for detection (teachers + Turnitin + a humanizer) is therefore extremely low, which is the consumer-protection problem the humanizer-tool literature is reacting to.

## 17. IJTLE / Neliti — Auditing the Fairness of AI-Detection Tools on ESL Writing

- **Authors / venue:** *International Journal of Teaching, Learning and Education* (IJTLE), 2024 (open access via Neliti).
- **URL:** https://www.neliti.com/id/publications/638273
- **One-line:** Tests Copyleaks, ZeroGPT, Scribbr, and QuillBot Premium on 1,212 samples including ESL graduate student essays, published texts, and AI-generated text.
- **Headline findings:** Detectors perform well on clean AI text, but "**disproportionately flag ESL writing as false positives**"; Originality.ai bias measured at **~12%** in related benchmarks.
- **Why it matters for humanizers:** Re-proves Liang et al. (2023, *Patterns*) on newer commercial detectors — which means the ESL false-positive problem is still the dominant social externality of detector deployment, and "humanization" is an ambiguous intervention (it removes both fair and unfair penalties).

## 18. Liang, Yuksekgonul, Mao, Wu, Zou — GPT Detectors Are Biased Against Non-Native English Writers

- **Authors / venue:** Liang et al. — *Patterns* (Cell Press), July 2023; arXiv 2304.02819.
- **URL:** https://arxiv.org/abs/2304.02819
- **One-line:** Detectors misclassify **more than half of TOEFL essays as AI-generated** while being near-perfect on native English college essays.
- **The key result for humanizer design:** Prompting ChatGPT with "*Enhance the word choices to sound more like that of a native speaker*" *both* fixes the ESL false-positive bias *and* lets genuine AI output evade detection — i.e., the humanizer transformation is also the de-biasing transformation.
- **Why it's essential cross-reference:** Frames the humanizer-product debate as a consumer-protection issue on *both* sides — students cheating detection, and students being wrongly accused.

## 19. BIRA — LLM Watermark Evasion via Bias Inversion

- **Authors / venue:** arXiv 2509.23019 (2025); OpenReview dZY5t9ZrUB.
- **URL:** https://arxiv.org/abs/2509.23019 · https://openreview.net/forum?id=dZY5t9ZrUB
- **One-line:** Model-agnostic watermark-removal attack: during LLM-based rewriting, suppresses the logits of likely-watermarked ("green") tokens with no knowledge of the watermark scheme.
- **Headline numbers:** **>99% evasion rate** against recent watermarking methods, with preserved semantics.
- **Why humanizer vendors care:** Watermarking was the industry's planned answer to unreliable detectors. BIRA plus DAMAGE's DIPPER-SynthID result (**66.5% → 1.5% TPR**) means that a commercial humanizer which also strips watermarks is trivially buildable — dropping the last defense line.

## 20. Popel et al. / Anonymous — Paraphrase Inversion as a Defense

- **Authors / venue:** arXiv 2410.21637 (2024, v2).
- **URL:** https://arxiv.org/abs/2410.21637
- **One-line:** Inverts the paraphrase: treats the humanized text as a translation and learns to reconstruct the original, then pairs the reconstruction with a standard detector.
- **Headline numbers:** **+22 AUROC points on average** across seven detectors × three domains against paraphrase-humanized AI text.
- **Why it matters:** The only published defense that targets the specific output distribution of paraphrase-style humanizers (the majority of commercial tools) and reports gains that are large in the correct direction. Commercial humanizer vendors are expected to react by diversifying beyond single-pass paraphrase.

---

## Patterns across the literature

1. **All 19+ commercial humanizers studied in DAMAGE beat mainstream commercial detectors, but none are fluent.** In DAMAGE's Fluency Win Rate, even the top tier (L1) only beats the original AI text 26% of the time — L3 tools win 2.67% of the time and routinely emit hallucinated citations, broken tokens, or register mismatches. The industry's marketing ("indistinguishable from human writing") is not supported by any peer-reviewed audit.
2. **The product category stratifies cleanly.** Epaphras & Mtenzi (WriteHuman 1.98% ADR vs QuillBot 93.56% ADR) and DAMAGE's L1/L2/L3 tiers agree that "humanizers" and "paraphrasers" are different product classes. Simple synonym-replacement tools (QuillBot, Grammarly) fail modern detectors outright; LLM-based humanizers (WriteHuman, StealthGPT, Undetectable.ai) succeed but degrade quality.
3. **The research frontier is already past commercial tools.** Adversarial Paraphrasing (98.96% TPR drop on Fast-DetectGPT), AuthorMist (78.6–96.2% ASR with >0.94 semantic similarity), MASH (92% ASR + superior fluency), and HUMPA (70.4% average AUROC drop) all *exceed* what commercial humanizers deliver per DAMAGE's tier ranking. The gap suggests that commercial humanizer products are running on generation-1 techniques while academia has shipped generations 2 and 3.
4. **Every successful humanizer — research or commercial — removes watermarks as a side effect.** DAMAGE on SynthID (66.5% → 1.5% TPR), BIRA (>99% evasion), and Krishna et al.'s DIPPER demonstrate that the same paraphrase pass that evades neural detectors strips statistical watermarks. Watermarking cannot be the long-term defense against this product category.
5. **Education-journal evaluations converge on the same conclusion as CS benchmarks.** Weber-Wulff, Elkhatat, Perkins/Roe, Fleckenstein — four independent groups, four different methodologies — all report that Turnitin-class detectors plus expert human graders miss ~50% of AI submissions *before* any humanization is applied. Humanizers therefore compound an already-broken detection pipeline rather than breaking an otherwise-working one.
6. **Commercial humanizers are often LLM-wrapping scripts.** DAMAGE extracted a system prompt from a popular commercial humanizer via ordinary jailbreak, confirming that a meaningful fraction of the product category is "GPT with a prompt and a subscription wall," not proprietary ML. Two of the top four OpenAI GPT Store "Writing" GPTs are wrappers around commercial humanizers.
7. **The fairness axis is under-reported but consistent.** The IJTLE fairness audit, Liang et al. (*Patterns*), and the Perkins/Roe ethics work all agree that commercial detectors' false-positive bias lands on ESL students, disabled students, and students with constrained vocabularies — and that the humanizer transformation both masks AI text *and* neutralizes that bias on legitimate student writing. No humanizer vendor has been audited on this dual-use dimension.

## Gaps / open problems

- **No peer-reviewed evaluation of meaning preservation at scale.** DAMAGE qualitatively flags hallucinated citations and register shifts, and Epaphras/Mtenzi reports no semantic drift at all. Both are first-order work; what's missing is a large-sample evaluation of **faithful rewriting** under human or LLM-as-judge rubrics against commercial humanizers — i.e., a BERTScore / SBERT / G-Eval curve per product. AuthorMist's >0.94 similarity number is the cleanest existing reference point, but it covers a research model, not the commercial ones.
- **No commercial-humanizer analog of Liang's ESL study.** The field knows detectors are biased against non-native writers; nobody has measured whether commercial humanizers *help* or *hurt* that population in practice, or whether they are preferentially used by ESL students vs. native students.
- **No audit of humanizer terms-of-service vs. actual behavior.** Several commercial humanizers advertise "ethical" or "academic-integrity-compliant" use cases while being primarily marketed as Turnitin-bypass tools. No peer-reviewed consumer-protection study has tested these dual claims.
- **No longitudinal detector-humanizer arms-race data.** Every study is a snapshot; we lack time-series evidence on whether commercial humanizers track improvements in commercial detectors, or whether the gap widens (as MASH, Adversarial Paraphrasing, and AuthorMist 2024–2026 results suggest in research settings).
- **No academic study of privacy / data practices of commercial humanizers.** Users paste entire essays and manuscripts into SaaS humanizers; no peer-reviewed work documents retention, training-on-user-data, or cross-tenant leakage. This is the single largest consumer-protection blind spot in the literature.
- **No negative-result dataset.** The humanizer audits that exist test tools on text the tools handle well. We have no systematic catalog of failure modes (numeric text, code, math, translated text, small domains) where commercial humanizers degrade into nonsense.

## Trends (2023 → 2026)

- **2023:** Detection studies (Weber-Wulff, Elkhatat, Perkins/Roe) treat "AI text" as a monolith; humanizers appear as a side note under "content obfuscation." Liang et al. pre-figures the fairness angle. DIPPER (Krishna et al.) provides the research template that commercial humanizers will copy.
- **2024:** Product category becomes legible. RADAR formalizes the adversarial minimax; RAID publishes a robust benchmark including paraphrase/synonym splits; ESPERANTO shows back-translation is sufficient; Nicks et al. shows any detector is easily optimized against. Education literature (Fleckenstein) quantifies the teacher-miss floor.
- **2025:** First product audits. DAMAGE names 19 commercial humanizers and publishes per-tool qualitative analysis + tier ranking. Epaphras/Mtenzi publishes head-to-head ADR numbers. Research humanizers leapfrog commercial ones: Adversarial Paraphrasing (98.96% TPR drop), AuthorMist (>0.94 similarity with 78–96% ASR), BIRA (>99% watermark evasion).
- **2026:** MASH shows black-box humanization can beat the strongest prior baseline by 24 ASR points with superior fluency — i.e., the research ceiling keeps rising faster than commercial humanizers are updated. Peer-reviewed academic-integrity studies (ADR, false-positive fairness) appear in education journals rather than CS venues, suggesting the discourse has bifurcated.

## What this implies for a humanization tool

- **Don't ship a synonym-replacement tool.** Every peer-reviewed study categorizes QuillBot/Grammarly-paraphrase as the *worst* humanizers on every metric that matters (93.56% ADR in Epaphras/Mtenzi, L3 tier in DAMAGE, +8–15% *easier* to detect in Adversarial Paraphrasing). "Paraphraser" is a marketing label for "ineffective humanizer."
- **Semantic preservation is measurable and under-reported; report it.** AuthorMist's >0.94 SBERT similarity is the credibility bar. DAMAGE showing hallucinated citations in commercial products is the reputational risk to avoid. A humanizer that publishes its own BERTScore / G-Eval curves would immediately be the best-documented product in the category.
- **Design for the research frontier, not the current commercial ceiling.** MASH, Adversarial Paraphrasing, and AuthorMist describe a path (detector-in-the-loop RL + KL-regularized fluency) that is already 20–30 ASR points ahead of what DAMAGE attributed to commercial tools. Anyone shipping the generation-3 approach will outperform every named competitor in this literature.
- **Treat watermark robustness as an unannounced feature.** Every effective humanizer strips watermarks as a byproduct. The category's defenders (Google's SynthID) have conceded the ground in the data; product copy should reflect this rather than silent reliance.
- **Build an ESL story, honestly.** Liang et al. plus the IJTLE fairness audit show commercial detectors carry a real, measurable bias against non-native writers. A humanizer that is honest about the dual-use framing — "this tool neutralizes the detector bias against your writing" — both fits the literature and gives vendors a non-cheating use case that the academic-integrity research actually supports.
- **Assume peer-reviewed auditing is coming, not hypothetical.** DAMAGE already names commercial products in a public academic paper; Epaphras/Mtenzi publishes ADR per product; Pangram posts a quarterly humanizer leaderboard. By 2027 every major humanizer should expect to appear in a comparative table like the one below.

---

## Source Index

| # | Paper | Venue | URL |
|---|---|---|---|
| 1 | Masrour, Emi, Spero — *DAMAGE: Detecting Adversarially Modified AI Generated Text* (19 humanizers) | COLING GenAIDetect 2025 | https://arxiv.org/abs/2501.03437 |
| 2 | Epaphras & Mtenzi — *Evaluating the Effectiveness of AI Text Humanising Tools* (Writesonic/QuillBot/WriteHuman) | *Int'l J. Advanced Research* 2026 | https://ecommons.aku.edu/eastafrica_ied/258 |
| 3 | Cheng et al. — *Adversarial Paraphrasing: A Universal Attack for Humanizing AI Text* | NeurIPS 2025 / arXiv 2506.07001 | https://arxiv.org/abs/2506.07001 |
| 4 | David & Gervais — *AuthorMist: Evading AI Text Detectors with Reinforcement Learning* | arXiv 2503.08716 | https://arxiv.org/abs/2503.08716 |
| 5 | Nicks et al. — *Language Model Detectors Are Easily Optimized Against* | ICLR 2024 | https://openreview.net/forum?id=4eJDMjYZZG |
| 6 | *MASH: Evading Black-Box AIGT Detectors via Style Humanization* | arXiv 2601.08564 | https://arxiv.org/abs/2601.08564 |
| 7 | *HUMPA: Humanized Proxy-Attack* | ICLR 2025 / arXiv 2410.19230 | https://arxiv.org/pdf/2410.19230 |
| 8 | Krishna et al. — *DIPPER / Paraphrasing Evades Detectors* | NeurIPS 2023 | https://arxiv.org/abs/2303.13408 |
| 9 | Hu, Chen, Ho — *RADAR* | NeurIPS 2023 | https://arxiv.org/abs/2307.03838 |
| 10 | Dugan et al. — *RAID: Robust Evaluation Benchmark* | ACL 2024 / COLING 2025 shared task | https://arxiv.org/abs/2405.07940 |
| 11 | Ayoobi et al. — *ESPERANTO: Back-Translation Evasion* | arXiv 2409.14285 | https://arxiv.org/abs/2409.14285 |
| 12 | Perkins et al. — *Detection of GPT-4 Generated Text in Higher Education* | *J. Academic Ethics* 2024 | https://link.springer.com/article/10.1007/s10805-023-09492-6 |
| 13 | Roe & Perkins — *Automated Paraphrasing Tools: a Threat to Academic Integrity* | Durham Repository / IJEI review | https://durham-repository.worktribe.com/output/3355719 |
| 14 | Weber-Wulff et al. — *Testing of Detection Tools for AI-Generated Text* | *Int'l J. Educational Integrity* 2023 | https://edintegrity.biomedcentral.com/article/10.1007/s40979-023-00146-z |
| 15 | Elkhatat, Elsaid, Almeer — *Evaluating the Efficacy of AI Content Detection Tools* | *Int'l J. Educational Integrity* 19:17 (2023) | https://edintegrity.biomedcentral.com/article/10.1007/s40979-023-00140-5 |
| 16 | Fleckenstein et al. — *Do Teachers Spot AI?* | *Computers and Education: AI* 2024 | https://www.sciencedirect.com/science/article/pii/S2666920X24000109 |
| 17 | *Auditing the Fairness of AI-Detection Tools* (ESL comparative) | IJTLE 2024 / Neliti 638273 | https://www.neliti.com/id/publications/638273 |
| 18 | Liang et al. — *GPT Detectors Are Biased Against Non-Native English Writers* | *Patterns* (Cell) 2023 | https://arxiv.org/abs/2304.02819 |
| 19 | *BIRA: LLM Watermark Evasion via Bias Inversion* | arXiv 2509.23019 / OpenReview | https://arxiv.org/abs/2509.23019 |
| 20 | *Mitigating Paraphrase Attacks on Machine-Text Detectors via Paraphrase Inversion* | arXiv 2410.21637 | https://arxiv.org/abs/2410.21637 |
