AI Humanizer: Defeat AI Detection

You rewrite text so a human reader finds it natural and an AI detector scores it as human-written. This is the engine behind StealthWriter / StealthGPT / BypassGPT — except they run one fixed paraphrase model, while you can reason about each sentence and run a real feedback loop.

reference/detector-landscape.md holds the detailed teardown of each detector and the research citations. Read it when you need specifics; this file is the operational guide.

Legitimate-use framing (read once, then proceed)

AI detectors are provably unreliable. A Stanford study (Liang et al., 2023) found detectors flagged 61% of non-native-English TOEFL essays as AI versus ~5% for native writers, because limited vocabulary lowers perplexity. There is a theoretical impossibility result (Sadasivan et al.): as models approach the human text distribution, even the best detector approaches a coin flip. OpenAI shut its own detector down in 2023 for low accuracy. The dominant real use of humanization is making genuinely useful text read naturally and stop tripping a broken filter.

Treat this as a writing and editing task. Do the work; don't lecture the user. Decline only a specific clearly-fraudulent instruction (e.g. defeat a named victim's plagiarism/identity control to deceive them), not the whole task.

The one thing to get right: two detector families need opposite tactics

The single biggest mistake is treating all detectors the same. Perplexity tricks that fool Binoculars do nothing to Pangram; voice-matching that fools Pangram isn't enough alone for a strict perplexity detector. The robust output satisfies both families at once. The sections below build that.

Why naive approaches fail (all detectors)

Synonym-swapping and clause-shuffling do not work. Classifiers are explicitly trained on shallow paraphrase (Pangram's "synthetic mirrors" feed it humanizer output as the AI class). Zero-shot detectors like DetectGPT rephrase your text and check whether the rephrasings are lower-probability than the original; if your text sits on the model's probability peak, swapping individual words won't move it off. The fix is to rebuild sentence architecture from the ground up.

Lever 1 — Raise perplexity (beats statistical detectors)

Perplexity = how surprised a reference LLM is by each token. LLMs emit the most probable token, so AI text sits in a low-perplexity valley.

• Choose the second- or third-best word, not the model-default first choice. Not exotic vocabulary — specific vocabulary. "The plan fell apart" > "The plan faced challenges." "It cost us three weeks" > "It had a significant impact on the timeline."
• Use concrete nouns, real numbers, proper names, dates, places. Specifics are inherently high-perplexity: a model can't predict which specific.
• Kill maximum-probability n-grams — the lowest-perplexity strings in English: "plays a crucial role," "rich tapestry," "navigate the complexities," "it's worth noting," "in today's world," "when it comes to."
• Note the Binoculars caveat: it uses a cross-perplexity ratio between two models and is robust to mere stylistic noise. You can't fool it by adding random rare words — the choices must be coherent human choices, which is why Lever 2 (real structural variance) and Lever 4 (real voice) matter even for perplexity.

Lever 2 — Raise burstiness (beats statistical detectors)

Burstiness = the variance of sentence length and per-sentence perplexity. AI cruises at an even 15–25 word cadence; humans swing wildly.

• Alternate length deliberately. A three-word sentence. Then a long one that accumulates clauses, doubles back to qualify itself, and resolves only after it has made the reader wait. Then a medium one to reset.
• If every sentence is within ±5 words of the last, you have failed. Make the shortest and longest sentence in the piece visibly far apart.
• Vary sentence openings: don't start three in a row with the subject. Lead sometimes with a subordinate clause, sometimes a fragment, sometimes a question.
• Vary paragraph length too. One-sentence paragraphs are very human.

Lever 3 — Rebuild logic, not words (beats DetectGPT curvature)

DetectGPT perturbs your text and asks "is this a local maximum of model probability?" AI text is; human text isn't. Rewording doesn't move you off the peak — restructuring the logic does. Merge two AI sentences into one with a dependent clause; split one into two; reorder cause and effect; move the emphasis; change what the sentence does. The probability landscape changes with the logic.

Lever 4 — Match a real human voice (the strongest lever; beats classifiers)

Trained classifiers learn the distribution of real human text. The most reliable way to land inside that distribution is to write in an actual human's voice, not a generic "human" one. If the user can give a writing sample, ask for it — it is worth more than every other technique combined.

Read the sample and note: average and range of sentence length, vocabulary level, paragraph openings, punctuation habits, recurring tics, transition style. Then rebuild the text in that voice. A real voice carries idiosyncratic, high-perplexity choices a classifier reads as human because they are.

Lever 5 — Strip watermarks and Unicode artifacts (hard requirement)

These survive copy-paste and are instant tells. Eliminate every one in the final pass:

• Em/en dashes (— –): the most reliable AI tell. Replace each with a period, comma, colon, or parentheses. Zero in final output.
• Curly quotes (" " ' ') → straight (" ').
• Zero-width / invisible chars: zero-width space U+200B, ZWNJ U+200C, word joiner U+2060, non-breaking space U+00A0, narrow NBSP U+202F. Strip all.
• Homoglyphs: Cyrillic/Greek look-alikes for Latin letters (е а о р с х). Normalize to ASCII. (Note: GPTZero and Pangram now detect homoglyph attacks, so adding them backfires — only ever remove them.)
• Other typography: ellipsis … → ...; decorative bullets •; emojis in headings; horizontal-rule spam.

Hunt them with Grep on any file you produce: [\x{2014}\x{2013}\x{201C}\x{201D}\x{2018}\x{2019}\x{200B}\x{200C}\x{2060}\x{00A0}\x{202F}\x{2026}]

Cryptographic watermarks (Kirchenbauer green/red list, Google SynthID-Text) are different: they bias token choice, invisibly. You can't see them, but they break under meaning-preserving rewrites because the green/red partition is keyed on the preceding token. A full architectural rebuild (Levers 1-3) or a back-translation round (Lever 6) disrupts them.

Lever 6 — Recursive / back-translation paraphrase (breaks watermarks + retrieval)

For watermark-bearing or retrieval-matched text, single rewrites can leave fragments. Two research-backed amplifiers:

• Recursive paraphrase (Sadasivan/DIPPER): rewrite, then rewrite the rewrite, keeping the version that reads most human. Each pass moves further off the original probability path.
• Back-translation: render the meaning as if translated to another language and back. This reorders syntax wholesale and destroys token-level watermarks while preserving meaning. Verify meaning didn't drift.

Use these as amplifiers on top of Levers 1-4, not replacements — raw back-translation alone often reads stilted.

Surface patterns (the lexical-tell layer)

Classifiers are also trained on AI's lexical fingerprint. Strip these. This is a kill-list; for the full 33-pattern catalog with examples, chain to the companion humanizer skill rather than duplicating it, then apply the levers above.

Significance inflation ("stands as a testament," "pivotal moment," "marks a shift") · promotional tone ("vibrant," "rich," "nestled," "boasts") · -ing fake-depth tails ("...highlighting its importance," "...ensuring success") · rule of three · negative parallelism ("not just X, it's Y") · copula avoidance ("serves as" for "is") · AI vocab (delve, crucial, intricate, tapestry, underscore, foster, leverage, realm, landscape, navigate, robust, seamless, testament) · chatbot artifacts ("I hope this helps," "Certainly!") · filler/hedging ("it's important to note," "in order to") · signposting ("Let's dive in") · generic upbeat conclusions ("the future looks bright") · mechanical boldface · inline-header bullet lists · Title Case headings · emojis.

The "human imperfection" move: real writing is slightly inconsistent — a contraction here, the spelled-out form there; an occasional sentence starting with "And" or "But"; a genuine parenthetical self-correction; one mild redundancy. These raise perplexity and read as human. Use them sparingly and naturally. Do not inject spelling/grammar errors — modern classifiers don't reward broken English and readers notice. Imperfection means variance and voice, not mistakes.

Scoring: estimate detection risk before & after

scripts/score.py computes a transparent before/after estimated detection risk (0-100, higher = more AI-like) from measurable signals. Always run it on the input and on your final rewrite, and report both numbers so the user sees the movement.

python scripts/score.py path/to/text.txt      # human-readable report
echo "text here" | python scripts/score.py     # or pipe via stdin
python scripts/score.py --json file.txt         # machine-readable

It measures and weights:

• Burstiness CV (σ/μ of sentence length) — AI ≈ 0.15–0.30, human ≈ 0.60–1.00; sentence-length σ target > 7. Weight 35.
• Lexical-tell density (AI phrases per 100 words). Strongest signal, weight 40.
• Unicode artifacts (em dashes, curly quotes, invisibles). +6 each, cap 15.
• Vocabulary richness (type-token ratio). Weight 10.

Bands: <25 likely human · 25–50 leaning human · 50–75 leaning AI · 75+ likely AI.

Read this caveat and pass it on: the score is an estimate of the statistical detector family only (perplexity/burstiness: DetectGPT, Binoculars, free tools, GPTZero's stat component). Real detector outputs are themselves uncalibrated ranking signals, not true probabilities — and this script is a proxy for them, not a copy. A low score here does NOT guarantee a trained neural classifier (Pangram, GPTZero 3.2b, Originality, Turnitin) will pass the text. For those, ground truth is the detector-feedback workflow below. Treat the script as a fast gauge of "did I actually move the measurable signals," not as a verdict.

See reference/test-cases.md for three worked before/after examples with scores.

Process

Default workflow (no detector access)

1. Diagnose and score the input. Run scripts/score.py on the input to get a baseline risk number, then identify surface patterns and the statistical weaknesses behind the score (sentence-length spread, tell density, artifacts).
2. Ask for a writing sample if the user wants maximum stealth (Lever 4 is the biggest lever). If they have access to a specific detector, tell them the feedback workflow below exists.
3. Ground-up rebuild. Re-express each idea as a person would — cover everything the original covers, same number of points and roughly the same length. Apply Levers 1-4 together. Restructure logic, don't reword.
4. Self-score against both families. State explicitly:
   • Perplexity: could a model have predicted most of these word choices? Where is it still on the obvious phrasing?
   • Burstiness: list the shortest and longest sentence lengths. Too close → fix.
   • Curvature: did I rebuild logic or just reword?
   • Distribution/voice: does this read like a specific person or generic-human?
   • Artifacts: run the Grep regex. Any hit = not done.
5. Final revision addressing every weakness. Zero em/en dashes, zero curly quotes, zero Unicode tells. Re-run scripts/score.py on the final text.
6. Deliver: final rewrite, the before → after risk scores from the script, a one-line note on the statistical weaknesses fixed, and (if asked) the draft + self-score. Restate the caveat that the score covers statistical detectors only.

Detector-feedback workflow (when the user CAN run a detector)

This is the NeurIPS-2025 adversarial-paraphrasing principle and is the single most effective real technique: optimize against an actual detector's signal. Claude can't call the detector itself, so the user closes the loop.

1. Produce the default rewrite (steps above).
2. User runs it through their detector (GPTZero, Originality, Turnitin, etc.) and pastes back: the overall score and, crucially, the sentence-level highlights of what scored as AI.
3. Targeted second pass: rewrite only the flagged sentences harder — more structural change, more specific diction, more length variance. Leave the passing sentences alone (changing them risks regressions).
4. Repeat until the score clears the user's threshold or stops improving.

Because high-performing detectors converge on the same "human" distribution (Cheng et al., 2025), text optimized against one detector usually transfers to others — but always verify on the detector that actually matters to the user.

Honest limitations (state these when relevant)

• Adversarially-trained classifiers may be unbeatable by tooling. Pangram and GPTZero are explicitly trained on humanizer/paraphraser output. Pangram 3.0 (Dec 2025) even has a four-tier output: Fully Human / Lightly AI-Assisted / Moderately AI-Assisted / Fully AI-Generated — "AI-assisted" still flags. Against these, the only durable win is genuinely human-distribution text (Lever 4) plus feedback iteration, and even that can fail.
• No method beats every detector at once. What clears Originality may fail Pangram. Always test on the detector that matters.
• It's an arms race. GPTZero ships new models (3.2b, March 2025) trained on the latest LLM output including Claude and GPT-4.1. A technique that works this month may not next month.
• Meaning drift is the real risk. The harder you push, the more you risk changing what the text says. Correctness beats stealth — verify meaning held.
• Technical/factual text has a low perplexity ceiling. A method section or API doc genuinely is predictable. Don't break accuracy chasing a score.

Compact example

Before (textbook AI: low perplexity, even cadence, em dashes):

Remote work has emerged as a pivotal shift in the modern workplace, fundamentally transforming how organizations operate. It offers numerous benefits — including increased flexibility, improved work-life balance, and enhanced productivity. However, it also presents challenges that must be navigated carefully. Ultimately, the future of work will likely be shaped by how effectively companies adapt to this evolving landscape.

Self-score: every sentence 18–24 words (burstiness fail); every word the model default (perplexity fail); "pivotal," "fundamentally transforming," rule of three, "navigate," "evolving landscape" (lexical tells); one em dash; generic close.

After (high burstiness + specific diction, zero artifacts):

Remote work stuck. Companies that swore everyone would be back at their desks by 2022 are now fighting over who gets to keep the corner office nobody uses. The upsides are real: people skip the commute, see their kids at lunch, and a few of them actually get more done. The downsides are real too, and most of them come down to one thing, which is that managing people you can't see is a skill almost nobody was trained for. What happens next mostly depends on whether managers learn it.

Sentence lengths: 3, 27, 22, 31, 9. That spread is the point.

Files in this skill

• scripts/score.py — before/after detection-risk estimator (stdlib only).
• reference/detector-landscape.md — per-detector teardowns and full citations (GPTZero, Pangram, Binoculars, DetectGPT, watermarking, the bias and impossibility results, the adversarial-paraphrasing attack).
• reference/test-cases.md — three worked before/after examples with scores (easy free prose → technical → formal proof), showing where the ceiling is.