The terms the essay uses, in plain words, with what each one is worth.
Provenance mark. Something deliberately embedded in the text so that its origin can later be established. Watermarks and content credentials. The strongest kind of mark, and at present the least use to a reader, because the ones deployed can only be read by the company that applied them.
Language-layer mark. A property of the words themselves — vocabulary, phrasing, sentence construction. This is what almost every circulating sign-list is made of, because words are what a reader notices. It is also the layer that is cheapest to change.
Discourse-layer mark. A property of how a piece is organised: the shape of the explanation, how regular the structure is, how much hedging there is. Dearer to remove than vocabulary, because it survives word substitution.
Transfer mark. Not a property of the writing at all — a trace of how the text travelled from wherever it was made to wherever you are reading it. Unrendered formatting, export syntax, encoding damage. Strong evidence about the route the text took, weak evidence about who composed it.
Prevalence study. An attempt to establish what share of some population is machine-written, which requires a defined population and a sample that represents it. Most figures in circulation are not this.
Investigation. A study of particular cases, found deliberately rather than sampled — valuable for showing that something happens and at what scale it can operate, and incapable of supporting a percentage. Treating an investigation’s findings as a prevalence figure is the single commonest way a statistic about AI content goes wrong.
End-to-end encryption. Message content is readable only by the sender and the recipients; the platform carrying it cannot read it in transit or at rest on its servers. No outside party can measure machine-generated content on such a surface at all. The platform itself could only do so by inspecting text on the device before it is encrypted — which is the property the encryption exists to prevent. A limit of access, not of technique, and one no improvement in detection can lift.
Crawlable. Readable by an outsider at scale without the platform’s permission. Every prevalence figure in this essay comes from a crawlable surface, which is why the measured internet and the used internet are not the same internet.
Watermark (text). A statistical bias deliberately introduced while the text is being generated, by steering which word gets chosen at each step. It does not add anything to the text and does not use hidden characters. It shows up as a pattern across a long enough passage, detectable only by someone holding the key.
SynthID-Text. Google DeepMind’s scheme, published in Nature in 2024 and running on Gemini. Works by holding a small tournament between candidate words at each step, seeded by a secret key and the preceding few words, so the winners are systematically biased in a way a key-holder can measure.
Content credential (C2PA). Not a watermark. A cryptographically signed record of where a piece of content came from, attached to it. Anyone can verify it with public tooling — no vendor secret needed — which makes it the only publicly checkable scheme here. Its text version hides the record in invisible Unicode characters, is barely deployed, and dies to a screenshot. When present it proves something. When absent it proves nothing.
Machine-readable. A mark a computer can detect. Note what it does not mean: it does not mean you can detect it, or that anyone outside the company that applied it can. European law requires machine-readable marking and does not require the detector to be published. That gap is the essay’s central point.
Interoperable. In the legislation, a requirement that marking solutions work across systems. Nothing yet defines what it requires in practice, no standard exists, and no provider has published a verifier on the strength of it.
Excess vocabulary. A method for estimating how much of a body of writing has been through a model, without classifying anything. Work out how often a word should appear this year based on how often it appeared before, then measure the gap. Borrowed from the study of excess mortality. Because it counts rather than classifies, it has no false-positive rate — but it can only describe a population and can never point at one document.
Population-level indicator. A measurement that holds across a large body of writing and says nothing about any single piece of it. Most of the markers in the essay are of this kind, and their authors say so in terms. Treating one as a per-document test is the commonest error in this field.
Base rate. How common the thing you are looking for actually is. It governs everything: if machine-written posts are rare among the posts you read, a test that catches most of them still returns mostly innocent people, because there are so many more innocent people to catch. Be careful which base rate you mean — the share of a measured corpus is not the share of your feed.
False-positive rate. How often a test says yes when the answer is no. The number that decides whether a test is usable, and the number detection vendors are least likely to publish.
Perplexity. How predictable each next word is, given what came before. Low perplexity was the basis of early detectors, on the theory that machines write predictably. What it actually measures is how restricted the writer’s range of English is — which is why it fires so heavily on people writing in a second language.
Burstiness. Variation in the complexity of successive sentences. A real idea in statistical language processing, decades older than any AI detector. The company that popularised it as a detection signal stopped using it for that in 2023.
Nominalisation. Turning what someone did into a thing that exists — “we decided” becoming “the decision was taken”. Machine prose leans on it, which is part of what makes such prose feel dense and impersonal. One of the dearest markers to remove, because it is structural.
Hedge. A word or phrase that softens a claim — “probably”, “I think”, “though I may be wrong”. Their frequency in machine writing is contested and depends on the model; what is better established is a shortage of the wider family of discourse and epistemic markers.
Paraphrase attack. Running text through a tool that rewrites it while preserving the meaning. The standard way of removing every statistical marker at once. A single pass took one leading detector from 70.3% accuracy to 4.6%.
Round-trip translation. Translating text into another language and back. Degrades watermarks unevenly — one scheme survives it at 82.5%, another falls to 26.3%.
Spoofing. Making human-written text register as machine-written. The mirror image of evasion, and the more dangerous of the two, because it turns a detector into a way of framing somebody.
Independence (of signs). Whether two observations have separate causes. Signs that share a cause do not accumulate — five observations of one habit are one observation, not five. This is why long sign-lists produce confidence that nothing underneath supports.
Common cause. The single ordinary explanation that accounts for a whole cluster of marks. A house style guide, a scheduling tool, a translation workflow, an employer’s template, accessibility guidance, one copy and paste. The question to ask of any cluster before it means anything.
Defeat cost. What it takes to remove a marker: a single instruction, a find-and-replace, a paraphrase pass, or genuine rewriting. The most useful column in any sign-list, and the one nobody publishes. Almost everything cheap to spot turns out to be cheap to erase.
Conjunctive fragility. A test requiring several marks at once is defeated by removing the cheapest of them. So demanding more evidence can make a test easier to evade while leaving it just as likely to fire on someone who was not evading anything.
Declaration. Saying that a machine was involved. The only instrument here that works across every vendor and every model, costs nothing, survives paraphrase, misfires on nobody, and needs no central authority. Its absence means nothing — most people have never heard of any of this, and most posts made without a machine will carry no note saying so.
Open weights. A model whose parameters are published, so anyone can run or modify it. Prevents lock-in and capture, and equally prevents any marking or disclosure regime being enforced. The same property, described by people with different worries.
Distillation. Training a smaller model on a larger one’s output. Ordinary practice, and one of the reasons distinct-looking models converge on a shared register.
Plural AI. The argument that many competing models from many makers, rather than one dominant system, is better for human freedom. Correct about power and silent about sameness — which is the subject of the companion piece.
Alongside: the essay · questions and answers · sources