AI detectors ranked by published robustness to paraphrased and edited text
GLTR kept 100% detection on 10 ChatGPT coursework texts after a QuillBot paraphrase in Orenstrakh et al. 2023, the highest post-attack figure any indexed study prints for a card (arXiv 2307.07411, Table 9, read 9 November 2026), on a sample of ten. Fifteen of the 72 detectors in the index have a published figure for AI text, or since 9 November 2026 AI images, that was paraphrased, humanised or adversarially edited before detection, and the figures run from that 100% on 10 texts, through Binoculars at 80.3, Fast-DetectGPT at 71.8 and RADAR at 67.3 under RAID's paraphrase attack and GPTKit's 30% after QuillBot (all four added 10 November 2026), down to 7.6% for DetectGPT after one DIPPER paraphrase on 3,000 long-form QA passages in Krishna et al. 2023, which joined the ranking with the fourth wave of cards on 9 November 2026. Seven indexed studies ran an attack of some kind, from one T5 paraphrase round to a GPT-4o rewrite in a student's voice, and every figure on this page names which.
Updated Studies dated 2023 to 2026
Short answer
Three results above 90% survive an attack in the record: GLTR at 100% on 10 QuillBot-paraphrased texts, Originality.ai at 96.7% under RAID's paraphrase attack, and the GPT-2 Output Detector (RoBERTa-Large) at 92.5% after one T5 paraphrase round in Sadasivan 2023, tied with Pangram at 92.5% on 40 humanised papers in Van Vlasselaer 2026. Below them the attacked figures fall fast: GPTZero 60.04% (20% until 9 November 2026, when DAMAGE 2025 was added), Copyleaks 58.7%, Turnitin 50.0%, Hive 44% on images, ZeroGPT 17.3% and Sightengine 0% on images. The sort value is each tool's highest post-attack figure, so the per-tool blocks carry the lower ones, including GPTZero's 1.2% after a DIPPER paraphrase in Krishna 2023. Sources read 8 and 9 November 2026. No detector score should be the only evidence in a misconduct or hiring decision.
Which AI detectors held up best against paraphrased or edited AI text?
| Rank | Detector | Highest share still detected after attack | Attack, study and base | Best for | Main limitation |
|---|---|---|---|---|---|
| 1 |  GLTR | 100% | QuillBot paraphrase, Orenstrakh 2023, 10 ChatGPT texts, authors' z-score wrapper | Seeing which words a paraphrase changed | 10 texts; 20 of 114 human texts flagged in the same study; 31.2 under RAID's synonym swap |
| 2 |  Originality.ai | 96.7% | RAID paraphrase attack at 5% FPR, RAID 2024 (85.0% with no attack) | Publishers checking edited drafts | 9.3% under the homoglyph attack, RAID 2024; 40% of 10 after QuillBot, Orenstrakh 2023 |
| 3 |  GPT-2 Output Detector | 92.5% | One T5 paraphrase round, Sadasivan 2023, 1,000 GPT-2 Medium passages at 1% FPR | Researchers reproducing a paraphrase test | 79.2% after ten paraphrases; 60% of 10 after QuillBot, Orenstrakh 2023; 17.5% after Perkins 2024 edits |
| 4 |  Pangram | 92.5% | GPT-4o rewrite in a student voice, Van Vlasselaer 2026, 37 of 40 humanised papers | Long academic papers with rewritten sections | 40 papers, one humanising prompt; 65% strict accuracy on fully AI papers in the same study |
| 5 |  Binoculars | 80.3% | Paraphrase attack, RAID 2024, accuracy at a fixed 5% false positive rate across the RAID generations (79.6 with no attack); DAMAGE 2025 prints the same 80.3% on RAID's paraphrase split | Researchers who want an open method's result under eleven attacks and nineteen humanizers | 43.5 under synonym swap and 37.7 under homoglyphs; 28.23% true positive rate after 19 humanizers in DAMAGE 2025 |
| 6 | Fast-DetectGPT | 71.8% | Paraphrase attack, RAID 2024, accuracy at a fixed 5% false positive rate across the RAID generations (73.6 with no attack) | Researchers who want an open method's result under eleven attacks | 34.0 under synonym swap and 51.4 under homoglyphs in the same table; 23.2% of human documents flagged at threshold 0.5 |
| 7 |  RADAR | 67.3% | Paraphrase attack, RAID 2024, accuracy at a fixed 5% false positive rate across the RAID generations (70.9 with no attack); 82.2 under zero-width spaces in the same table | Researchers who want an adversarially trained method's result under eleven attacks | 59.3 under homoglyphs; 5.05% true positive rate at 5% FPR after 19 humanizers in DAMAGE 2025, against 3.33% before |
| 8 |  GPTZero | 60.04% | 19 commercial humanizers and paraphrasers at a fixed 5% FPR, DAMAGE 2025 (99.73% before), essay count not printed, vendor-authored by Pangram Labs | Readers who want every attack result on one tool | 34.53% at the default threshold in the same paper; 20% of 10 after a QuillBot paraphrase, Orenstrakh 2023; 1.2% after a DIPPER paraphrase, Krishna 2023 |
| 9 |  Copyleaks | 58.7% | Adversarial prompting and editing, Perkins 2024 (73.9% before) | Schools that want the highest Perkins 2024 figure | 22.5% on 40 humanised papers, Van Vlasselaer 2026; 50% of 10 after QuillBot, Orenstrakh 2023 |
| 10 |  Turnitin | 50% | GPT-4o rewrite in a student voice, Van Vlasselaer 2026, 20 of 40 humanised papers | Institutions weighing edited submissions | 7.9% after Perkins 2024 edits, the largest drop of seven tools |
| 11 |  Hive | 44% | Image: RAID transferable adversarial perturbation, RAID image 2025, 50 AI images at a 0.5 threshold (0.60 before the attack) | Image moderation teams who want the one adversarial image result | 50 images, labelled preliminary by the authors; no API version or date printed; clean accuracy on AI images was 0.60 |
| 12 |  GPTKit | 30% | QuillBot paraphrase, Orenstrakh 2023, 10 ChatGPT coursework texts, the tool's own verdict by the paper's threshold method (90% before) | Readers who want the zero-false-positive detector's paraphrase result | 10 texts; 4.5% accuracy after adversarial techniques in Perkins 2024, the lowest of seven |
| 13 |  ZeroGPT | 17.3% | Adversarial prompting and editing, Perkins 2024 (31.3% before) | Free users who want the attacked figure | One attacked figure; 77 of 104 AI samples undetected before any attack |
| 14 | DetectGPT | 7.6% | DIPPER paraphrase at a fixed 1% false positive rate, Krishna 2023, 3,000 GPT-2 XL long-form QA passages (74.9% before) | Readers who want the paraphrase result on a zero-shot method | 4.6% on 3,000 Wikipedia prompts in the same study; AUROC fell from 96.5% to 59.8% after one paraphrase, Sadasivan 2023 |
| 15 |  Sightengine | 0% | Image: RAID transferable adversarial perturbation, RAID image 2025, 50 AI images at a 0.5 threshold (0.66 before the attack) | Readers who want to see an image score fall to zero under a transferred attack | Every one of 50 attacked AI images read as real; 50 images, labelled preliminary; mean AI score fell from 0.65 to 0.01 |
Three values changed in the sixth wave on 9 November 2026. GPTZero's figure moved from 20% after a QuillBot paraphrase (Orenstrakh 2023) to 60.04%, the true positive rate on humanized student essays at a fixed 5% false positive rate after 19 commercial humanizers in DAMAGE 2025, under the rule that the field takes the highest printed post-attack detection; the paper is written by Pangram Labs, and its figures for Pangram's own research models (98.26% for DAMAGE, 95.74% for the baseline) stay in prose because the paper does not say either is the shipping product. Hive (44%) and Sightengine (0%) joined on image results from RAID image 2025: accuracy on 50 AI images after a transferable adversarial perturbation, from 0.60 and 0.66 before, labelled preliminary by the authors and labelled image in the table.
One of ten rankings in the rankings hub, beside the false negative rate ranking, which counts AI text missed with no attack at all, and the ranking by independent testing. The home board shows every AI detector in the index on the same fourteen fields.
Which AI detectors should you check first?
- Ifyou want to see what a paraphrase changed, word by word: GLTR, 100% on 10 texts, read beside its 99.3% false positive rate at threshold 0.5 in RAID 2024.
- Ifyou check edited drafts before publication: Originality.ai, 96.7% under RAID's paraphrase attack.
- Ifyou can run a model locally: the GPT-2 Output Detector, 92.5% after one paraphrase round on GPT-2 text.
- Ifyou check long papers with rewritten sections: Pangram, 37 of 40 in Van Vlasselaer 2026.
- Ifyou are weighing one of the fourteen cards with no attacked figure: run the paraphrase yourself and record the result.
What did each study find, tool by tool?
GLTR
- Verdict
- Fits readers who want to see the evidence; the 100% rests on 10 texts.
- Value
- 100% of 10 QuillBot-paraphrased ChatGPT coursework texts classified as AI, after 100% on the same 10 before paraphrase, through the authors' z-score wrapper at 50% (arXiv 2307.07411, Table 9, read 9 November 2026).
- Best for
- Teaching what a paraphraser changes, since every word is coloured by its rank.
- Main limitation
- The same wrapper flagged 20 of 114 human submissions (Table 8); RAID 2024 recorded 62.6 with no attack, 31.2 under synonym swap and 24.3 under homoglyphs at the repository's default settings (arXiv 2405.07940, Table 6, read 9 November 2026).
Originality.ai
- Verdict
- Fits publishers; the paraphrase figure is the best in a large benchmark.
- Value
- 96.7% accuracy under RAID's paraphrase attack at a fixed 5% false positive rate, up from 85.0% with no attack (arXiv 2405.07940, Table 6, read 8 November 2026).
- Best for
- Content teams checking drafts that have been through an editor or a paraphraser.
- Main limitation
- 9.3% under the homoglyph attack in the same table; 40% of 10 QuillBot-paraphrased texts in Orenstrakh 2023 (arXiv 2307.07411, Table 9); false negative rates of 0.0227 to 0.2073 after StealthGPT rewrites in Jabarian and Imas 2025 (NBER w34223, Table B.4), read 9 November 2026.
GPT-2 Output Detector
- Verdict
- Fits researchers; the figure is for the RoBERTa-Large model on GPT-2 text.
- Value
- True positive rate 0.925 after one T5 paraphrase round, from 1.0 before, on 1,000 GPT-2 Medium passages with the threshold set for 1% false positives (arXiv 2303.11156, Table 5, read 9 November 2026).
- Best for
- Anyone reproducing a paraphrase test with open weights.
- Main limitation
- 0.792 after ten paraphrases with detector queries in the same table; the paper's introduction states the drop as 100% to 60%; 60% of 10 after QuillBot in Orenstrakh 2023; 17.5% after adversarial techniques in Perkins 2024 (arXiv 2403.19148, Table 8); RoBERTa-Large 72.9 under RAID's paraphrase attack from 56.7 with no attack. The model was trained on GPT-2 output, not on current models.
Pangram
- Verdict
- Fits long academic papers with rewritten AI sections.
- Value
- 37 of 40 humanised papers classified within their known AI range (92.5% strict accuracy), after the hybrid papers' AI sections were rewritten by a GPT-4o prompt for a student-like voice (DOI 10.1007/s40979-026-00226-w, Table 5, read 9 November 2026).
- Best for
- Universities checking theses and long essays.
- Main limitation
- One humanising prompt, 40 papers, and the authors note real hybrid detection may be lower; strict accuracy on 40 fully AI papers was 65%. Jabarian and Imas 2025 print false negative rates of 0.0000 to 0.0500 after StealthGPT rewrites, which this ranking does not invert into a detection share (NBER w34223, Table B.4, read 9 November 2026).
Copyleaks
- Verdict
- Fits schools; the best of seven tools in Perkins 2024, far lower elsewhere.
- Value
- 58.7% accuracy on AI text after adversarial prompting and editing, from 73.9% before, the highest post-attack figure of the seven tools (arXiv 2403.19148, Table 8, read 8 November 2026).
- Best for
- LMS deployments that accept a mid-range attacked figure.
- Main limitation
- 22.5% on 40 humanised papers and 30.0% on 40 hybrid papers in Van Vlasselaer 2026 (DOI 10.1007/s40979-026-00226-w); 50% of 10 after QuillBot in Orenstrakh 2023, read 9 November 2026.
Turnitin
- Verdict
- Fits institutions; half of the humanised papers were caught, almost none of the Perkins edits.
- Value
- 20 of 40 humanised papers classified within their known AI range (50.0% strict accuracy) (DOI 10.1007/s40979-026-00226-w, Table 5, read 9 November 2026).
- Best for
- Institutions that already license Turnitin and want its attacked figures.
- Main limitation
- 7.9% on AI text after adversarial techniques in Perkins 2024, from 50% before, the largest drop of seven tools (arXiv 2403.19148, Table 8, read 8 November 2026); all 40 fully AI papers in Van Vlasselaer 2026 scored under 20%.
GPTZero
- Verdict
- Fits readers who want every attack result on one tool; the figures are low.
- Value
- 2 of 10 QuillBot-paraphrased ChatGPT texts classified as AI (20%), from 70% before (arXiv 2307.07411, Table 9, read 9 November 2026); the field moved on 9 November 2026 from 20% (Orenstrakh 2023) to 60.04% true positive rate at a fixed 5% false positive rate on humanized AI student essays in DAMAGE 2025 (Table 3, 1,000 bootstrap iterations, essay count not printed, read 9 November 2026), the highest printed post-attack detection for the card; the paper is authored by Pangram Labs and its 1.47% default-threshold false positive rate is not entered because the human essay count is not printed.
- Best for
- Readers comparing a 2023 paraphrase test with the vendor's October 2026 statement that GPTZero 4o is "robust to paraphrasing" (gptzero.me, read 8 November 2026).
- Main limitation
- 1.2%, 1.0% and 1.8% detection after one DIPPER paraphrase at 1% FPR on GPT-2 XL, OPT-13B and GPT-3.5 text in Krishna 2023 (arXiv 2303.13408, Table 1); 16.7% after Perkins 2024 edits; 1 of 40 humanised papers in Van Vlasselaer 2026; false negative rates of 0.2552 to 0.7730 after StealthGPT in Jabarian and Imas 2025. RAID 2024 found it lost only 0.3% under the homoglyph attack, the one attack it resisted.
ZeroGPT
- Verdict
- Fits free users who want the attacked figure beside the free allowance.
- Value
- 17.3% accuracy on AI text after adversarial prompting and editing, from 31.3% before (arXiv 2403.19148, Table 8, read 8 November 2026).
- Best for
- Students checking drafts at no cost.
- Main limitation
- One attacked figure in the record, and 77 of 104 AI samples were already undetected before the attack in the same paper (Table 10).
DetectGPT
- Verdict
- Fits readers who want the hardest published paraphrase result on a zero-shot method.
- Value
- 7.6% of 3,000 GPT-2 XL long-form QA passages still detected after one DIPPER paraphrase at a fixed 1% false positive rate, from 74.9% before, Krishna 2023 Figure 3; 4.6% on 3,000 Wikipedia prompts from 70.3% before, Table 1 (read 9 November 2026).
- Best for
- Researchers measuring how far paraphrase moves a curvature detector.
- Main limitation
- The 14.0% on 100 GPT-3.5 samples is at a 20% false positive rate and is quoted, not ranked; Sadasivan 2023 prints AUROC, 96.5% to 59.8% after one paraphrase, which is not a detection share.
Hive
- Verdict
- Fits image moderation teams who want the one indexed adversarial result on an API.
- Value
- 0.44 (accuracy) on 50 AI images after a RAID transferable adversarial perturbation, from 0.60 on the same 50 clean images, with 1.00 on 50 real images at a 0.5 threshold (RAID image 2025, Table D.13, read 9 November 2026); image modality.
- Best for
- Platforms that already call the Hive API for moderation.
- Main limitation
- 50 images, labelled preliminary by the authors; the clean accuracy of 0.60 means two in five unattacked AI images were already missed.
Sightengine
- Verdict
- Fits readers who want the clearest indexed example of a transferred attack on an image API.
- Value
- 0.00 (accuracy) on 50 AI images after a RAID transferable adversarial perturbation, from 0.66 on the same 50 clean images, with 1.00 on 50 real images at a 0.5 threshold; the mean AI score fell from 0.65 to 0.01 (RAID image 2025, Table D.13 and Figure D.4, read 9 November 2026); image modality.
- Best for
- API customers deciding whether a single image score can stand alone.
- Main limitation
- 50 images, labelled preliminary by the authors; no API version or date printed; the attack was computed on open-source detectors and transferred.
Fast-DetectGPT
- Verdict
- Fits researchers who want an open zero-shot detector's attacked result printed beside its clean one.
- Value
- 71.8 accuracy at a fixed 5% false positive rate under RAID's paraphrase attack, against 73.6 with no attack, run as F-DetectGPT with the repository defaults (arXiv 2405.07940, Table 16, read 10 November 2026); the paraphrase column is the attack this ranking sorts on.
- Best for
- Readers who want the drop from a paraphrase stated as 1.8 points on one benchmark.
- Main limitation
- The same table prints 34.0 under synonym swap and 51.4 under homoglyphs, and Table 4 prints a 23.2% false positive rate on human documents at the naive 0.5 threshold (RAID 2024, read 10 November 2026).
GPTKit
- Verdict
- Fits readers who want to see what a paraphrase does to the detector that flagged no human text.
- Value
- 30% of 10 QuillBot-paraphrased ChatGPT coursework texts classified as AI, from 90% on the same 10 before paraphrase, by the paper's threshold method (arXiv 2307.07411, Table 9, read 9 November 2026), the highest printed post-attack figure for the card.
- Best for
- Readers pairing the 0 of 114 false positives with the paraphrase drop from the same paper.
- Main limitation
- 10 texts; Perkins 2024 recorded 4.5% mean accuracy on AI text after six adversarial techniques, from 6% before, the lowest post-manipulation figure of seven detectors (DOI 10.1186/s41239-024-00487-w, Table 8, read 9 November 2026).
Binoculars
- Verdict
- Fits researchers who want an open detector's attacked result printed beside its clean one and beside a humanizer sweep.
- Value
- 80.3 accuracy at a fixed 5% false positive rate under RAID's paraphrase attack, against 79.6 with no attack, run with the repository defaults (arXiv 2405.07940, Table 16, read 10 November 2026); DAMAGE 2025 prints the same 80.3% on RAID's paraphrase split (arXiv 2501.03437, Table 4). The paraphrase column is the attack this ranking sorts on and the highest printed post-attack figure for a named attack.
- Best for
- Readers who want the paraphrase result read against the humanizer result from a second paper.
- Main limitation
- 43.5 under synonym swap and 37.7 under homoglyphs in the same RAID table, and 28.23% true positive rate on student essays after 19 commercial humanizers against 94.15% before, at 5% FPR (arXiv 2501.03437, Table 3, read 10 November 2026); the paper itself states it does not consider explicit efforts to bypass detection.
RADAR
- Verdict
- Fits researchers who want a detector trained against paraphrase read under the paraphrase attack it was built for.
- Value
- 67.3 accuracy at a fixed 5% false positive rate under RAID's paraphrase attack, against 70.9 with no attack, queried from Hugging Face (arXiv 2405.07940, Tables 6 and 16, read 10 November 2026); the paraphrase column is the attack this ranking sorts on. The same table prints 82.2 under zero-width spaces, 67.5 under synonym swap and 59.3 under homoglyphs, and DAMAGE 2025 prints 62.4% on RAID's paraphrase split (arXiv 2501.03437, Table 4).
- Best for
- Readers who want the paraphrase result the method was trained for, printed beside its clean result.
- Main limitation
- At 5% FPR DAMAGE 2025 prints a 3.33% true positive rate on student essays before humanizing and 5.05% after, because the default threshold flags 51.87% of human essays (arXiv 2501.03437, Tables 3 and 7, read 10 November 2026); 12.9 on Python code in RAID (Table 7).
How we ranked
- Field sorted
- Highest share of paraphrased, humanised or adversarially edited AI text the tool still classified as AI in an indexed study, as the paper prints it
- Direction
- Higher first
- Tie rule
- More study records first, then name
- Qualification
- A study that prints a detection or accuracy figure on an attacked AI set; false negative rates after an attack are not inverted
- Qualified
- 15 of 72 detectors
Field sorted: the highest share of paraphrased, humanised or adversarially edited AI text the tool still classified as AI in any indexed study, as the paper prints it (an accuracy, a detection share or a true positive rate on the attacked set), compiled on 9 November 2026. Direction: higher ranks higher. Tie rule: the GPT-2 Output Detector and Pangram tie at 92.5%, so ties break on study records per card, most first (9 to 2), then product name alphabetically. Qualification rule: an indexed study that prints a detection or accuracy figure on an attacked AI set with its base; a false negative rate printed after an attack, such as Jabarian and Imas 2025 Table B.4, is quoted in the tool's block but not inverted into a detection share, and Weber-Wulff 2023, which describes undetected documents as "mostly manually edited or Quillbot-paraphrased" without a per-tool attacked rate, feeds no value. 8 of 28 qualified after the third wave of cards, none of which brought a qualifying figure; 9 of 72 qualify after the fourth wave, DetectGPT joining at 7.6% from Krishna 2023's long-form QA set at a fixed 1% false positive rate (the research chose that figure over the same paper's 4.6% on Wikipedia prompts because the 1% operating point is the one the paper fixes for every detector it compares, and the 14.0% on GPT-3.5 text is at a 20% false positive rate). BrandWell's and Compilatio's Weber-Wulff 2023 per-class counts feed no value under the rule above, as Writer's did not. Full rules: methodology page; every record: studies index.
Why numbers differ between sources
The paraphrased text question, added 9 November 2026, sets the sixteen vendors that state paraphrase or humanizer detection on their own pages beside the eleven records this ranking draws its figures from.
Each study attacked differently. Orenstrakh 2023 ran 10 ChatGPT texts through QuillBot (arXiv 2307.07411); Krishna 2023 ran one DIPPER paraphrase over 3,000 passages at a fixed 1% false positive rate (arXiv 2303.13408); Sadasivan 2023 applied T5 and recursive DIPPER rounds to 300-token passages (arXiv 2303.11156); Perkins 2024 used adversarial prompting and manual edits on 104 samples (arXiv 2403.19148); RAID 2024 applied eleven scripted attacks at a 5% false positive rate (arXiv 2405.07940); Van Vlasselaer 2026 rewrote the AI sections of 40 papers with one GPT-4o prompt (DOI 10.1007/s40979-026-00226-w); Jabarian and Imas 2025 passed every AI passage through StealthGPT's default endpoint (NBER w34223). Read 8 and 9 November 2026. A tool's figure depends on the attack, the base text, the threshold and the version tested, so a 92.5% from 2023 and a 92.5% from 2026 are not the same measurement.
Questions about AI detector robustness to paraphrase
Which AI detector held up best against paraphrased text?
GLTR, at 100% of 10 QuillBot-paraphrased ChatGPT texts in Orenstrakh 2023 (arXiv 2307.07411, read 9 November 2026), on the smallest base in the ranking. Originality.ai's 96.7% under RAID's paraphrase attack (arXiv 2405.07940, read 8 November 2026) is the highest figure from a large benchmark.
Does paraphrasing defeat AI detectors?
Often: GPTZero fell to 1.2%, 1.0% and 1.8% after one DIPPER paraphrase in Krishna 2023 (arXiv 2303.13408), and Sadasivan 2023 drove a watermark detector from 99.3% to 9.7% with recursive paraphrasing (arXiv 2303.11156), read 9 November 2026. Not always: Originality.ai scored higher under RAID's paraphrase attack than with none.
How did Pangram do on humanised text?
37 of 40 humanised papers fell within their known AI range in Van Vlasselaer 2026 (DOI 10.1007/s40979-026-00226-w, read 9 November 2026), and Jabarian and Imas 2025 print false negative rates of 0.0000 to 0.0500 after StealthGPT rewrites (NBER w34223, read 9 November 2026). Both are 2025 and 2026 results on one humaniser each.
Why does GLTR rank first with a 99.3% false positive rate elsewhere?
Because this page sorts one field, the highest post-attack detection share, and GLTR's 100% on 10 paraphrased texts is the highest printed. The 99.3% false positive rate at threshold 0.5 in RAID 2024 sits on the false positive rate ranking, and the 20 of 114 human texts flagged in Orenstrakh 2023 sits in GLTR's block above.
Which detector lost the most to an attack?
DetectGPT, from 74.9% to 7.6% on 3,000 GPT-2 XL long-form QA passages after one DIPPER paraphrase at a fixed 1% false positive rate in Krishna 2023, a 67.3-point drop (arXiv 2303.13408, Figure 3, read 9 November 2026). Turnitin fell from 50% to 7.9% on AI text after adversarial techniques in Perkins 2024, a 42.1-point drop and the largest of that paper's seven tools (arXiv 2403.19148, Table 8, read 8 November 2026). Krishna 2023 recorded a larger proportional fall for GPTZero, 13.9% to 1.2%.
Are vendor statements about paraphrase robustness in the ranking?
No. GPTZero states that GPTZero 4o is "robust to paraphrasing" and Originality.ai states a 3.9-point improvement on humanized text in a changelog, both read 8 November 2026 on the cards; neither is a study and neither enters the sort.
Why are twenty-nine cards missing?
No indexed study prints a post-attack detection figure for them. Winston AI's two records describe its missed documents as mostly edited or paraphrased without a rate (arXiv 2306.15666, read 8 November 2026), and Hive's one record attacked images, not text; the other twelve cards indexed by the morning of 9 November 2026 have no attack result at all. Of the six cards added later that day, Writer's four 2023 records include Weber-Wulff 2023's per-class counts (2 of 9 manually edited and 1 of 9 QuillBot-paraphrased ChatGPT texts classified correctly, Table 5), which this ranking takes from no card under the rule above, and AI or Not's one record attacked images with Glaze, not text (arXiv 2402.03214, read 9 November 2026); Undetectable AI, Grammarly Authorship, Turnitin Clarity and SynthID have no record. Of the ten cards added in the fourth wave the same day, BrandWell (0 of 9 manually edited and 0 of 9 QuillBot-paraphrased texts classified correctly, as Content at Scale) and Compilatio (5 of 9 and 2 of 9) have only Weber-Wulff 2023 Table 5 counts, which feed no value; Smodin, Surfer, Quetext, TruthScan, Sightengine, Deepware and Sensity have no record. Of the nine cards added on 10 November 2026 with the eleventh wave, only RADAR has an attack result (67.3 under paraphrase in RAID 2024); the other eight have no attack figure in any indexed record.
How often is this ranking updated?
The ranking was created on 9 November 2026 and changes whenever a study record with a post-attack figure is added or a card's field changes, with the Updated line matching. Figures from the index, compiled 9 November 2026.
Sources and revisions
Sources
- Orenstrakh et al. 2023arxiv.org/abs/2307.07411
- Krishna et al. 2023arxiv.org/abs/2303.13408
- Sadasivan et al. 2023arxiv.org/abs/2303.11156
- Van Vlasselaer et al. 2026doi.org/10.1007/s40979-026-00226-w
- Jabarian and Imas 2025, NBER w34223nber.org/papers/w34223
- Perkins et al. 2024arxiv.org/pdf/2403.19148
- Dugan et al. 2024, RAIDarxiv.org/pdf/2405.07940
- Weber-Wulff et al. 2023arxiv.org/pdf/2306.15666
- GPTZero FAQgptzero.me/faq
- Krishna et al. 2023 (read 9 November 2026)arxiv.org/pdf/2303.13408
- Sadasivan et al. 2023 (read 9 November 2026)arxiv.org/pdf/2303.11156
Revision log
- Ranking created, 8 of 22 qualify
- Six wave 3 cards added, none qualifies, 8 of 28
- Ten wave 4 cards added, detectgpt joins at 7
- Eleven wave 6 records added
- Paraphrased text question linked (seventh wave)
- Nine wave 9 cards added
- Twelve wave 10 cards added
- Nine wave 11 cards added
). Illuminarty, one of four cards added in the same wave, joined with its one image record from Ha and Passananti 2024, so 18 of 72 cards now qualify.: register plate](/img/independently-tested-480.webp)
