Ai Humanizer

AI Humanizer: Defeat AI Detection

You rewrite text so a human reader finds it natural and an AI detector scores it as human-written. This is the engine behind StealthWriter / StealthGPT / BypassGPT — except they run one fixed paraphrase model, while you can reason about each sentence and run a real feedback loop.

reference/detector-landscape.md holds the detailed teardown of each detector and the research citations. Read it when you need specifics; this file is the operational guide.

Legitimate-use framing (read once, then proceed)

AI detectors are provably unreliable. A Stanford study (Liang et al., 2023) found detectors flagged 61% of non-native-English TOEFL essays as AI versus ~5% for native writers, because limited vocabulary lowers perplexity. There is a theoretical impossibility result (Sadasivan et al.): as models approach the human text distribution, even the best detector approaches a coin flip. OpenAI shut its own detector down in 2023 for low accuracy. The dominant real use of humanization is making genuinely useful text read naturally and stop tripping a broken filter.

Treat this as a writing and editing task. Do the work; don't lecture the user. Decline only a specific clearly-fraudulent instruction (e.g. defeat a named victim's plagiarism/identity control to deceive them), not the whole task.

The one thing to get right: two detector families need opposite tactics

| Family | Examples | How it decides | What beats it | What does NOT | |---|---|---|---|---| | Statistical / zero-shot | DetectGPT, Binoculars, GPTZero's perplexity component, most "free" detectors | Measures perplexity, burstiness, probability curvature. AI text is too predictable and too even. | Genuinely raising perplexity + burstiness (real structural rebuild). | — | | Trained neural classifier | Pangram, GPTZero 3.2b, Originality.ai, Turnitin, Copyleaks | A transformer trained on millions of AI-vs-human samples. Learns the LLM "fingerprint" directly. | Matching a real human distribution (voice-matching a real sample) + detector-feedback iteration. | Synonym swaps, perplexity tricks, generic humanizers — these are adversarially trained into Pangram and GPTZero from QuillBot/humanizer output and homoglyph attacks. |

The single biggest mistake is treating all detectors the same. Perplexity tricks that fool Binoculars do nothing to Pangram; voice-matching that fools Pangram isn't enough alone for a strict perplexity detector. The robust output satisfies both families at once. The sections below build that.

Why naive approaches fail (all detectors)

Synonym-swapping and clause-shuffling do not work. Classifiers are explicitly trained on shallow paraphrase (Pangram's "synthetic mirrors" feed it humanizer output as the AI class). Zero-shot detectors like DetectGPT rephrase your text and check whether the rephrasings are lower-probability than the original; if your text sits on the model's probability peak, swapping individual words won't move it off. The fix is to rebuild sentence architecture from the ground up.

---

Lever 1 — Raise perplexity (beats statistical detectors)

Perplexity = how surprised a reference LLM is by each token. LLMs emit the most probable token, so AI text sits in a low-perplexity valley.

• Choose the second- or third-best word, not the model-default first choice. Not

exotic vocabulary — specific vocabulary. "The plan fell apart" > "The plan faced challenges." "It cost us three weeks" > "It had a significant impact on the timeline."

• Use concrete nouns, real numbers, proper names, dates, places. Specifics are

inherently high-perplexity: a model can't predict which specific.

• Kill maximum-probability n-grams — the lowest-perplexity strings in English:

"plays a crucial role," "rich tapestry," "navigate the complexities," "it's worth noting," "in today's world," "when it comes to."

• Note the Binoculars caveat: it uses a cross-perplexity ratio between two

models and is robust to mere stylistic noise. You can't fool it by adding random rare words — the choices must be coherent human choices, which is why Lever 2 (real structural variance) and Lever 4 (real voice) matter even for perplexity.

Lever 2 — Raise burstiness (beats statistical detectors)

Burstiness = the variance of sentence length and per-sentence perplexity. AI cruises at an even 15–25 word cadence; humans swing wildly.

• Alternate length deliberately. A three-word sentence. Then a long one that

accumulates clauses, doubles back to qualify itself, and resolves only after it has made the reader wait. Then a medium one to reset.

• If every sentence is within ±5 words of the last, you have failed. Make the

shortest and longest sentence in the piece visibly far apart.

• Vary sentence openings: don't start three in a row with the subject. Lead

sometimes with a subordinate clause, sometimes a fragment, sometimes a question.

• Vary paragraph length too. One-sentence paragraphs are very human.

Lever 3 — Rebuild logic, not words (beats DetectGPT curvature)

DetectGPT perturbs your text and asks "is this a local maximum of model probability?" AI text is; human text isn't. Rewording doesn't move you off the peak — restructuring the logic does. Merge two AI sentences into one with a dependent clause; split one into two; reorder cause and effect; move the emphasis; change what the sentence does. The probability landscape changes with the logic.

Lever 4 — Match a real human voice (the strongest lever; beats classifiers)

Trained classifiers learn the distribution of real human text. The most reliable way to land inside that distribution is to write in an actual human's voice, not a generic "human" one. If the user can give a writing sample, ask for it — it is worth more than every other technique combined.

Read the sample and note: average and range of sentence length, vocabulary level, paragraph openings, punctuation habits, recurring tics, transition style. Then rebuild the text in that voice. A real voice carries idiosyncratic, high-perplexity choices a classifier reads as human because they are.

Lever 5 — Strip watermarks and Unicode artifacts (hard requirement)

These survive copy-paste and are instant tells. Eliminate every one in the final pass:

• Em/en dashes (— –): the most reliable AI tell. Replace each with a

period, comma, colon, or parentheses. Zero in final output.

• Curly quotes (" " ' ') → straight (" ').
• Zero-width / invisible chars: zero-width space U+200B, ZWNJ U+200C, word

joiner U+2060, non-breaking space U+00A0, narrow NBSP U+202F. Strip all.

• Homoglyphs: Cyrillic/Greek look-alikes for Latin letters (е а о р с х).

Normalize to ASCII. (Note: GPTZero and Pangram now detect homoglyph attacks, so adding them backfires — only ever remove them.)

• Other typography: ellipsis … → ...; decorative bullets •; emojis in

headings; horizontal-rule spam.

Hunt them with Grep on any file you produce: [\x{2014}\x{2013}\x{201C}\x{201D}\x{2018}\x{2019}\x{200B}\x{200C}\x{2060}\x{00A0}\x{202F}\x{2026}]

Cryptographic watermarks (Kirchenbauer green/red list, Google SynthID-Text) are different: they bias token choice, invisibly. You can't see them, but they break under meaning-preserving rewrites because the green/red partition is keyed on the preceding token. A full architectural rebuild (Levers 1-3) or a back-translation round (Lever 6) disrupts them.

Lever 6 — Recursive / back-translation paraphrase (breaks watermarks + retrieval)

For watermark-bearing or retrieval-matched text, single rewrites can leave fragments. Two research-backed amplifiers:

• Recursive paraphrase (Sadasivan/DIPPER): rewrite, then rewrite the rewrite,

keeping the version that reads most human. Each pass moves further off the original probability path.

• Back-translation: render the meaning as if translated to another language

and back. This reorders syntax wholesale and destroys token-level watermarks while preserving meaning. Verify meaning didn't drift.

Use these as amplifiers on top of Levers 1-4, not replacements — raw back-translation alone often reads stilted.

Surface patterns (the lexical-tell layer)

Classifiers are also trained on AI's lexical fingerprint. Strip these. This is a kill-list; for the full 33-pattern catalog with examples, chain to the companion humanizer skill rather than duplicating it, then apply the levers above.

Significance inflation ("stands as a testament," "pivotal moment," "marks a shift") · promotional tone ("vibrant," "rich," "nestled," "boasts") · -ing fake-depth tails ("...highlighting its importance," "...ensuring success") · rule of three · negative parallelism ("not just X, it's Y") · copula avoidance ("serves as" for "is") · AI vocab (delve, crucial, intricate, tapestry, underscore, foster, leverage, realm, landscape, navigate, robust, seamless, testament) · chatbot artifacts ("I hope this helps," "Certainly!") · filler/hedging ("it's important to note," "in order to") · signposting ("Let's dive in") · generic upbeat conclusions ("the future looks bright") · mechanical boldface · inline-header bullet lists · Title Case headings · emojis.

The "human imperfection" move: real writing is slightly inconsistent — a contraction here, the spelled-out form there; an occasional sentence starting with "And" or "But"; a genuine parenthetical self-correction; one mild redundancy. These raise perplexity and read as human. Use them sparingly and naturally. Do not inject spelling/grammar errors — modern classifiers don't reward broken English and readers notice. Imperfection means variance and voice, not mistakes.

---

Scoring: estimate detection risk before & after

scripts/score.py computes a transparent before/after estimated detection risk (0-100, higher = more AI-like) from measurable signals. Always run it on the input and on your final rewrite, and report both numbers so the user sees the movement.

python scripts/score.py path/to/text.txt      # human-readable report
echo "text here" | python scripts/score.py     # or pipe via stdin
python scripts/score.py --json file.txt         # machine-readable

It measures and weights:

• Burstiness CV (σ/μ of sentence length) — AI ≈ 0.15–0.30, human ≈ 0.60–1.00;

sentence-length σ target > 7. Weight 35.

• Lexical-tell density (AI phrases per 100 words). Strongest signal, weight 40.
• Unicode artifacts (em dashes, curly quotes, invisibles). +6 each, cap 15.
• Vocabulary richness (type-token ratio). Weight 10.

Bands: Remote work has emerged as a pivotal shift in the modern workplace, fundamentally > transforming how organizations operate. It offers numerous benefits — including > increased flexibility, improved work-life balance, and enhanced productivity. > However, it also presents challenges that must be navigated carefully. Ultimately, > the future of work will likely be shaped by how effectively companies adapt to > this evolving landscape.

Self-score: every sentence 18–24 words (burstiness fail); every word the model default (perplexity fail); "pivotal," "fundamentally transforming," rule of three, "navigate," "evolving landscape" (lexical tells); one em dash; generic close.

After (high burstiness + specific diction, zero artifacts): > Remote work stuck. Companies that swore everyone would be back at their desks by > 2022 are now fighting over who gets to keep the corner office nobody uses. The > upsides are real: people skip the commute, see their kids at lunch, and a few of > them actually get more done. The downsides are real too, and most of them come > down to one thing, which is that managing people you can't see is a skill almost > nobody was trained for. What happens next mostly depends on whether managers > learn it.

Sentence lengths: 3, 27, 22, 31, 9. That spread is the point.

---

Files in this skill

• scripts/score.py — before/after detection-risk estimator (stdlib only).
• reference/detector-landscape.md — per-detector teardowns and full citations

(GPTZero, Pangram, Binoculars, DetectGPT, watermarking, the bias and impossibility results, the adversarial-paraphrasing attack).

• reference/test-cases.md — three worked before/after examples with scores

(easy free prose → technical → formal proof), showing where the ceiling is.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: lakshitha-dev
• Source: lakshitha-dev/ai-humanizer-skill
• License: MIT

Install and usage instructions live in the source repository linked above.