Nine percent. That was the false-positive rate attached to OpenAI's own AI-text classifier before it was quietly retired in July 2023 โ and at that nine percent, its true-positive rate sat near twenty-six percent. Read those two figures together and you have a tool that misses roughly three of every four machine-generated texts while wrongly flagging nearly one in ten human ones. Now a research collaboration between Google DeepMind and the University of Pennsylvania is being reported as a step forward, on the strength of a single phrase: the detector will "show its work."
That phrase is where I stop trusting the headline and start reading the ledger.
For six weeks in 2017 I audited EVM bytecode for a privacy project that advertised a fixed supply and minted behind a hidden function. I did not need the team to explain itself to me. I needed the discrepancy between stated and actual token supply โ 12,000 ETH of it โ and a transaction hash to anchor it. A detector that "shows its work" is not a transaction hash. One is a narrative bolted onto a judgment; the other is a fact you can re-execute on demand. This article is about why the crypto industry, of all industries, should be the least impressed by the former โ and why the most important sentence in the DeepMind story is the one nobody printed: there is no false-positive rate in it.
Context first, because the absence matters. The coverage circulating is a summary-level rewrite โ two to four paragraphs of a research announcement, no test set, no TPR, no FPR, no publication date, no methodology. That is not a reason to dismiss the work. It is a reason to classify it correctly: as a narrative event, not a measured one. When a data point is missing from a document that is ostensibly about data, the silence is the finding.
The underlying claim โ "show your work" โ points at explainability, or auditability. But text detection is not one technology. It is at least three, and they fail in structurally different ways. Watermarking embeds a statistical signature in the generator's sampling; the detector runs a hypothesis test and returns a p-value-like confidence. This is genuinely auditable, but only if the detection party holds the generator's key or knows its sampling rules. Classifier and perplexity detection scores text as human or machine and returns a confidence โ this is what OpenAI shipped and retired. Provenance metadata attaches a cryptographically signed manifest to a file โ C2PA and Content Credentials are the reference implementations โ attesting to origin and edit history.
The report almost certainly blurs all three. That matters, because conflating a classifier with a watermark systematically overstates what "showing your work" can deliver. A classifier that explains itself is still a guess with a paragraph attached. A watermark is a verifiable signature โ but only inside a walled garden where the operator holds the key. And a provenance manifest is not a detection at all; it is an attestation that the content was what it claims to be.
Crypto readers should care for a specific reason: provenance is the native answer to this problem, and this industry has spent a decade building the exact cryptographic rails a probabilistic detector is trying to approximate. "Don't trust, verify" is not marketing here. It is an architectural commitment to signatures, attestations, and reproducibility. The DeepMind announcement is, structurally, an attempt to solve a provenance problem without provenance.
Here is the evidence chain, in the order I keep for any audit: what the data says, what the mechanism is, what the implication is.
The data says explainability and accuracy are orthogonal. Attaching a rationale to a judgment raises human acceptance. It does not raise statistical validity. And there is a well-documented failure mode โ the unfaithful rationale. An LLM-generated explanation can be a post-hoc story reconstructed backward from the verdict, bearing no causal relationship to the signal that produced it. Data indicates this is not an edge case; it is a structural property of language models explaining themselves. I have watched the same pattern in token dashboards: a clean chart annotated by the team that built it, describing a supply curve the contract never enforced. The annotation is not the ledger. Code is the only witness, and a witness who explains itself is a witness you have to cross-examine.
The mechanism, at scale, is a question of how errors multiply. A one percent false-positive rate sounds like precision. It is not, once volume enters the equation. At ten million documents screened per day, one percent is one hundred thousand wrong judgments daily โ and the "positive" in this domain carries high stakes: academic discipline, hiring rejection, manuscript refusal, legal exposure. In on-chain terms, this is the difference between a heuristic and a hard rule. A heuristic that flags one in one hundred addresses is acceptable for a watchlist. It is not acceptable as a verdict, because the cost is not borne by the system. It is borne by the accused.
| Scenario | FPR | Volume/day | Wrong flags/day | Consequence class | |---|---|---|---|---| | Academic screening | 1% | 10,000,000 | 100,000 | Discipline, expulsion | | Publishing first-pass | 3% | 50,000 | 1,500 | Rejection, delay | | Hiring text check | 5% | 200,000 | 10,000 | Candidate elimination | | Legal e-discovery | 1% | 100,000 | 1,000 | Evidence challenge |
The error is also not uniform โ it is concentrated. Public research found classifiers misjudging non-native English writing at rates exceeding sixty percent on TOEFL-style samples. The mechanism is not mysterious: non-native prose sits closer to the statistical distribution of machine output, with flatter perplexity and more formulaic transitions. The same is true of legal boilerplate, customer-service scripts, and any heavily templated register. Consequently the harm is not spread evenly. It lands on the groups whose writing looks least like the "human" reference distribution. In on-chain analytics we know this failure intimately: a naive clustering heuristic will sweep up exchange hot wallets and label them a single whale, because they share behavior. Precision requires knowing which clusters are structural artifacts and which are real. Wallets connect the dots, but only if you know which dots are noise. A detector without a per-cohort FPR breakdown is a clustering heuristic with a confidence score โ and a confidence score is not a calibration.
Then there is the finding I would put at the top of any institutional memo: the generator and the judge are the same party. Google controls Gemini, the generation side, and now a detector reportedly at the frontier. This is the generator-as-judge conflict. Technically it is the optimal configuration โ a watermark requires generation-side cooperation, and no one else can produce one for Gemini but Google. Governance-wise it is the configuration regulators distrust most. I have seen the same double role in token markets: the team that holds the mint function and also publishes the "independent" supply audit. Chain links don't lie, but only if the chain is the one you can read. A watermark inside a closed model is a chain you cannot read without the operator's key.
Which leads to the political economy the coverage skips entirely. EU AI Act transparency obligations and comparable labeling regimes push toward a single principle: AI content must be identifiable. An open-weight model cannot be watermarked by its authors โ anyone can fine-tune it, and the watermark's premise, generation-side control, is gone. Therefore, if identifiability becomes a compliance default, policy hands a structural advantage to closed, controllable models and structurally discriminates against the open-weight ecosystem. The detector is not neutral infrastructure. It is a moat disguised as a public good. Follow the gas, not the hype: the incentive gradient points toward whatever makes closed generation look more compliant, and the second-order effect is a compliance tax on open protocols that never asked to be measured.
The provenance alternative already exists and is more honest. C2PA and Content Credentials attach a cryptographically signed manifest to a file โ origin, edit history, signing entity. It answers "who made this and what happened to it" rather than "does this look machine-written." The distinction is the difference between an attestation and a guess. On-chain, this maps directly onto the attestation layer โ Ethereum Attestation Service, signed content registries, zero-knowledge proofs of provenance โ where the claim is verifiable by anyone, not merely the issuer. The structural difference is visible in the data format itself:
{
"classifier_output": {
"label": "likely_ai",
"confidence": 0.87,
"rationale": "uniform sentence length, low perplexity",
"reproducible": false,
"issuer_key": null
},
"attestation_manifest": {
"content_hash": "0x9f2c...",
"signing_entity": "0x4a1e...",
"edit_history": ["capture", "crop", "export"],
"verifiable": true,
"issuer_key": "ed25519:0x7b..."
}
}The first object asks you to trust a score. The second lets you verify a signature. One survives adversarial cross-examination; the other dissolves under it.
Now the honest counterweight, because a forensic report that only argues one side is not a forensic report. Provenance has its own failure modes: metadata is strippable, screenshots launder it, and adoption is uneven. That is exactly why detection is attractive โ it works on text that arrives naked. But "works on naked text" and "works accurately" are different claims, and the coverage has merged them into one comfortable sentence. The mature position is not that one tool beats the other. It is that detection is the fallback you reach for when provenance is absent, and mistaking the fallback for the foundation is how bad architecture becomes policy.
Here is the part that will annoy both the AI-safety crowd and the reflexive crypto crowd.
The counterintuitive claim is not that detection is inaccurate. It is that detection's real product is not accuracy โ it is liability transfer. Institutions do not buy a detector because it is correct. They buy it because it lets them point at a system when they make a decision. "The AI flagged it" is a defensible sentence in a way that "I judged it" is not. Therefore the demand curve is almost perfectly inelastic to the one thing the technology is worst at. A detector that is twenty-six percent sensitive but arrives with a confident explanation will outsell a detector that is eighty percent sensitive and mute, because the buyer is purchasing cover, not truth. I documented this exact dynamic in NFT markets in 2021: the wash-trading syndicate did not need the floor price to be real โ it needed the floor price to be printed. The marketplace displayed it, buyers trusted the display, and forty-two front wallets moved the number three hundred percent. The lesson was never "the price was wrong." It was "the display was the product."
And the crypto crowd should be equally uncomfortable, because the reflexive answer โ "put it on-chain, problem solved" โ is lazy. An on-chain attestation is only as good as its issuer and the coverage of what gets attested. A signed manifest on three percent of content is a provenance system for three percent of content. The honest position is that neither probabilistic detection nor cryptographic provenance is sufficient alone, and this industry's tendency to treat "on-chain" as a synonym for "true" is its own form of automation bias. Chain links don't lie about what they record. They are silent about what they don't.
Risk disclosure โ the metrics that would flip my thesis: a published per-cohort false-positive rate, especially on non-native writing; a third-party reproduction of the detector's true-positive rate on out-of-distribution models; a stated watermark key-custody model; and evidence of C2PA interoperability. Absent those, the bearish read stands. This is a narrative and standards play, not a measured capability, and in a bear market the difference between a story and a measurement is the difference between surviving and bleeding.
Watch three signals over the next two quarters, and none of them is a benchmark score. Watch whether the detector ships with a disclosed false-positive rate broken out by cohort โ silence there tells you the buyer is being sold persuasion, not precision. Watch whether identifiability hardens into a compliance default that open-weight models structurally cannot meet โ that is where the real reallocation happens, and it will never appear in a detector's marketing. And watch whether the attestation layer โ signed content, on-chain provenance, verifiable edit history โ gets adopted by the same institutions now trialing detectors, because that is the version of this problem where the witness can actually be cross-examined.
The detector will show you its work. The question worth asking is who audits the work, and whether you are permitted to read the ledger it was written on. Until that ledger is open, the score is not evidence. It is a sentence.