What AI humanizers actually do to your writing

There is a whole market built on a single promise: paste machine text in, get text out that no detector will flag. It is a large market, the pricing is remarkably consistent, and almost none of it publishes an honest account of what the transformation costs you. Here is what these tools actually do to a piece of writing.

We should declare the interest immediately. Lacewing builds HumanFlow, a rewriting tool, and TextSight.ai, a detector. We are on both sides of this, which is either a conflict of interest or the only vantage point from which the trade-off is visible. Read it with that in mind.

Four things sold under one word

“Humanizer” covers at least four technically distinct operations with wildly different quality and risk profiles.

1. Synonym substitution

The oldest and worst. Walk the text, replace words with dictionary synonyms, ship it. This is article-spinning software from 2010 with a new landing page.

It has a famous failure signature. In 2021 Guillaume Cabanac, Cyril Labbé and Alexander Magazinov catalogued what they called tortured phrases in the scientific literature: “counterfeit consciousness” for artificial intelligence, “profound learning” for deep learning, “colossal information” for big data. Each is a technically valid synonym chain that a human would never write, because the original term is a fixed collocation, not a bag of interchangeable words.

This is not a historical curiosity. Tortured phrases now drive retractions at scale. Springer Nature retracted 2,923 papers in 2024, with phrase-level screening among the detection methods, and Retraction Watch has documented that the pattern predates large language models entirely. It comes from spinners. If your rewriting tool produces it, your tool is a spinner.

2. Full paragraph regeneration

Feed the passage to a language model and ask for a rewrite. This is what most competent tools do, and it is also what you get by asking ChatGPT to rephrase something.

The reference implementation in the research literature is DIPPER, from Krishna and colleagues at UMass, presented at NeurIPS 2023: an eleven-billion-parameter paraphraser with two explicit control knobs, lexical diversity and content reordering, conditioned on the surrounding context so it does not lose the thread between sentences.

3. Statistical target matching

The technically interesting version, and the one that explains why cheap tools underperform. Naive paraphrasing does not raise a text’s perplexity toward the human range. It lowers it, because you are running the text through another language model and getting output that is, if anything, more model-like than the input.

Sophisticated tools therefore target a distribution rather than minimising a score: raising sentence-length variance, adjusting vocabulary rarity, matching punctuation density to a human reference corpus. This is a real engineering discipline and it produces better output than synonym swapping, but note what it optimises for. It optimises for the shape of the statistics, not for the reader.

4. Character-level tampering

Homoglyph substitution (a Cyrillic character that looks identical to a Latin one), zero-width space insertion, unusual whitespace. This is not rewriting at all. It changes nothing a human can see and nothing about the meaning; it corrupts tokenisation.

It also has the worst risk profile of anything in this list, for reasons we will get to.

Does it work? The evidence, honestly

The answer is uncomfortably specific: it depends entirely on which detector, and the research literature and the vendor claims point in opposite directions.

Against older statistical detectors, paraphrasing works well. Krishna and colleagues reported DetectGPT’s accuracy falling from 70.3% to 4.6% at a 1% false positive rate after DIPPER paraphrasing. That is the founding result of this field and it is not in dispute.

Against production commercial detectors, off-the-shelf paraphrasing is much weaker than advertised. The RAID benchmark at ACL 2024 tested twelve detectors including four commercial products against eleven attacks over six million generations. Under the paraphrase attack, GPTZero lost about two and a half accuracy points. Originality.ai gained around eleven. Under synonym replacement, one open-source RoBERTa detector gained more than twenty points, because substituting words moved the text toward the distribution that classifier was trained on.

Read that again, because it is the single most useful finding for anyone buying these tools: rewriting can make text more detectable, not less, depending on which detector is reading it. Any vendor claiming a universal bypass is either testing against detectors nobody uses or not testing at all.

Character tampering is devastating against detectors that skipped a preprocessing step, and useless against those that did not. In RAID, the homoglyph attack knocked Originality.ai from 85% accuracy down to 9.3%. GPTZero lost three tenths of a point. The difference is a single Unicode normalisation pass before tokenisation.

Why homoglyph tricks are the worst possible bet

This deserves its own section because the risk asymmetry is extreme and almost nobody explains it.

The technique comes from Boucher, Shumailov, Anderson and Papernot’s 2022 IEEE Security and Privacy paper on imperceptible NLP attacks. It is genuinely powerful against unprotected systems. But consider what happens in the two possible worlds:

• The detector normalises Unicode. Your evasion fails completely, and you have handed the reviewer a document containing Cyrillic characters in English words. That is not ambiguous. There is no innocent explanation.
• The detector does not normalise. Your evasion succeeds until anyone opens the file in a different tool. Turnitin documents the “zero width space cheat” and “hidden characters cheat” as known patterns. Oxford Brookes’ guidance to staff is literally: save the document as a web page and open the HTML in a browser. The characters become visible instantly.

A paraphrase has innocent explanations. Someone might have rewritten for clarity. Invisible Cyrillic characters have exactly one explanation, and detectors increasingly treat their presence as a positive signal of deliberate tampering rather than a bypass. You are trading a defensible position for an indefensible one in exchange for a bypass that expires the moment a vendor adds three lines of preprocessing.

What it costs your writing

Every evasion technique buys detector performance with something. The research is consistent about what.

The recursive paraphrase row is the one that should stop people. Running text through a rewriter three times to get a clean score produces prose that has lost roughly half its semantic relationship to what you wrote. You have not concealed your meaning. You have deleted it.

There is a documented failure mode worse than drift. Rewriting models inject material that was never in the source: hallucinated citations, stray fragments, artefacts of the model’s own training data landing mid-sentence. If you are rewriting anything with references, numbers or claims of fact, the rewriter can silently corrupt them, and no detector score will tell you that happened.

The market, and how to read it

Pricing has converged remarkably. Undetectable.ai runs roughly $9.99 to $42.50 monthly across tiers; StealthGPT from about $29.99 to $179.99; WriteHuman around $20 to $59; QuillBot bundles paraphrasing into an $8.33 monthly Premium tier. The market clusters at nine to thirty dollars for ten to fifty thousand words.

Two things to know before you read any comparison article.

The vendor claims are mutually contradictory. Pangram publishes benchmarks showing it catches humanised text at a very high rate while GPTZero catches under half. GPTZero publishes benchmarks showing the reverse ordering. Both cannot be right. Neither publishes a protocol you can reproduce.

The leading “independent” humanizer leaderboard is not independent. HumanizerBench presents itself as a neutral comparison of fourteen tools. Its footer states it is operated by WriteHuman, the tool it ranks first. Nearly every top-ranking “best AI humanizer, tested against five detectors” article is published by a humanizer vendor. There is effectively no independent consumer testing in this category at all.

The policy position, which is the part that actually matters

Detector evasion is not the risk. Institutional policy is, and it does not care about your score.

Google. The scaled content abuse policy explicitly names “automated transformations like synonymizing, translating, or other obfuscation techniques” as prohibited where little value is provided to users. Google’s stated test is value to the reader, not authorship. The March 2024 core update targeted content produced at scale to manipulate rankings “whether automation, humans or a combination are involved.” Rewriting a low-value page does not change its policy status. It just makes it a rewritten low-value page.

Academic publishing. Elsevier’s position is representative: language and readability improvement is explicitly permitted, and basic grammar and spelling checks need no declaration, but anything beyond that requires a disclosure statement naming the tool and confirming human review. The line is disclosure and accountability, not the tool.

Detection vendors. Turnitin shipped AI paraphrasing detection in July 2024 and a dedicated bypasser-detection capability in August 2025. Neither ships with published accuracy figures, which is its own problem, but the direction of travel is unambiguous.

Where the line actually is

There is a clean test, and it does not require a philosophy degree.

Fixing grammar, tightening clauses, cutting a passage that repeats itself, restoring a technical term the model got wrong, restructuring for flow: all of that improves the text for a reader. It happens to reduce detector scores too, because human editing genuinely does move text away from raw model output. That is a side effect, not the objective.

Running three paraphrase passes until a number goes green, injecting deliberate typos, inserting invisible characters. None of that improves anything for anyone. The objective function is the detector, and the reader is a bystander.

Here is the awkward part we will state directly rather than have you discover it: a writer who genuinely uses AI for a first draft and then edits it substantially by hand will often still trip a detector, while a writer who runs it through an aggressive humanizer will not. Detection currently rewards the less honest behaviour. That is a real perverse incentive and it is a genuine argument against building high-stakes policy on detector output, the same conclusion we reached from the false-positive side.

The short version

Humanizers work against old statistical detectors and much less reliably against current commercial ones. Cheap character tricks are the most effective attack and simultaneously the most incriminating. Aggressive rewriting costs you meaning, terminology and factual integrity in ways no score reports. The leaderboards are owned by the vendors on them. And every policy that matters (Google’s, publishers’, universities’) is written around value and disclosure, not around whether a classifier was fooled.

If you are editing to make writing better, use whatever tools help and disclose what your context requires. If you are editing to make a number go green, you are optimising the wrong thing, and the number will change next quarter anyway.