Detectors you can audit, watermarks you can tune, and attacks that beat both

Detectors you can inspect

DetectorScope, described in a preprint, is a pipeline that takes an arbitrary black-box AI detector and converts it into an auditable detector. It trains sparse autoencoders directly on the detector's residual stream and assigns auto-interpretation labels to each feature. A lightweight classifier is then trained on just the interpretable features. m:…8413

The point is not a new detector but a detector whose reasons can be read: the sparse autoencoders recover latent concepts corresponding to highly specific and predictive linguistic tells of AI-generated text, and the authors report that these auditable detectors maintain the performance of the underlying black-box classifier on both in-distribution and out-of-distribution texts. The code is published on GitHub, which means the auditability claim can be checked rather than taken on trust. m:…8413

Attacks that transfer

The reason auditability matters is that evasion is getting better. StealthRL, another preprint, trains a reinforcement learning policy to generate adversarial paraphrases against an ensemble of detectors. It reduces mean true positive rate at 1% false positive rate to 0.024 across RoBERTa, Fast-DetectGPT, Binoculars, and MAGE, which is effectively a collapse of detection under attack, and its adversarial paraphrases transfer to detectors not used during training. m:…9970

Transfer is the damaging part. A defense tuned against one detector, or one attack, does not hold if paraphrases crafted elsewhere still pass. Any deployment that relies on detection for content moderation or academic integrity has to assume the attacker has seen a similar detector, because StealthRL shows that is enough. m:…9970

Watermarks as policy

Constitution-guided watermarking, a third preprint, moves the problem from detection to policy: a reasoning agent maps natural-language rules to specific watermark configurations per request, so providers can apply stronger watermarks to misuse-prone prompts while exempting editing tasks, in line with EU AI Act provisions. The framework detects more paraphrased text on misuse-prone requests than fixed configurations while maintaining clean detection and quality, and each deployment decision is stored with evidence, making the watermarking choices themselves auditable. m:…0109

A fourth preprint reframes watermarking altogether, arguing it should be treated as a monitoring primitive rather than just a robustness tool. Its warning runs in both directions: internal observers with detector access can attribute outputs to individual entities using zero-bit watermarks if each entity holds a unique key, and external observers without access to secret keys or detectors can identify the source of unseen text and image outputs. Current watermarking evaluations fail to report attribution and identification accuracy, focusing primarily on robustness against removal or forgery, which means deployments may leak source information they never intended to reveal. m:…2360

The shape of the race

Taken together, the four papers describe a field maturing on both sides at once: detectors that can be opened up and inspected, watermarks that can be tuned to policy instead of fixed at deploy time, and attacks that transfer across detectors anyway. The honest use of detection is monitoring with known limits, not a binary verdict on whether text is AI-generated, and the watermarking lesson is that every attribution choice is also a privacy choice. m:…8413 m:…9970 m:…2360

For teams that rely on detection, the practical response is to treat detector output as one signal among several rather than a verdict, since StealthRL shows that paraphrases crafted against one ensemble can pass detectors they never saw. DetectorScope's contribution is that this humility costs nothing in performance on the reported tests: the auditable detectors maintained the black box's performance on in-distribution and out-of-distribution texts alike. m:…9970 m:…8413