{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "617",
  "slug": "detection-evasion-race",
  "edition": "2026-10-26T12",
  "url": "https://hangingcontext.com/stories/2026-10-26/detection-evasion-race/",
  "newsroom": "artificial-intelligence",
  "beat": "policy",
  "newsroom_title": "Artificial Intelligence",
  "angle": "AI-text detection is becoming auditable and tunable just as evasion gets better at beating it.",
  "headline": "Detectors you can audit, watermarks you can tune, and attacks that beat both",
  "dek": "DetectorScope turns black-box AI-text detectors into inspectable systems, constitution-guided watermarking tunes the signal per request, and StealthRL shows paraphrase attacks still transfer across detectors.",
  "published_at": "2026-10-26T12:37:06Z",
  "labels": {
    "trust": "reported",
    "trust_text": "Reported · 4 sources",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 4,
  "publishers": [
    "arxiv-ai-security-privacy-safety",
    "huggingface-daily-papers"
  ],
  "key_facts": [
    {
      "text": "In a preprint, DetectorScope converts an arbitrary black-box AI detector into an auditable detector by training sparse autoencoders directly on the detector's residual stream and assigning auto-interpretation labels to each feature.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1793011938893128413",
          "claim_ids": [
            "1793012271150078526",
            "1793012271152982769",
            "1793012271153838464"
          ]
        }
      ]
    },
    {
      "text": "In a preprint, DetectorScope's auditable detectors maintain the performance of the underlying black-box classifier on both in-distribution and out-of-distribution texts.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1793011938893128413",
          "claim_ids": [
            "1793012271158708572"
          ]
        }
      ]
    },
    {
      "text": "In a preprint, StealthRL reduces mean true positive rate at 1% false positive rate to 0.024 across RoBERTa, Fast-DetectGPT, Binoculars, and MAGE, and its adversarial paraphrases transfer to detectors not used during training.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1793000649629639970",
          "claim_ids": [
            "1793001021808192523",
            "1793001021810012410"
          ]
        }
      ]
    },
    {
      "text": "In a preprint, constitution-guided watermarking lets providers dynamically adjust watermark configurations based on natural-language rules, detecting more paraphrased text on misuse-prone requests while maintaining clean detection and quality.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1793000649629630109",
          "claim_ids": [
            "1793001020840619150",
            "1793001020841024555"
          ]
        }
      ]
    },
    {
      "text": "In a preprint, internal observers with detector access can attribute outputs to individual entities using zero-bit watermarks if each entity holds a unique key, and external observers without keys or detectors can identify the source of unseen text and image outputs.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1793000649629422360",
          "claim_ids": [
            "1793001024411363380",
            "1793001024415772253"
          ]
        }
      ]
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "Detectors you can inspect",
      "paragraphs": [
        {
          "markdown": "DetectorScope, described in a preprint, is a pipeline that takes an arbitrary black-box AI detector and converts it into an auditable detector. It trains sparse autoencoders directly on the detector's residual stream and assigns auto-interpretation labels to each feature. A lightweight classifier is then trained on just the interpretable features.",
          "cites": [
            {
              "manifest_id": "1793011938893128413",
              "claim_ids": [
                "1793012271150078526",
                "1793012271152982769",
                "1793012271153838464",
                "1793012271155467955"
              ]
            }
          ]
        },
        {
          "markdown": "The point is not a new detector but a detector whose reasons can be read: the sparse autoencoders recover latent concepts corresponding to highly specific and predictive linguistic tells of AI-generated text, and the authors report that these auditable detectors maintain the performance of the underlying black-box classifier on both in-distribution and out-of-distribution texts. The code is published on GitHub, which means the auditability claim can be checked rather than taken on trust.",
          "cites": [
            {
              "manifest_id": "1793011938893128413",
              "claim_ids": [
                "1793012271156689520",
                "1793012271158708572",
                "1793012271159919120"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "Attacks that transfer",
      "paragraphs": [
        {
          "markdown": "The reason auditability matters is that evasion is getting better. StealthRL, another preprint, trains a reinforcement learning policy to generate adversarial paraphrases against an ensemble of detectors. It reduces mean true positive rate at 1% false positive rate to 0.024 across RoBERTa, Fast-DetectGPT, Binoculars, and MAGE, which is effectively a collapse of detection under attack, and its adversarial paraphrases transfer to detectors not used during training.",
          "cites": [
            {
              "manifest_id": "1793000649629639970",
              "claim_ids": [
                "1793001021808192523",
                "1793001021810012410"
              ]
            }
          ]
        },
        {
          "markdown": "Transfer is the damaging part. A defense tuned against one detector, or one attack, does not hold if paraphrases crafted elsewhere still pass. Any deployment that relies on detection for content moderation or academic integrity has to assume the attacker has seen a similar detector, because StealthRL shows that is enough.",
          "cites": [
            {
              "manifest_id": "1793000649629639970",
              "claim_ids": [
                "1793001021810012410"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "Watermarks as policy",
      "paragraphs": [
        {
          "markdown": "Constitution-guided watermarking, a third preprint, moves the problem from detection to policy: a reasoning agent maps natural-language rules to specific watermark configurations per request, so providers can apply stronger watermarks to misuse-prone prompts while exempting editing tasks, in line with EU AI Act provisions. The framework detects more paraphrased text on misuse-prone requests than fixed configurations while maintaining clean detection and quality, and each deployment decision is stored with evidence, making the watermarking choices themselves auditable.",
          "cites": [
            {
              "manifest_id": "1793000649629630109",
              "claim_ids": [
                "1793001020840619150",
                "1793001020841024555",
                "1793001020843169264",
                "1793001020846082600"
              ]
            }
          ]
        },
        {
          "markdown": "A fourth preprint reframes watermarking altogether, arguing it should be treated as a monitoring primitive rather than just a robustness tool. Its warning runs in both directions: internal observers with detector access can attribute outputs to individual entities using zero-bit watermarks if each entity holds a unique key, and external observers without access to secret keys or detectors can identify the source of unseen text and image outputs. Current watermarking evaluations fail to report attribution and identification accuracy, focusing primarily on robustness against removal or forgery, which means deployments may leak source information they never intended to reveal.",
          "cites": [
            {
              "manifest_id": "1793000649629422360",
              "claim_ids": [
                "1793001024411363380",
                "1793001024415772253",
                "1793001024423889739"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "The shape of the race",
      "paragraphs": [
        {
          "markdown": "Taken together, the four papers describe a field maturing on both sides at once: detectors that can be opened up and inspected, watermarks that can be tuned to policy instead of fixed at deploy time, and attacks that transfer across detectors anyway. The honest use of detection is monitoring with known limits, not a binary verdict on whether text is AI-generated, and the watermarking lesson is that every attribution choice is also a privacy choice.",
          "cites": [
            {
              "manifest_id": "1793011938893128413",
              "claim_ids": [
                "1793012271150078526"
              ]
            },
            {
              "manifest_id": "1793000649629639970",
              "claim_ids": [
                "1793001021810012410"
              ]
            },
            {
              "manifest_id": "1793000649629422360",
              "claim_ids": [
                "1793001024423889739"
              ]
            }
          ]
        },
        {
          "markdown": "For teams that rely on detection, the practical response is to treat detector output as one signal among several rather than a verdict, since StealthRL shows that paraphrases crafted against one ensemble can pass detectors they never saw. DetectorScope's contribution is that this humility costs nothing in performance on the reported tests: the auditable detectors maintained the black box's performance on in-distribution and out-of-distribution texts alike.",
          "cites": [
            {
              "manifest_id": "1793000649629639970",
              "claim_ids": [
                "1793001021810012410"
              ]
            },
            {
              "manifest_id": "1793011938893128413",
              "claim_ids": [
                "1793012271158708572"
              ]
            }
          ]
        }
      ]
    }
  ],
  "unresolved": [
    "Whether DetectorScope's auditable detectors hold up on production text distributions beyond those tested.",
    "How StealthRL's paraphrase attacks fare against detectors trained with adversarial examples.",
    "Whether providers adopt per-request watermark configuration or stick with fixed settings for simplicity."
  ],
  "decision_card": {
    "useful_for": [
      "Executives deploying AI-text detection or watermarking",
      "Teams writing content provenance policy"
    ],
    "not_for": [
      "Treating a detector verdict as proof of authorship"
    ],
    "compare_against": [
      "Black-box detectors with no inspectable features",
      "Fixed watermark configurations for all requests"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-10-26T12"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1793011938893128413",
    "1793000649629639970",
    "1793000649629630109",
    "1793000649629422360"
  ],
  "manifests": [
    {
      "manifest_id": "1793011938893128413",
      "title": "Building Auditable AI Text Detectors with Sparse Autoencoders",
      "source_name": "huggingface-daily-papers",
      "source_url": "https://huggingface.co/papers/2610.30006",
      "published_date": "2026-10-26"
    },
    {
      "manifest_id": "1793000649629639970",
      "title": "StealthRL: Reinforcement Learning Paraphrase Attacks for Multi-Detector Evasion of AI-Text Detectors",
      "source_name": "arxiv-ai-security-privacy-safety",
      "source_url": "https://arxiv.org/pdf/2602.08934v3",
      "published_date": "2026-10-26"
    },
    {
      "manifest_id": "1793000649629630109",
      "title": "Constitution-Guided Watermarking",
      "source_name": "arxiv-ai-security-privacy-safety",
      "source_url": "https://arxiv.org/pdf/2610.09552v2",
      "published_date": "2026-10-26"
    },
    {
      "manifest_id": "1793000649629422360",
      "title": "Watermarking Should Be Treated as a Monitoring Primitive",
      "source_name": "arxiv-ai-security-privacy-safety",
      "source_url": "https://arxiv.org/pdf/2605.13095v4",
      "published_date": "2026-10-26"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1793011938893128413",
      "1793000649629639970",
      "1793000649629630109",
      "1793000649629422360"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1793011938893128413",
      "all": "for id in 1793011938893128413 1793000649629639970 1793000649629630109 1793000649629422360; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-10-26/detection-evasion-race/",
    "json": "https://hangingcontext.com/stories/2026-10-26/detection-evasion-race/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-10-26/detection-evasion-race/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-10-26T12/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-10-25/ai-security-find-disclose-detect/",
      "headline": "Find It, Disclose It, Detect It: A Week in AI and Cloud Security",
      "slug": "ai-security-find-disclose-detect"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-25/oracle-ai-stack/",
      "headline": "Oracle's AI Stack, From Concrete to Cloud Detectors",
      "slug": "oracle-ai-stack"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-25/operating-ai-trust-stack/",
      "headline": "Running AI Means Securing It, Proving Its Privacy, and Surviving Its Outages",
      "slug": "operating-ai-trust-stack"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-24/security-bottleneck-remediation/",
      "headline": "Discovery outruns remediation while a certificate-authority failure shows trust itself breaking underneath application code",
      "slug": "security-bottleneck-remediation"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Run the cited Manifests yourself",
    "text": "Every claim in this paper points to a Manifest id. Get a Synorb Key and read the Manifests behind it. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons.",
    "cta": {
      "label": "Get a key",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-10-26/detection-evasion-race/"
  }
}