When a student submits an essay drafted by ChatGPT, the problem is not that the text was copied — it is that no copy exists to find. Traditional plagiarism detection was built on string matching against a corpus of prior submissions and indexed web pages. Large language models produce text that has never been written before, by anyone. The detection problem is structurally different, and treating it as a more aggressive version of Turnitin is the first mistake most institutions make. This is the conversation universities have been holding since early 2023, and the answers have not stabilised. In our experience advising teams that build content-authenticity stacks, the institutions that landed in a defensible position did not pick a side between “ban it” and “embrace it”. They split the problem into three layers — detection, provenance, and policy — and accepted that no single layer is reliable on its own. Why Conventional Plagiarism Tools Miss Generative Output Turnitin, iThenticate, and similar services work by computing fingerprints of submitted text and comparing them against a database of student papers, journal articles, and crawled web content. The match is essentially lexical, with some tolerance for paraphrasing through shingled n-gram comparison. This works because copied text leaves a trace in the source corpus. ChatGPT output leaves no such trace. The model samples token-by-token from a learned probability distribution, and the same prompt produces different completions across runs. There is no canonical source document to match against. An observed pattern across the AI-detection vendors is that classifier-based detectors trained on GPT-3.5-era outputs degrade sharply when applied to GPT-4 and later models — the surface statistics they keyed on (perplexity, burstiness, token-length variance) shift with each model generation, and detector retraining lags release cycles by months. The practical consequence: a clean Turnitin report on a ChatGPT-drafted essay tells you almost nothing. The same essay run through a dedicated AI-text classifier may come back as “likely AI-generated” with a confidence score, but those scores carry a non-trivial false-positive rate, particularly on writing by non-native English speakers and on technical prose with constrained vocabulary. Stanford’s 2023 study on GPT detectors flagged this bias explicitly, and we have seen no detector vendor convincingly rebut it since. What Counts as Plagiarism When the Source Has No Author Plagiarism, in the academic sense, has always rested on a chain of attribution: an idea or phrasing has an originator, and submitting it without credit misrepresents authorship. ChatGPT breaks the chain at the originator. The model assembles tokens from statistical regularities in its training data, but the specific sentence it produces is not attributable to any single source in that data. It is also not attributable to the student, who supplied a prompt rather than the reasoning. This is why the policy debate has fragmented. Some institutions have ruled that any uncited use of generative AI constitutes academic dishonesty, treating the tool category as a citable source. Others have permitted use for brainstorming, outlining, or revision while prohibiting it for the final submitted text. A smaller group has redesigned assessment around in-person or process-based evaluation, sidestepping the textual-authenticity problem entirely. None of these positions are unreasonable, but they are not interchangeable. An institution that prohibits AI use without specifying which stages of writing are off-limits creates an enforcement vacuum. An institution that permits AI use without defining citation form leaves students to invent their own conventions, which then vary by course and instructor. The Detection-Plus-Provenance Stack The durable posture for content authenticity — in education and beyond — combines three mechanisms: Layer What it does Where it breaks Classifier detection Estimates probability that a passage is AI-generated from surface statistics Degrades with each model generation; biased against non-native writers; binary verdicts mislead Cryptographic provenance Signs assets at creation with C2PA or equivalent, producing an auditable chain Only covers content from participating producers; signatures can be stripped; adoption is partial Process-based assessment Evaluates drafts, in-class writing, and oral defence rather than only the final artefact Higher staffing cost; harder to scale to large cohorts C2PA — the Coalition for Content Provenance and Authenticity standard — was designed for images and video, where major camera vendors and generative tools (Adobe Firefly, some OpenAI surfaces) now embed signed manifests at capture or generation time. The standard is extensible to text, but text-provenance adoption lags image-provenance adoption by a wide margin, and stripping a manifest is trivial for a determined user. Provenance is a positive signal when present, not a negative signal when absent. We discuss the cryptographic and detector trade-offs in more depth in our broader treatment of detecting AI-generated content across modalities. Classifier detection sits on the opposite end of the trust spectrum. It can be deployed unilaterally — no producer cooperation needed — but its outputs are probabilistic and degrade over time. The institutions that use it well treat the detector score as one input to a human review, not as adjudication. The institutions that use it badly publish thresholds (“anything over 70 percent is grounds for a misconduct hearing”) and discover later that the false-positive cases were disproportionately students from particular linguistic backgrounds. What a Workable University Policy Looks Like The institutions that have settled into a workable position share four traits in our observation: Stage-specific rules. They distinguish between brainstorming, drafting, revising, and final submission, and state which AI uses are permitted at each stage. “No AI for the final draft, AI permitted for outlining with disclosure” is enforceable. “No AI” is not. Required disclosure with a defined form. Students declare which tools they used and how, on a standard cover sheet. The disclosure itself is not evidence of misconduct — the absence of disclosure when AI use is later inferred is. Detector outputs as evidence, not verdict. AI-text classifier scores enter the academic misconduct process as one piece of evidence among many (draft history, version control on the document, oral defence, stylistic comparison with earlier submitted work). No score alone triggers a finding. Assessment redesign where the stakes are high. For courses where authorship of the submitted text genuinely matters, they shift weight toward in-class writing, supervised exams, and viva-style oral components. This is expensive but durable. The fourth point is the one most institutions resist, because it cuts against a decade of trend toward asynchronous, scalable assessment. But classifier-only enforcement is a treadmill: every model release moves the goalposts, and the false-positive cost falls on the students least able to absorb it. For a closer look at how text classifiers actually reason and where their evidence comes from, see our explainer on how AI detectors identify AI-written content. How Should Universities Combine Detection, Provenance, and Policy? A defensible academic-integrity stack treats the three layers as complementary rather than redundant. Detection catches the casual case where a student pastes raw ChatGPT output with no editing. Provenance, where it exists, raises the bar by making legitimate AI assistance auditable — a student who used Microsoft Copilot in a setting that preserves the manifest can demonstrate the editing they did. Policy defines what “legitimate” means in the first place, and assessment redesign provides the fallback when the other two layers fail. What does not work is picking one layer and treating it as sufficient. Detection-only stacks fail on adversarial users and false-positive on innocent ones. Provenance-only stacks fail because most AI use happens through tools that do not sign their output. Policy-only stacks fail because students will, on average, do what is enforceable, and unenforced rules become noise. The same logic applies in publishing, journalism, and any domain where text authorship carries weight — the education sector is just the one that ran into the problem first. The mechanics of how detection itself is evaluated and tuned are covered in our piece on smarter checks for AI detection accuracy. What This Means for Students and Instructors For students, the practical guidance is narrower than the public debate suggests. Use AI tools where they are explicitly permitted by your institution and disclosed on your submission. Keep your draft history — most word processors and version control systems retain it automatically — because it is the strongest evidence of authorship if you are ever challenged. Treat detector false positives as a real risk, not a hypothetical one, and choose drafting workflows that produce a defensible trail. For instructors, the guidance is harder. Detector outputs are useful as a triage signal, not as adjudication. If you find yourself escalating a misconduct case where the only evidence is a classifier score above some threshold, the case is weaker than it looks, and the institutional review process should reflect that. The cases that hold up are the ones with corroborating evidence: missing draft history, stylistic discontinuity with the student’s prior work, inability to explain the submitted content in conversation. We see this same pattern in enterprise content-authenticity work, where the failure mode is over-reliance on a single detection layer and the recovery is a layered stack that combines automated signals with human review. The technology improves each year, but the structural answer does not change. FAQ How do current AI image detectors actually work — embeddings, watermarks, perceptual hashing, classifiers? Image detectors typically combine learned classifiers (trained on labelled real vs generated examples), perceptual hashing for near-duplicate detection against known generated content, and where available, verification of embedded watermarks or C2PA manifests. Each layer has a different failure mode, which is why production stacks use several in parallel rather than relying on one. Can C2PA cryptographic provenance be faked, and what is its real coverage in 2026? The signatures themselves are cryptographically sound — forging a valid manifest requires the signer’s private key. The practical weaknesses are coverage and stripping: only content from participating producers carries a manifest, and the manifest can be removed by re-encoding the asset. Provenance is therefore a strong positive signal when present, but its absence proves nothing. What is the failure rate of best-in-class detectors (Winston, GPTZero, TruthScan) on real content? Published independent evaluations report observed error rates in the low double digits for both false positives and false negatives, with significant variance by domain and writer demographics. The figures shift with each model generation, so any specific number dates quickly. The operative point is that no current detector reaches the reliability threshold where its output alone should drive a high-stakes decision. Where does perceptual hashing fit in the detection stack alongside ML-based detectors? Perceptual hashing matches new content against a database of previously-flagged generated content. It is cheap, deterministic, and useful for catching reused or lightly-edited assets, but it cannot detect novel generation. It is a complement to ML classifiers, not a substitute. How does an enterprise deploy a layered detection, provenance, and governance stack for AI content? The pattern we see work is a three-layer stack: ingest-time provenance checks (verify manifests where present), ML classification for content without provenance, and human review for the contested cases. Governance — who decides, on what evidence, with what appeal path — sits on top of the technical stack and is usually the harder problem. Which detection patterns work for images, text, audio, and video, and where do they break? Image and audio detection benefit from cryptographic provenance adoption among major producers and from physical-signal artefacts that classifiers can learn. Text detection is the hardest because text has fewer surface artefacts and provenance adoption is thinner. Video sits in between — high-quality video generation is recent enough that detector training data is still catching up. For more on how text-specific detection works in practice, see our deeper coverage of AI plagiarism detection. Credits: ChatGPT Is Making Universities Rethink Plagiarism (Sofia Barnett, Jan 30, 2023, Wired). Thanks to Ákos Rúzsa for the original conversation that prompted this piece.
