Write Like It's 1923: The One-Prompt Trick That Beats AI Detectors

Write Like It's 1923: The One-Prompt Trick That Beats AI Detectors Source: https://arxiv.org/abs/2607.13565 Paper was published on July 15, 2026 This episode was AI-generated on July 16, 2026. The script was written by an AI language model and the host voices were synthesized by Eleven Labs. The producer is not affiliated with Anthropic or Eleven Labs. The clever way to fool an AI-text detector — make it look more human — dies the instant the detector retrains, and actually backfires. But asking a model to write in a hundred-year-old literary register walks straight through, and patching that hole with real 1920s books only makes it bigger. This is a paper about a whole category of writing bypassing the gate teachers and journals rely on. Key Takeaways: - Why the obvious 'make AI text look human' attack collapses in one retraining pass — and then backfires, making disguised text more detectable than doing nothing - The in-distribution vs. out-of-distribution reframe: an AI-text detector is really just a detector for text unlike its human examples, so anything genuinely unusual lands in a blind spot - How the 'synth-anchor' attack works in two API calls — write a period paragraph, then rewrite the target text in that register — reaching a ~0.798 fool rate against a hardened detector - Why plugging the hole with real pre-1923 books made it worse (fool rate rose to 0.846), because it widened the safe zone without teaching real-vs-emulated period prose apart - The steelman critique: the 'state-of-the-art' detectors were the authors' own reconstructions, and the 'reads more human' naturalness claim was judged by AIs, not human raters - The deflating practical fix — run two detectors, in-distribution and out-of-distribution — catches nearly everything except stream-of-consciousness 00:00 - The trick nobody expected: The cold open lays out the surprising result: to beat a detector that fights back, you make the model write like it's 1923 rather than trying to look human. 01:03 - Why looking human wins — then dies: The 2025 make-it-look-human recipe jumped fooling rates thirteen-fold, but this paper shows it's the strategy that collapses fastest once the detector retrains. 01:58 - How patching makes it worse: Introduces the fool rate and adversarial fine-tuning, and shows how retraining inverts the disguise so it becomes more obviously machine-written than a plain generation. 04:44 - The blind spot outside the map: Explains the in-distribution vs. out-of-distribution idea — a detector is only calibrated on data like its training set — using the 1920s-costume security camera analogy. 05:48 - Two API calls, fifty times better: Details the synth-anchor attack — write a period paragraph, then rewrite the target text in its register — which fools the retrained detector ~80% of the time. 06:33 - Does it read like bad Gatsby?: AI judges scored the period rewrite at 0.535 human-likeness, essentially even with a plain generation, while the 2025 recipe dropped naturalness to 0.30 — plus the Borges vs. Sebald test showing era, not uniqueness, is the lever. 07:52 - Feeding it old books backfired: The defense of mixing ~1,000 real pre-1923 passages into training was predicted to cut the fool rate to 20%, but it rose to 0.846 — widening the door instead of closing it. 10:02 - Where the top-line claim overreaches: The steelman critique: the beaten detectors were the authors' own reconstructions, the naturalness verdict came from AI judges, and running two detectors catches nearly everything except stream-of-consciousness. 11:56 - Ask what it's never seen: The takeaway and the open question — keep hardening classifiers attack by attack, or move to watermarking at generation — plus the paper's core lesson about un-patchable blind spots. Recommended Reading: - Attribution and Obfuscation of Neural Text Authorship: A Data Mining Perspective: Surveys the detection-vs-evasion arms race the episode centers on, framing why obfuscation attacks succeed and where classifiers break. (https://arxiv.org/abs/2210.10488) - A Watermark for Large Language Models: The generation-time watermarking approach Finn and Juniper contrast against post-hoc detection as the possible 'real move.' (https://arxiv.org/abs/2301.10226) - Can AI-Generated Text be Reliably Detected?: Argues detectors are fundamentally beatable by paraphrasing and recursive rewriting, directly supporting the episode's 'blind spot' thesis. (https://arxiv.org/abs/2303.11156) - DetectGPT: Zero-Shot Machine-Generated Text Detection using Probability Curvature: The statistical-fingerprint style of detector the episode's classifier is built on, letting listeners see the method the attack exploits. (https://arxiv.org/abs/2301.11305)