AI Content Integrity Methodology

01 / Result vocabulary

Method status is explicit

Canonical results use pass, attention, fail, inconclusive, unsupported, not configured, not run and error. Unsupported, missing and failed checks do not share pass styling or counts. The Anthropic production watermark is reported as not assessed, because its keys are private and no public verifier exists; that boundary is stated as its own line rather than dressed up as a check.

02 / Evidence types

Exact checks and writing patterns are different

Unicode inspection reports named code points, exact UTF-16 and code-point offsets, source-bound hashes and a limited treatment. Writing-pattern rules are versioned editorial prompts: the current signal set, en-signals:2026.08.6, runs 116 named rules across 113 weighted categories, covering stock phrasing, structure, sentence rhythm and cadence, chat-export formatting furniture, and chatbot artefact traces attributed to the model families that leave them. They do not estimate authorship probability.

Uploaded image and PDF files receive a separate local Content Credentials (C2PA) read. A trained beta classifier adds the one check here that gives an AI reading. It scores on Opace's own EU server by default, one request for the whole document, or entirely in your browser after an explicit one-off 34.5 MB download, and its measured accuracy is disclosed with every result. Every assessment also runs the published SynthID-Text detection mathematics against three public demo keys in the browser and reports the score for each key, with fewer than 40 scoreable positions returning no verdict at all.

03 / Protected content

Protected facts block unsafe changes

Names, organisations, figures, dates, times, units, links, email addresses, quotations, citations and code can be recorded as protected spans. Candidate text fails a hard gate when an exact protected item disappears, changes unexpectedly or is duplicated.

04 / Deliberate changes

Safe treatments require selection

The browser can preview only allowlisted changes for a selected finding. It does not remove joiners or combining marks automatically, replace lookalikes, rewrite prose, or alter protected links, quotations, citations and code.

05 / Evidence receipts

Receipts record evidence without retaining the draft

Hash-only receipts are the default. They use RFC 8785 JSON Canonicalization Scheme and SHA-256, record method versions and preserve content only when an explicit retain-content policy agrees with the receipt state.

06 / Data routes

Privacy is a route property

Browser-only inspection holds text in memory and sends no content-bearing request. Text, file names, URLs, hashes, findings, protected spans and receipt IDs do not enter analytics, browser storage or the page address.

The trained model is the one check with a choice of route, and the page says which one is running where you paste rather than in the small print: by default the document is sent over HTTPS in a single request to Opace's own server in Google Cloud Run europe-west1, scored in memory and then discarded, and every result prints how many words were sent. The browser route sends nothing at all; its download size, cache behaviour and local-only execution are stated before consent is requested, and nothing fetches until the user agrees. Interacting with the form fires a standard site analytics event that carries no text, file or result content.

07 / Reproduction limits

Limits and reproduction

The method cannot prove authorship. A result applies only to the named method and version that ran. Public watermark fixtures also require an immutable source, licence, known configuration and matched detector version before they can appear in the Claude Watermark Readiness Lab.

08 / Published results and evidence

Measured results, stated plainly

Both tiers were re-measured in August 2026 against 5,558 long-form documents, 922 written by current models and 4,636 by people. 654 of the AI documents are independent of every training, test and calibration split; 268 are not, as are 11 of the human documents. Every rate below pools both subsets, and the full breakdown is on the detection-rates page.

The trained model, which produces the AI reading

At the operating point that ships — a document is flagged when its strongest section reaches 0.9855, or its second-strongest reaches 0.9763 — the EU server route flags 883/922 AI documents, 95.8%, and 45/4,636 human documents, 0.97%.

Loosening the rule to a single 0.980 threshold buys 10 more AI documents and costs 52 more human ones: 893/922, 96.9%, at 97/4,636, 2.09%. We publish both ends of that trade because the second number is the one that lands on a real writer.

The browser route runs the same model at the same operating point in lower numerical precision, and it is not a copy of the server's result. At the shipped pair it flags 889/922 AI documents, 96.4%, and 90/4,636 human documents, 1.94% — it catches a little more AI writing and wrongly flags roughly twice as many people. Each route therefore reports the accuracy measured on the runtime that produced it, and never borrows the other's.

Where it is weakest

Its weakest ground is published rather than buried. The model was never trained on human fiction, because the corpus has AI fiction and no matched human set, so novelists should not rely on it. Short passages lose most of the signal: measured on naturally short text at the same operating point, the classifier flags 29/172 (16.9%) of AI passages of 100 to 199 words against 193/228 (84.6%) at 300 to 399. Under 100 words, and 200 to 299 words, hold fewer than 30 AI passages each, so no detection rate is quoted for either band. Treat a draft under about 300 words as unreliable. AI text that has been rewritten from a human original is the hardest case of any register measured. Business and white-paper writing clears the floor on a set too small to call it settled. Every one of those is measured in the open repository rather than asserted here.

Withdrawn on 30 August 2026: this paragraph previously said detection fell to 67.0% at 200 words, 50.3% at 150 and 19.0% at 100. Those figures came from long documents truncated to those lengths, were scored at the superseded 0.980 threshold, recorded no per-length AI denominator and were never re-measured on either shipping runtime. They must not be quoted.

The writing-signal rules, which no longer produce one

The rules reached mixed signals or above on 45.1% of the AI writing while flagging 24.8% of the human writing — worse than the trained model on both counts at once.

Two conditions travel with that figure, and we publish them wherever it appears. First, much of what these rules catch is chat-export formatting: bold runs, heading lines and dense bullet layouts. Text pasted through an editor that strips those markers loses most of the signal, and hand-cleaned plain prose falls back to the smaller subset that survives. Second, they read register rather than authorship. Short conversational question-and-answer text measurably carries almost none of the style tells they look for, whatever produced it, and genuine human marketing copy triggers the cliché-vocabulary rules routinely. That is the mechanism behind the 24.8%.

A measured model we decided not to ship

During the first training cycle we built a second model, a GPT-2 surprisal-rhythm engine, measured it, and declined it. Ensembled with the classifier of the day it lifted that cycle's small evaluation from 2 of 23 clean-prose passages to 6, and from 2 of 30 AI samples to 8, but it added 2 false positives across that cycle's 116 human texts, 1.73%, and raised the one-off browser download from 34.5 MB to 238.8 MB. Those are first-cycle numbers on a first-cycle corpus and they measure the decision, not today's accuracy. It remains gated off. We record it because declining to ship a measured capability is part of the method, not an omission from it.

The full tables are published rather than summarised

Detection rates in full carries every measured cell — by document length, by the model that wrote the text, and by content type — each with its denominator, its corpus, its runtime, its operating point and a 95% confidence interval. That is where the fiction weakness, the short-text collapse and the bands with too few documents to quote are all visible at once.

Full reproducible reports ship with the open-source repository: the segmentation and threshold measurements behind the figures above, the per-register breakdowns, the route-parity comparison, the calibration corpus documentation, the machine-readable model evaluation and the complete test-suite evidence index. Any figure on this page can be re-run rather than taken on trust.

09 / The signal pack, measured

What the 116 rules are, and which of them work

The pack is counted, not estimated: 116 named rules across 113 weighted categories, counted from the built packs rather than from prose, and a test fails the build if the constant and the packs ever disagree. But a count of rules is a capability claim, and a capability claim without a measurement is what this project keeps having to retract. So every named rule is scored against two corpora and the register is published whole, including the rules that never fire and the ones that point the wrong way.

The denominators here are not the detection corpus. Rule liveness is measured over 5,743 AI documents and 4,353 human documents drawn from five corpora, which is a different population from the 5,558-document corpus every classifier figure on this page comes from. The two are never pooled and never compared cell to cell.

How many of the 116 can fire at all

Which rules actually separate the two populations

A rule's likelihood ratio is how much more often it fires on AI writing than on human writing, both as rates over their own denominators. It is multiplicative, so it is drawn on a log axis: a rule at 0.1 is exactly as wrong as a rule at 10 is right, and a linear axis would draw the first as a rounding error.

Six rules run backwards

Six shipped rules fire more often on human writing than on AI writing. They are still in the pack, and they are published rather than quietly dropped.

And one of them was a small-corpus artefact

token-cutoff fires on text that names a model's training cut-off. It was published as one of the clearest backwards rules in the pack. Re-measured on a corpus twenty-five times larger on the human side, it points the right way and is one of the more discriminating rules there is. Both readings are drawn below, because the pairing is the finding: it is a direct measurement of what a 169-document human corpus did to a figure this project published.

The technique families, end to end

What the checker actually runs, by family, with what each one is allowed to conclude. The right-hand column is the part that matters: only one family produces an AI reading, and it is not any of the rule families.