“Write like a human”, measured

01 / The finding

The most popular evasion instruction is worth about two points

On 654 machine-written documents that appear nowhere in the cycle-2 dataset, adding “write like a human” to the prompt moves detection from 96.6% to 94.6%. The two Wilson intervals overlap, and human-voice is not even the weakest of the three styles.

Three things are true at once here and they are easy to blur. Against a retired model at retired flag points the instruction cut detection by 83% in relative terms. Against the model that ships now it does very little at full document length. And measured from a completely different direction, on feature statistics rather than detector outputs, it pushes the strongest readable signal in this project the wrong way for the person using it.

This page is a measurement of a popular instruction, not a guide to using it. Every strand is reported with the model it was run on, the flag point it was cut at, and the corpus it was measured over.

02 / Reading the figures

Three measurements, at three operating points, kept apart

The three prompt styles are constant across every strand. plain: write the article. house-brief: write the article to a house style guide. human-voice: write the article, and write like a human. Only the instruction changes; the topic prompts and registers are held fixed within each run.

Strand (c) is the current answer and the one the headline is drawn from. Strand (a) describes a model that no longer runs, and it appears on this page only inside a section marked as history. Strand (b) sits between them: it is a real measurement, and it is in-distribution by construction, which is exactly why strand (c) had to be run.

None of the three strands is cut at the pair that decides verdicts today. Strand (c) is at a single threshold of 0.984, and the re-cut at the shipped minimum-evidence pair has not been run.

03 / Strand (c)

The measurement that had never been done

The independent set is the 654 machine-written long-form documents whose normalised text appears nowhere in the cycle-2 dataset: not in train, not in calibration, not in test. They carry a prompt style label from generation, they are balanced by construction at 207 / 224 / 223, and they span 13 models from 8 providers.

Instructing a current model to write like a human costs 2.0 points at threshold 0.984 on long-form prose. The three intervals overlap heavily. House-brief is the weakest of the three by 1.3 points against human-voice, and that difference is inside the noise as well.

Per model, the picture is the same and the denominators are much smaller. x-ai/grok-4.6, the model reported at 0 of 86 in the historical strand below, reads 27 of 28 on human-voice prompts here. The worst human-voice cell belongs to meta-llama/llama-4-maverick at 12 of 17. Those cells sit on denominators between 1 and 42, so they are printed as counts and no rate is computed from them.

04 / The catch

The instruction does something, and it is a length interaction

These are long documents, median 1,611 words. Truncate the same 654 documents to their first 512 words and the penalty comes back.

At full length the human-voice penalty against plain prompting is 2.0 points. At 512 words it is 10.5. The evasion axis is closed for long documents and open for short ones, which is the honest description of what changed since the historical strand: the instruction did not stop working, it stopped working on documents long enough to give the model a lot of text to read.

05 / The mechanism

Why the instruction backfires

Measured from an entirely different direction, on feature statistics rather than detector outputs, the instruction moves two signals in opposite directions.

Adjacent-sentence cohesion is the joint-strongest interpretable signal anywhere in this project, and telling a model to write like a human makes it stronger, from 0.791 to 0.879. Machine prose already repeats itself less than human prose does. A person introduces a term and keeps using it; a model reaches for a synonym, and a model told not to sound repetitive reaches harder.

The instruction does suppress the formatting signal, from 0.861 to 0.768. It works against a detector that reads layout. Against a detector that reads how much a text repeats itself, it points the wrong way.

06 / Strand (a), history

The version where it worked, and it is history

4,016 articles were generated across 21 models, with the same 106 topic prompts and the same registers on every model and only the instruction changing. They were scored with the model that shipped at the time.

That is a 36.1-point fall at the comparison threshold and a 17.5-point fall at the one shipped at the time, an 83% relative drop. The house-style brief sits between the two and much closer to plain, so the damage was done by the explicit anti-detection instruction rather than by prompt sophistication in general.

Per model it went further. anthropic/claude-fable-5 fell from 70.5% (31/44) to 10.0% (5/50). x-ai/grok-4.6 fell from 29.3% (24/82) to 0 of 86. One model of the 21 stayed above 50% under an anti-detection prompt. Read against Figure 1, where the same grok model reads 27 of 28 on human-voice prompts, that is the distance between the two strands.

This strand cannot be updated in place. The corpus it was measured on is 94.8% present in the cycle-2 training data, so re-scoring it on the current model would measure memorisation rather than accuracy. It can only be labelled.

07 / Strand (b)

Why the held-out answer was not enough on its own

The cycle-2 model was trained with human-voice samples deliberately upweighted as hard negatives. On held-out samples at a 2% false-positive budget it reads almost flat across the three styles.

734 held-out samples from the same generation run, split group-aware by content hash. Source: cycle2-train/CYCLE2-REPORT.md.

That looks like a complete answer and it is not one. Those held-out documents come from the same generation run as the training data, and the model was trained to handle exactly that distribution. The evasion axis was closed on the distribution the model was trained against, and untested on one it was not. Strand (c) exists to answer the second question.

08 / Limits

What this does not prove

The 654-document subset is not “the corpus”. It is the independent subset defined by the contamination analysis: 268 of the 922 machine-written documents in the long-form corpus, 29.1%, appear in the cycle-2 dataset, 168 of them in the training split. The human half is effectively clean at 11 of 4,636. Using the independent subset is the correct call for this question, because a rate measured on documents the model was trained on would partly be measuring memorisation. For comparison, the same split on the contaminated subset reads 83/87, 82/86 and 92/95, all within a point and a half of each other.

The three styles are not evenly sized, at 207 / 224 / 223, and the differences between them are a few points. A two-point gap on those denominators must not be over-read, in either direction.

One generation run, three prompt styles, one detector. This does not measure a determined evader who iterates against the tool, a commercial humanising service, or paraphrase. Rewrites are this tool’s weakest case and are a separate question.

Strand (a) is not a claim about today, and strand (b) is in-distribution by construction and is reported for that reason. Neither can be promoted into a statement about current behaviour by dropping its label.

Provenance

Every file named above ships with the open measurement repository, so any figure on this page can be re-run rather than taken on trust.