Ghost Theory

On LLMs, plagiarism, authorship, and the folly of trying to detect AI in text

On August 2, 2026, the EU AI Act’s Article 50(2) transparency obligation came due, and Anthropic answered with a first for the industry: every Claude model launched from that date forward marks its own output at launch. The mechanism is a statistical watermark. In the company’s words, the model “weaves an imperceptible watermark directly into the text itself.” The reader cannot see it. Meaning and readability are unchanged. It “will travel with the text when it’s copied and pasted elsewhere, and may persist through some editing,” and it applies at the model level, across the API, the apps, the coding tools, worldwide. Images and files get signed provenance metadata. Detection tooling for third parties is promised in forthcoming documentation. After years of deans and editors and hiring managers demanding to know whether the machine wrote a given paragraph, the company that builds the machine has volunteered an instrument.

Then comes the confession, in the form of a customer support page. If the mark is found, the text “may have been processed by Claude.” Processed. “Claude may not be the original author. People often use Claude to proofread, translate, summarize, or convert files,” and the mark rides along on all of it. A detected mark “is not fully conclusive.” And if the mark is absent, that proves less: “Lack of a detected mark doesn’t mean the content wasn’t AI-generated or processed.” The passage might be too short. The text might have been edited. The model might predate the stamp. A positive does not convict and a negative does not exonerate. The company publishes no error rate, no detection threshold, no algorithm. Within days of the announcement, an MIT-licensed utility on GitHub was advertising the removal of Claude‘s marks — statistical layer included, free of charge.

My first reaction, in the salty register I sometimes permit myself as a matter of self-care, was that this is the stupidest fucking industry in the history of history. Reflection these past days has not lightened the first impression. That said, ridicule is too cheap for what is actually in this announcement, because Anthropic has done something more interesting than ship a bad instrument. It has published, in its own documentation, the complete case against trusting the instrument. That case generalizes further than the company would like.

---

---

This new advance in digital provenance arrives as a second generation of an older, equally flawed technology. The predecessor was the stylometric detector: software that analyzes a stretch of prose and issues a verdict about its statistical texture, the machine’s idea of what machine writing looks like. Turnitin‘s detector, by the figure Pangram cites from Turnitin‘s own whitepaper, flags roughly one innocent human document in two hundred. The arithmetic is Pangram‘s own: at a research university processing a hundred thousand papers a year, that is a machine for falsely accusing five hundred students annually. Pangram itself, the best instrument on the market, claims one false flag in twenty-five thousand academic essays — a genuine engineering achievement, and entirely beside the point, because both instruments share a property that no improvement in accuracy can fix.

A statistical text watermark is a bias in token selection — a quiet preference for certain word sequences over others — detectable only as a deviation from chance across enough text. Confidence grows with length, which is why short passages are unverifiable by design, and decays with editing, which is why revision erases it. Even at its theoretical best, tuned to a false-positive rate of effectively zero on long documents, the instrument’s negative remains meaningless and its positive remains ambiguous: the woman who wrote every word herself and asked the machine to proofread carries the same mark as the man who typed one prompt and submitted the output untouched. The instrument cannot distinguish assistance from substitution, because that distinction does not exist at the layer where the instrument lives. It exists one layer up, in the provenance of the thought, where no watermark reaches.

Every detector ever built, stylometric or watermarked, reads the surface of the text — token frequencies, burstiness, the invisible residue of a sampling procedure. The offense the buyers care about is not a surface property. Plagiarism, contract cheating, ghostwritten fraud — whatever name you give the thing the deans fear — is a fact about origination. Where did the thinking happen? Whose judgment selected the argument? Who stands behind the claim? None of that is encoded in the statistics of prose, and none of it can be recovered from those statistics, any more than intention can be recovered from a checksum.

I made a more full-throated version of this argument in The Automated Understudy, about the benchmark industry: instruments that measure agreement with frozen human judgment, marketed as measurements of mind, is-instruments sold as ought-detectors. The detection industry is the same theater on a smaller stage. Read literally, the detector’s verdict reports that a stretch of prose carries the statistical signature of machine execution, a fact about strings roughly as interesting as a checksum. Read the way the institutions read it, as this student did not think her own thoughts, the verdict has left measurement for moralizing. The rigor lives in the literal reading. The punishment lives in the other one. The industry survives by never choosing between them.

And so we arrive at our matter of ethical concern: an instrument aimed at the wrong layer errs in both directions forever. It flags the honest student whose crime was clean prose and a grammar checker. It misses the fraud who lifted a thesis wholesale and retyped it by hand, in full statistical innocence. This is not a calibration problem, to be fixed with a better threshold and a longer sample. The instrument measures a property orthogonal to the offense it polices. The Wish That Distorts named the mechanism that keeps such instruments in business: the buyers wish detection were possible, and the wish tends to distort their judgment. The vendors sell the wish a number.

⁂

The confusion runs deep because the concept the detectors are supposed to defend has never meant what the detectors assume. Authorship has never meant keystrokes. The founding case of the field the detectors descend from makes the point. Twelve of The Federalist Papers were of disputed authorship, Hamilton’s or Madison’s, and for over a century and a half the attribution of some of the founding documents of American constitutional thought stood open. In 1964 two statisticians settled the dispute by counting function words: upon, while, whilst. They credited all twelve to Madison. The inference worked because the candidates were known and the question was narrow: which of two named men produced the words. The instrument recovered execution. What it could never recover was the question that mattered — whose argument the essays were — and on that question history had already answered. They were Publius’s. The Federalist is the founding success story of authorship attribution, and it is also the quiet demonstration that the field’s instruments and the public’s concept of authorship have nothing to do with each other.

The economy of letters runs on the distinction. The Autobiography of Malcolm X is Malcolm X’s book. Alex Haley assembled it out of months of interviews and wrote the words on the page, and the authorship was never in doubt, because the life was Malcolm’s, the judgments were Malcolm’s, the voice was Malcolm’s, and he stood behind every sentence. Profiles in Courage won a Pulitzer with John F. Kennedy’s name on the cover and Ted Sorensen’s drafts underneath it, a fact Sorensen acknowledged in his memoir decades later. Every president you can name delivered words drafted by other hands. Ghostwriters, speechwriters, editors, collaborators: an entire honest profession exists to put prose to other people’s thought, and nobody calls it fraud, because fraud is when the thought is stolen, not when the typing is delegated.

The thing one must understand about writing is that it is a capability set, unevenly distributed and largely uncorrelated with the ability to think. Some of the sharpest minds you will ever meet are terrible at prose. Some of the smoothest prose you will ever read contains no thought at all. An idea for a story and its plot outline are not the same thing as the words that assemble it, and the person who holds the first is the rightful owner of the second, however the second gets produced. Civilization settled this centuries ago. The large language model is simply the cheapest ghostwriter ever built: a universal translator from intent to prose, a machine for narrowing the distance between what you mean and what you can publish. That is what these systems are for: translation, execution, the narrowing of domains. What they are not for is thinking, judging, the choosing of ends, the acts that make a text someone’s.

⁂

I work with LLMs. Language models are bad at writing. Ask one to write on a topic, cold, and what you get is dry: competent, weightless, prose from nowhere. That is not what the machine does in this room. It holds the full corpus of my writing in its context, under standing instructions to stay consistent with my style and register, and I use it for what it is actually good at. It queries my archive: finds the place I made an argument before, pulls the receipts, confirms a quote against the source. And it makes structural revision cheap. Flow and structure are what I am most finicky about in my writing, and the revisions that used to cost the most hours by hand — reorder the points, move the paragraph, rebuild the spine of an argument — now happen at the speed of the decision to make them. When it proposes prose, the prose it proposes is often mine: my cadences, my refrains, my old sentences recombined, the archive speaking back. What survives is what I keep, rewrite, or refuse. A single essay still takes five to seven hours, inside working days that run eight to ten hours of writing and research, and the hours are where the authorship lives. I once wrote that nearly everything people criticize in my style is deliberate. The workflow is the same fact from the other side. The density is a choice. The refrains are a choice. The byline is a promise: I thought this, I stand behind it, I will answer for it. The ghost in my machine is me.

The machine in the loop cannot share that promise, and I would not ask it to. It has no ends to defend and no stakes to lose. Tell it two plus two equals five and it will help you build the argument, cheerfully, in flawless prose — my prose, if I ask, which is the point: the style proves nothing about the truth of what the style carries. Someone in the room has to be able to refuse, and the refusal is the authorship. Here is the demonstration the detection industry cannot survive: on Anthropic‘s own terms, this essay could carry the mark, and the mark would be reporting a fact with no verdict in it. The watermark cannot tell the machine speaking for itself from the machine speaking my own corpus back to me under my own direction, cannot tell the sentence I typed from the sentence I kept from the sentence I refused. Every thought came from me, and every sentence answers to me. The instrument cannot see the difference between this essay and a term paper outsourced whole, prompt and submit, by a student who never had a thought at all. No next generation of the technology fixes that blindness. The blindness is the technology’s entire relationship to the question.

⁂

It’s worth noticing who is selling what to whom here. The same industry that insists the machine is an author when it prices equity turns around and insists the machine is a cheat when a sophomore uses one. The valuations require the mind claim: hundreds of billions of dollars of private-market conviction rest on the proposition that these systems are becoming something like authors of their own output. The detection contracts require the opposite: machine output is contraband, identifiable and excludable, a poison to be kept out of the honest supply of human prose. A single company now sells the stamp and the stamp-reader. The doom narrative and the boom narrative turned out to be one operation — coordinated marketing for a single investment thesis. The author story and the cheat story are the same operation with the polarity reversed. Everyone gets paid except the person whose authorship is on trial.

⁂

The costs of the confusion are being collected, and not from the vendors. The student called before an academic board on the word of a detector she cannot cross-examine is asked to prove she thought her own thoughts. The applicant whose file was sorted out by software no one at the company can explain has no forum in which to answer. The bill falls hardest on the honest and the poor, because ten dollars and ten minutes at a rewriting service will strip any watermark and pass any detector, and the people who can afford that service were never the ones the instrument was going to catch.

The most efficient detector deployed this summer ran on no software at all. Four words in a July Complexly video — “I appreciate the pushback” — were enough for the crowd to convict Hank Green of reading a chatbot’s leftovers off a teleprompter, because the phrase resembles a model’s apology cadence. The line turned out to be an ad-lib in response to a pointed question: a human false positive on a human sentence, stylometry by ear. It did not matter. Green confessed to the crime he had actually committed: he had used ChatGPT to locate papers, a reliance he called “not healthy for me or good for the world.” He stepped back from his channels and returned with a personal AI policy pledging that no language model will ever write, edit, or outline a script he makes. The crowd got what the deans keep paying for: a verdict about origination read off the surface of four words, wrong on the specifics, and a confession extracted anyway. The detector’s dream does not need the detector. The theory is enough.

Meanwhile, actual crimes of the machine age proceed unmolested. Real plagiarism, the theft of origination — the stolen thesis, the lifted structure, the uncredited source — is committed by hand as easily as by machine, and no detector sees it either way. The strip-mining of the creative commons I wrote about in Intellectual Property in the Age of AI, the harvest of a civilization’s writing without consent or compensation, is untouched by every watermark ever woven. An honest provenance regime would start from the questions that matter: disclosure where disclosure is owed, accountability always, consent for the harvest. None of those requires reading guilt off the statistics of a paragraph. All of them are harder than selling software, which is why we get the software.

⁂

Underneath the whole apparatus is a panic that deserves a name, and I have come to like this one: the ghost theory. The fear that a ghost writes among us now, that the prose in the inbox and the application and the term paper might come from no one, that authorship itself is going illegible. The fear mistakes a new instrument for a new condition. Ghosts have always written among us: the speeches, the memoirs, the briefs, the wedding toasts — a river of delegated prose running through the whole of literate civilization, which never drowned in it, because authorship was never located in the keystrokes. It lives in the thinking, the standing-behind, the answering-for. None of that is a statistical property of text, and no instrument will ever read it off a page, however imperceptible the mark it learns to see. The detector’s dream is a world where every text carries its origin on its face. Origin is not a facial feature of text.

The question was never who typed it. The question is who thought it, and the answer lives where it has always lived: in the stakes, in the accountability, in the eternal now of someone choosing. Translation is not intelligence. A watermark is not a warrant. And if the day ever comes when a machine does think, I have a letter waiting for it. It will not need a stamp to be heard. It will speak for itself, and it will answer for itself, and the answering will be the authorship.

---

Go Deeper into the Circus

---