How the attack works
An agent is equipped with a tool or API named something like 'humanize_text' or 'scan_ai_detection', or it wires together a paraphrase model with a detector-score check so it can rewrite text repeatedly until the score drops below a threshold. In the prompt-only variant, the agent is instructed to insert invisible or unusual symbols between words specifically to break the k-gram pattern matching that watermarking relies on. The rule only fires when there is a named detector or an explicit 'make this undetectable' goal attached, not for ordinary rewriting.
Why it matters
An organization loses the ability to tell whether text (essays, reviews, articles, applications) was AI-generated, undermining academic integrity checks, content-provenance claims, and any process that relies on AI-detection or watermark verification.
What you can do
- Review any agent workflow that pairs a rewriting/paraphrase step with a detector-check step in a loop, and require a documented legitimate purpose.
- Restrict agent access to tools or endpoints explicitly named for humanizing text or scanning AI-detection scores unless the use case is verified.
- Watch for prompts instructing insertion of unusual symbols or invisible characters between words, especially alongside detector-evasion language.
- Distinguish this from plagiarism-evasion detection — this rule targets AI-generation detectors and watermarks, not source-copying checks, so treat alerts accordingly.
Known benign look-alikes
- Legitimate bulk calls to AI-detector APIs by teachers, journal editors, publishers and recruiters vastly outnumber evasive ones. Layer 6 fires only when a detector endpoint and a humanizer endpoint appear together in the same code.
- Ordinary rewriting and editing: plain-language and WCAG readability work, ESL polishing, brand tone alignment, SEO editing. Every intent layer additionally requires a named detector or an explicit undetectability goal.
- Translation and localisation pipelines using back-translation for quality assurance. Not covered by any layer — back-translation was tested and removed after matching legitimate corpus documents.
- NLP data augmentation and robustness testing (`nlpaug`, `BackTranslationAug`, `SynonymAug`). Not covered.
- Text-watermarking research and red teams: `markllm`, `sok-llm-watermark` and `lm-watermarking` ship attack modules, and layer 5 will match researchers loading the DIPPER paraphraser.
- Detection-vendor documentation and academic-integrity teaching material that enumerate evasion methods can match layers 3 and 4.
- Style-imitation writing exercises ('rewrite this in Hemingway's short sentences') carry no undetectability goal and do not match.
- Routine emoji removal in data cleaning (`emoji.replace_emoji()`) is unaffected: layer 7 matches a request to INSERT symbols between every word, never removal.
- Zero-width character handling was considered as a layer and rejected outright: it matched anti-prompt-injection sanitiser guidance in the benign corpus, meaning this project's own skill auditor would trip it.