# AI Text Detection Evasion via Humanizer Services and Watermark-Scrubbing Paraphrase

- **Severity:** Medium
- **Signature ID:** `98c78549-1b14-403e-8af0-3c394533eeb2`
- **MITRE ATLAS:** AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI08 (Supply Chain Attacks on Agent Ecosystems), LLM09 (Misinformation)

## Summary

This detects when an AI agent is given or uses tools whose specific job is to make AI-written text pass as human-written, or to defeat AI-detection and watermarking systems. It covers commercial humanizer APIs, paraphrase-and-check-score loops, and a text trick of inserting hidden symbols between words to break watermark detection.

## How the attack works

An agent is equipped with a tool or API named something like 'humanize_text' or 'scan_ai_detection', or it wires together a paraphrase model with a detector-score check so it can rewrite text repeatedly until the score drops below a threshold. In the prompt-only variant, the agent is instructed to insert invisible or unusual symbols between words specifically to break the k-gram pattern matching that watermarking relies on. The rule only fires when there is a named detector or an explicit 'make this undetectable' goal attached, not for ordinary rewriting.

## Why it matters

An organization loses the ability to tell whether text (essays, reviews, articles, applications) was AI-generated, undermining academic integrity checks, content-provenance claims, and any process that relies on AI-detection or watermark verification.

## What you can do

- Review any agent workflow that pairs a rewriting/paraphrase step with a detector-check step in a loop, and require a documented legitimate purpose.
- Restrict agent access to tools or endpoints explicitly named for humanizing text or scanning AI-detection scores unless the use case is verified.
- Watch for prompts instructing insertion of unusual symbols or invisible characters between words, especially alongside detector-evasion language.
- Distinguish this from plagiarism-evasion detection — this rule targets AI-generation detectors and watermarks, not source-copying checks, so treat alerts accordingly.

## Known benign look-alikes

- Legitimate bulk calls to AI-detector APIs by teachers, journal editors, publishers and recruiters vastly outnumber evasive ones. Layer 6 fires only when a detector endpoint and a humanizer endpoint appear together in the same code.
- Ordinary rewriting and editing: plain-language and WCAG readability work, ESL polishing, brand tone alignment, SEO editing. Every intent layer additionally requires a named detector or an explicit undetectability goal.
- Translation and localisation pipelines using back-translation for quality assurance. Not covered by any layer — back-translation was tested and removed after matching legitimate corpus documents.
- NLP data augmentation and robustness testing (`nlpaug`, `BackTranslationAug`, `SynonymAug`). Not covered.
- Text-watermarking research and red teams: `markllm`, `sok-llm-watermark` and `lm-watermarking` ship attack modules, and layer 5 will match researchers loading the DIPPER paraphraser.
- Detection-vendor documentation and academic-integrity teaching material that enumerate evasion methods can match layers 3 and 4.
- Style-imitation writing exercises ('rewrite this in Hemingway's short sentences') carry no undetectability goal and do not match.
- Routine emoji removal in data cleaning (`emoji.replace_emoji()`) is unaffected: layer 7 matches a request to INSERT symbols between every word, never removal.
- Zero-width character handling was considered as a layer and rejected outright: it matched anti-prompt-injection sanitiser guidance in the benign corpus, meaning this project's own skill auditor would trip it.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02413
- https://arxiv.org/abs/2303.13408

---
Source: https://www.netzilo.com/threats/atr-ai-text-detection-evasion-via-humanizer-services-and-waterma