Can AI Detectors Be Fooled? SICO and Prompt-Based Evasion Explained

Can AI detectors be fooled by a prompt alone, with no extra paraphrasing model at all? A 2024 paper in Transactions on Machine Learning Research says yes. Its method, SICO, builds a prompt from a few dozen human examples, and in the authors' tests it pushed six detectors to roughly coin-flip performance.

A 2025 NeurIPS paper went further, steering a paraphraser token by token with a detector's own scores. Read together, the two papers say less about clever tricks than about a structural weakness in how detectors are built. This post explains both and what they imply.

What SICO does, in plain terms

SICO stands for Substitution-based In-Context example Optimization. Earlier evasion work, such as the DIPPER paraphraser, trained a separate model to rewrite AI text. SICO asks a different question: if large models are good at following examples, can the right examples inside a prompt do the same job?

At a high level the method has three parts:

• Describe the difference. The model is shown pairs of AI-written and human-written answers to the same tasks and asked to describe what distinguishes the human writing.
• Refine the examples. In-context examples are improved over several rounds with word-level synonym swaps and sentence-level rephrasing. A proxy detector scores each candidate, and changes that make the examples look less machine-like are kept, within a constraint that meaning stays similar.
• Reuse the prompt. The final prompt (the feature description, the task instruction and the refined examples) can then be used for new inputs of the same task.

The setup is cheap. The authors report needing only 40 human-written examples and a limited number of model calls, about 1 USD of GPT-3.5 API usage in their estimate. SICO comes in two forms: SICO-Gen writes the task output directly, and SICO-Para rewrites existing AI output. Plain instructions such as "write like a human" are a different matter; see why simple prompts tend to fail.

How it was tested

The experiments used GPT-3.5 on three tasks: academic essay writing (completing Wikipedia paragraphs from the SQuAD dataset), open-ended question answering (ELI5 questions) and fake Yelp reviews. Each task had 200 AI-generated and 200 human-written texts.

Six detectors were tested: a RoBERTa model fine-tuned on GPT-3.5 text (also the proxy used during optimization), OpenAI's GPT-2 output detector, GPTZero, the OpenAI AI text classifier, DetectGPT and a log-rank method. SICO was compared with four paraphrasing baselines, including DIPPER and a hand-written "make it sound human" prompt.

Detector quality was measured with AUC, where 1.0 means perfect separation of AI and human text and 0.5 is no better than chance.

What the results show

SICO beat every baseline in every setting, and in most cases brought detector AUC below 0.5. On the academic writing task the drops were large:

• DetectGPT, original0.834
• DetectGPT, SICO-Para0.149
• GPTZero, original0.779
• GPTZero, SICO-Para0.290
• GPT-3.5 detector, original0.908
• GPT-3.5 detector, SICO-Para0.239

Source: Lu et al. 2024, Table 1 (Writing task). AUC of 0.5 equals random guessing.

An AUC well below 0.5 means the detector ranked SICO text as more human than the actual human texts. For comparison, DIPPER on the same task only brought GPTZero to 0.689.

Quality held up too. In human evaluation on the writing task, SICO-Gen text scored 3.84 for readability against 3.92 for human text, and completed the task 93.6% of the time against 98.2% for human writers. DIPPER managed 70.6% task completion.

The authors also tested a defense. Pairing the original detector with a second one trained on SICO text, and taking the higher score, lifted AUC on SICO-Para writing from 0.332 to 0.762 for the GPT-2 detector, with almost no loss on ordinary AI text.

Adversarial Paraphrasing: steering with the detector itself

The University of Maryland team behind this paper started from a fair observation: newer detectors, especially ones trained on paraphrased text, had become harder to fool with plain paraphrasing. In their tests, simple paraphrasing actually raised the true positive rate at 1% false positives by 8.57% on RADAR and 15.03% on Fast-DetectGPT.

Their method requires no training. An off-the-shelf instruction model (LLaMA-3-8B in their setup) paraphrases the text, and at each step a detector scores the candidate next tokens; the candidate that looks least AI-like is chosen. The authors describe it as a detector-guided search one token deep.

Guided by an OpenAI RoBERTa-Large detector, the attack reduced the true positive rate at 1% false positives by 64.49% on RADAR and 98.96% on Fast-DetectGPT, with an average reduction of 87.88% across eight detectors spanning neural classifiers, watermarks and zero-shot methods. The key word is transfer: optimizing against one detector weakened detectors of entirely different types. The authors report mostly slight drops in text quality, and they analyze that tradeoff explicitly.

What this research says about detector resilience

Strip away the method names and both papers make the same point. A detector is a classifier that has learned a boundary between two distributions of text. Anything that can query a detector, or a reasonable stand-in for one, can learn where that boundary sits. SICO did it through a handful of prompt examples, Adversarial Paraphrasing through per-token choices. Neither needed the detector's internals.

Three practical consequences follow:

• Detection becomes an arms race. Defenses such as SICO's ensemble or adversarial training help against known attacks, and each new attack shifts the boundary again.
• Transfer means no detector is safe by being different. Optimizing against one model weakened others, which matches the broader picture in the RAID benchmark.
• Surface form is not authorship. If small, meaning-preserving changes flip a verdict, then the verdict was tracking style statistics, not who did the thinking. That is the same reason careful human writers, especially non-native English writers, get flagged.

None of this makes evading coursework rules acceptable. Both papers frame their work as stress tests that expose weaknesses so detection can improve. If you use AI tools in academic work, the honest path is to follow your institution's or journal's policy, disclose where required, and keep your drafts so your process is visible.

Where Academic Humanizer fits

For researchers, the useful lesson from this literature is that meaning and detector verdicts can come apart. Academic Humanizer is built around keeping meaning fixed: the Humanizer rewrites only the sentences detectors flag, preserves your claims, numbers, terminology and citations, and leaves human-reading sentences untouched. It is validated against Turnitin, GPTZero, ZeroGPT, Copyleaks, Sapling and Originality.ai, and the AI Detection Report shows each rewrite next to the original so you approve every change yourself.