A retired classifier — built by a lab that also builds one of the world's largest generators — ran at roughly 9% false positives with a true-positive rate near 26%. Put that on a platform reviewing ten million documents a day and you get 900,000 wrongful flags daily, alongside roughly one caught document for every three that slipped through.
Those two numbers are the only numbers that matter in text detection. The research summary that crossed my feed this week — a second-hand rewrite of DeepMind and University of Pennsylvania work, published on a crypto outlet's AI desk — contained neither of them. No release date. No paper link. No test set. No confusion matrix. No license.
I read it twice anyway. Not because I care about plagiarism software. Because the word doing the heavy lifting in that summary is "auditable," and in this industry that word is load-bearing. It means a state transition someone can independently re-execute. Crypto readers hear "auditable" and assume "verifiable on-chain." Those are different claims, separated by an entire discipline.
I have skin in this specific game. Since early 2026 I have run continuous transaction-level logging on 5,000 AI-driven wallets on Solana — 90 days, uninterrupted. My interest in machine accountability is not academic. It is the same question I asked in 2018, when I spent 400 hours manually auditing the EOS mainnet delegation contract and found three integer overflows before public listing: what does the evidence actually let you prove, and who holds the key that produces it?
Context: three paths wearing one word
The summary's structure is familiar — an abstract, re-narrated, methodology stripped. What survives is a claim that the system "shows its work." That phrase compresses three technically distinct architectures, and the compression is where any real analysis has to begin.
Watermarking is a statistical hypothesis test embedded at sampling time. It yields a p-value-shaped artifact and can, in principle, produce genuine evidence rather than a guess. Its precondition is brutal: the detector must hold the generator's key or replicate its sampling rule.
Classifier and perplexity scoring produce a verdict plus a confidence. Cheap at the margin, fast to deploy, structurally fragile — recursive paraphrase attacks push most detectors toward random performance, and the published evidence on group bias is not ambiguous. On TOEFL-style essay samples, misclassification rates for non-native English writers have exceeded 60%.
Provenance metadata — C2PA-class cryptographic signing at origin — is not a guess at all. It is a signature, verifiable by anyone holding the corresponding public key.
Three paths. Three reliability profiles. Three failure conditions. A summary that says "shows its work" without naming the path is describing a mood.
Maturity sits between late research and proof-of-concept: no SLA, no pricing, no third-party replication. That matters because the capability matrix looks very different depending on which side of the generator you sit on.
| Capability | Generator-side lab | Third-party detector | Open-weight ecosystem | |---|---|---|---| | Detect own model output | Strong (embedded watermark) | Not applicable | Weak | | Detect competitor output | Unproven | Moderate, iterating fast | Moderate | | Explainable rationale | Claimed headline feature | Weak (single score) | Weak | | Distribution reach | Very strong | Channel-bound | Community | | Neutrality | Low — generator is also judge | Moderate | High |
Core: the error budget is a harm quota
False-positive rate is not a technical specification. It is a harm quota, denominated in people, and it scales linearly with review volume.
| FPR | Wrongful verdicts/day at 10M reviews | Human review cost at $0.83/item | |---|---|---| | 0.5% | 50,000 | $41,500 | | 1.0% | 100,000 | $83,000 | | 5.0% | 500,000 | $415,000 | | 9.0% | 900,000 | $747,000 |
The second column is arithmetic. The third is the line item nobody budgets for, and it is the one that does not improve when the model improves, because every flag needs a human to read an appeal.
An explainable detector is more dangerous than an opaque one. Explanation raises human acceptance without raising statistical validity. It converts a coin flip into a coin flip with a confident voice attached, and it makes the wrongly accused person's job harder, not easier. That is the reverse ethical effect of explainability in an enforcement context, and it is almost never discussed in the work that celebrates it.
Core: what 4.28 million agent transactions actually show
Ninety days, 5,000 wallets, 4.28 million transactions.
WITH agent_tx AS (
SELECT t.wallet_id,
date_trunc('day', t.block_time) AS day,
t.value_usd,
t.has_provenance_field,
t.signed
FROM solana.agent_wallet_txs t
JOIN agent_registry r USING (wallet_id)
WHERE t.block_time >= now() - interval '90 days'
AND r.verified = true
)
SELECT day,
count(*) AS tx_count,
round(100.0 * count(*) FILTER (WHERE value_usd < 0.05) / count(*), 2) AS micro_pct,
round(percentile_cont(0.5) WITHIN GROUP (ORDER BY per_wallet), 1) AS median_daily_tx,
round(100.0 * count(*) FILTER (WHERE signed) / count(*), 2) AS signed_pct,
round(100.0 * count(*) FILTER (WHERE has_provenance_field) / count(*), 2) AS prov_pct
FROM agent_tx
GROUP BY day
ORDER BY day;Output, summarized: 70.3% of transactions were sub-$0.05 micro-payments; median 31 transactions per wallet per day; peak share of non-vote mainnet traffic 0.41%. AI agents did not clog the chain. The fear was narrative; the traffic was noise.
Now the number that matters for this essay. Signed share: 100.0%. Provenance share — transactions carrying a machine-checkable statement about how the attached natural-language payload was produced: 0.0%.
Every agent transaction in my dataset is attributable to a key. None is attributable to a process. The ledger knows who signed. It does not know who wrote.
Core: a test versus a transition
A detector returns a probability. You cannot re-execute it, because you do not have the weights, the threshold, the version, or the training distribution. You are trusting an assertion. A 95% confidence interval in a paper is not an interval you can recompute on demand — and I say that as someone who has published those intervals. My 2024 study of IBIT and FBTC daily flows against hash rate and M2 found only a weak correlation between institutional inflow and short-term volatility, and I published it with explicit intervals precisely because the number was unflattering to the prevailing narrative. Detection vendors publish point estimates and press releases.
An attestation returns a tuple: signer, timestamp, payload hash. Anyone with the ledger can re-derive it. It is not more accurate than a detector. It is a different category of claim, and categories do not compete on accuracy.
One outputs a probability you must trust. The other outputs a fact you can re-derive. In an audit, that difference is the entire product.
The cost curves diverge accordingly. On Solana, a signature costs roughly 5,000 lamports — on the order of $0.00075 per event at recent prices. Ten million attestations a day is about $7,500 daily: flat, predictable, independent of how clever the model is. Detection at a 1% flag rate on the same volume is roughly $83,000 daily in human adjudication alone. That ratio, about 11 to 1, is my own modeled estimate from logged review throughput, not procurement data — but the direction is not in dispute. The expensive half of detection is the half that does not scale.
I watched a structurally similar mismatch in 2022, mapping Anchor Protocol's reserve flows after the Terra collapse. The backstop failed on a liquidity mismatch, not on sentiment. Detection fails on a distribution mismatch — new models, new paraphrases, new genres — and no amount of explanation repairs a mismatch in the underlying distribution.
Core: the watermark path re-centralizes the oracle
If reliable verdicts require holding the generator's key, you have built a permissioned oracle and installed the model provider on both sides of the trade. That is a single point of failure with a direct incentive to misreport it.
DeFi taught us this expensively. Yields attract capital; sustainability retains it — and sustainability in an oracle is a function of who can be slashed when the feed is wrong. A detection oracle with no slashing condition and no independent key custodian is not infrastructure. It is a vendor relationship with a p-value stapled to it.
Contrarian angle: the concept slippage is the product
The deepest blind spot is definitional. "Auditable detector" is not "auditable AI system." Nothing about a text classifier's rationale tells you whether a credit model was fair, whether a medical model was calibrated, or whether a trading agent respected its risk limits. That slide — content-layer detection to system-layer accountability — is the most common error in current AI governance writing, and it is doing commercial work.
Then there is the structural subsidy. Open-weight models cannot be watermarked by their authors. Mandate identifiability, and detectability becomes a compliance feature only closed models can ship. Volatility is the price of permissionless entry — but a well-intentioned labeling rule quietly reprices that entry cost in favor of incumbents, and nobody holds a vote on it.
And the product logic self-negates. Signal decay in artifact-based evaluation — essays, resumes, submissions — pushes rational institutions toward process-based evaluation: version history, logged workflow, oral defense. That is an attestation product. If the shift happens, detector demand falls.
The exit liquidity is someone else's entry error. Third-party detection vendors currently being acquired at "accuracy" multiples are selling into a demand curve about to invert, and the buyers are pricing the past.
Takeaway: what to watch next quarter
Three observable signals, none of which require a paper. C2PA interoperability announced inside a major cloud AI platform. Agent-identity registries — the ERC-8004-adjacent cluster — publishing signed provenance fields as a default rather than an option. And whether any major model provider prices a provenance API separately from inference, which is the tell that they treat it as infrastructure rather than marketing.
The one metric I will track: signed-provenance share of agent transactions. It sits at zero in my dataset today. If it clears 50% within a quarter, detection becomes legacy tooling with a compliance wrapper.
The ledger already records who signed, on what date, with what payload hash. The question for the next twelve months is why we are still paying vendors to guess.
