You Can't Filter What You Can't Detect: The AI-Content Blocker Everyone Wants Is the Product the Evidence Says You Can't Ship

More than a million people clicked LinkedIn's "seems like AI slop" button in its first two weeks. That is a demand signal you can build a company on — and in the same window, detecting AI content got harder than the models it is supposed to catch (Fortune: 1M+ clicked LinkedIn's AI slop button). People want the machine output named and filtered. The most capable builder of the machines is the one who walked away from naming it.

Here is the plain version. On 20 July 2023, OpenAI retired its own AI text classifier — the tool whose entire reason to exist was to tell you whether its own models wrote something — with the note that the classifier was "no longer available due to its low rate of accuracy." It had caught only 26% of AI-written text and mislabeled human-written text 9% of the time. In the same note, OpenAI said it was "researching more effective provenance techniques for text" (Ars Technica: OpenAI discontinues its AI writing detector). The company with the most to gain from detection declared detection commercially dead and pivoted to provenance. Every "filter the AI content" product shipped since is trying to ship the thing its own maker abandoned.

That is what this piece is about. Not "AI content is a plague" — the fatigue is real and measured, and it is not the thesis. The thesis is narrower and, for a builder, more useful: you cannot reliably detect AI content from the content, and every false positive is a human accused of being a machine. The product the market is asking for is built on a verdict the industry already stopped trusting. What can be built is the layer underneath the verdict — a signed declaration that travels with the content, which the law is now forcing into existence.

Say it once, plainly, because it is the whole decision:

A detector converts a probability into a binary the user acts on. Provenance is a signed declaration that travels with the content. Build on the declaration layer, or don't ship the verdict at all.

---

1. The claim as it is usually stated

The claim shows up in one sentence, over and over, whenever the fatigue conversation turns into a product idea:

"People are sick of AI content. Build something that detects it and filters it out."

The reader this is for is a solo builder or small-team operator — or a platform PM — who has seen the demand and is about to do one of three things: ship a detector, ship a blocker, or add an "AI-written" flag to an existing product. The fatigue signal is loud and the build feels tractable. A classifier, a score, a badge, a filter toggle. The daily-brief version of the idea is "a browser extension that identifies and filters out content likely generated by AI," which is the obvious product to reach for (IdeaGenius daily brief: Anti-AI Content Filter & Blocker).

Two things are worth naming before we look at the evidence, because they set the stakes.

First, the demand is real and now measurable. Cloudflare reported that bot and AI traffic has surpassed human traffic — roughly 58–62% of search requests depending on the date — and Pew Research, looking at 10,000 web pages collected in July 2026, found 10% showed significant indicators of AI authorship, up from about 2% five years earlier (Entrepreneur summary of Cloudflare and Pew). Whatever the exact numbers, the direction is not in dispute. People are swimming in machine output and they are reaching for a filter.

Second — and this is the part the brief reads too generously — the story that started the idea is not a product request. The daily brief was built on a Hacker News thread, "Tired of AI When will this era end?" (HN 47522856, 28 points, 17 comments). Read the actual post and it is a developer's complaint about hype and about the craft of coding — "the most beautiful thing in the Tech was taken away from us... coding" — not a request for a content filter (Hacker News 47522856). The content-filter product is an inference from the sentiment, not the sentiment's own ask. Hold that distinction; it recurs throughout this piece.

2. What the evidence actually says

The claim "you can just detect and filter AI content" has been tested — by the labs, by peer-reviewed researchers, and by the one company that most needs it to work. The record is consistent, and it points the same way each time.

The best-resourced attempt was retired for low accuracy. OpenAI's classifier is the clearest experiment anyone has run. A company that owns the models, the training data, and the strongest incentive to identify its own output could not make a text classifier accurate enough to keep. At 26% true-positive and 9% false-positive, the tool was wrong more often than right in the direction that mattered — and it was "overconfident in wrong predictions" and struggled specifically with AI text that humans had edited, which is most real AI-assisted writing. This is not a startup's early prototype. It is the model-maker's own product, pulled.

The failure is not random — it is systematically biased, and the bias lands on people with the least power to contest it. Liang et al., in a peer-reviewed 2023 study in Patterns, ran seven widely used GPT detectors over 91 human-written TOEFL essays (non-native English writers) and 88 US eighth-grade essays (native speakers). The detectors scored the native-speaker essays near-perfectly. Then they misclassified more than half the human non-native essays as AI-generated — an average false-positive rate of 61.3%. All seven detectors unanimously flagged 19.8% of the human TOEFL essays as AI, and at least one detector flagged 97.8% of them. The mechanism is the point: the detectors keyed on low text "perplexity" — predictable, simple word choice — which is exactly what constrained English looks like. And a trivial prompt like "enhance the word choices" flipped the verdicts back to human-written (Liang et al., Patterns 202300130-7.pdf)).

Read that last line again. The verdict was not a fact about the writer. It was a fact about how polished the sentence happened to be. A student flagged as a machine has no way to prove the negative — there is no test that confirms a human wrote something; you cannot demonstrate the absence of a model's involvement.

Strong watermarking is provably impossible under stated assumptions. If you can't detect from the content, the fallback is to mark the content at creation. Zhang et al., in "Watermarks in the Sand," prove that a computationally bounded attacker equipped with a quality oracle and a perturbation oracle can remove any watermark — even a secret-key one — without meaningful quality loss, and demonstrate the attack against three existing LLM watermarking schemes. Sadasivan et al. show the same wall from the other side: paraphrasing defeats post-hoc detectors, and reliable detection is fundamentally limited whenever human and AI text distributions sit close together (Zhang et al., arXiv 2311.04378).

Now the meta-irony that should raise your guard about every statistic in this space. The widely cited "74.2% of new web pages contain AI content" (Ahrefs, ~900k pages, April 2025) is the output of Ahrefs' own detector — bot_or_not — the very class of tool this piece is questioning. It also conflates "contains some AI" with "pure AI," when only 2.5% of the pages were pure AI. The number that gets quoted as a fact about the web is a verdict from an unverifiable verdict-machine. That is not a reason to dismiss it; it is a reason to label it for what it is: directional, not measured.

3. Where the claim is roughly right, and where it falls apart

Honesty here matters more than a clean story, because the failure record is easy to overread.

Where the claim holds: the demand is real; the fatigue is real; the accuracy of AI-content detection is genuinely not good enough to support a binary verdict, and this has been demonstrated by the maker of the models, by peer-reviewed research, and by an impossibility proof. If your plan is "classify the content and tell the user AI or human," the evidence says the core verdict cannot be made accurate or fair.

Where the claim falls apart — and this is where the piece could go wrong if I overstated it:

  • Watermark-impossibility is conditional, and strongest for text.** The impossibility result holds under stated assumptions (a quality oracle and a perturbation oracle). It is not a theorem that no detection ever works.
  • Signed provenance for images and audio is a real, partially deployed counterexample.** C2PA Content Credentials — cryptographically signed origin metadata — are already embedded by OpenAI, Google, Adobe, and Microsoft; C2PA reports 6,000-plus members and affiliates, and TikTok joined its steering committee in July 2026. OpenAI is adding C2PA conformance, Google's SynthID watermarking, and a public verification tool (OpenAI: advancing content provenance). This layer is declared at creation and verified by signature, so it sidesteps the guess entirely — for the modalities where it is deployed.
  • Inference still helps at the margin, and for triage.** Some signals narrow the range; a probabilistic score can route content to human review, rank it, or flag it for a closer look. What it cannot do is decide.
  • The accuracy numbers are not one number.** Turnitin has claimed a sub-1% false-positive rate; a University of Maryland study of a dozen detectors found roughly 6.8% average false positives; Liang et al. found 61.3% on non-native essays. These cannot be collapsed into "AI detectors are X% accurate," because the corpora differ. The 61.3% figure is a specific TOEFL-corpus result and should be labeled as such, not generalized to all production content moderation.

So the honest version of the claim is not "all detection is impossible." It is narrower and sharper: detection-from-content cannot carry a verdict at the accuracy a filter's users will demand, and its errors fall hardest on the people least able to contest them. Everything else the claim implies should be checked against the counterexample before you repeat it.

And here is why "at the accuracy a filter's users will demand" is the load-bearing phrase. A filter is a product whose entire value is the verdict. A user who wants AI content gone does not want a likelihood; they want the content gone. The moment you ship a binary, you have accepted a false-positive rate as a promise — and your worst-case false positive is a real person told a machine wrote their work, on a platform that then shows them 40% fewer views because of it. That is not a bug to fix later. It is the product.

4. The better version of the claim — and the decision rule

The better claim is a layer choice, and it can be run as a test on any idea in this space.

The inference-vs-provenance test. Ask one question about your core signal:

Is your signal (a) inferred from the content, or (b) a signed declaration that travelled with it?

  • (a) Inference** guesses the origin from the artifact — perplexity scores, classifiers, "AI-ness" heuristics. This is the unfixable layer: the verdict has no ground truth, the signal decays with every model release, and the errors are systematically biased.
  • (b) Provenance** reads a declaration made at the point of creation — a signed C2PA manifest, a SynthID watermark, an EU-mandated machine-readable mark. It never guesses, because nothing has to be inferred; the origin either carried a valid declaration or it didn't.

If your idea lives in (a), you are trying to build the product OpenAI retired. If it lives in (b), you are building on the layer the ecosystem — and now the law — is consolidating on.

If you must ship anything on the inference side, four rules keep it honest:

  • Never ship a binary "AI / human" verdict.** Ship a calibrated likelihood with the base rate shown, so the user sees what an error costs before acting on it. A probability can be argued with; a verdict gets enforced.
  • Always ship a one-tap appeal or override.** The flagged person cannot prove a negative, so the appeal path is not a courtesy — it is your liability control. Every false positive you cannot review is a person you have accused and cannot un-accuse.
  • Assume the detection signal decays with every model release, and price detection as a permanent maintenance cost — not a launch task.** The vendor you are trying to detect controls the next model release. You are not building a feature; you are signing up for a subscription to an arms race you don't set the clock on.
  • Prefer the declared-provenance layer, and if you must infer, use it to triage and route — never to decide.** Route it to a human, rank it, queue it for review. Do not hand it the final call.

Corollary: the demand for "less AI noise" is real, but it is a demand for a feeling — and the feeling is not the same as a shippable mechanism. Ship the thing that can be grounded, or don't ship the verdict.

5. Two worked examples

Example one: the content blocker that works in the demo. You build the browser extension from the brief. It runs a classifier on the page text and hides what scores above a threshold. In your tests it is triumphant: it hides obvious generated paragraph-blogs and leaves your hand-written test set alone. You ship. Within a week, complaints arrive — not from bots, from people. A support engineer with formal, structured English write-ups is flagged. A non-native founder's launch post is flagged. A poet who writes in short, plain sentences is flagged, because low perplexity is exactly the profile the classifier learned to distrust. Now run the test: your signal is inferred from the content, so you are in (a), and every false positive is a human accused with no way to prove the negative. Rule 1 and rule 2 both apply, and the demo could never have shown you why: your test set was you and your cofounder, both native, both reading "polished" as "human." The fix is not a better threshold. It is a different layer.

Example two: the platform flag that ships as "AI slop." You add an "AI-generated" tag to posts on your product, the way LinkedIn did. The mechanism is identical — a detector making a binary call — and so is the failure surface. If a flagged post loses 40% of its views (LinkedIn's own reported figure for its slop flag), then your false positive is not a mislabeled item; it is a creator punished by your guess. The rule that would have saved you is rule 1: show a calibrated likelihood to you, the moderator, not a verdict badge to the audience, and give the creator the appeal in rule 2. The reference implementation you are copying is itself reporting the outcome that should warn you off the binary.

6. What changes if you act on the better version

Your product shape changes, and so does your build sequence — in a way that is now supported by law rather than by your own judgment call.

The regulatory floor has arrived. EU AI Act Article 50 transparency obligations apply from 2 August 2026, requiring providers of generative AI to mark synthetic output in a machine-readable, detectable way, and deployers to label deepfakes and AI-generated public-interest text. There is a deferral to 2 December 2026 for systems already on the market, and to 2 February 2027 for watermark-detection interoperability (European Commission: quick facts on AI transparency rules). Read what that does to the market: the declaration layer is becoming mandatory infrastructure. A builder who ships provenance tooling — verification, display, appeal workflows around C2PA and SynthID — is building on top of something the ecosystem and the law have both decided to carry. A builder who ships a detection verdict is building the product a regulator would eventually require to be replaced.

Concretely, the next step for two reader profiles:

  • If you are about to build a detector or blocker: run the inference-vs-provenance test before you write the classifier. If your signal is inferred, downgrade the product to triage-and-route (rules 3 and 4) and put the verdict behind a human. If your signal can be a declaration, build the provenance reader instead — it is the same user need ("I don't want to be fooled") served by a mechanism that doesn't guess.
  • If you are adding a flag to an existing product: ship the calibrated likelihood to your moderators, not a badge to the audience, and build the appeal path in the same sprint, not "later." Your false positive is a human you will spend trust to un-accuse, and the flag's credibility depends on you being able to show your work.

---

The tired-of-AI crowd is real, and so is the demand — a million clicks real. But you can't filter what you can't detect, and "detect AI content from the content" is the verdict OpenAI retired, the verdict that flags 61% of human non-native essays as machine, and the verdict strong watermarking proves you cannot make robust from the inside. Every false positive is a human accused of being a machine, and the accused can't prove the negative. So stop trying to guess the origin from the artifact. Build on the declaration layer — C2PA Content Credentials, SynthID, the marking that Article 50 makes mandatory in August — and if you ship any detection surface at all, ship a calibrated likelihood plus one-tap appeal, never a binary verdict.

---

Sources

Honest-scope note: The watermark-impossibility result (Zhang et al.) is conditional — it holds under stated assumptions and is strongest for text; signed provenance for images and audio (C2PA, SynthID) is a real, partially deployed counterexample, so this piece does not claim "all detection is impossible." No source establishes a ground-truth rate of AI content on the web: every percentage (Ahrefs 74.2%, Pew 10%, Pangram's >40% of LinkedIn long-form posts) is a detector's classification, not a measured fact, and the Ahrefs figure in particular is the output of Ahrefs' own detector and conflates "contains some AI" with "pure AI" (2.5%). LinkedIn's engagement figures are self-reported. The 61.3% false-positive rate is a specific TOEFL-corpus result, not a production-moderation measurement. Detection-accuracy estimates conflict because the corpora differ (Turnitin <1%, University of Maryland ~6.8%, Liang et al. 61.3%) and cannot be collapsed into one number. No source measures willingness to pay for an AI-content blocker or the size of that market. I did not independently re-verify the C2PA membership count, the Pangram analysis, or the Cloudflare/Pew percentages beyond the cited coverage; refresh the web-composition percentages before shipping. The angle is the researcher's; I did not change it.

---

X entryway list (distribution entryways named in the approved angle)

Hook type, the one claim or mechanism each post would carry, and whether it links to the article. Actual posts are written later, at the distribution stage, after this draft is approved.

  • Hook: surprising proof point.** OpenAI — the company with the most to gain from detecting its own output — retired its AI text classifier on 20 July 2023 for "low rate of accuracy." It caught only 26% of AI-written text and mislabeled 9% of human text. Every "filter AI content" product since is trying to ship the thing its maker walked away from. → Links to the article (the single most credible number in the packet and the cleanest proof of the thesis; the article supplies the decision rule — the number carries the post, the link is a bonus).
  • Hook: risk.** A peer-reviewed study ran seven AI detectors on human-written essays: they flagged 61.3% of non-native English writers' essays as AI-generated while scoring native-speaker essays near-perfectly. The detectors key on simple, predictable word choice — so they punish exactly the writers with the least power to contest the verdict, and no one can prove they didn't use AI. → Links to the article (names the false-positive harm that makes detection a liability, not a feature; the article gives the inference-vs-provenance fix).
  • Hook: mechanism.** An AI-content filter converts a probability into a binary verdict the user acts on — but there is no ground truth for "was a model involved" on the open web, so the verdict is an unverifiable guess. Proxy detection keyed on perplexity is systematically biased against simple or non-native prose, and a human flagged as a machine has no way to prove the negative. → Links to the article (the standalone mechanism — verdict without ground truth; the article is its applied form).
  • Hook: workflow.** The inference-vs-provenance test, in one question: is your core signal inferred from the content, or a signed declaration that travelled with it? If inferred, ship a calibrated likelihood plus a one-tap appeal, never a binary verdict, and price the maintenance as a permanent cost — because the vendor you detect controls the next model release. → Links to the article (an actionable decision rule a builder can apply to their idea today; the article explains why each rule exists).
  • Hook: result.** The resolution is already being forced: EU AI Act Article 50 transparency obligations apply from 2 August 2026, requiring machine-readable marking of AI output, while C2PA Content Credentials and Google's SynthID are embedded by OpenAI, Google, Adobe, and Microsoft. The answer moved from guessing at the content to signing the content — build there, or don't build the verdict. → Links to the article (names the live shift and the date that makes the piece urgent; the article explains how to build on it).

Note: actual X posts are not written here — that is the distribution stage, after this draft is approved.