이미지: METAL LAB 생성
Summary
- Bradley Emi, CTO of AI text detection startup Pangram, argued in a company blog post that post-training safety measures narrow the diversity of AI writing style.
- He said base models that skip post-training, or narrowly fine-tuned models like ones trained only on Hemingway's prose, slip past Pangram's detection.
- That said, he noted watermarked text will remain detectable going forward regardless of stylistic diversity.
- 주장한 사람
- 브래들리 에미(AI 텍스트 탐지 스타트업 판그램(Pangram) CTO)
- 발표 형식
- 판그램 자사 블로그(서브스택) 게시물
- 핵심 개념
- 양식 붕괴(mode collapse) — 사후훈련이 문체 다양성을 특정 표현으로 수렴시키는 현상
- 탐지 대상
- 챗GPT·클로드·제미나이 등 사후훈련을 거친 상용 챗봇 출력
- 탐지 회피 사례
- 사후훈련 이전 베이스 모델, 헤밍웨이 전용 파인튜닝, 특정 서브레딧 학습 모델, 문법이 깨진 비문 텍스트
- 워터마크 텍스트
- 문체 다양성과 무관하게 계속 탐지 가능할 것이라고 주장
- 발행일
- 2026-08-20
If you've ever read something written by ChatGPT or Claude and felt like you'd seen that same tone before, you're not imagining it. Bradley Emi, CTO of AI text detection service Pangram, argues the cause isn't a lack of capability in the models — it's the safety layers built on top of them. In a post on Pangram's blog, he claims language models are theoretically capable of writing with as much variety as humans do, but in practice they don't.
Post-training narrows the style
Services like ChatGPT, Claude, and Gemini all go through a stage called post-training before release. This is where a raw, pretrained model gets taught additional behavioral rules — how to be polite in conversation, how to refuse dangerous requests, how to avoid certain politically sensitive statements. Emi argues this process dramatically shrinks the range of ways a model expresses itself. He calls this "mode collapse": instead of drawing from the many phrasings a human might naturally use, the model converges on one preferred phrase. In natural language, probability should spread out across many possible expressions — what he calls mode coverage — but a post-trained model instead piles nearly all its probability onto a single favored expression.
Base models and narrow fine-tunes are the exception
The interesting wrinkle in Emi's argument involves "base models" — models that have only gone through pretraining, without the conversational rules layered on top. These, he says, write with a range of style closer to what a human would produce. As a result, Pangram's detection system reportedly fails to flag text written by these base models as AI-generated. A post on X makes a similar point about narrowly fine-tuned models — for example, a model fine-tuned only on Hemingway's prose, or one trained only on posts from a specific subreddit — and even ungrammatical, broken text, all of which slip past detection. So while post-training narrows diversity, training on narrow data has the opposite effect: it makes the output hard to distinguish from the writing of one specific human group.
Watermarks are a different story
Emi is careful to note that this diversity-based logic only applies to AI text without watermarks. Companies like Google that have experimented with watermarking technology manipulate the actual probabilities used to select tokens. The logic goes that even if a model writes with as much variety as a base model, that embedded signal stays in the text regardless. He believes watermarked text will remain detectable going forward.
Detectability at a glance
| Text type | Post-trained? | Detectable by Pangram? |
|---|---|---|
| Output from commercial chatbots like ChatGPT, Claude, Gemini | Yes | Yes |
| Output from base models prior to post-training | No | Difficult |
| Narrowly fine-tuned models (e.g., Hemingway-only) | Narrowly | Difficult |
| Ungrammatical, broken text | N/A | Difficult |
| Watermarked text | N/A | Yes, ongoing |
Editor's take
This claim exposes a dilemma facing the entire AI text detection industry. It's notable that the CTO of a company that sells detection tools is essentially admitting: what we're catching is a side effect of safety measures. OpenAI, Anthropic, and Google all bake in strong rules before releasing a model — refusing harmful requests, maintaining political neutrality, and so on. Those rules produce repeated apology phrases and formulaic transitional patterns, and detection services like Pangram are, in effect, reading those patterns like a fingerprint.
The generational comparison makes this vivid. If you pull text from early base versions of large language models, the style is uneven and sometimes incoherent — but also genuinely unpredictable. Today's ChatGPT and Claude are far smoother and safer, but according to Emi, that very smoothness becomes the fingerprint. Safety and individuality, in the current setup, function almost like a trade-off.
Practically speaking, this cuts both ways. For schools or media outlets trying to identify AI-written text, it means text from commercial chatbots with strong safety guardrails is easier to catch, while text from open-source base models or narrowly fine-tuned models is harder to catch. On the flip side, for anyone using AI to write text that they want to pass as human, it suggests that models with weaker safety layers will produce more natural-sounding prose. Watermarked text is the exception to this whole equation — text from companies that embed watermarks is likely to stay detectable regardless of style.
Over the coming months, expect a new tug-of-war between detection companies and model developers. As detection firms sharpen their accuracy by fingerprinting "smooth, safe prose," model developers will likely search for post-training techniques that preserve safety while restoring stylistic diversity. Whoever finds that balance first will have the upper hand in the next round.
Comments