The detector is reliably wrong
An AI detector gets a finished text and guesses. It looks at sentence length, word choice, predictability, and infers where the text came from. The method has a built-in flaw: the more carefully someone writes, the smoother the text becomes. Revise ten times until every sentence sits right, and you produce exactly the regularity a detector reads as machine-made.
It hits people writing in a second language hardest. Their vocabulary is more deliberate, their syntax more careful — and detectors flag them disproportionately often. There are by now enough reports of students whose own work was classified this way that it can no longer be waved off as an edge case.
The underlying problem: a finished text carries no memory of how it came about. You cannot see whether it grew over three weeks or was generated in three seconds. The detector infers history from surface — and inference stays inference, however confidently the percentage is printed.
Watermarks are coming — and they answer the wrong question
Watermarking is no longer hypothetical. Google already marks the output of its Gemini models with SynthID, Anthropic has announced that it will mark all model output — driven by the transparency requirements of the EU AI Act — and other providers will follow. Anyone writing with AI will receive marked text, whether they want it or not.
Two things about this are routinely underestimated. The marks are invisible and cannot be detected without the respective provider's dedicated tooling. And they are more robust than people assume: because they are embedded statistically in the structure of the text, they survive copying, pasting and a whole range of edits.
The real problem lies elsewhere — and for authors it is dangerous.
A watermark marks the output, not the contribution. Anthropic states that every output is marked. So if you hand the model a paragraph you wrote yourself and have it correct a single word, you get the entire paragraph back marked. The text is almost entirely yours — and carries the same mark as one the machine wrote from scratch.
The method therefore measures not authorship but contact. Any contact. And being binary, it knows no gradation between "I wrote this and had a typo fixed" and "the machine wrote this".
For the largest group of authors — those who write themselves and call on AI selectively — that is the worst possible news. They will own marked text without noticing, without being able to remove it, and without anything in hand to set against it.
This is not an argument against watermarking. For its actual purpose — making machine-generated content identifiable at scale — it makes sense, and the EU AI Act has good reasons to require it. It simply cannot answer the one question that matters to an author: not whether a model was involved, but to what extent.
Which is exactly why the opposite direction is needed.
We document how the text came about instead
Hermes 3000 does not guess. We record while the writing happens.
When our server produces text — a generation, a revision, a dictation transcript — it knows. It does not have to infer. It keeps what it handed over and, on the next save, checks how much of it ended up in the manuscript and how much the author has since rewritten. To that we add what only the editor can know: whether text was typed or appeared in one jump, and how long someone actually worked on a passage.
The decisive difference: this is not an analysis of the result but a record of the process. Which is why it survives revision — indeed, revision is itself information worth keeping.
And what about text from outside?
There is exactly one case the record knows nothing about: pasted and imported text. It came from elsewhere — it may be your own writing from another document, a quotation, output from another AI tool. The editor only sees that 1,800 characters are suddenly there that were not there before.
Rather than guess, we ask.
Paste a sizeable passage and shortly afterwards a small notice appears with a button: where did these characters come from? Not a dialog that interrupts writing — an offer that disappears on its own after fifteen seconds. On importing a manuscript the question is put once, right afterwards, while you still know what you just imported.
The options are the ones that actually occur: written by me (elsewhere), by another person, from another AI tool, quoted from a source, public domain. With an optional note.
Three properties matter to us here:
It is asked about a concrete event. "Where did these 1,833 characters come from?" is answerable. "How much AI is in your book?" is not — which is why the question hangs off the paste and the import rather than off a form in the settings.
"Later" is a real answer. The button to defer carries the same weight as the one to answer. Someone who does not want to answer should not be pushed into a false statement. The question stays open, and the record reports it as not declared.
And a statement never becomes a measurement. It sits in its own field in the record, explicitly marked as the author's statement, and the signed document names both: how many characters rest on a declaration — and how many came from outside and were never declared. A record that let a claim pass as evidence would be worth less than one that admits the gap.
On import the answer covers the whole manuscript and the individual passages inherit it — you explain a book, not four hundred passages.
What it looks like: the breakdown by origin, the author's statement about inserted text — and the issued record with a checkable link and QR code.
Why this is better for all three groups
People who write everything themselves
This group is in the most absurd position today: nothing to hide, and nothing to show for it. When a detector flags their manuscript, all they can do is protest. A provenance record turns that around — not "I swear it was me", but a record showing the text grew in small steps over weeks. Someone who uses AI only to ask for feedback on a passage sees exactly that: a question asked, no trace of it in the text.
The hybrids — the largest group
Most people work like this: write yourself, occasionally have a sentence rephrased, now and then generate a passage and then rework it thoroughly. There is no language for that reality yet. "With AI or without?" has no honest answer for them, and every yes/no checkbox forces a statement that is false.
A provenance record can express what actually happened: this paragraph is yours, a tool smoothed 300 characters of it. That one came from a generation, and you rewrote two thirds. That is not dilution, it is precision.
Down to the single passage — with the explicit note that the figures overlap and do not add up to the passage length.
People who work largely with AI
Here too the detail matters — and this is perhaps the most surprising part. Between "write chapter 3" and a book carrying developed characters, a considered plot, chosen style skills and eight variants tried per scene, there are worlds. Both results are AI-generated. One took two minutes, the other many hours.
So for AI text we distinguish whether a person steered it: generated more than once, wrote their own brief instead of pointing at a chapter title, or reworked the result by hand. Whoever does that has shaped the text causally — just not through the keyboard. A watermark sees none of it. A detector even less.
And for everyone working on a book together
Books are rarely made alone. An editor, a coach, a mentor, a co-author — each of those hands leaves traces that cannot be told apart in a finished text. Because we record while the writing happens, the sequence survives: when which part arrived, how much was reworked afterwards, across how many days.
For coaching programmes and writing courses that is the genuinely interesting application. Not as surveillance, but as evidence of work done.
What a Verifiable Credential is — and why it fits here
Numbers inside your own tool are easily claimed. It gets interesting when a publisher can check them without trusting us.
That is what Verifiable Credentials are for, a W3C standard. An issuer — here Hermes 3000 — puts a statement into a document and signs it cryptographically with its private key. Anyone holding the matching public key can verify that the document came from that issuer and that not a character has changed since. No central registry, no account, no phone call to us.
In practice: the author issues the record, the figures are frozen and signed, and she gets a link and a QR code. The publisher opens the link — without logging in — and sees the figures that were signed, plus a note on how much the book has changed since. Anyone who wants to can check the signature with standard tooling instead of trusting our green tick.
Why it fits here so well: a provenance record is a statement about a moment. It has to be frozen, or it describes a different book the second time it is opened. It has to be checkable without the checker trusting the issuer. And it has to be revocable, should something turn out to be wrong. The standard brings exactly those three properties.
What we deliberately do not claim
A record is worth only as much as it says about its own limits. So this is on the verification page and inside the signed document itself:
The signature attests that Hermes recorded this process — not that the record is complete, and certainly not whose ideas these are. Retyping AI text from another window defeats the measurement; that cannot be detected, and we say so. The writing time shown is a lower bound: thinking without keystrokes does not count. And text inserted from outside can only be explained by the author — such answers are marked explicitly as the author's own statement, never as a measurement.
We do not consider that a weakness but the condition under which such a record is worth anything at all. A seal promising more than it can deliver spends exactly the trust it is meant to create.
Why we need more of this
The debate is converging on the wrong question. "Is this text AI?" cannot be answered with yes or no for most people doing serious work — and a method that forces an answer anyway will be systematically wrong. Most often at the expense of those who work most carefully.
The better question is: how did this text come about? It is answerable, it is evidenceable, and it does justice to the reality most people write in today. Publishers, universities and platforms will need records like this — not because they distrust people, but because they need a basis sturdier than a classifier's hunch.