Invisible characters hide machine text in the human range: normalize, then calibrate, and recall rises 5 points at 0.1% false positives
Synopsis
Web platforms screen posts for large-language-model text at a very low false-positive rate, and invisible edits such as homoglyphs and zero-width spaces push machine text into the human score range. NormDetect normalizes each document with Unicode rules, then anchors a small per-section classifier head to the normalized Binoculars zero-shot score, with the blend weight chosen on training folds under a human false-positive cap. On eight RAID sections and eleven attacks with the Falcon-7B scoring pair, it recalls 55.5% at a 0.1% calibrated false-positive rate, 5.0 points above normalized Binoculars, while every section's human false-positive bound stays at most 1%.
Interpretation
When a web platform screens for machine-written text, the costly error is flagging a human writer, so the detector must run at a very low false-positive rate and hold that line in every section. Earlier zero-shot detectors lose much of their recall at low false-positive rates, and character edits invisible to a reader nearly disable them. On the RAID development set, homoglyphs and zero-width spaces split a post into 1.5 to 1.8 times as many tokens, and Binoculars recall falls from 75.5% to 4.2% and 2.0%.
Normalization repairs posts broken by character edits, but not attacks such as paraphrasing and synonym swaps that leave no characters to clean. Normalization restores recall to 56.3% and 62.0% on the two edited slices and leaves the other ten unchanged, adding no false positive on the 7,521 human documents of the guard set. After normalization, recall stays at 14.5% under synonym swaps and 45.9% under paraphrasing, so the remaining half of machine text needs evidence beyond the score.
NormDetect keeps the normalized Binoculars score as an anchor and adds a per-section logistic-regression head as a correction. A learned head alone recalls less than the normalized score at a 0.1% false-positive rate, so the two standardized scores are blended rather than the anchor being replaced. The blend weight is chosen over five folds of the training pool under a 0.5% per-fold human false-positive cap, and one threshold is calibrated on human text alone.
On the Falcon-7B scoring pair, NormDetect recalls 55.5% at a 0.1% calibrated false-positive rate, above normalized Binoculars at 50.5% and the clipped likelihood-ratio test at 53.2%. The gain comes from near misses around the anchor threshold: it flags 36 development documents the anchor misses and drops 6 that the anchor flags. A paired bootstrap over source articles puts the gain over normalized Binoculars at 2.98 to 7.15 points, recall is higher in all eight sections, and the largest human false-positive bound is 0.91% on Reddit.
Perspective
The demonstrated setting is eight web sections and eleven attacks from the RAID training split, with the Falcon-7B, Gemma-4-12B and Gemma-4-31B scoring pairs; the threshold is calibrated once on human text and the 95% upper bound is then checked per section on a separate human set against a 1% limit.
The gain depends on the scoring pair: on Ministral-3-8B and Qwen3.5-9B the NormDetect gain vanishes at equal false-positive rate, and on Gemma-4-31B the selected weight trades the Reddit guard for recall. DIPPER paraphrase rewrites the whole text, and every detector shown exceeds 1% human false positives under it.