Swimming the Author

England tested witches with water. The suspect was bound, right thumb to left toe, looped to a rope, and lowered into the village pond. Pure water was believed to refuse the devil’s servant, so a body that floated was guilty and a body that sank was innocent, and the innocent were hauled up half-drowned to receive the town’s apology. The procedure was called swimming a witch, and its genius was architectural: it could only convict. Whatever the water did, the crowd on the bank went home with the verdict it had carried down to the shore. Four centuries on, the pond fits in a browser tab. Paste the chapter. Click the button. Let the water decide.

Matthew Hopkins understood the business before anyone else. From 1645 to 1647 he rode East Anglia as a self-styled Witchfinder General, and the towns he purified paid him for the purification, parish by parish, gallows by gallows. Fear created the demand; the man who certified the fear collected the fee. His trade has reopened under new signage. One of the detection sites now menacing authors offers, a single click beneath its verdict, to “humanize” any flagged text for a price, and a service called Verify My Writing charges writers for a certified-human badge issued when a detector scores their prose 95 or better. Accusation at one counter, absolution at the next, and the register rings either way.

This is the season we are living through. In March, Hachette pulled Mia Ballard’s horror novel Shy Girl from every market it controlled, canceling the planned American edition and discontinuing the British one, after a screenshot campaign and a two-and-a-half-hour YouTube prosecution convinced the internet the book was machine work; the New York Times reported it as the first commercial novel from a major house withdrawn over evidence of AI use. Ballard denies writing a word by machine and says a freelance editor she hired back in her self-publishing days introduced the offending passages; she is pursuing legal action against that editor, and she says “my name is ruined for something I didn’t even personally do.” In late July the ceiling came down on Jerry Falade, whose debut crime novel Call Me, I’ll Hide the Body had drawn an offer above two million dollars from Minotaur, a Macmillan imprint, with film and television buyers circling the rights before a single copy existed. Halfway through international submissions an editor decided the prose smelled synthetic, and Falade’s own representatives withdrew the manuscript with an email conceding they could no longer vouch for how the book had evolved, even as the people cutting him loose kept praising the book they were burying. Falade denies everything: “The accusations are wrong, and I am completely innocent.” Through that spring, the Atlantic insinuated that H.M. Wolfe’s bestseller Daggermouth was machine-made, leaning on a detector scan and a preprint that had never faced peer review; the publishing veteran Nathan Bransford called the piece “deeply irresponsible.” Three authors in five months. One confirmed seven-figure wreck. No confession, no stranded prompt, no plagiarized page entered into evidence against any of them. Suspicion, plus a score.

Some of the accused are guilty, and we know which ones because their books confessed in open court. In May of 2025, readers found the machinery still warm inside published novels: a mafia romance by K.C. Crowne carried the words “Thought for 13 seconds” in the middle of a page, trailed by a chatbot’s cheerful offer of an enhanced version of the scene, and chapter three of Lena McDonald’s Darkhollow Academy: Year 2 held an editing note announcing that the passage had been rewritten to imitate the style of the novelist J. Bree. A third writer, Rania Faris, was caught that May with matching debris in her pages. Those are convictions I will sign. A stranded prompt is a confession printed at the author’s own expense. A detector score is an accusation printed at the author’s expense by somebody else, and the two should never be spoken of in the same breath. Fraud exists, fraud should cost the defrauder everything, and fraud gets proven the way it has always been proven: by documents and witnesses. What has changed is that the crowd no longer waits for either. My motto has long been that yes is hard, no is easy, and here it stands in full costume. A book is a tower of consecutive yeses: yes to the idea, yes at the desk every morning for a year, yes from an agent, an editor, a printer, a stranger with twenty-eight dollars. The accuser needs a single no, and the no costs nothing and builds nothing. Envy has always trailed success like a dog; the detector finally issued the dog a badge.

So what is this instrument the crowd now trusts with careers? Every tool in the class, including Pangram, the strongest of the breed, is an inference engine: it keeps no registry of machine sentences, it guesses at authorship from statistical pattern, and the guessing degrades exactly where living writers live, in edited, revised, hybrid prose. The science writer Tim Requarth, who spent the spring auditing the field, drew the distinction that matters: population studies are one thing, and pointing the same instrument at one named human being is another. When the Wall Street Journal’s James Taranto tested Pangram against three opinion pieces the company’s own research had outed as machine-written, the same tool on the same articles returned different verdicts on different runs, one column swinging from fully synthetic to fully human, while the researchers’ public database disagreed with the live scanner about all three. A separate study fed identical text to fourteen detectors across multiple days, watched the classifications wander, and concluded the tools were “neither accurate nor reliable.” Arvind Narayanan of Princeton ran the arithmetic on Pangram’s proudest number, a claimed false-positive rate of one in ten thousand: take the claim at face value, scan every paper an American undergraduate submits across four years, and five to ten percent of the student body ends up falsely branded a cheat before graduation. The universities did that math first. NYU switched off its vendor’s detection module; the University of Texas at Austin banned third-party detection outright for judging student work and warned professors they could be personally liable for damages if they freelanced with such tools; Berkeley, Yale, MIT, Georgetown, Vanderbilt, and Northwestern arrived at the same door. Even the vendors flinch. Turnitin’s own documentation says its score should never be the sole basis for punishing a student, Originality.ai’s terms forbid using its output for any decision with legal or material consequence for a person, and Pangram’s own 2024 technical report pleads against deploying the classifier as a lone arbiter of integrity. The makers of the ducking stool have posted a sign saying the pond proves nothing, and the crowd keeps drowning people under the sign.

The pond is now municipal plumbing. On July 21, Substack switched on a Pangram-powered scanner that lets any reader run any post, note, or comment over one hundred words through the ordeal and receive a percentage split of human, AI-assisted, and AI-generated, with a disclosure box where writers may explain themselves and a toggle to shut the feature off post by post. The platform that built its brand on the writer’s independence has bolted a dunking chair to every doorpost and handed the rope to the audience. Within hours of the launch, an account announced a startup training a model to defeat every detector on the market, which names the future plainly: determined fraud will always walk, while the casual, the honest, and the hybrid get flagged. One Substack reader ran a post published in 2008 through the new scanner and was told it was machine-generated, a verdict handed down on prose that predates the machine. Reader beware, the pond has opinions about the past.

The novelist Linda Lappin, with a new book on the way, posted an experiment to the Authors Guild discussion board on August 3 that reproduces the Journal’s finding at desk scale. She spot-checked her manuscript through Pangram’s free tier, and the detector highlighted one sentence in yellow as machine-assisted, a sentence she had written and fussed over herself, reordering words the way writers do. She swapped the phrase “untouched by the sun” for “had never seen the sun,” shuffled three adjectives, ran the passage again, and was pronounced fully human. Alarmed enough to pay, she opened a subscription under a different email address and fed the detector the identical original passage, yellow sentence and all. It came back one hundred percent human. Same words, same tool, opposite verdict, and her question deserves engraving over the door of every publishing house: “Does it depend how Pangram is feeling on a particular day?” A TechCrunch reviewer put the detector through its paces in late July and watched it flag sentences he had completely rewritten in his own hand. An instrument that convicts on Tuesday and acquits on Thursday is measuring something, and the something is never the crime.

Then there is the corpse in the pond that started the shouting. In March a screenshot went viral showing an AI detector’s judgment on the opening of chapter five of Frankenstein: one hundred percent machine-generated, every sentence of Mary Shelley’s lit up like contraband. Thousands shared it as proof the witch hunts had lost their minds, and the outrage was fair. I checked anyway, because a claim that convenient deserves suspicion from friend and foe alike, and the fuller record turns out stranger than the meme. The viral verdict came from one of the lesser detectors, a site whose results page offers a one-click paid service to launder flagged text into passing prose, Hopkins with a subscription tier. When a skeptic re-ran the 1818 passage, Pangram itself scored it fully human, and so did most of its rivals. The tools disagree about a dead woman exactly as they disagree about the living, and the crowd shared whichever verdict fit, because the crowd always does. The irony needed no help from the meme. Frankenstein is the founding text of the mob against the made thing. In Shelley’s novel the villagers meet the creature with stones; the torches and the windmill came later, from the 1931 film; either way, the creature’s crime was assembly, the suspicion that he had been stitched from borrowed parts and animated by a technology nobody trusted. Two centuries on, the ordeal came for the book itself.

So where are the accusers drawing their dim little lines? Nobody will say, because no line survives being said aloud. An author’s process runs from idea through research, outline, draft, revision, line edit, copy edit, proof, index, and jacket, and machine assistance can touch any station or none. Which touch damns the book? The Authors Guild, no friend of the machine, had to answer when it built its Human Authored certification, and its answer amounts to a confession: the seal permits AI research, brainstorming, and outlining, permits machine-built tables of contents and indexes, and waves spell-check and grammar software through as too minor to count. The Guild wrote a de minimis clause because absolute purity is unworkable, and every word processor on earth has run statistical language machinery under the keys since the nineties. Yet the public ordeal recognizes no de minimis at all; one yellow sentence and the torches come out. Weigh the asymmetry we have all accepted without a vote: a hired human editor can rewrite your paragraph wholesale and the book remains yours, while a machine suggesting the identical edit turns the book into a changeling. Mia Ballard’s case sits on that fault line. She says a human freelancer she paid introduced machine-shaped passages into her novel; the publisher hanged the book anyway, without ever telling the public where its own line ran. If the idea is the author’s, the structure the author’s, the revision choices the author’s, and the name on the spine answers for every sentence, then the author was the one element in the process never in doubt. Authorship means judgment and responsibility, the choosing and the answering, and no scanner on earth measures either.

The panic itself is old enough to own a bibliography. In the Phaedrus, Plato has an Egyptian king refuse the gift of writing itself, warning that letters would rot memory and dress ignorance up as wisdom; the first recorded review of a writing technology was a witch trial. In 1492 the abbot Johannes Trithemius composed In Praise of Scribes to argue that hand-copied manuscripts carried a devotion print could never hold, then sent the tract to a printer because he wanted it read. Mark Twain bragged of being the first author to deliver a typescript to a publisher, back when the typewriter stood accused of making prose mechanical. Nietzsche, going blind, bought a Danish writing ball and remarked in a letter that the instrument was working on his sentences, an observation scholars have chewed ever since. The word processor arrived in the eighties trailed by essays swearing that screens would bleach the soul out of literature, and then the spell-checker, the grammar pass, and the autocomplete bar followed without anyone holding a funeral. Stone chisel, reed, quill, press, typebar, cursor. Each generation swears the newest instrument will finally sever the hand from the soul, and each generation’s grandchildren cannot find the scar. The doubt dies when the tool disappears into the hand, and the tool disappears when every hand is holding one.

What stops the swimming? On that Guild board, one day before Lappin, a member named William Reid posted the remedy publishing least wants to hear: litigation, aimed correctly. Suing the detector companies is a dead end; their terms of service are wallpapered with disclaimers. The exposed party is the publisher or agency that took an instrument whose own maker calls it unfit for high-stakes judgment and swung it at a career anyway. Reid, whose corner of the lawsuit trade is medical malpractice, sketched the negligence frame: a duty of reasonable care toward the author, a breach of that duty in acting on evidence known to be unreliable, damage worth counting, and a causal chain from breach to wreckage, all provable by a mere preponderance, the civil standard of just past fifty percent. Plaintiffs’ lawyers take such cases on contingency, and the first consultation costs nothing. His closing line belongs on a banner over the next book fair: “Don’t just get mad; get even.” Reid is no lawyer by his own account, and neither am I, and any damaged author should be sitting across from an actual plaintiffs’ attorney before quoting either of us. Discovery, though, is where the pond drains. Picture the deposition in which a canceled author’s counsel runs the acquiring editor’s own rejection letter through that scanner, live, on the record, twice, and reads the two different verdicts into the transcript. The University of Texas already warned its faculty about personal liability for damages arising from detector verdicts. The lawyers understood the water before the publishers did.

And the Authors Guild itself? I respect the Guild’s war over training data; authors were strip-mined, and they deserve their day. The Human Authored seal is another animal. It costs members nothing and outsiders ten dollars a title, it verifies the author’s identity, and it never reads the manuscript; Jane Friedman has already said the quiet part, that a certification with no independent check behind it amounts to an oath, and an oath is what publishing ran on before the badge existed. A guild is a dues-collecting body, and a machine pays no dues, so the incentive points one direction only; nobody should faint when the shepherds’ union rules against the wolf. Purity regimes deserve suspicion on older grounds, though. This country once wrote purity into statute, the one-drop rule, and those laws are remembered with shame because a purity test exists to find impurity; it always finds some, and it finds it first among the people the crowd already suspected. The pattern of this year’s bonfires is plain. Ballard, Falade, and Wolfe, the three headline cancellations and quashings of 2026, are all Black writers, all denying, and Falade said so to the Guardian in plain words: three Black authors landed major deals this year, and all three watched them canceled or disrupted on AI suspicion, as though “the work could not possibly be their own.” The research says the machinery aims itself. A 2023 Stanford study found detectors flagging 61 percent of genuine essays by non-native English speakers as machine-made, with one tool reaching 97 percent, and later work confirmed the bias against anyone whose rhythm the model finds foreign. The ordeal, as ever, swims the people the town already wanted swum.

The cure for the madness is older than the madness. Evidence convicts; oracles accuse. A stranded prompt, a plagiarized page, a version history that begins at the final draft: bring me those, and I will hold the rope myself. A fluctuating score from a tool whose own manual disavows the use is nothing, and a publisher who treats nothing as proof should meet the plaintiffs’ bar and lose. Authors, keep your receipts, the dated drafts and notebooks and marginalia no screenshot can argue with, because provenance is testimony, and testimony beats augury every day of the week. Readers might also recall how the older story actually ends. Shelley’s creature, hounded from every village, proves the most articulate soul in the novel, more capable of love and grief than the men holding the stones. The mob never read the book. In March they swam Frankenstein, and Frankenstein floated. We have records of what the people who trusted that test did next, and the records are called graves.