Detecting AI-generated text before publication with n8n: triage, not a verdict

An overly polished product review, a cover letter where every candidate seems to have used the same prompt, a guest post submitted to your blog that reads just a bit too smooth: the question "did a human actually write this?" comes up more and more often once a site accepts open submissions. The instinct is to look for a detector that settles it. The problem, documented by research, is that no detector settles it reliably — and building one that claims to causes more harm (false positives on real customers, real candidates) than it solves. This guide builds in n8n not a detector, but a triage pipeline: a suspicion score, never a verdict, with a confidence band that systematically routes ambiguous cases to human review.

No detector is 100% reliable, and that's not a footnote

That's the starting point to accept before writing a single node. The study by Sadasivan, Kumar, Balasubramanian, Wang and Feizi, Can AI-Generated Text be Reliably Detected? (2023), tests the robustness of a wide range of detectors — neural classifiers, zero-shot methods, watermarking, retrieval-based detection — against a simple recursive paraphrasing attack. Result: detection accuracy collapses for nearly every method tested, watermarking included, without the reworded text losing its meaning or quality. The authors also show, theoretically, that there's a fundamental limit beyond which sufficiently natural text becomes indistinguishable, regardless of the detector.

The other side of the problem is false positives on genuinely human text. The most common detectors rely on statistical predictability signals (perplexity, syntactic regularity) that also show up, naturally, in writing from people composing in a second language or with a very structured academic style — a documented bias, regularly cited as a source of unfair discrimination in academic and hiring contexts. A pipeline that auto-rejects on this signal alone isn't detecting AI: it's penalizing a certain kind of human writing.

So what is a detection score actually for

Exactly the same role as classification in our guide on phishing and spam detection: one signal among several, never an autonomous decision. The goal isn't a binary wall but a three-band filter — clearly human, clearly generated, and a deliberately wide gray zone that goes to review. It's the same safeguard logic already applied on this blog for review and comment moderation or application screening: AI speeds up the sorting, a human keeps the decision that matters.

Step 1 — Centralize submissions into a single entry point

Whether the source is a review form, a multi-step Form Trigger for unsolicited applications, or a webhook fed by your CMS for guest posts, every submission needs to converge on the same n8n workflow before publication — see our complete Webhook guide for reliably receiving these events. At this stage, the item holds at minimum the raw text, the source (review, application, article), and if possible a session or author identifier for tracking.

Step 2 — A structured-output LLM judge, not a black box

Rather than an opaque score returned by a third-party API, an AI Agent node (or a simple Basic LLM Chain for a task this focused) receives the text along with an explicit analysis grid: excessive syntactic regularity, generic transitions ("it is important to note that"), lack of concrete verifiable detail, a suspiciously well-balanced list structure. The prompt explicitly asks the model to justify each flagged indicator rather than output a bare number — a score with no justification isn't usable in human review.

Force a structured output with the Structured Output Parser:

{
  "suspicionScore": 0.62,
  "indices": ["repeated generic transitions", "no verifiable concrete detail"],
  "confidence": "medium"
}

The confidence field matters as much as the score itself: a model that's uncertain should say so, rather than forcing a precise value on a structurally ambiguous case — exactly the principle already covered in our Text Classifier node guide for any AI routing in a gray zone.

Step 3 — Cross-check with signals independent of the LLM

A second LLM is just one signal among others, and combining them reduces the risk of an isolated false positive:

• Near-duplicate submissions. Mass-generated content (bulk reviews, templated applications) often produces texts that are close without being identical. Our guide to detecting approximate duplicates with embeddings applies directly here: several reviews with high cosine similarity submitted in a short window are a far stronger signal than an isolated style score.
• Submission metadata. Abnormally short writing time relative to text length (if the form captures a start and end timestamp), submission volume per IP or session in a short window.
• Consistency with the stated profile. An application citing very generic experience unrelated to the role, or a review describing features absent from the product actually sold.

None of these signals, taken alone, justifies an automatic rejection. Combined into a composite score, they shrink the gray zone without ever claiming to eliminate it.

Step 4 — Route by confidence band, never a silent rejection

An IF or Switch node then splits items into three branches based on the composite score:

• Low score (clearly human text): publish directly, no extra friction.
• High score with strong confidence: hold and notify the team, never auto-delete — the author stays informed that a review is underway.
• Gray zone (the majority of ambiguous cases): systematic routing to human review, following the same pattern as our guide to human approval with the Wait node and Slack. The message sent to the reviewer includes the full text, the score, and above all the textual indicators flagged by the LLM judge — not just a number.

This three-band architecture, not two, is what separates a defensible pipeline from a simple binary filter: the middle band needs to stay wide as long as detector reliability remains no better than what current research shows.

Step 5 — Log every decision, human or automatic

Every verdict — score, indicators, final decision, reviewer identity where applicable — deserves to be logged in an audit trail rather than lost after processing. Beyond legal traceability (a candidate or customer can legitimately ask why their submission was delayed), this log also helps recalibrate the LLM judge's prompt over time: if the "high score" band produces an abnormal rate of confirmed false positives in review, that's a signal to adjust thresholds, not to automate further.

Common pitfalls

• Treating a detection score as proof. No serious study supports the idea that a detector reaches sufficient reliability to justify automatic rejection without human recourse.
• Ignoring the bias against non-native writers. A pipeline that systematically penalizes regular writing style unwittingly discriminates against a segment of your legitimate users.
• Relying on a single signal. Style alone, duplicates alone, metadata alone: each produces false positives. The combination, with a deliberately wide gray zone, is what makes the pipeline defensible.
• Not providing recourse for the author. A delayed or rejected submission should be contestable — that's also a matter of trust with your audience.

In summary

No AI text detector — homegrown LLM judge or commercial tool — deserves the trust of an automatic verdict; research shows this clearly, with a documented bias against non-native writers on top. What an n8n pipeline can build instead is an honest triage system: a composite score combining LLM analysis with independent signals (near-duplicates, metadata), a deliberately wide gray zone routed to human review, and a log that lets thresholds be recalibrated over time. This traceability logic — every decision documented, every ambiguous case escalated to a human — is exactly what the Compliance & Audit Pack (€149) formalizes. If your immediate priority is triaging an inbound email flow instead, the Inbox AI Pack (€79) applies the same score-and-review architecture; the Full FlowKit Bundle (€269 instead of €347) brings all three packs together if you're planning to chain several pipelines like this one.