# AI_CONTAMINATION_TIERS.md

**Owner:** Source Integrity Screen (RAM S2)
**Type:** Tool (tiered decision protocol)
**Scope:** Tier 0 through Tier 3 decision tree, signal-independence rules, language and token gates.

## 1. Framing

AI-text detection is partially-solved, trending unsolvable as base models improve. Three families -- watermarking, zero-shot statistical, trained classifiers -- each carry documented failure modes. Single-signal thresholding fails: commercial detectors have reported ~61% FPR against non-native English writers (Liang 2023, **UNVERIFIED** -- see S06 Queue); paraphrase attacks cut TPR by 40-60 points at fixed FPR (Krishna 2023); zero-shot detectors degrade out-of-domain. The tiered protocol treats detector output as one signal among many and reserves auto-rejection for Tier 3.

## 2. Pre-Checks (gating)

- **Token floor.** Minimum 300 tokens; below floor, skip detectors, mark `skipped-short-text`. Do NOT lower threshold to compensate.
- **Language gate.** English OR language-calibrated threshold loaded; otherwise skip, mark `skipped-language-uncalibrated`.
- **Translation gate.** Machine-translated text triggers the language gate by default.

## 3. Detector Ensemble (parallel)

1. **Fast-DetectGPT (primary zero-shot).** Conditional-probability curvature. Continuous score + flag.
2. **Binoculars (zero-shot cross-check).** Perplexity / cross-perplexity ratio between two related LLMs. **UNVERIFIED** in S06.
3. **Watermark probe.** Run only when claimed producer watermarks (e.g., SynthID-Text for Gemini). Absence on non-watermarking producer is non-informative.
4. **Metadata corroboration (one signal, four checks).** DOI resolves to expected venue; venue in DOAJ / Scopus; author identifiable via ORCID or institutional record; citation graph internally consistent.

## 4. Tier Decision Table (authoritative)

| Tier | Condition | Action | `ai_screen.status` |
|---|---|---|---|
| Tier 0 | No detector triggered AND (source pre-2022 OR in authoritative registry) | Pass clean. No flag. | `clean-tier0` |
| Tier 1 | Exactly one statistical detector triggered AND no metadata anomaly | Pass with label. Flag rendered. Source usable. | `flagged-tier1` |
| Tier 2 | Two or more independent signals triggered | Quarantine. Human review queue, 24-48h SLA. | `quarantined-tier2` |
| Tier 3 | Fabricated-citation metadata (DOI / venue / author fail) AND at least one statistical detector triggered | Hard block. ONLY auto-rejection path. | `blocked-tier3` |

## 5. Signal-Independence Rules

Two signals count as independent iff they measure **structurally distinct properties**:

- Fast-DetectGPT and Binoculars: independent.
- Low perplexity alone: NOT a second signal -- it is the input to both statistical detectors.
- Metadata anomaly: ONE signal regardless of how many of the four sub-checks fail.
- Commercial classifiers (GPTZero, Originality.ai): NOT counted. FPR bias disqualifies them as primary screens.
- Watermark probe: counts only when the claimed producer watermarks.

## 6. Safeguards

- Surface every flag downstream; NEVER silently filter at Tier 1.
- Ledger carries continuous detector scores, not just bool.
- Tier 2 quarantine enqueues for human review; not auto-rejection.
- Tier 3 requires BOTH fabricated metadata AND statistical signal.
- Any S06 citation in rationale carries `UNVERIFIED(...)` until the Queue clears.

## 7. Recalibration

Thresholds change only by Phase 3 re-research. Runtime pressure never loosens thresholds.
