The case for keeping AI detectors secret is strong. It still doesn't cover error rates

Distributors are right to keep the inner workings of their AI detectors private. They are wrong to treat that as a reason to keep their mistakes private too. The method can stay secret; the error rate, the notice and the appeal can't.

The news hook

In a filing in Manhattan federal court in mid-October, Universal, Capitol and Sony asked a judge to make DistroKid hand over details of a third-party "prediction model" it uses to test recordings for AI generation. The labels' proposed order asks for the model's name and vendor, monthly counts of tracks tested and flagged, and any accuracy analysis, including, as Music Business Worldwide reports, "the basis for its statements about false positives". The proposed deadline is 30 October. We set out what that means for artists in how distributors decide your song is "AI", and ended that piece by saying distributors should publish their vendor, false-positive rate, score rules and appeal path.

This column takes on the strongest objection to that, ours included.

The best case for secrecy

Put it as strongly as a distributor's trust-and-safety team would. A detector is a filter in an arms race. The people uploading thousands of generated tracks a day are not hobbyists; they are running businesses, and they test what gets through. Name the vendor and they can buy or probe the same tool. Publish the threshold and they can tune each upload to land just under it. Publish what each score triggers and they know exactly how much risk a borderline track carries.

Spotify's own October update makes the point without spelling it out: "AI moves fast, and bad actors adapt just as fast," and AI detection "has limitations, and it will only get harder as generative AI evolves" (Spotify). Spotify says it combines "multiple third-party AI detection tools" with other signals. A rival or a spammer who learned which tools those are would learn a lot.

There is a fairness argument too. If the detector is beaten, the people who lose are the honest artists, whose royalties are diluted by the flood that gets through. On that reading, secrecy protects artists.

We think most of this is correct.

Where the argument stops

The secrecy case protects one thing: the method. Vendor, model, features, thresholds. It says nothing about the outcomes, and outcomes are what artists need.

A false-positive rate measured over a quarter tells a spammer nothing about how to shape tomorrow's upload. Neither does an overturn rate on appeal, or a line in a rejection email saying "an automated model contributed to this decision". Those numbers describe how often the filter hurts the wrong people. They don't describe how it works.

Other industries fighting adversaries have already drawn this line. Google does not publish how its spam systems score pages, and its spam policies don't explain the detection. But when it takes a manual action, it says it will notify the site owner in Search Console, and that "all sites will have the opportunity to address this issue or appeal via a reconsideration request." The method stays private; the person affected is told and can push back.

European law makes the same split. The Digital Services Act requires providers that moderate content to report on "any use made of automated means," including "indicators of the accuracy and the possible rate of error" of those tools (Article 15). Hosting services must give the affected user "a clear and specific statement of reasons," covering "information on the use made of automated means in taking the decision" (Article 17). Neither article asks for thresholds or model weights. Whether a given distributor falls under those articles is a legal question we aren't answering here; the point is that lawmakers facing the same arms-race objection decided error rates and notice could be public without handing the method to abusers.

And music already has a working example. Deezer publishes that its detector may wrongly flag fewer than 1 in 10,000 human-made tracks, while licensing the same technology to distributors since January. Publishing a number has not, as far as anyone has shown, made its filter easier to beat.

What we think

The secrecy argument wins on method and loses on everything else. So we'd revise our own ask. A distributor that runs a detector on its customers' music should:

1. Keep the vendor and thresholds private if it wants. That's a fair security call, and we no longer think it's the thing to fight over.
2. Publish a false-positive figure, measured on its own catalogue, at least twice a year. Not a vendor's lab number: the share of flags that turned out wrong on review or appeal.
3. Tell the artist when a model was involved in holding, labelling or rejecting a release, in plain words, in the email they already get.
4. Offer a human review with a deadline, and say how many decisions it reversed.

None of these tells a spammer anything useful. All of them tell an artist whether the filter can be trusted.

There's also an irony in the hook. If the court grants the labels' order, the first accuracy evidence on DistroKid's detector goes to major-label lawyers as discovery. That is the most detailed disclosure the method could get, and it is happening anyway, just not for the artists whose tracks were scored. If a distributor can hand its error analysis to a court, it can publish the headline figure for its customers.

Detection secrecy is a reasonable defence against spammers. It isn't a reason to keep artists from knowing how often they're the ones getting caught. For background on how far independent tests of these tools fall short of vendor claims, see our report on what a benchmark of eight detectors found.