How AI-Origin Detection Works: Signal Types Explained
AI-origin detection combines stylometry, entropy, dependency context, and commit history to estimate whether code was human-written, AI-assisted, or AI-generated.
AI-origin detection is a signal model, not a magic label
Reliable AI-origin detection evaluates many weak signals together. No single variable proves authorship, but patterns across formatting, naming, control flow, dependency usage, comments, and commit timing can produce an explainable confidence score.
The multi-signal approach
ProvenanceOS computes a repository-level heuristic from a bounded sample of source files: up to 40 JavaScript, TypeScript, or Python files, and 512 KB, crawled from the package entry points. The score includes a confidence level and the sample coverage. Per-commit attribution, per-file attribution, and model-family detection are planned. The score is not a determination that any statute is satisfied.
How teams use the score
Once that score ships, security and legal teams will be able to require review when confidence crosses a threshold, preserve evidence for audit reports, and compare AI usage across repositories without blocking every pull request by default.