AI Proposals to Counter AI Cheating by Students in Non-Invigilated Assessment

Synthesis: Lieske and Wadley (2026) turn AI on the problem AI created: they put one prompt to eight large language models and search tools, asking each to nominate, explain and rank six techniques for stopping students from using AI to cheat in non-invigilated written assignments, then pooled the 48 answers into composite approaches. The exercise produced 15 distinct approaches, of which the models collectively favored personalization of tasks, AI detection, and process-based measures, with oral follow-up, plagiarism detection, authentic-interactive design and constraints completing a "norm" of seven. The authors read their own result cautiously: the models are not graders of evidence, and the paper concludes that no technique in the set is demonstrably foolproof or cheap enough to be called efficient. Its value is as a map of the option space and a set of institutional recommendations, not as a finding about which countermeasure works.

Key Findings

1. Fifteen composite approaches came out of 48 model responses. Each of the eight models returned six ranked techniques, from Claude 4.6 Sonnet, Chat in MS 365 Word, Gemini 3 Pro, Llama 3.3 70B, Co-pilot 365 Chat Basic, Chat GPT 5.1, Perplexity and DeepSeek; pooling their terminology reduced 48 sets of descriptors to 15 composite approaches.
2. Personalization ranked highest, then AI detection, then process-based measures. With a first-ranked technique weighted at six points and a sixth-ranked one at one, those three dominated the weighted count. The seven approaches the authors call the norm add oral follow-up, plagiarism detection, authentic-interactive means and constraints.
3. The models appeared to rank detection lowest as a countermeasure. AI detection was the only approach to appear four times in the sixth-ranked position across the models, which the authors read as a collective verdict that detection is the weakest of the six techniques a model was asked to propose. That sits uncomfortably beside the amount of institutional money spent on detection.
4. There was no agreement at the top. No single technique appeared more than once among the models' first-ranked proposals, and only oral follow-up recurred in second place. The eight models read "effectiveness" differently, which is a finding about the question as much as about cheating.
5. The authors found no hallucinated techniques. Because the outputs were checked against published counter-measures, and no fabricated proposal was detected in the project output, they treat the composite list as grounded in documented practice rather than in model invention.
6. Prevention outranked cure in the models' answers, and the paper endorses that ordering. Redesigning tasks so that generic AI output cannot satisfy them appeared both at the top of the models' rankings and in the authors' own reading of the literature.
7. The paper's own conclusion is that the question is unresolved. It answers its research question only in terms of necessary conditions: the 15 approaches exist, but across all disciplines none can be confirmed as either effective against a determined cheater or light enough in cost.

The problem the paper frames

The authors separate a strategic level, where institutions set policy, from a tactical level at the student-instructor interface, and place their own work at the tactical end. Much of the argument is built from public reporting rather than from studies: a pseudonymous academic's newspaper piece, two weekend magazine exposés, and quoted students describing panic when an exam was brought back in person and relief when it was moved online again. A student quoted in the paper describes classmates as treating non-cheating as foolishness because grades no longer discriminate. Faculty quoted alongside them describe grading chatbot output knowingly, and one argues students no longer regard what they are doing as cheating at all.

That material is testimony, not data, and the paper uses it to establish that the problem is felt acutely rather than to measure it. The one measured element is the model exercise itself.

Where the numbers do and do not hold

The output lengths show how differently the models answered the same prompt: Claude produced 406 words and MS Word's chat feature 352, while Gemini returned 701 and DeepSeek 684. The authors note that shorter answers risk omitting techniques, and that longer ones risk one model's framing overwriting another's when the responses are pooled.

What the method cannot support is a claim about what works in a classroom. A language model's ranking of countermeasures reflects its training material, which is largely commentary and vendor documentation, not trial evidence. The paper says so, and treats the ranking as a way of organizing the literature rather than as an estimate of effect. The distinction matters because the resulting table reads like a league table of interventions.

The authors also argue that effectiveness here is binary rather than relative: in the social sciences, 85 or 90 per cent elimination of a behavior is usually a good result, but for cheating any working exploit circulates verbally or online and is immediately adopted, so a partial measure is not a partial success. They borrow the cybersecurity framing in which a control that does not physically work cannot be judged on cost-effectiveness at all.

What this means for practice

• Instructors: Read the top approaches as task-design moves rather than surveillance purchases. Personalization and authentic-interactive design lead precisely because a task tied to local data, class discussion or a student's own experience is one a context-free model cannot produce.
• Instructors: Do not treat detection as a foundation. If the models that generate the text rank detection last as a countermeasure, adding another detector to a course is the least promising of the options on the list.
• Administrators: The paper's recommendation is program management, not tool procurement: integration, scope, time, risk and quality elements, with any extra funding for constructive assessment disbursed equitably across disciplines rather than concentrated where a pilot happens to sit.
• Assessment designers: Oral follow-up held a high place in the models' rankings and is the cheapest of the top approaches to trial. It is also the one that fits existing formats without new software.
• Researchers: The gap the paper names is evaluation. Fifteen approaches are catalogued here and none has been tested against a comparison condition, so the useful next study is a trial of two or three of the top approaches rather than a longer list.

Limitations

• The paper reports no empirical data. It is a commentary in which the analytical instrument is a set of language models asked to rank proposals, and no student, class, or course was studied.
• Its evidence base is largely journalism. Public reporting and quoted testimony establish salience, not prevalence or effect, and the paper offers no baseline for how much AI cheating occurs.
• Model output is treated as a source of ideas rather than as evidence, but the composite ranking is still shaped by what those models were trained on, including vendor material about their own products.
• The ranking weights technique position rather than effectiveness: a technique ranked first by one model scores six points regardless of whether it works, so the ordering measures model consensus, not efficacy.
• The authors acknowledge the volatility problem directly: several of the models named are superseded within months, and any ranking of countermeasures tied to a model generation dates quickly.

Citation

Lieske, S. N., & Wadley, D. (2026). Artificial intelligence (AI) proposals to counter AI cheating by students in non-invigilated assessment. Assessment & Evaluation in Higher Education. Advance online publication.