How to Design AI-Resistant Assignments: An Instructor's Guide

Three years after ChatGPT arrived in the seminar room, the phrase “AI-proof assignment” has quietly disappeared from the serious teaching-and-learning literature. What has replaced it is a more honest vocabulary — AI-resistant, AI-aware, or AI-inclusive — and a body of practice that treats generative AI as a permanent feature of the assessment environment rather than a temporary crisis. This piece is written for instructors who have watched detection tools fail in both directions and concluded, correctly, that assessment design has to do the work that AI detection tools cannot reliably do. It is grounded in the empirical literature on assessment redesign since 2023, the guidance published by QAA, TEQSA, and Advance HE, and the case studies from institutions that have actually pushed changes through faculty senates.

The vocabulary matters: resistant, not proof

There is no such thing as an AI-proof take-home assignment. Any prompt whose response is text a human can produce is text a language model can, in some form, also produce. What varies is how much value AI can add, how much the student still has to think, and how easy the shortcut is to detect from the artefact itself. The QAA's updated 2024 guidance on generative AI in education makes this distinction explicit: institutions should be designing for “resistance and integration” rather than pretending to prevent access. TEQSA's assessment reform framework in Australia uses similar language. The Association for the Advancement of Artificial Intelligence's 2025 AAAS-linked report on assessment in the age of generative AI is blunter: the goal is to make the AI-only route useless, not impossible.

The practical implication is that we stop asking “could a student cheat on this with AI?” and start asking “could a student pass this without doing the learning?” Those are very different questions, and only the second one is answerable through design.

What the research actually shows about where AI struggles

The most useful synthesis of the 2023–2025 empirical work comes out of the University of Sydney's AI in Education Working Group and the growing body of studies published in Assessment & Evaluation in Higher Education and Higher Education Research & Development. Three findings recur across otherwise very different studies.

First, current models perform strongly on the middle of Bloom's taxonomy — describing, summarising, comparing, explaining — and much less well at the ends. They are inconsistent on the highest-order tasks (evaluating a specific study against a discipline's methodological norms, or creating a genuinely novel synthesis grounded in local material) and, oddly, unreliable on the lowest-order tasks that require accurate recall of specific, verifiable facts they were not trained on. Second, AI performance drops sharply when the task depends on context the model does not have access to: this week's lecture, the cohort's discussion thread, a specific dataset collected in the field, a personal experience. Third, AI performance is poorest when the output is multimodal or embodied — a talk, a demonstration, an oral defence, a physical artefact — because the transferable value of the generated text is limited by what still has to be performed live.

Those three findings, taken together, describe the design surface for AI-resistant assessment. Everything below is a variation on them.

Design principles that actually do the work

The specific techniques are unglamorous and mostly not new. What is new is that they have moved from “nice-to-have” to load-bearing.

In-class and invigilated components. The clearest way to guarantee authorship of a specific piece of writing is to watch it happen. Short in-class writing tasks, timed exam elements, or supervised computer-based responses give you a stylistic baseline that makes anomalies in take-home work obvious. Advance HE's 2024 briefings on generative AI and assessment recommend this pairing explicitly: keep the take-home work, but anchor it with an invigilated component that has to align with it.

Personal and contextual grounding. Prompts that require reference to a specific lecture, a specific reading discussed in class, a piece of fieldwork done by the student, or a personal experience with the material are harder for AI to complete well because the model does not have the context. This is the mechanism behind McMaster University's widely-cited “Two-Lane Approach”: one assessment lane treats AI as a permitted collaborator with process documentation required; the other lane is deliberately context-bound and invigilated. Students choose their lane; the design does the integrity work.

Process portfolios and iterative drafts. Requiring version history, submitted outlines, marked-up sources, and a short reflection on the writing process turns the assignment from a product into a trajectory. A student who used AI to skip the trajectory usually cannot produce a plausible version history of it after the fact. This is the model that Deakin University's generative AI in education framework pushes across its faculties, and that Danny Liu and colleagues at Sydney have written about extensively.

Oral defence. Even a five-minute viva, done well, is a devastating check on authorship. A student who wrote the paper can talk about the choices in it. A student who did not, generally cannot — not because they are being caught out, but because the underlying learning did not happen. The University of Cape Town's 2024 teaching and learning guidelines position oral checks as the default authenticity mechanism for major assignments.

Multimodal outputs. Recorded presentations, screencasts explaining a solution, a physical prototype, a poster defended in a lab meeting, a coded artefact demonstrated live. AI can help draft the script; it cannot deliver it convincingly under questioning.

Rubrics that reward process, not just polish

A well-designed rubric quietly closes several AI-arbitrage gaps at once. If the highest-weighted criteria are “clarity of prose” and “grammatical fluency,” you have designed a rubric that rewards what AI is best at. If the highest-weighted criteria include specificity of engagement with named readings, quality of the argumentative move, and evidence of iteration, you have designed a rubric that rewards what students still have to do themselves.

The practical shift is to add explicit process criteria: submission of an outline, use of at least two sources discussed in class, a short methodology reflection, or evidence of revision between drafts. None of these makes AI use impossible, but each raises its cost while lowering the risk of misreading a well-written human paper as generated. Because the rubric now rewards signals that AI cannot cheaply fake, the incentive structure shifts. This is also why how you configure the Turnitin assignment — specifically whether you require Draft Coach, multiple submissions, or version-history-preserving formats — matters more than which detection thresholds you set.

What this looks like across disciplines

Because the design principles are general, the applications look very different by discipline.

Writing and humanities. Replace the one-shot 3000-word essay with a portfolio: a short annotated bibliography submitted in week four, a 1500-word draft in week eight with peer review, a final version in week twelve with a 500-word reflection on how the argument changed. Anchor the whole thing with a 20-minute in-class writing task in week five that establishes the student's baseline voice. Total assessment volume is similar; AI leverage is dramatically lower.

STEM lab reports. Require raw data from a specific lab session, marked with the student's cohort code. Add a two-minute recorded explanation of one figure and one methodological choice. AI can still write the discussion section, but the specific data, the specific figure, and the two-minute oral component each raise the effort of the AI-only route above the effort of just doing the work.

Business case studies. Use a case constructed from the cohort's own market-research field visits, or a case that draws on a guest speaker's presentation earlier in the term. Require students to reference at least three specific claims from the class discussion or the speaker's slides. General-purpose AI has no access to any of it.

Social sciences data analysis. Give students unique subsets of a dataset (a fixed slice per student ID) and require reflective commentary on the choices they made when the data misbehaved. The technical output is checkable against the input; the reflective commentary is where the learning is assessed.

Design coursework. Physical artefacts, iterated prototypes, and crit sessions were already the norm in design education, which is one reason design faculties have been the least disrupted by generative tools. The lesson for the rest of us is that a live crit is a very effective assessment.

The failure modes to watch for

Not every redesign works, and the literature since 2023 documents a few characteristic failure modes worth naming.

“Personal” prompts that are only nominally personal. Asking students to “reflect on your experience of leadership” is trivial for AI to answer plausibly because there is no ground truth. Personalisation only helps if there is verifiable context — a specific event, a specific reading, a specific dataset — that the model cannot hallucinate its way through.

Process artefacts that are easy to fabricate. A required outline submitted alongside the final paper is worth almost nothing if it can also be generated. Version history from Google Docs or Word AutoSave, timestamped over multiple sessions, is much harder to fake than a static outline document.

Oral components that are not actually diagnostic. A five-minute viva that consists of “tell us about your paper” is not enough. The questions have to press on specific choices: why this source and not that one, how would the argument change if the assumption were different, what did the reviewer's feedback prompt you to revise.

Rubrics that still weight surface polish. If eloquence is 40% of the mark, AI is 40% of the assessment.

The equity question we cannot ignore

Any conversation about AI-resistant redesign runs into an equity argument that cuts both ways. On one side: in-class exams and oral defences disadvantage students with disabilities, caring responsibilities, or English-as-additional-language backgrounds who benefit from take-home time. On the other: leaving the assessment landscape unchanged effectively rewards students with paid AI subscriptions and the writing skill to edit the output convincingly, while disproportionately exposing non-native English writers to false-positive detection outcomes.

The defensible response is not to pick a side but to use the Two-Lane approach or a portfolio structure that gives students choice and offers multiple avenues to demonstrate competence. Advance HE's equity briefings and the International Center for Academic Integrity's 2024 resource on assessment and integrity converge on this: the goal is authenticity of assessment, not uniformity of format.

The real time cost, honestly stated

Redesigning a course costs time. A first pass typically runs 15–25 hours per module for someone who has taught it before, and more for a new course. Oral components add roughly 8–12 minutes of instructor time per student per assessed episode. Process portfolios shift some marking effort forward in the term rather than eliminating it. None of this is trivial, and pretending otherwise damages the credibility of the reformers.

What partially offsets the cost is that a well-designed AI-resistant assessment removes the downstream work of chasing false positives, running detection reports, and having difficult conversations whose evidentiary base is thin. Instructors who have made the transition consistently report that the front-loaded design cost is recouped over one to two teaching cycles by the reduction in integrity casework.

What to change on Monday morning

You do not need to redesign an entire programme this week. A defensible next-step list looks something like: add a short in-class writing episode to one module this term, so you have a stylistic baseline; add a required version-history submission to your next major essay; add a five-minute oral check to the highest-stakes assignment; and add one rubric criterion that explicitly rewards specific engagement with a named source discussed in class. Those four changes, on their own, meaningfully move an assessment from the “AI arbitrage is easy” category into the “AI arbitrage is more work than doing the assignment” category. That is the actual goal.

The best assessment does not need a detector because the design has already done the integrity work. That is the position the QAA, TEQSA, Advance HE, and the serious teaching centres have converged on since 2023, and it is where our institutional policies will need to arrive whether we act now or later.

Frequently asked questions

Is there really no such thing as an AI-proof assignment?

Not for take-home text-based work. Any prompt whose answer is text a human can write is text a model can produce a plausible version of. The right framing is “AI-resistant” — making the AI-only route more effortful or less rewarded than doing the learning — rather than “AI-proof.” Fully AI-proof outcomes require live components: invigilated writing, oral defences, or physical demonstrations.

Do I have to redesign every assessment in my course?

No, and trying to do so at once tends to fail. The evidence from the 2024–2025 redesign literature is that adding one or two anchoring elements — a short in-class baseline task, a required version-history submission, or a brief oral check on the highest-stakes assignment — is enough to shift the incentive structure of the whole module. Full portfolio conversion can then follow across teaching cycles.

Are oral defences realistic given class sizes of 200+?

For very large cohorts, five-minute individual vivas are usually impractical, but structured alternatives work: small-group vivas (three students, fifteen minutes), randomised oral spot-checks on a sample of submissions with the sample's selection communicated in advance, or recorded two-minute Loom-style explanations that TAs can review asynchronously. The evidence base for these lighter variants is thinner but promising.

Will AI-resistant redesign eliminate the need for Turnitin's AI detector?

In most cases, yes — and that is closer to the point than a bug. If the assessment is authentic, the detector becomes a redundant and legally risky belt-and-braces layer whose false-positive costs typically exceed its marginal integrity benefit. Institutions that have moved decisively on assessment redesign have generally also de-emphasised or disabled AI detection, and the conjunction is not an accident.

What about contract cheating — does redesign help there too?

Yes, and often more than it helps with AI. The same features that make an assignment AI-resistant — contextual grounding, oral defence, process portfolios — also make it hard to buy from an essay mill, because the mill writer has no access to the lecture, the cohort discussion, or the student's data. See our piece on whether Turnitin can detect a bought essay for why detection is a poor substitute for design here as well.