Usually you don't have to be 100% sure. E.g. for spam or DDoS protection you just need to know with high enough certainty. The pursuit of certainty is a lost cause, because a human could always verify a bot manually and fool the system, or some AI might trick it eventually. But the tool makes sense as just one solution out of many working together, in the same way that having a multitude of relays makes Nostr decentralized.