SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Finally, we construct a simple single-feature classifier for artificial text detection with PHD as the feature, training a logistic regression on some dataset of real and generated texts.
Datasets. Our main dataset of human texts is Wiki40b [Guo et al., 2020]. We measured intrinsic dimension of fiction stories on the target split of the WritingPrompts dataset [Fan et al., 2018], a collection of short texts written by Reddit users. For multilingual text detection experiments, we generated a new WikiM dataset for 10 languages by GPT3.5-turbo (ChatGPT). We use the header and first sentence from a Wikipedia page as the prompt and ask the model to continue. In cross-domain and paraphrase robustness experiments, we use Wiki and Reddit datasets (3k samples each) [Krishna et al., 2023] that use two consecutive sentences (Wiki) or the question (Reddit) as a prompt and generate texts by GPT2-XL, OPT13b, and GPT3.5 (text-davinci-003). Following their pipeline for Reddit, we have also generated a StackExchange dataset by GPT3.5 (text-davinci-003) as the third domain. We select questions posted after 2019-08-01 from non-technical categories, where both question and answer have rating more than 10, and clean them removing HTML artifacts. In order to assess the bias in our estimator, we use the data provided by Liang et al. [2023].
Intrinsic dimensionality of real and generated texts. First, we observe an intriguing fact: the intrinsic dimension of natural texts is mostly concentrated between values 9 and 10, while the dimension of generated texts is lower and is approximately equal to 8, regardless of the generator. This is illustrated in Figure 3. Table 1 shows that this value is stable across different text genres but slightly varies for different languages: it is approximately equal to  $9 \pm 1$  for most European languages,
Figure 4: Boxplots of PHD distributions in different languages on Wikipedia data. Embeddings are obtained from XLM-RoBERTa-base (multilingual).
Figure 5: Boxplots of PHD distributions obtained by different LMs on English Wikipedia data.
slightly larger for Italian and Spanish  $(\approx 10 \pm 1)$ , and lower for Chinese and Japanese  $(\approx 7 \pm 1)$ ; details are shown in Fig. 4. But we always observe a clear difference between this distribution and generated texts on the same language (see Appendix for more experiments).
Next, we check how the PHD estimation depends on the base model that we use for text embedding calculation. Fig. 5 demonstrates that PHD changes slightly with the change of the base LM, decreasing for models with fewer parameters. RoBERTa-base embeddings provide the best variance for PHD estimation, so we use this model for all further experiments in English, and XLM-R of the same size for multilingual experiments.
Artificial text detection. We show that intrinsic dimension can lead to a robust method of artificial text detection. In all experiments below, we use the one-feature thresholding classifier (see Section 4).
Comparison with universal detectors. First, we show that our detector is the best among general-purpose methods designed to detect texts of any domain, generated by any AI model, without access to the generator itself. Such methods are needed, e.g., for plagiarism detection. To be applicable in real life, the algorithm should provide high artificial text detection rate while avoiding false accusations of real authors. Besides, it should be resistant to adversaries who transform the content generated by popular AI models to reduce the chance to be caught.
Here we adopt the experimental settings by Krishna et al. [2023] and use the baseline results presented there. We compare PHD and MLE with two general-purpose detectors: GPTZero [Tian, 2023], targeted to detect the texts generated by contemporary LLMs (GPT-3, GPT-4, ChatGPT, BARD), and OpenAI detector [OpenAI, 2023] announced together with the ChatGPT model in order to reduce its expected social harm. Our third baseline is DetectGPT [Mitchell et al., 2023], which is a state of the art thresholding classifier that evaluates text samples by the probability curvature obtained via the generator model. It works best when the base model coincides with the generator model ("model detects itself") but the authors claim that it can generalize to cross-model setup with reasonable quality. RankGen [Krishna et al., 2022] is a method originally developed for ranking hypotheses during text generation; it demonstrates a surprising ability to handle adversarial attacks.
Table 2: Artificial text detection (accuracy at  $1\%$  FPR) for open-ended generation using Wikipedia prompts. DIPPER was run with Lex=60, Order=60.
Generator	DetectGPT	Existing Solutions	Our methods
OpenAI	GPTZero	RankGen	PHD	MLE
GPT-2	70.3*	21.6	13.9	13.5	25.2	23.8
+ DIPPER	4.6	14.8	1.2	28.5	27.6	19.7
OPT	14.3	11.3	8.7	3.2	28.0	26.7
+ DIPPER	0.3	10.0	1.0	13.5	30.2	22.1
GPT-3.5	0.0	30.0	7.1	1.2	40.0	46.7
+ DIPPER	0.0	15.6	1.8	7.3	41.2	33.3
Following Krishna et al. [2023], we report the detection accuracy with false positive rate (FPR) fixed at  $1\%$ . Table 2 shows that our PHD-based classifier outperforms all baselines with a large margin:  $+10\%$  for GPT-3.5,  $+14\%$  for OPT. Note that DetectGPT uses GPT-2 as the base model, which explains its results for GPT-2. PHD is also invulnerable to the DIPPER paraphrasing attack [Krishna et al., 2023]. When generated texts are transformed by DIPPER, they lose some characteristic features of the generator, which causes a dramatic drop in quality for most detectors; but for the PHD classifier the accuracy of artificial text detection even increases slightly after this perturbation. Interestingly, the MLE dimension estimator also works quite well for this task, and even achieves  $6\%$  better detection for GPT-3.5 generations; but its adversarial robustness is significantly worse.
Cross-domain and cross-model performance. Table 3 shows that our ID estimation is stable across text domains; consequently, our proposed PHD text detector is robust to domain transfer. We compare the cross-domain ability of PHD with a supervised classifier obtained by fine-tuning RoBERTa-base with a linear classification head on its  $CLS$  token, a supervised classification approach used previously for artificial texts detection with very high in-domain accuracy [Solaiman et al., 2019, Guo et al., 2023, He et al., 2023]. We split data into train / validation / test sets in proportion  $80\% / 10\% / 10\%$ . Table 3 reports the results of the classifier's transfer between three datasets of different text styles—long-form answers collected from Reddit, Wikipedia-style texts, and answers from StackExchange—using data generated by GPT-3.5 (text-davinci-003). Although supervised classification is virtually perfect on in-domain data, it fails in cross-domain evaluation, while the PHD classifier is not influenced by domain transfer. On average, the PHD classifier slightly outperforms the supervised baseline, while being much more stable. Table 3 also reports cross-model transfer ability, where the classifier is trained on the output of one generation model and tested on another. We consider generations of GPT-2, OPT, and GPT-3.5 (text-davinci-003) in the Wikipedia domain and observe that the PHD classifier, again, is perfectly stable. This time, RoBERTa-base supervised classifier handles the domain shift much better and outperforms PHD on average, but it has a higher cross-domain generalization gap. This means that we can expect the PHD classifier to be more robust to entirely new AI models.
PHD-based classification for other languages. Table 4 presents the results of PHD-based artificial text detection for Wikipedia-style texts generated by ChatGPT in 10 languages. Text embeddings were obtained with XLM-RoBERTa-base, the multilingual version of RoBERTa. As quality metric we report the area under ROC-curve (ROC-AUC). We see that both ID classifiers provide solid results for all considered languages, with the average quality of 0.78 for PHD and 0.8 for MLE; MLE performs better for almost all languages. The worst quality is on Chinese and Japanese (PHD 0.71 and 0.74, MLE 0.65 and 0.75 respectively), the best is for Spanish and Italian (PHD 0.83, MLE 0.85 for both). Note that the best and worst classified languages are those with the largest and smallest ID values in Fig. 4; we leave the investigation of this phenomenon for further research.
Non-native speaker bias. Finally, we show how our model helps to mitigate the bias present in ML-based artificial text detectors. We follow Liang et al. [2023] who demonstrate that current artificial text detectors are often too hard on texts written by non-native speakers. We use OpenAI and GPTZero as the baselines (see Appendix for more results) and PHD and MLE classifiers, choosing the thresholds was chosen on data unrelated to this task, as the equal error classifier on introductions of Wikipedia articles (real vs GPT-3.5-turbo) where it achieved EER of  $26.8\%$  for PHD and  $22.5\%$  for MLE. On the left, Fig. 6 shows false positive rates (FPR) for three sets of student essays: TOEFL essays by non-native speakers (red), same texts processed by GPT-4 asked to improve the text (grey),
Table 3: Cross-domain and cross-model accuracy of PHD and RoBERTa-based classifiers on data from three different domains and three different models; classes are balanced in training and evaluation.
Train \ Eval	RoBERTa-cls	Intrinsic Dimension (PHD)
Wikipedia	Reddit	StackExchange	Wikipedia	Reddit	StackExchange
Wikipedia	0.990	0.535	0.690	0.843	0.781	0.795
Reddit	0.388	0.997	0.457	0.855	0.776	0.773
StackExchange	0.525	0.473	0.999	0.834	0.778	0.800
Train \ Eval	GPT2	OPT	GPT3.5	GPT2	OPT	GPT3.5
GPT2	0.992	0.993	0.933	0.769	0.759	0.832
OPT	0.988	0.997	0.967	0.769	0.763	0.837
GPT3.5	0.937	0.982	0.990	0.759	0.757	0.843
Table 4: Quality of artificial text detection in different languages (ROC-AUC) for ChatGPT text.
Language:	cn-zh	en	fr	de	it	jp	pl	ru	es	uk
PHD	0.709	0.781	0.790	0.767	0.831	0.737	0.794	0.777	0.833	0.768
MLE	0.650	0.770	0.804	0.788	0.852	0.753	0.850	0.816	0.853	0.821
Figure 6: Comparison of GPT detectors in non-standard environment. Left: bias against non-native English writing samples (the lower is better). Right: effect of the prompt design on performance (the higher is better).
and native speakers (blue). First, blue bars are almost invisible for all detectors because the FPR for a native speaker is very small ( $< 1\%$ ) while non-native speakers can be wrongly accused by OpenAI and GPTZero in  $58\%$  and  $52\%$  of the cases respectively. The PHD classifier reduces this discriminating rate by  $2x$ , showing FPR  $26\%$  for non-native speakers. After GPT-4 polishing, this rate further decreases to  $7.7\%$  compared to  $19\%$  for GPTZero. Interestingly, OpenAI also deals with GPT-4 polished texts surprisingly well, its FPR drops by  $15x$ . The MLE detector also demonstrates less biased behaviour compared to baselines, but worse than PHD.
On the right, Fig. 6 shows the true positive rates (TPR) of these methods on essays generated by ChatGPT. Red bars show that our classifiers greatly outperform baselines. Grey bars demonstrate the robustness of ID detectors to changes in generation style via prompt design. If an adversary asks ChatGPT to generate a text with some predefined level of complexity ("use simple words", or "more complex words"), baseline systems fail to correctly recognize such texts while both ID classifiers still yield high detection rates.
Analysis of edge cases. We noticed an interesting tendency among the human-written passages with the lowest ID (misclassified as AI-generated). It seems that most of these examples contain a lot of addresses, geographical names, or proper nouns; some texts, however, are typical but very short. We hypothesize that it can be related to an unusually high number of rare tokens or numbers in the text and that PH dimension estimation is overall less correct on short texts. Besides, Davinci-generated texts with the highest ID (misclassified as human-written with the most certainty) are also often quite short. We leave a more comprehensive analysis of such failure cases for future work.
We provide examples of both types of misclassified texts in Appendix E. Moreover, we show bar plots of the PHD of artificially created texts made from random tokens and texts composed by repeating the
same token in Figure 11. One can see that the simplest samples have the lowest ID, and the highest values of ID correspond to completely random texts. This supports the general understanding of ID as the number of degrees of freedom in the data.
We see three main limitations of our method. First, it is stochastic in nature. PH dimensions of texts from the same generator vary widely, and the estimation algorithm is stochastic as well, which adds noise, while rerolling the estimation several times would slow down the method. Second, "out of the box" our method can detect only "good" (fluent) generators with a relatively small temperature of generation. The PH dimension of "bad" or high-temperature generators is actually higher on average than for real texts, so the detector will need to be recalibrated. Third, we have only evaluated our approach on several relatively high-resource languages and we do not know how the method transfers to low-resource languages; this is a direction for future work. Nevertheless, our method provides a new tool for recognizing fake content without discriminating non-native speakers, which is also much more robust to model change and domain change than known tools.
In this work, we have introduced a novel approach to estimating the intrinsic dimension of a text sample. We find that this dimension is approximately the same for all human-written samples in a given language, while texts produced by modern LLMs have lower dimension on average, which allows us to construct an artificial text detector. Our comprehensive experimental study proves the robustness of this classifier to domain shift, model shift, and adversarial attacks. We believe that we have discovered a new interesting feature of neural text representations that warrants further study.
The work of Evgeny Burnaev was supported by the Russian Foundation for Basic Research grant 21-51-12005 NNIO_a.
H. Adams, M. Aminian, E. Farnell, M. Kirby, J. Mirth, R. Neville, C. Peterson, and C. Shonkwiler. A fractal dimension for measures via persistent homology. In Topological Data Analysis: The Abel Symposium 2018, pages 1-31. Springer, 2020.
D. I. Adelani, H. Mai, F. Fang, H. H. Nguyen, J. Yamagishi, and I. Echizen. Generating sentiment-preserving fake online reviews using neural language models and their human-and machine-based detection. In Advanced Information Networking and Applications: Proceedings of the 34th International Conference on Advanced Information Networking and Applications (AINA-2020), pages 1341–1354. Springer, 2020.
A. Aghajanyan, S. Gupta, and L. Zettlemoyer. Intrinsic dimensionality explains the effectiveness of language model fine-tuning. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pages 7319-7328, Online, Aug. 2021. Association for Computational Linguistics. doi: 10.18653/v1/2021.acl-long.568. URL https://aclanthology.org/2021.acl-long.568.
L. Albergante, J. Bac, and A. Zinovyev. Estimating the effective dimension of large biological datasets using fisher separability analysis. pages 1-8, 07 2019. doi: 10.1109/IJCNN.2019.8852450.
L. Amsaleg, O. Chelly, T. Furon, S. Girard, M. Houle, K.-i. Kawarabayashi, and M. Nett. Extreme-value-theoretic estimation of local intrinsic dimensionality. Data Mining and Knowledge Discovery, 32(2):1-38, November 2018. doi: 10.1007/s10618-018-0578-6.
L. Amsaleg, O. Chelly, M. Houle, K.-i. Kawarabayashi, M. Radovanovic, and W. Treeratanajaru. Intrinsic dimensionality estimation within tight localities. pages 181-189, 05 2019. ISBN 978-1-61197-567-3. doi: 10.1137/1.9781611975673.21.
A. Ansuini, A. Laio, J. H. Macke, and D. Zoccolan. Intrinsic dimension of data representations in deep neural networks. Advances in Neural Information Processing Systems, 32, 2019.
A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, and I. Sutskever. Language models are unsupervised multitask learners. 2019.
V. S. Sadasivan, A. Kumar, S. Balasubramanian, W. Wang, and S. Feizi. Can ai-generated text be reliably detected? arXiv preprint arXiv:2303.11156, 2023.
B. Schweinhart. Persistent homology and the upper box dimension. Discrete & Computational Geometry, 65(2): 331-364, 2021.
I. Solaiman, M. Brundage, J. Clark, A. Askell, A. Herbert-Voss, J. Wu, A. Radford, G. Krueger, J. W. Kim, S. Kreps, et al. Release strategies and the social impacts of language models. arXiv preprint arXiv:1908.09203, 2019.
J. M. Steele. Growth rates of euclidean minimal spanning trees with power weighted edges. The Annals of Probability, 16(4):1767-1787, 1988.
C. Stokel-Walker. AI bot ChatGPT writes smart essays-should academics worry? Nature, 2022.
E. Tian. GPTZero: An AI text detector, 2023. URL https://gptzero.me/. Accessed: 2023-05-16.
E. Tulchinskii, K. Kuznetsov, L. Kushnareva, D. Cherniavskii, S. Barannikov, I. Pionkovskaya, S. Nikolenko, and E. Burnaev. Topological data analysis for speech processing. In Proc. INTERSPEECH 2023, pages 311-315, 2023. doi: 10.21437/Interspeech.2023-1861. URL https://www.isca-speech.org/archive/interspeech_2023/tulchinskii23_interspeech.html.
L. Valeriani, D. Doimo, F. Cuturello, A. Laio, A. Ansuini, and A. Cazzaniga. The geometry of hidden representations of large transformer models. CoRR, abs/2302.00294, 2023. URL https://doi.org/10.48550/arXiv.2302.00294.
A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin. Attention is all you need. In I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume 30. Curran Associates, Inc., 2017. URL https://proceedings.neurips.cc/paper_files/paper/2017/file/3f5ee243547dee91fbd053c1c4a845aa-Paper.pdf.
F. Xue, B. Yang, Y. Qi, and J. Xin. Searching intrinsic dimensions of vision transformers. arXiv preprint arXiv: 2204.07722, 2022.
R. Zellers, A. Holtzman, H. Rashkin, Y. Bisk, A. Farhadi, F. Roesner, and Y. Choi. Defending against neural fake news. Advances in neural information processing systems, 32, 2019.
W. Zhu, Q. Qiu, J. Huang, R. Calderbank, G. Sapiro, and I. Daubechies. Ldmnet: Low dimensional manifold regularized neural networks. In 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2743-2751, 2018. doi: 10.1109/CVPR.2018.00290.
(a) Point cloud concentrated around a straight line;  $PHD \approx 1.0$
(b) Point cloud concentrated around two curved intertwined lined;  $PHD \approx 1.5$
Figure 7: Example of the difference between intrinsic dimensionality (PHD) of point clouds for different geometric shapes. The point cloud concentrated around a more complex structure (7b) has larger PHD than a point cloud concentrated around a simpler structure (7a).
A.1 Formal definitions of persistent homologies
A persistent homology is a sequence of homology groups and linear maps parameterized by a filtration value. Formally speaking, given a filtered chain complex  $(K,\partial)$  with filtration values  $\lambda_1 < \lambda_2 < \ldots < \lambda_n$ , we have a sequence of chain complexes:  $K_{\lambda_0} \subseteq K_{\lambda_1} \subseteq K_{\lambda_2} \subseteq \ldots \subseteq K_{\lambda_n} = K$ . For each  $\lambda_j$ , the  $i$ -th homology group  $H_i(K_{\lambda_j})$  denotes the factor vector space  $H_i(K_{\lambda_j}) = \ker \partial|_{K_{\lambda_j}^{(i)}} / \operatorname{im} \partial|_{K_{\lambda_j}^{(i)}}$ . The inclusion  $K_{\lambda_j} \subseteq K_{\lambda_{j+r}}$  induces a linear map  $f_{j,j+r}: H_i(K_{\lambda_j}) \to H_i(K_{\lambda_{j+r}})$ . By definition, the persistent homology  $\mathrm{PH}_i$  of the filtered chain complex is the collection of homology groups  $H_i(K_{\lambda_j})$  and linear maps between them:  $\mathrm{PH}_i = \{H_i(K_{\lambda_j}), f_{j,j+r}\}_{j,r}$ .
By the structure theorem of persistent homology, a filtered chain complex  $(K,\partial)$  is decomposed into the unique direct sum of standard filtered chain complexes of types  $I(b_{p},d_{p})$  and  $I(h_{p})$ , where  $I(b,d)$  is the filtered complex spanned linearly by two elements  $e_b,e_d$ ,  $\partial e_d = e_b$  with filtrations  $e_b\in I_b^{(i)},e_d\in I_d^{(i + 1)},b\leq d$  and  $I(h)$  is the filtered complex spanned by a single element  $\partial e_h = 0$  with filtration  $e_h\in I_h^{(i)}$  [Barannikov, 1994]. This collection of filtered complexes  $I(b_p,d_p)$  and  $I(h_{p})$  from the decomposition of  $K$  is called the ith Persistence Barcode of the filtered complex  $K$ . It is represented as the multiset of the intervals  $[b_p,d_p]$  and  $[h_p, + \infty)$ . In Section 3, when we speak loosely about the persistent homology  $\mathrm{PH}_i$ , we actually mean the ith persistence barcode. In particular, the summation  $\sum_{\gamma \in \mathrm{PH}_i}$  is the summation over the multiset of intervals constituting the ith persistence barcode.
A.2 Equivalence between  $\mathbf{PH}_0(\mathbf{S})$  and MST(S)
For the reader's convenience, we provide a sketch of the equivalence between the 0th persistence barcodes and the set of edges in the minimal spanning tree (MST).
First, recall the process of constructing the 0-dimensional persistence barcode [Adams et al., 2020]. Given a set of points  $S$ , we consider a simplicial complex  $K$  consisting of points and all edges between them (we do not need to consider faces of higher order to compute  $H_0$ ):  $K = \{S\} \cup \{(s_i, s_j) | s_i, s_j \in S\}$ . Each element in the filtration  $K_{\lambda_0} \subseteq K_{\lambda_1} \subseteq K_{\lambda_2} \subseteq \ldots \subseteq K_{\lambda_n} = K$  contains edges shorter than the threshold  $\lambda_k$ :  $K_{\lambda_k} = \{S\} \cup \{(s_i, s_j) | s_i, s_j \in S, ||s_i - s_j|| < \lambda_k\}$ . The 0-th persistence barcode is the collection of lifespans of 0-dimensional features, which correspond to connected
components, evaluated with growths of the threshold  $\lambda$ . Let us define a step-by-step algorithm for evaluating the features' lifespans. We start from  $\lambda = 0$ , when each point is a connected component, so all the features are born. We add edges to the complex in increasing order. On each step, we are given a set of connected components and a queue of the remaining edges ordered by length. If the next edge of length  $\lambda$  connects two connected components to each other, we claim the death of the first component and add a new lifespan  $(0, \lambda)$  to the persistence barcode; otherwise, we just remove the edge from the queue since its addition to the complex does not influence the 0th barcode.
Now we can notice that this algorithm corresponds exactly to the classical Prim's algorithm for MST construction, where the appearance of a new bar  $(0,\lambda)$  corresponds to adding an edge of length  $\lambda$  to the MST.
B Algorithm for computing the PHD
In Section 4 of the paper, we describe a general scheme for the computation of persistence homology dimension (PHD). Here we give a more detailed explanation of the algorithm.
Input: a set of points  $S$  with  $|S| = n$ .
Output:  $\dim_{PH}^0 (S)$
1. Choose  $n_i = \frac{(i - 1)(n - \hat{n})}{k} + \hat{n}$  for  $i \in \overline{1, \ldots, k}$ ; hence,  $n_1 = \hat{n}$  and  $n_k = n$ . Value of  $k$  may be varied, but we found that  $k = 8$  is a good trade-off between speed of computation and variance of PHD estimation for our data (our sets of points vary between 50 and 510 in size). As for  $\hat{n}$ , we always used  $\hat{n} = 40$ .
2. For each  $i$  in  $1, 2, \ldots, k$
(a) Sample  $J$  subsets  $S_{i}^{(1)},\ldots S_{i}^{(J)}$  of size  $n_i$ . For all our experiments we took  $J = 7$ .
(b) For each  $S_{i}^{(j)}$  calculate the sum of lengths of intervals in the 0th persistence barcode  $E_0^1 (S_i^{(j)})$ .
(c) Denote by  $E(S_{i})$  the median of  $E_0^1 (S_i^{(j)})$ ,  $j\in \overline{1,\ldots J}$ .