SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Eduard Tulchinskii<sup>1</sup>, Kristian Kuznetsov<sup>1</sup>, Laida Kushnareva<sup>2</sup>, Daniil Cherniavskii<sup>3</sup>, Sergey Nikolenko<sup>5</sup>, Evgeny Burnaev<sup>1,3</sup>, Serguei Barannikov<sup>1,4</sup>, Irina Piontkovskaya<sup>2</sup>
$^{1}$ Skolkovo Institute of Science and Technology, Russia;
$^{2}$ AI Foundation and Algorithm Lab, Russia;
<sup>3</sup>Artificial Intelligence Research Institute (AIRI), Russia; <sup>4</sup>CNRS, Université Paris Cité, France;
$^{5}$ St. Petersburg Department of the Steklov Institute of Mathematics, Russia
Rapidly increasing quality of AI-generated content makes it difficult to distinguish between human and AI-generated texts, which may lead to undesirable consequences for society. Therefore, it becomes increasingly important to study the properties of human texts that are invariant over different text domains and varying proficiency of human writers, can be easily calculated for any language, and can robustly separate natural and AI-generated texts regardless of the generation model and sampling method. In this work, we propose such an invariant for human-written texts, namely the intrinsic dimensionality of the manifold underlying the set of embeddings for a given text sample. We show that the average intrinsic dimensionality of fluent texts in a natural language is hovering around the value 9 for several alphabet-based languages and around 7 for Chinese, while the average intrinsic dimensionality of AI-generated texts for each language is  $\approx 1.5$  lower, with a clear statistical separation between human-generated and AI-generated distributions. This property allows us to build a score-based artificial text detector. The proposed detector's accuracy is stable over text domains, generator models, and human writer proficiency levels, outperforming SOTA detectors in model-agnostic and cross-domain scenarios by a significant margin. We release code and data<sup>1</sup>
Modern large language models (LLMs) generate human-looking texts increasingly well, which may also lead to worrisome consequences [Fagni et al., 2021, Adelani et al., 2020, Stokel-Walker, 2022]. Hence, the ability to detect AI-generated texts (artificial text detection, ATD) becomes crucial for media, education, politics, creative industries and other spheres of human social activities. A straightforward idea would be to train a classifier to detect artificial text; many such classifiers exist [Zellers et al., 2019, Gehrmann et al., 2019, Solaiman et al., 2019], but most of them are designed to detect samples of individual generation models, either using the model itself [Mitchell et al., 2023] or training on a dataset of its generations. This leads to poor generalization to new models and unknown data domains. Another idea, known as watermarking, is to inject some detectable artifacts into model generations; for instance, Kirchenbauer et al. [2023] propose to intentionally inject a statistical skew that can be detected in a text sample. However, later works showed that watermark detectors can be broken by adversarial attacks, e.g., by text perturbations or paraphrasing [He et al., 2023]. Since text generation is constantly evolving, Sadasivan et al. [2023] claim that perfect artificial text detection is impossible; Krishna et al. [2023] address this statement and propose a retrieval-based detector that could be implemented by text generation service providers: they should store the hash
'github.com/ArGintum/GPTID
value of every text generated by their model and retrieve it by request. This approach works even for a perfect text generator indistinguishable from human writing, but it does not apply to publicly available models, and plenty of them already exist.
(a) AI generated
(b) human written
(c)
Figure 1: Real and artificial text have different intrinsic dimension: (a-b) idea; (c) actual results.
In this work, we show that the intrinsic dimension of text samples can serve as a helpful score function allowing to separate artificial and generated texts in a very general setting, without additional knowledge about the generator. The only assumption is that generation is good enough to create fluent grammatical samples of length  $\approx 200$  words. We propose a method based on persistent homology dimension theory, which allows to estimate the dimension of text samples with high accuracy, and show that the proposed dimension-based classifier outperforms other artificial text detectors with a large margin in the general-purpose setup, for a very wide class of generators.
Many works have estimated the intrinsic dimension of data representations [Pope et al., 2021, Barannikov et al., 2021], neural network weights [Ansuini et al., 2019], or parameters needed to adapt to some downstream task [Aghajanyan et al., 2021], but these objects are very complex. Even if we are certain that a dataset fits into some surface in a high-dimensional feature space, it is not easy to estimate its dimension due to various kinds of noise (natural irregularities, measurement noise, numerical approximations) and the ambiguity of estimating a surface from a sparse set of points.
We estimate the geometry of every text sample as a separate object. Since texts generated by modern LLMs are fluent and usually do not contain grammatical, syntactical, or local semantic inconsistencies, we are interested in global sample geometry rather than properties that could be detected over short text spans. We show that the persistent dimension estimator provides an excellent way to deal with textual data: it turns out that real texts have a higher intrinsic dimension than artificial ones (Fig. 1). We propose an efficient method to implement the estimator and evaluate its classification ability in various settings, proving its robustness for artificial texts detection and showing that it works equally well across a number of different languages.
Our main contributions are thus as follows: (1) we propose to estimate the intrinsic dimensionality of natural language texts with the persistent homology dimension estimator and develop an efficient algorithm for computing it; (2) we show that the intrinsic dimension serves as a good score for artificial text detection for modern LLMs; in cross-domain and cross-model settings our method outperforms other general purpose classifiers by a large margin, is robust to adversarial attacks, and works for all considered languages; (3) we show that our text detector reduces the bias against non-native speakers in comparison to available ATD models; (4) we release a multilingual dataset of generations produced by GPT-3.5 and natural texts from the same domain in order to enable further ATD research. Below, Section 2 reviews related work, Section 3 introduces intrinsic dimension and its estimation with persistent homology, Section 4 applies it to artificial text detection, Section 5 presents our experimental evaluation, Section 6 discusses the limitations, and Section 7 concludes the paper.
Artificial text detection (ATD) becomes increasingly important with modern LLMs. GPT-2 [Radford et al., 2019] was accompanied by a work by Solaiman et al. [2019] on potential dangers and defences against them; the best ATD classifier there was based on supervised fine-tuning of RoBERTa [Liu et al.,
2019]. Supervised approaches can work well for other generative models and data domains [Krishna et al., 2023, Guo et al., 2023, He et al., 2023] but they do not generalize to other text domains, generation models, and even sampling strategies [Bakhtin et al., 2019, Solaiman et al., 2019]. In the zero-shot setting, Solaiman et al. [2019] threshold the average log-probability score of a sample calculated by some pretrained language model (LM). DetectGPT [Mitchell et al., 2023] treats log-probability calculation as a function, estimates its curvature in a small neighbourhood of the text, and shows that this curvature score is smaller for artificial texts (there are "flat" regions around them); however, DetectGPT needs the likelihood to come from the same LM as the sample.
We focus on developing an ATD model that could be generalized to unseen text generation models and domains. Zellers et al. [2019] detect generated texts perfectly with a discriminator model built on top of the generator, but the quality drops significantly when the generator changes, even with supervised adaptation; a similar "model detects itself" setup was adopted by Mitchell et al. [2023]. Solaiman et al. [2019] show that a simple score-based approach by the likelihood score works well in the "model detects itself" setting but does not generalize to different generators and discriminator; as for transferability, they show that a supervised classifier generalizes well when it is trained on the output of a more complex model and transferred to a less complex one but not in the reverse direction. Bakhtin et al. [2019] consider different types of generalization: in-domain (train and test generators are the same), cross-corpus (train and text generators fine-tuned on different corpora), and cross-architecture (train and test generators have different architectures but the same training corpora); their model shows good in-domain generalization ability, handles relatively well cross-architecture generalization, but loses quality in cross-corpus generalization. Mitchell et al. [2023] demonstrate the stability of their method over text domains compared to supervised models, which are better on in-domain data but lose efficiency in a cross-domain setting. Finally, Krishna et al. [2023] show all methods failing dramatically against the DIPPER paraphrase attack (except for a lower-performing approach developed for text quality ranking [Krishna et al., 2022]). We also note a work by Liang et al. [2023] who show the bias of artificial text detectors against non-native speakers and show that all existing detectors can be broken by generating texts with controllable complexity.
Geometrical and topological methods have shown their usefulness for analysing the intrinsic dimensionality of data representations. Some works focus on data manifolds [Pope et al., 2021, Barannikov et al., 2021] and others consider hidden representations and other parts of neural networks and investigate through the lens of intrinsic dimensionality. Li et al. [2018] define the intrinsic dimension of objective landscape by tracking the subspace dimension and performance of a neural network, while Zhu et al. [2018] use manifold dimension directly to regularize the model. Ansuini et al. [2019] apply TwoNN to internal representations in CNNs and establish a connection to the model's generalization ability. Birdal et al. [2021] show that the generalization error of these models can be bounded via persistent homology dimension. Vision transformers were also investigated by Xue et al. [2022] and Magai and Ayzenberg [2022]. Moreover, intrinsic dimensionality has been connected to the generalization of Transformer-based LLMs [Aghajanyan et al., 2021]. Valeriani et al. [2023] analyze the intrinsic dimensionality of large Transformer-based models. Topological properties of the inner representations of Transformer-based models [Vaswani et al., 2017], including BERT [Devlin et al., 2019] and HuBERT [Hsu et al., 2021], have been successfully applied for solving a wide variety of tasks, from artificial text detection [Kushnareva et al., 2021] and acceptability judgement [Cherniavskii et al., 2022] to speech processing [Tulchinskii et al., 2023].
3 Intrinsic dimension and persistent homology dimension
Informally speaking, the intrinsic dimension of some subset  $S \subset \mathbb{R}^n$  is the number of degrees of freedom that a point moving inside  $S$  has. This means that in a small neighbourhood of every point, the set  $S$  can be described as a function of  $d$  parameters,  $d \leq n$ , and this number cannot be reduced. This idea is formalized in the notion of a  $d$ -dimensional manifold in  $\mathbb{R}^n$ : it is a subset  $M \subset \mathbb{R}^n$  such that for every point  $x \in M$  there exists an open neighborhood which is equivalent to an open ball in  $\mathbb{R}^d$  for some value  $d$ . Importantly, if  $M$  is a connected set then  $d$  should be the same for all its points, so we can talk about the dimension of the entire manifold.
Data representations often use excessive numbers of features, some of which are highly correlated. This overparametrization has been noticed many times [Hein and Audibert, 2005, Kuleshov et al., 2017, Pope et al., 2021], and the idea that real data lies (approximately) on some low-dimensional manifold in the feature space is known as the manifold hypothesis [Goodfellow et al., 2016]. However,
there are obstacles to estimating the intrinsic dimension of a dataset. First, a real dataset can be a combination of sets of different dimensions. Second, data can be noisy and may contain outliers. Moreover, real data can have a complicated hierarchical structure, so different approximation methods lead to different intrinsic dimension values. For an analogy, consider the observations of a single spiral galaxy that consists of separate points (stars, planets etc.) but forms a compact 3-dimensional manifold. At some level of approximation the galaxy looks like a disk, which is 2-dimensional, but if we take a closer look we discover the structure of a 3-dimensional core and basically 1-dimensional arms. Moreover, if we add observations over time, the dataset will consist of 1-dimensional trajectories of individual points that exactly correspond to well-defined mathematical trajectories (the noise here comes only from measurement errors); these trajectories form an approximate 3-dimensional cylinder in 4-dimensional space with a much higher level of noise around its borders. As a result, the dimension of the entire object can be estimated by any number from 1 to 4 depending on the detector's sensitivity to noise and outliers, preference for global or local features, and the way to average the values of the non-uniform distribution of the points.
Thus, it is natural that there exist several different methods for intrinsic dimension (ID) estimation, and we have to choose the one most suitable for the task at hand. For example, many ID estimators are based on constructing a global mapping of the data into a lower-dimensional linear subspace, with either linear projection (e.g., PCA), kernel-based methods, or distance-preserving nonlinear transformations. However, in our preliminary experiments these types of dimension estimation seemed to be losing information that was key for artificial text detection.
We focus on the persistent homology dimension estimator (PHD) [Schweinhart, 2021], which belongs to the class of fractal dimension approaches. Consider a ball of radius  $r$  inside a  $d$ -dimensional manifold  $M$ . As  $r$  grows, the volume of the ball increases proportionally to  $r^d$ . Let  $x_1, \ldots, x_N$  be points uniformly sampled from  $M$ . Then the expected number of points in a ball of radius  $r$  also changes as  $r^d$  with  $r$ . Naturally, real datasets usually do not correspond to a uniform distribution of points, but this issue can be overcome by considering the asymptotic behaviour of the number of points in an  $r$ -ball as  $r \to 0$ . In this case, it suffices for the data distribution to be smooth and therefore close to uniform in the neighbourhood of every point. Accurate straightforward estimation of  $d$  based on the above observation is not sample-efficient but there exist several approximate approaches, including the MLE dimension that evaluates the data likelihood [Levina and Bickel, 2004], the TwoNN dimension that uses the expected ratio of distances from a given point to its two nearest neighbours [Facco et al., 2017], and MADA [Farahmand et al., 2007] that uses the first order expansion of the probability mass function. We also report MLE-based results as its performance is comparable to PHD in some tasks.
We propose to use persistence homology dimension (PHD) that has several appealing properties compared to other fractal intrinsic dimension estimators. First, the above methods operate locally while PHD combines local and global properties of the dataset. Second, according to our experiments, this method is sample-efficient and redundant to noise (see below). Third, it has a solid theoretical background that connects topological data analysis, combinatorics, and fractal geometry [Adams et al., 2020, Birdal et al., 2021, Jaquette and Schweinhart, 2020, Schweinhart, 2021].
The formal definition of PHD is based on the concept of persistent homology for a set of points in a metric space, which is a basic notion of topological data analysis (TDA) [Chazal and Michel, 2017, Barannikov, 1994, 2021]. TDA aims to recover the underlying continuous shape for a set of points by filling in the gaps between them that are smaller than some threshold  $t$  and studying the topological features of the resulting object as  $t$  increases. Each persistent homology  $\mathrm{PH}_i$  in a sequence  $\mathrm{PH}_0, \mathrm{PH}_1, \ldots$  is defined by the set of topological features of dimension  $i$ : 0-dimensional features are connected components, 1-dimensional features are non-trivial cycles, 2-dimensional features are tunnels, etc. For each feature we calculate its "lifespan", a pair  $(t_{\mathrm{birth}}, t_{\mathrm{death}})$ , where  $t_{\mathrm{birth}}$  is the minimal threshold where the feature arises, and  $t_{\mathrm{death}}$  is the threshold where it is destroyed.
Following Adams et al. [2020], we introduce the persistent homology dimension as follows. Consider a set of points  $X = \{x_{1},\ldots ,x_{N}\} \subset \mathbb{R}^{n}$ . We define the  $\alpha$ -weighted sum as  $E_{\alpha}^{i}(X) = \sum_{\gamma \in \mathrm{PH}_{i}(X)}|I(\gamma)|^{\alpha}$ , where  $I(\gamma) = \mathrm{t}_{\mathrm{death}}(\gamma) - \mathrm{t}_{\mathrm{birth}}(\gamma)$  is the lifespan of feature  $\gamma$ . For  $i = 0, E_{\alpha}^{i}$  can be expressed in terms of the minimal spanning tree (MST) of  $X$ : its edges map to lifespans of 0-dimensional features  $\gamma \in \mathrm{PH}_0(X)$  [Bauer, 2021, Birdal et al., 2021]. Thus, the definition of  $E_{\alpha}^{0}(X)$  is equivalent to  $E_{\alpha}^{0}(X) = \sum_{e\in \mathrm{MST}(X)}|e|^{\alpha}$ , where  $|e|$  is the length of edge  $e$ .
Figure 2: A comparison of ID estimators with noise on artificial datasets; lower is better.
There is a classical result on the growth rate of  $E_{\alpha}^{0}(X)$  [Steele, 1988]: if  $x_{i}$ ,  $0 < i < \infty$  are independent random variables with a distribution having compact support in  $\mathbb{R}^d$  then with probability one  $E_{\alpha}^{0}(X) \sim Cn^{\frac{d - \alpha}{d}}$  as  $n \to \infty$ , where equivalence means that the ratio of the terms tends to one. It shows that  $E_{\alpha}^{0}$  tends to infinity with  $N$  if and only if  $\alpha < d$ . Now one can define the intrinsic dimension based on MST as the minimal value of  $\alpha$  for which the score is bounded for finite samples of points from  $M$  [Schweinhart, 2021]:
$$
\dim_ {\mathrm {M S T}} (M) = \inf  \{d \mid \exists C \text {s u c h t h a t} E _ {d} ^ {0} (X) \leq C \text {f o r e v e r y f i n i t e} X \subset M \},
$$
and a PH dimension as
$$
\dim_ {\mathrm {P H}} (M) = \inf  \{d \mid \exists C \text {s u c h t h a t} E _ {d} ^ {0} (X) \leq C \text {f o r e v e r y f i n i t e} X \subset M \}.
$$
We now see that  $\dim_{\mathrm{MST}}(M) = \dim_{\mathrm{PH}}(M)$  for any manifold  $M$ . This fact, together with the growth rate result above, provides a sample-efficient way to estimate  $\dim_{PH}(M)$  [Birdal et al., 2021]: sample subsets  $X_{n_i} = \{x_1,\ldots ,x_{n_i}\} \subset M$  of  $n_i$  elements for a growing sequence of  $n_i$ , for every subset find its MST and calculate  $E_{\alpha}^{0}(X_{n_i})$ , and then estimate the exponent of the growth rate of the resulting sequence by linear regression between  $\log E_{\alpha}^{0}(X_{n_i})$  and  $\log n$ , since we know that  $\log E_{\alpha}^{0}(X_{n_i})\sim (1 - \frac{\alpha}{d})\log n_i + \tilde{C}$  as  $n_i\to \infty$ .
Next, we show empirically that our method of ID estimation via PHD approximates the real dimension of a manifold well and is well suited for the conditions mentioned earlier: presence of noise and small number of samples. To compare with other ID estimators, we utilize a benchmark by Campadelli et al. [2015] designed specifically for the evaluation of ID estimation methods and used the scikit-dimensions library [Bac et al., 2021] with efficient implementations of 12 different approaches to ID estimation, popular for different tasks. We evaluated many of these approaches on artificial datasets from Bac et al. [2021], 1000 samples each, without noise. Choosing three "winners"—MLE, TwoNN, and MADA—we have evaluated their sample efficiency and noise tolerance in comparison with our implementation of the PHD estimator. Fig. 2 shows the results: PHD is the only method tolerant to noise, and it does not degrade when data is scarce. It outperforms all other methods in the noisy setup for any sample size. The second-best method is MLE, which performs relatively well on small samples (200-500) in noisy settings and has a small variance. Below we will show that as a result, MLE is also applicable to artificial text detection, but it lags a little behind PHD on average.
We consider consistent text samples of medium size, with length  $\approx 300$  tokens; we assume that each text contains a complete thought or is devoted to a single topic. We estimate the dimension of each text sample, considering it as a separate manifold. To do this, we obtain contextualized embeddings for every token in the text by a pretrained Transfromer encoder. In our experiments, we use RoBERTa-base [Liu et al., 2019] for English and XLM-R [Goyal et al., 2021] for other languages. Each embedding is a numerical vector of a fixed length, so we view it as a point in the Euclidean space. We drop the artificial first and last tokens (<CLS> and <SEP>) and evaluate the persistent homology dimension of the resulting point cloud using the growth rate theorem (see Section 3).
Table 1: Intrinsic dimensions of English texts of different genres.
Wikipedia articles	Fiction stories (Reddit)	Question answering (Stack Exchange)
PHD	9.491 ± 1.010	9.212 ± 1.288	9.594 ± 1.29
MLE	11.827 ± 0.768	11.553 ± 1.197	12.131 ± 1.004
Intrinsic dimension (PHD) of English texts generated by different models
Figure 3: Boxplots of PHD distributions for different generative models in comparison to human-written text on Wikipedia data. Embeddings are obtained from RoBERTa-base.
Given a set of points  $S$ ,  $|S| = n$ , we first sample subsets  $S_{i} \subset S, i = 1, \dots, k$  whose sizes  $n_1, \dots, n_k$  are uniformly distributed in  $[1, n]$ . For each  $S_{i}$  we calculate its persistent score  $E_0^1(S_i)$  (just  $E(S_i)$  below); this can be done with a classical MST algorithm in linear time. Then we prepare a dataset consisting of  $k$  pairs  $D = \{(\log n_i, \log E(S_i))\}$  and apply linear regression to approximate this set by a line. Now the dimension  $d$  can be estimated as  $\frac{1}{1 - \kappa}$ , where  $\kappa$  is the slope of the fitted line.
In general, our method for PHD calculation is similar to the computational scheme proposed by Birdal et al. [2021]. But since we are dealing with sets that are much smaller and less uniformly distributed, their algorithm becomes unstable, with variance up to  $35\%$  of the value from different random seeds; moreover, if one of the subsets  $S_{i}$  slips into a local density peak and has an unusually low persistence score, the algorithm may even produce a meaningless answer (e.g., negative  $d$ ).
To overcome this issue, we add several rounds of sampling and averaging to improve the stability of calculation. We estimate the expectation  $\mathbb{E}_{s\subset S,|s| = n_i}[E(s)]$  for a given  $n_i$  instead of direct calculation of  $E(S_{i})$  for a single sample. For that, we perform the whole process of computing  $d$  several times, averaging the results. Details of our sampling schema can be found in the Appendix.