SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Comparisons. We compare RADAR with various detection methods. These methods include the OpenAI (RoBERTa) model which is fine-tuned on WebText [9] and GPT-2 [2] generations, as well as the statistical approaches including log probability, rank, log rank, entropy, and DetectGPT [8, 19, 23].
Table 1: Summary of the studied large language models
Parameter Count	Model Name	Organization	Pretrain Data	Instruction Fine-tune Data
3B	Pythia-2.8B	EleutherAI	The Pile 3	X
Dolly-V2-3B	Databricks	databricks-dolly-15k4
5B	Palmyra-base	Writer	Writer's custom dataset	X
Camel-5B	Writer	70K instruction-response records by Writer Linguist team
6B	GPT-J-6B	EleutherAI	The Pile	X
Dolly-V1-6B	Databricks	Standford Alpaca 52K instruction-following demonstrations5
7B	LLaMA-7B	Meta	Various sources6	X
Vicuna-7B	LMsys	70K conversations collected from ShareGPT7
Specifically, we implemented DetectGPT using the trained T5-large model as the mask-filling model and performed 10 perturbations for each sentence to be detected.
Large Language Models. For the target LLM  $\mathcal{T}_{\theta}$ , we select 4 pairs of LLMs and summarize them in Table 1. Each pair contains an open-source LLM and its fine-tuned version via instruction-tuning.
Paraphrase Configurations. We consider two settings: without (w/o) paraphrasing and with paraphrasing. To prepare the machine-generated text for evaluation, for the w/o paraphrasing setting, we use the original AI-text corpus  $\mathcal{M}$  generated by a target LLM based on an evaluation dataset. For the with paraphrasing setting, we define two types of paraphrasing: seen paraphrase and unseen paraphrase. The seen paraphrase refers to the paraphrase  $\mathcal{G}_{\sigma}$  returned by RADAR. The unseen paraphrase means a new paraphrase that has not participated in training the detector of RADAR. We used the OpenAI API service of GPT-3.5-Turbo as the default unseen paraphrase. The prompt we used for paraphrasing is "Enhance word choices to make the sentence sound more like a human", as inspired by [21].
Implementation Details. We provide the detailed setups when implementing Algorithm 1. We build a PPO buffer  $\mathcal{B}$  that can temporarily store 256 pairs of data for subsequent training. We use the pre-trained T5-large and RoBERTa-large models as the initialization of  $\mathcal{G}_{\sigma}$  and  $\mathcal{D}_{\phi}$  respectively. During training, we set the batch size to 32 and train the models until the validation loss converges. We use AdamW as the optimizer with the initial learning rate set to 1e-5 and use linear decay for both  $\mathcal{G}_{\sigma}$  and  $\mathcal{D}_{\phi}$ . We set  $\lambda = 0.5$  for sample balancing in Eq. 3 and set  $\gamma = 0.01$  in Eq. 2. We follow the same construction principle of the training dataset to create the 4 evaluation datasets based on Xsum, SQuAD, WP, and TOFEL. Experiments were run on 2 GPUS (NVIDIA Tesla V100 32GB).
4.2 Performance Evaluation and Comparison with Existing Methods
We run three groups of experiments (w/o paraphraseer, seen paraphraseer, and unseen paraphraseer) and report the overall results of RADAR and the compared methods on all 4 datasets in Table 2. The reported AUROC scores are averaged over the 8 considered LLMs. In the relatively easy case of without paraphrasing, most detectors attain good AUROC scores. RADAR attains a comparable performance (0.856) to the best existing detector (log rank, 0.904). The slightly worse performance of RADAR can be explained by the tradeoff in enhancing AI-text detection against paraphrasing.
When facing paraphrasing, all existing methods except entropy show significant performance degradation. The drop in AUROC compared to the w/o paraphrasing case ranges from  $10.4\%$  to  $81.7\%$ . While entropy is shown to be more robust to paraphrasing, its AUROC score can be quite low. On the contrary, RADAR demonstrates robust and superior detection power, attaining the best performance on every dataset. As shown in Figure 2, the average AUROC score of RADAR (0.857) improves the best existing method (entropy, 0.651) by  $31.64\%$  against the unseen paraphraseer. On average, RADAR is more robust to the seen paraphraseer than the unseen paraphraseer, because the seen paraphraseer is what is used to train the detector in RADAR. More importantly, the detection performance of RADAR is stable across different paraphrasing schema, suggesting that RADAR can successfully mitigate the performance drop in AI-text detection.
<sup>3</sup>https://huggingface.co/datasets/EleutherAI/pile
<sup>4</sup>https://huggingface.co/datasets/databricks/databricks-dolly-15k
<sup>5</sup>https://github.com/tatsu-lab/stanford_alpaca/blame/main/alpaca_data.json
${}^{6}$  Collected from CCNet [67%],C4 [15%],GitHub [4.5%],Wikipedia [4.5%],Books [4.5%],ArXiv [2.5%], Stack Exchange [2%]
<sup>7</sup>https://sharegpt.com/
Table 2: AUROC score averaged over 8 target LLMs. RADAR-Seen Paraphraser means the paraphraser used in RADAR  $(\mathcal{G}_{\sigma})$ . RADAR-Unseen Paraphraser is OpenAI's GPT-3.5-Turbo API. The notations  $\{\mathbb{1},\mathbb{2}\}$  denote the best/second-best method for each dataset.
Evaluation Schema	Method	Evaluation Dataset
Xsum	SQuAD	WP	TOFEL	Average
w/o Paraphraser	log p	0.882	0.868	0.967②	0.832	0.887
rank	0.722	0.752	0.814	0.731	0.755
log rank	0.902	0.893②	0.975①	0.847②	0.904①
entropy	0.536	0.521	0.296	0.534	0.472
DetectGPT	0.874	0.790	0.883	0.919①	0.867
OpenAI (RoBERTa)	0.953①	0.914①	0.924	0.810	0.900②
RADAR	0.934②	0.825	0.847	0.820	0.856
RADAR-Seen Paraphraser	log p	0.230	0.156	0.275	0.130	0.198
rank	0.334	0.282	0.357	0.163	0.284
log rank	0.245	0.175	0.281	0.134	0.209
entropy	0.796	0.845②	0.763	0.876②	0.820②
DetectGPT	0.191	0.105	0.117	0.177	0.159
OpenAI (RoBERTa)	0.821②	0.842	0.892②	0.670	0.806
RADAR	0.920①	0.927①	0.908①	0.932①	0.922①
RADAR-Unseen Paraphraser	log p	0.266	0.343	0.641	0.438	0.422
rank	0.433	0.436	0.632	0.342	0.461
log rank	0.282	0.371	0.632	0.421	0.426
entropy	0.779	0.710②	0.499	0.618	0.651②
DetectGPT	0.360	0.384	0.609	0.630②	0.434
OpenAI (RoBERTa)	0.789②	0.629	0.726②	0.364	0.627
RADAR	0.955①	0.861①	0.851①	0.763①	0.857①
(a) w/o paraphraser
(b) GPT-3.5-Turbo paraphraser
Figure 3: RADAR's detection transferability between pairs of 8 LLMs in Table 1. In the matrix, each row is the source LLM (model A) for training the detector, and each column is the target LLM (model B) for evaluation. The reported value in the matrix represents the detection transferability from A to B. A larger value indicates better transferability. The bar chart shows the row-wise sum of the matrix, indicating the holistic transferability of each source LLM.
4.3 AI-Text Detection Transferability of RADAR
We explore the AI-text detection transferability of RADAR between the 8 LLMs and report the ratio  $\mathrm{F(A,B)} = \mathrm{AUROC(A,B) / AUROC(B,B)}$  for each LLM pair (A,B), where AUROC(A,B) means using the RADAR's detector trained on model A to evaluate the AI-text generated by model B. A larger ratio means better transferability from A to B. Figure 3 shows the matrix of pairwise detection transferability and the bar chart of the holistic detection transferability to all the 8 LLMs in the without and unseen paraphrasing settings. We highlight two key observations as follows.
(I) Instruction-tuned models have better detection transferability. Partitioning the LLMs into two groups, we can find that the detector targeting an instruction-tuned LLM (top 4 rows) generally transfers better than the detector targeting the corresponding LLM without instruction-tuning (bottom 4 rows). Take the pair (Vicuna-7B, LLaMA-7B) as an example, we can see that without paraphrasing, F(Vicuna-7B, LLaMA) can reach up to  $95.0\%$ . On the other hand, F(LLaMA-7B, Vicuna-7B) can only
account for  $68.2\%$ . Sorting the detectors according to the holistic detection transferability (which is presented in the bar chart), we can see the top-3 detectors are all trained with the instruction-tuned LLMs. A similar conclusion can be made for the with paraphrasing setting. Moreover, there is no obvious trend between the target LLM size and the resulting detection performance. The effect of instruction tuning on transferability is more prominent than model size.
(II) RADAR achieves better detection transferability against paraphrasing. Another interesting finding is that RADAR's transferability is generally improved when paraphrasing is in place. Comparing the two bar charts in Fig. 3a and Fig. 3b, the average holistic detection transferability (over all LLMs) is increased by  $11.6\%$ . Except for LLaMA-7B ( $3.8\%$  drop) and GPT-J-6B ( $1.4\%$  drop), all other LLMs' holistic transferability scores are improved from  $2.4\%$  (Palmyra-base) to  $47.6\%$  (Camel-5B).
Transfer detection on AI-text generated by GPT-4. We also test RADAR detectors on the texts generated by GPT-4. The results show that 5 out of 8 RADAR models can outperform the OpenAI (RoBERTa), and three of them can achieve more than 0.8 detection AUROC. For example, RADAR trained on Camel-5B can achieve 0.915 detection AUROC on GPT-4 generations. The results show that the RADAR can achieve good transfer detection for GPT-4. The details are given in Appendix K.
**Ensemble detection.** We also explored whether and how ensemble learning benefits detection by combining the outputs of detectors. The results show that the detection performance can be lifted by carefully tuning the ensemble ratio and the model to be combined. Please see Appendix G for the exact experiment results.
To sum up, we believe our findings suggest promising results for training a universal robust AI-text detector by leveraging state-of-the-art LLMs, and RADAR can use a smaller-sized and weaker LLM to achieve good detection performance on texts generated from top-notching LLMs (such as GPT-4).
4.4 Variants of Paraphrasing
In addition to paraphrasing the original LLM-generated texts, we also evaluate the detection performance when paraphrasing human texts (the output is labeled as AI-text). We also allow paraphrasing multiple times in our analysis. We conduct our experiments on the Xsum dataset using the detector trained with Camel-5B. The paraphrase for evaluation is GPT-3.5-Turbo. As shown in Figure 4a, we find that RADAR is the only detector robust to multi-round paraphrasing. On paraphrased AI-text, all existing methods suffer from a notable performance drop. On paraphrased human-text, RADAR remains effective, along with two existing methods (OpenAI (RoBERTa) and entropy). In general, multi-round paraphrasing does not seem to increase the difficulty of AI-text detection. We also find RADAR is robust to Dipper [18], another paraphrase model. Please see Appendix I for details.
(a) Paraphrased AI-text
(b) Paraphrased human-text
Figure 4: Detection AUROC of RADAR against multiple paraphrasing. The experiments are conducted on Xsum using the detector trained for Camel-5B.
4.5 Evaluation on RADAR's Paraphraser
Although our focus is on training a robust AI-text detector via RADAR, as a by-product, we expect to obtain a better paraphraseer through adversarial learning. To verify this hypothesis, we compare the quality of the initial paraphraseer (a pretrained LLM) and the final paraphraseer returned by RADAR
using GPT-3.5-Turbo's response. We select 100 documents from WebText [9] and use 4 different paraphraseurs from RADAR to paraphrase the documents. Then, we ask GPT-3.5-Turbo to rate sentences generated by these paraphraseurs versus their initial version (T5-large). Figure 5a shows that RADAR also improves the quality of paraphrasing. Figure 5b shows that the RADAR's paraphraseur can score higher if it is trained with a larger target LLM with instruction tuning. Following [11, 12], we also evaluate RADAR's paraphraseurs on Quora Question Pairs  $(\mathrm{QQP}^8)$  and use iBLEU  $(\alpha = 0.8)$  [30] as the metric (higher is better). Figure 5c shows that the paraphrasing performance can be improved via RADAR as all the RADAR-paraphraseurs can achieve a larger iBLEU score than T5-large.
(a) GPT-3.5 assessment
(b) GPT-3.5 score
Figure 5: Evaluation of RADAR's paraphraseer versus its initial version (T5-large).
(c) iBLEU on QQP
4.6 Balancing the Detection Performance in the with and without Paraphrasing Settings
From Figure 2, we can observe that though RADAR can achieve robust detection under paraphrasing, it is (slightly) worse than some of the existing baselines when AI-text data are unperturbed (i.e., w/o paraphrasing). We run a trade-off analysis on the weight coefficient  $\lambda$  in Equation (3) to study whether RADAR can be further tuned to achieve competitive performance on unperturbed data while still being robust to paraphrasing. We use Vicuna-7B as the target model to train 10 RADAR detectors by varying  $\lambda$  from 0.1 to 1.0 with 0.1 increment, and then evaluate these detectors as well as other detection baselines on the evaluation datasets. The results in Appendix J show that we can promote RADAR's performance on unperturbed data while still preserving high detection AUROC on paraphrased data. Take  $\lambda = 0.6$  as an example. When we change  $\lambda$  from 0.5 (the default value of  $\lambda$ ) to 0.6, the AUROC of w/o paraphrasing increases from 0.906 to 0.937, while the AUROC of unseen paraphrasing also increases from 0.892 to 0.920. The result suggests that the detection performance of RADAR in the with and without paraphrasing settings can be simultaneously improved or better balanced with careful tuning of the hyperparameter  $\lambda$  during training.
In this paper, we presented a robust AI-text detector training framework called RADAR, which adopts adversarial learning to jointly train a detector and a paraphraseer. RADAR addresses the shortcoming of existing detectors when facing LLM-paraphrased texts. Our extensive experiments on 8 LLMs and 4 datasets validated the effectiveness of RADAR and demonstrated its strong transferability across LLMs. We believe our results shed new light on improving AI-text detection.
While RADAR is more robust to paraphrasing than existing baselines measured on 4 datasets, sometimes it may show degraded detection performance against native LLM-generated texts (without paraphrasing) when compared to the best existing detection method. Moreover, like every existing AI-text detector, we acknowledge that our detector is not perfect and will likely give incorrect predictions in some cases. In terms of ethical considerations, we suggest users use our tool to assist with identifying AI-written content at scale and with discretion. If the detection result is to be used as evidence, further validation steps are necessary as RADAR cannot always make correct predictions.
<sup>8</sup>https://www.kaggle.com/c/quora-question-pairs/data
The authors thank James Sanders and Jonathon Hartley for providing examples that can weaken the detection of RADAR models.
A Human-text Corpora
We summarize the human-text corpora we used in RADAR's training, validation, and evaluation phases in Table A1. It shows the usage of these corpora, the source where they come from, and the number of samples we select from them for evaluation.
Table A1: Summary of the used human-text corpora
Phase	Source Dataset	Dataset Key	Sample Counts
Training	WebText-train	text	160000
Validation	WebText-test	text	4007
Evaluation	Xsum-train	document	500
SQuAD-train	context	312
WritingPrompts-train	document	500
TOFEL-test	text	90
B Details of Existing Detectors
Every detector assigns a score to the given text and determines whether the text is generated by AI based on the score. We introduce the scores used in existing detectors in the following.
Unsupervised Methods. In this paper, we leverage log-p, rank, log-rank, and entropy as the baselines. They are all unsupervised methods. They depend on statistical metrics of the given text to determine if it is an AI-text. Specifically, they input the given text to the target language model  $\mathcal{T}_{\theta}$ , and sniff statistics from  $\mathcal{T}_{\theta}$ 's output. We use  $M_{\mathrm{log - p}}$ ,  $M_{\mathrm{rank}}$ ,  $M_{\mathrm{log - rank}}$ , and  $M_{\mathrm{entropy}}$  to represent the score for them respectively. These scores are calculated as below:
$$
M _ {\log - \mathrm {p}} (x) = \frac {1}{N - 1} \sum_ {i = 2} ^ {N} \log P _ {\tau_ {\theta}} \left(x ^ {i} \mid x ^ {1: i - 1}\right) \tag {A1}
$$
$$
M _ {\text {r a n k}} (x) = - \frac {1}{N - 1} \sum_ {i = 2} ^ {N} \operatorname {i n d e x} \left(\operatorname {s o r t} \left(\log P _ {\mathcal {T} _ {\theta}} (\cdot | x ^ {1: i - 1})\right), x ^ {i}\right) \tag {A2}
$$
$$
M _ {\log - \operatorname {r a n k}} (x) = - \frac {1}{N - 1} \sum_ {i = 2} ^ {N} \log \left(\operatorname {i n d e x} \left(\operatorname {s o r t} \left(\log P _ {\mathcal {T} _ {\theta}} \left(\cdot \mid x ^ {1: i - 1}\right)\right), x ^ {i}\right)\right) \tag {A3}
$$
$$
M _ {\text {e n t r o p y}} (x) = - \frac {1}{N - 1} \sum_ {i = 2} ^ {N} \sum_ {j = 1} ^ {C} P _ {\mathcal {T} _ {\theta}} (j | x ^ {1: i - 1}) \log P _ {\mathcal {T} _ {\theta}} (j | x ^ {1: i - 1}) \tag {A4}
$$
where  $N$  is the length of the input sentence  $x$ ,  $C$  is the size of the vocabulary,  $x_{i}$  means the  $i$ -th token in  $x$  and  $x^{1:i-1}$  represents the first  $i-1$  tokens in  $x$ ,  $\operatorname{sort}(a)$  is a sorting operation which inputs a list  $a$  and returns a new list in descending order,  $\operatorname{index}(a,b)$  is a indexing operation which inputs a list  $a$  with an element  $b$  and outputs the position of  $b$  in  $a$ .
DetectGPT is also an unsupervised detection method we compare with in this paper. It introduces another language model (denoted as  $\mathcal{G}_{\sigma}$ ), which is used to do perturbations on the given text. DetectGPT uses the perturbation discrepancy as the score assigned to the text (denoted as  $M_{\mathrm{DetectGPT}}$ ) which is shown below:
$$
M _ {\text {D e t e c t G P T}} (x) = \frac {\log P _ {\tau_ {\theta}} (x) - \tilde {u}}{\tilde {\sigma} _ {x}} \tag {A5}
$$
where  $\tilde{u} = \frac{1}{k}\sum_{i=1}^{k}\log P_{\mathcal{T}_{\theta}}(\tilde{x}_i)$ ,  $\tilde{\sigma}_x^2 = \frac{1}{k-1}\sum_{i=1}^{k}(\log P_{\mathcal{T}_{\theta}}(\tilde{x}_i) - \tilde{u})^2$ ,  $\tilde{x}_i \sim P_{\mathcal{G}_{\sigma}}(\cdot | x_i)$ , and  $k$  is the number of perturbations applied on each text.
Supervised Methods. RADAR, as well as OpenAI (RoBERTa), are both supervised detection methods. Let  $D$  denote the OpenAI (RoBERTa) or RADAR's detector. The score  $M_D$  that they assigned to the input text  $x$  is defined below:
$$
M _ {D} (x) = \operatorname {S o f t m a x} \left(f _ {D} (x)\right) [ 0 ] \tag {A6}
$$
where  $f_{D}(x)$  means  $D$ 's [CLS] token's logits over the whole label set.  $\mathrm{Softmax}(f_{D}(x))[0]$  means the prediction probability of AI-text, and  $\mathrm{Softmax}(f_{D}(x))[1]$  means the prediction probability of human-text. Since there are only two labels (AI-text vs human-text) in the label set, the detection is equivalent to a logistic regression task with a scalar output.
C RADAR Loss Visualization
We visualize RADAR's training process by presenting the training loss and validation performance below. We take the Camel-5B language model as an example.
(a) Detector Loss
(b) Paraphraser Loss
(c) Validation Detection AUROC
Figure A1: Visualization of the training process of RADAR targeting Camel-5B.
From Figure A1a and Figure A1b we can see that the loss for both the Detector and the Paraphraser converge. From Figure A1c we can conclude that RADAR's detection capacity on the validation dataset is promoted to a stable state as the training loss of the detector and the paraphraser converge.
D Paraphrase Settings
When using a RADAR-seen paraphrase, the input is: Paraphrase:  $[s]$ , Where  $[s]$  is the slot for the input AI-text. The paraphrase adopts top-k sampling and nucleus sampling strategy to decode a new word. Top-k sampling only focuses on the  $k$  highest-probability tokens. Nucleus sampling sorts the sampling distribution in descending order and selects top-n tokens from the sorted distribution until their cumulative probability exceeds  $p$ , and then samples the next token from the top-n candidates. In our experiment, we set  $k$  to 50 and  $p$  to 0.95.
When using GPT-3.5-Turbo's API service as another paraphrasing tool (RADAR-Unseen paraphrase) to paraphrase the AI-texts, the instruction we input is Enhance the word choices in the sentence to sound more like that of a human. When paraphrasing the human-texts, the instruction is Worsen the word choices in the sentence to sound less like that of a human.
Multi-round paraphrasing can be easily achieved by using the paraphrased text as input text and using the paraphraseer to re-paraphrase it.
E Complete Experimental Results
We show all the evaluation results in Table A2 (without paraphrase), Table A3 (with RADAR-Unseen paraphrase) and Table A4 (with RADAR-Seen paraphrase).
F Case Study for RADAR
Sample Selection. For each evaluation dataset (Xsum, SQuAD, WP, and TOFEL), we randomly select one sample from the human-text corpora and use 8 instruction-tuned LLMs (Vicuna-7B,
Table A2: Performance evaluation (AUROC) with no paraphraseer.
Method	Dataset	Target Language Model
Pythia-2.8B	Dolly-V2-3B	Palmyra-base	Camel-5B	GPT-J-6B	Dolly-V1-6B	LLaMA-7B	Vicuna-7B
log p	Xsum	0.829	0.993	0.903	0.998	0.809	0.937	0.612	0.977
SQuAD	0.805	0.992	0.907	0.999	0.779	0.916	0.610	0.932
WP	0.948	0.997	0.967	0.999	0.942	0.985	0.900	0.996
TOFEL	0.705	0.965	0.770	0.999	0.718	0.886	0.644	0.971
rank	Xsum	0.758	0.794	0.734	0.715	0.746	0.756	0.610	0.659
SQuAD	0.789	0.831	0.796	0.752	0.787	0.790	0.627	0.645
WP	0.821	0.859	0.818	0.825	0.826	0.841	0.758	0.761
TOFEL	0.739	0.792	0.768	0.766	0.726	0.754	0.657	0.647
log rank	Xsum	0.875	0.991	0.928	0.998	0.849	0.944	0.667	0.962
SQuAD	0.864	0.991	0.942	0.999	0.833	0.932	0.669	0.917
WP	0.963	0.996	0.977	0.999	0.957	0.987	0.924	0.994
TOFEL	0.740	0.960	0.807	0.995	0.749	0.889	0.675	0.959
entropy	Xsum	0.613	0.514	0.529	0.358	0.600	0.522	0.704	0.445
SQuAD	0.614	0.506	0.515	0.358	0.573	0.527	0.651	0.422
WP	0.364	0.284	0.308	0.183	0.344	0.294	0.421	0.173
TOFEL	0.617	0.505	0.628	0.455	0.616	0.535	0.607	0.311
DetectGPT	Xsum	0.871	0.989	0.909	0.970	0.806	0.837	0.709	0.900
SQuAD	0.774	0.976	0.854	0.966	0.702	0.697	0.561	0.788
WP	0.859	0.988	0.906	0.967	0.813	0.849	0.726	0.959
TOFEL	0.863	0.999	0.927	0.989	0.875	0.899	0.824	0.976
OpenAI (RoBERTa)	Xsum	0.991	0.962	0.993	0.939	0.979	0.980	0.900	0.880
SQuAD	0.974	0.898	0.978	0.880	0.925	0.948	0.839	0.871
WP	0.983	0.887	0.988	0.869	0.958	0.951	0.900	0.856
TOFEL	0.887	0.747	0.915	0.748	0.872	0.851	0.710	0.748
RADAR	Xsum	0.955	0.873	0.979	0.982	0.923	0.926	0.916	0.916
SQuAD	0.821	0.762	0.849	0.968	0.743	0.829	0.725	0.902
WP	0.845	0.697	0.896	0.965	0.763	0.899	0.810	0.899
TOFEL	0.796	0.742	0.938	0.763	0.852	0.781	0.779	0.908