Venue: NAACL 2022

# Cross-Domain Detection of GPT-2-Generated Technical Text

Juan Diego Rodriguez\({}^{1}\) Todd Hay\({}^{2}\) David Gros\({}^{3}\)

Zain Shamsi\({}^{1}\) Ravi Srinivasan\({}^{1}\)

\({}^{1}\)Applied Research Laboratories, The University of Texas at Austin \({}^{2}\)En Solucion \({}^{3}\)University of California, Davis {juand-r, zain.shamsi, ravi.srinivasan}@utexas.edu

todd.hay@ensolucion.com

###### Abstract

Machine-generated text presents a potential threat not only to the public sphere, but also to the scientific enterprise, whereby genuine research is undermined by convincing, synthetic text. In this paper we examine the problem of detecting GPT-2-generated technical research text. We first consider the realistic scenario where the defender does not have full information about the adversary's text generation pipeline, but is able to label small amounts of in-domain genuine and synthetic text in order to adapt to the target distribution. Even in the extreme scenario of adapting a physics-domain detector to a biomedical detector, we find that only a few hundred labels are sufficient for good performance. Finally, we show that paragraph-level detectors can be used to detect the tampering of full-length documents under a variety of threat models.

+
Footnote †: July 10-15, 2022 ©2022 Association for Computational Linguistics

## 1 Introduction

Recent advances in techniques for generating realistic synthetic content (i.e., deepfakes) pose a diverse set of problems with significant societal consequences Kreps et al. (2020); Bommassani et al. (2021); McGuffie and Newhouse (2020). The advent of large language models for text generation Radford et al. (2019); Brown et al. (2020) have made it easier than ever to create convincing synthetic1 text Solaiman et al. (2019). While much attention has been focused on the role of synthetic audio and video, it can be argued that synthetic text may give rise to some of the most serious threats to information integrity and the long-term preservation of archival knowledge Aliman and Kester (2021).

Footnote 1: Some authors use the term _fake text_; however, we prefer _synthetic_, since human-written text can contain false information, while machine-generated text can sometimes be factually correct Schuster et al. (2020); Belz (2019).

While there are currently no documented cases of published papers containing text from neural language models, non-neural machine-generated papers have already been published in peer-reviewed journals Cabanac and Labbe (2021). With more convincing text generation techniques and a growing number of publications, this is a problem that could get much worse, particularly for non-peer-reviewed technical text Ranade et al. (2021). In addition to hindering the scientific process, synthetic technical texts could be used to manipulate public opinion and sow discord around specific scientific topics Aliman and Kester (2021). Other consequences of machine-generated technical text include the contamination of NLP pipelines Ranade et al. (2021) and poisoning of language models Schuster et al. (2021).

The rise of realistic machine-generated text - and

Figure 1: Machine-generated text enables the corruption of technical knowledge (e.g., biomedical research). One of the above abstracts was generated by GPT-2. More examples of generated text can be found in §A.7.



its possible misuse - has spurred the development of automated tools to distinguish between genuine and synthetic English text.2 However, most work to date has focused on web text or news, rather than on domain-specific technical text Solaiman et al. (2019); Zellers et al. (2019). While synthetic technical text is likely to be distinguished by subject matter experts (SMEs), it is difficult for non-domain evaluators to do so. Therefore, given the ease at which large amounts of synthetic text can be generated, automated countermeasures are necessary in order to alleviate the burden on SMEs.

Footnote 2: Most work on the detection of GPT-2-generated text has focused on English. However, Harrag et al. (2020) examines automated detection of synthetic tweets in Arabic.

We focus on developing capabilities for detecting generated technical English text and delineating the contexts in which these detection approaches can be applied.3 We assume an adversary generating technical text using GPT-2 Radford et al. (2019), but do not know apriori in exactly which technical area. Realistically, some domain shift will be inevitable, which leads us to investigate whether detectors can be applied across domains, e.g., can a detector of generated physics papers be adapted to also detect biomedical text? In addition, most work to date has focused on detecting short pieces of text. We show that automated detection of tampered full-length research papers is possible under various threat models. Our work makes two main contributions:

Footnote 3: Our code is available at [https://github.com/cids-ut/cross-domain-detection-qpt-2](https://github.com/cids-ut/cross-domain-detection-qpt-2)

* We show that accurate cross-domain detection of generated technical text is possible using a small number of in-domain samples and quantify the amount of SME effort required.
* We study the detectability of tampered full-text technical papers (where a subset of paragraphs have been replaced with generated text) under various scenarios.

## 2 Related Work

Automated detection of synthetic textAutomated approaches to detecting machine-generated text have included energy-based models Bakhtin et al. (2019), repurposing the generator as a discriminator Zellers et al. (2019), and various neural and non-neural classifiers Solaiman et al. (2019); Ippolito et al. (2020); Uchendu et al. (2020); Zhong et al. (2020); Frohling and Zubiaga (2021); Fagni et al. (2021). Most work on automated detection targeted GPT-2-generated text, although Bakhtin et al. (2019), Uchendu et al. (2020), Fagni et al. (2021) and Stiff and Johansson (2021) also experimented with other generators. Finally, there is a growing body of work on the adversarial robustness of automated detectors of synthetic text Wolff (2020); Bhat and Parthasarathy (2020); Stiff and Johansson (2021); Crothers et al. (2022). A survey on the automatic detection of synthetic text can be found in Jawahar et al. (2020).

Prior work closest to our study are Solaiman et al. (2019), Ippolito et al. (2020), Munir et al. (2021), Bakhtin et al. (2019) and Stiff and Johansson (2021), which look at cross-domain settings where the distribution of synthetic text used to train a detector differs from the target distribution. The shift could be due to different model architectures Bakhtin et al. (2019); Stiff and Johansson (2021), different model sizes Solaiman et al. (2019), different decoding strategies Solaiman et al. (2019); Ippolito et al. (2020), or different fine-tuning datasets Bakhtin et al. (2019); Munir et al. (2021); Stiff and Johansson (2021). Bakhtin et al. (2019) show that energy-based models generalize poorly across corpora Wikipedia, news and books), but that training on the union of the source and target domains is effective. Munir et al. (2021) show that XLNet can accurately attribute synthetic text even when the GPT-2-generated portions of the training and test sets come from GPT-2 fine-tuned on different subreddits.

Unlike the previous papers, we evaluate our detectors on technical (biomedical) text, and vary the number of labeled samples available for training in the target domain, under the assumption that source labels are plentiful but target examples are more expensive to obtain (i.e., source samples can be generated at will, but target examples need to be discovered and verified by a human since the adversary's target text generator is generally unavailable). In addition, we evaluate the detection of full-length tampered documents consisting of a mix of real and machine-generated content.

Attribution for synthetic textIn addition to distinguishing between real and generated text, one may also wish to determine _which_ system generated a given text (e.g., model type, size, decoding strategy). Variations of this "authorship attribution" problem have been explored by Uchendu et al. (2020), Tay et al. (2020) and Munir et al. (2021).

 

These works have found that, in general, while the attribution problem is harder than the detection problem, details of the text generator can often be learned from the generated text.

Human detection of synthetic textHuman evaluations on the detection of generated text have been conducted for news Zellers et al. (2019); Brown et al. (2020); Kreps et al. (2020); Clark et al. (2021), product reviews Hovy (2016); Yao et al. (2017); Adelani et al. (2020), web text Gehrmann et al. (2019); Ippolito et al. (2020), stories Clark et al. (2021); Donahue et al. (2020); Clark et al. (2021); Gunser et al. (2021), peer reviews Bartoli and Medvet (2020), cybersecurity text Ranade et al. (2021) and submissions to federal public comment websites Weiss (2019). These studies have shown that it is difficult for people to distinguish between real and neural-generated text. gehrmann2019learning developed a tool, GLTR, to help users visualize statistical artifacts in generated text.

## 3 Threat model and defender capabilities

### Threat Model

Given that people have trouble distinguishing real (human-written) from GPT-2-generated text Zellers et al. (2019); Kreps et al. (2020); Clark et al. (2021), we study the detection of generated text under the threat model where an adversary generates text from GPT-2 domain-tuned4 on domain-specific text. We do not necessarily assume that text from this domain is publicly available in significant quantities. Throughout, we shall refer to those developing the generated text as the _adversary_, and those building automated detectors of synthetic text as the _defender_. As there does not (yet) exist a "real-world" dataset of GPT-2 generated technical text, we simulate both the adversary and the defender.5

Footnote 4: Following Han and Eisenstein (2019), we use _domain-tuning_ to refer to further self-supervised training of a model on unlabeled text in a specific domain, and _task-tuning_ to refer to supervised fine-tuning of a model for a given labeling task.

Footnote 5: More recently, a corpus of GPT-2 generated (NLP-related) abstracts has been created for testing detection methods Liyanage et al. (2022).

We study two scenarios: where the adversary generates single technical abstracts (SS4.1), and where the adversary replaces randomly selected paragraphs in full-length documents with GPT-2-generated paragraphs (SS4.2). Other threat models are possible, such as replacing single words, sentences or phrases Schuster et al. (2020); Donahue et al. (2020); Bhat and Parthasarathy (2020), and should be studied in future work.

### Defender Capabilities

In general, the defender has little or no information about the adversary's text generation pipeline, including the data used for training, the model architecture used, or the decoding strategy employed. We assume the defender has access to a small number of examples from the adversary, which can be labeled by a subject matter expert (SME) as real (human) or synthetic (generated).6 In addition, since the defender does not have access to the adversary's _target generator_, they can build a _proxy generator_, trained on _proxy_ text, in order to obtain

Figure 2: Experimental setup for detecting synthetic text used in this paper. Since the defender does not have access to the adversary’s text generator, they develop a _proxy_ generator, in order to mimic the adversary’s generator as closely as possible. Proxy and target corpora will generally come from different domains.

 

more samples of real and synthetic text which are (hopefully) statistically similar to the ones obtained from the adversary7, as shown in Figure 2. The defender can then train a model to detect generated text using both the in-domain SME-labeled text and the (possibly) out-of-domain proxy text, as described in more detail in SS4. The level of access the defender is assumed to have to various parts of the adversary generation pipeline is shown in Table 1.

Footnote 6: [https://github.com/facebook/sommer_dataset](https://github.com/facebook/sommer_dataset)

Footnote 8: [http://www.cs.ucsd.edu/~david/](http://www.cs.ucsd.edu/~david/)

Footnote 9: [https://github.com/facebook/sommer_dataset](https://github.com/facebook/sommer_dataset)

Since the effect of differing model sizes has already been explored [35; 30], we assume the adversary and defender use the same sized model (GPT-2 Medium, with 355M parameters), but domain-tuned on different datasets. Since the defender cannot guess the temperature value used by the target generator, we shall decode using a temperature value of 1.0 for the target generator, but 0.8 for the proxy generator.10 We also assume both adversary and defender use nucleus sampling [15]. The defender would not know whether the generator is using nucleus sampling. However, it was shown in [12, 12] that a discriminator trained with nucleus sampling is able perform nearly as well at detecting text generated with top-k [30] sampling as with nucleus sampling, while a discriminator trained using top-k sampling fails to detect generations from nucleus sampling11. Hence this is a reasonable assumption to make.

Footnote 10: Indeed, viewing the accuracy scores in Table 2 of [12] as the payoff to the defender in a zero-sum game, nucleus sampling is the minimax strategy for both defender and generator.

Our experiments will investigate the effects of domain shift between the proxy and target data, as well as the number of SME-labeled examples available to the defender. While the assumption that both adversary and defender share the same model architecture may seem like a strong one, we fix the architecture so as to focus on the effect of domain shift, and note that previous works have already studied the effect of using different architectures [2, 12], model sizes [30], and decoding strategies [12, 12].

## 4 Automated Detection

### Detecting Generated Abstracts

While the defender could train a detector on the union of SME-labeled (target) and proxy data as done in [35], we instead follow a pipelined approach by first task-tuning on the proxy real and synthetic text to produce a proxy detector, before task-tuning a second time on the SME-labeled text. One advantage of this approach is that one would still have a detector even when SME labels are not available. In addition, previous studies have shown that task-tuning twice can yield good performance on a variety of tasks and can help mitigate the effects of domain shift [22, 30].

Preliminary experiments on in-domain detection showed that fine-tuning RoBERTa consistently outperformed other classifiers (LSTMs, HAN, BERT and XLNet), as shown in Appendix SSA.2, and so we exclusively use RoBERTa in all of our experiments. This is in line with results in [30, 30, 31], which showed the effectiveness of RoBERTa for detecting GPT-2-generated text. In order to investigate the benefit of further pretraining [22], we also domain-tune RoBERTa on technical text from various science, technology, engineering, and mathematics (STEM) fields, as described in SS5.1.2; we call the resulting model _RoBERTa-large-STEM_. Our experiments will vary both the number of proxy and SME-labeled abstracts, as well as the subject domain of proxy text, as detailed in SS5.1.

### Detecting Tampered Documents

We also investigate how well our detection methods work when applied at the document level, assuming the following attacker model: a fraction of randomly-selected paragraphs in a document are replaced by generated paragraphs (see SS5.2.1 for details). Each generated paragraph is conditioned

\begin{table}
\begin{tabular}{l|c} \hline \multicolumn{1}{l}{**Defender’s access level**} \\ \hline Adversary’s (target) generator model & None \\ Labeled samples from adversary domain & Limited (SME) \\ Real samples from proxy domain & Plentiful \\ Synthetic samples from proxy domain & Unlimited \\ \hline \end{tabular}
\end{table}
Table 1: Assumptions about the defender’s access to data or models that can be used in a detection pipeline. We assume a SME is able to label a small (random) sample consisting of real and adversary-generated text.

 

on the previous paragraph (i.e., the previous paragraph is used as a prompt). Conditioning helps the text stay on-topic, and would likely help evade coherence-based detectors10Singla et al. (2021). We refer to the modified documents as _tampered_ rather than generated, since only a subset of the document might be generated.

Footnote 10: Such detectors would use paragraphs in context, rather than independently, and should be considered in future work.

On the detection side, we train paragraph-level detectors, and then aggregate paragraph scores into document scores to classify documents. We need to specify both the question we would like to answer, as well as how to aggregate the detectors' paragraph scores \(\{s_{i}\}\) to answer it. Here we interpret \(s_{i}\) as the probability that a paragraph has been generated. The general question "has this document been tampered with?" leads to two more specific questions and associated scoring strategies:

* **(S1)** Is at least one paragraph in the document generated? The probability that a document with paragraph scores \(\{s_{i}\}\) has at least one synthetic paragraph is then given by: \[P=1-\prod(1-s_{i})\]
* **(S2)** What fraction of a document is generated? For a document with \(N\) paragraphs, this is: \[F=\frac{1}{N}\sum\mathbbm{1}_{s_{i}>0.5}\] As we will see, one drawback of scoring with (S1) is that it is extremely sensitive to false positives. Entirely human-written documents have a high chance of having one or two false positives (especially among short paragraphs), even if the other paragraphs are correctly classified. In these cases the human documents will be classified as tampered. Since the false positive rate is highest for short paragraphs11, we can filter out very short paragraphs from each document before scoring. We thus also experiment with the following score: Footnote 11: The effect of paragraph length on the false positive rate is shown in Figure 7 in Appendix §A.4. Similar results can also be found in Ippolito et al. (2020); Munir et al. (2021).

* **(S1-T)** Is at least one paragraph \(p_{i}\) longer than a given threshold \(T\) synthetic? The probability that this is the case is: \[P=1-\prod(1-s_{i}\cdot\mathbbm{1}_{\text{len}(p_{i})>T})\] For each document we can use thresholds for \(P\) or \(F\) to decide how to classify the document; in addition, we shall use (S2) to rank documents by how much generated content they contain.

## 5 Datasets

Here we describe the datasets used and other experimental details when simulating the adversary and defender's pipelines (Figure 2). The experiments on synthetic abstract detection are described in SS5.1; experiments on tampered document detection are described in SS5.2.

### Real and Synthetic Abstracts

Table 2 summarizes the datasets used. The adversary has access to the Semantic Scholar Open Research Corpus12Armar et al. (2018), while the defender has access so several subsets of CORE Knoth and Zdrahal (2012), as well as small amount of text labeled by a SME. We chose abstracts from CORE related to biomedicine and physics, since these subjects had the largest number of abstracts for fine-tuning models (shown in SSA.6, Table 10).

Footnote 12: These abstracts are mostly, but not entirely, biomedical Beltagy et al. (2019).

#### 5.1.1 Test Data

We first discuss the construction of datasets used to evaluate the detection of GPT-2-generated abstracts. The test set consists of 1000 real and 1000 synthetic abstracts, generated using GPT-2 dominanted on abstracts from the January 2019 version of the Semantic Scholar Open Research Corpus Ammar et al. (2018)13, hereafter referred to as

\begin{table}
\begin{tabular}{l|c} \hline \multicolumn{2}{l}{**Synthetic abstract detection**} \\ \cline{2-3}
**Corpus** & **Purpose** \\ \hline _Semantic Scholar_ & • Real portion of the test set \\ (Biomed+CS) & • Domain-tune adversary’s generator \\ • Task-tune detector on real (“SME-labeled”) samples from adversary domaina \\ \hline _CORE_ & • Domain-tune proxy generator \\ (Biomed, Physics, Biomed+Physics) & • Task-tune detector on proxy data \\ \hline _CORE (STEM)_: & • Domain-tune RoBERTa on STEM \\ (all subjects listed in §A.6) & text (“RoBERTa-large-STEM”) \\ \hline \end{tabular}
\end{table}
Table 2: List of datasets and how each was used for the cross-domain synthetic abstract detection experiments. The Semantic Scholar Open Research Corpus is used for the adversary’s generation pipeline, while subsets of CORE are used for the defender’s pipeline.

 

Semantic Scholar.14 Text was generated using nucleus sampling, with \(p\) sampled uniformly between 0.9 and 1.0, since [26] showed detection was hardest with \(p\) in that range.

Footnote 13: [https://github.com/allenai/s2orc](https://github.com/allenai/s2orc).

#### 5.1.2 Training Data

Here we describe the SME-labeled abstracts (in-domain) and proxy (possibly out-of-domain) data used to train detectors of GPT-2 generated abstracts.

SME-labeled dataNested subsets of another 10k abstracts (of sizes {100, 500, 1000, 1k, 10k}), obtained in the same way as the test set, were used as "SME-labeled" (in-domain) data for training.

Proxy dataOut-of-domain abstracts were sampled from the CORE dataset of open access research papers [7], version 2018-03-0115. CORE covers a wide variety of subjects, some of which can be identified from each paper's data provider. We used a subset of CORE related to STEM fields16, and filtered out non-English abstracts using the Python package _langdetect_. This subset of CORE was also used to domain-tune RoBERTa-large on STEM abstracts, resulting in _RoBERTa-large-STEM_.

Footnote 15: Available at [https://core.ac.uk/services/dataset/](https://core.ac.uk/services/dataset/)

Footnote 16: The list of open access data providers for each STEM subject is provided in Table 10 in Appendix §A.6.

We trained proxy generators using the biomedical and physics portions of CORE (237,620 abstracts for each), and on the union of the biomedical and physics portions ("biomedical-physics", with 475,240 abstracts). For each of these three generators, we created nested subsets (of sizes {100, 500, 1000, 1k, 10k, 100k}) of proxy training data. As with the SME-labeled data, half of the samples were real and half were generated17. In the case of biomedical-physics, we used equal numbers of real biomedical and real physics text. We estimate that roughly half of the biomedical-physics generations were biomedical. Examples of generated physics and biomedical abstracts can be found in Appendix SSA.7.

Footnote 17: In the absence of additional information, it seems reasonable to assume an uninformative prior wherein the classes are balanced. In practice, one could base this prior on the empirical distribution over classes in the SME-labeled data, which approximates the distribution of real and generated samples in the corpus under consideration.

### Real and Tamepered Documents

While the CORE corpus includes full-length documents, they have not been pre-processed and are rather noisy. Fortunately, the S2ORC corpus [11] includes millions of pre-processed scientific documents. The full-length papers in S2ORC have been preprocessed with paragraph splitting; in addition, captions, tables, headers, footers, footnotes, abstracts and bibliography have been removed from the main text.

We sampled from the 6.8 million papers in S2ORC which are biomedical19 to create disjoint datasets for domain-tuning proxy and target GPT-2 generators, for task-tuning RoBERTa-based detectors, and for test sets. Since our attacker model consists of random paragraph replacement, we dominanted GPT-2 on 890,000 biomedical paragraphs in order to generate new paragraphs conditioned on previous paragraphs.20 This is done twice, on non-overlapping data, to obtain two separate generators: the target generator is used to create the test document collections and SME-labeled training paragraph collections, while the proxy generator is used to create proxy training data. The details of each of these datasets are given below.

Footnote 19: We selected all papers with a Microsoft Academic Graph field of study which included Biology or Medicine, or which had a PubMed or PMC ID tag (these are biomedical in a broad sense: the 15% of papers that were not tagged with Biology or Medicine were on the related fields of Chemistry, Psychology, Physics, Math or Computer Science applied to biomedicine.)

Footnote 20: Details on the fine-tuning of GPT-2 are in Appendix §A.1.1.

#### 5.2.1 Test Data

In order to evaluate our detectors against various document tampering scenarios, we use several document-level datasets, which differ by the number of generated (replaced) paragraphs in each document. Each of these test sets consists of 500 human documents and 500 tampered (generated/modified) documents.21 The five test sets containing tampered documents are given as follows: _test-1-fake_ contains only tampered documents with exactly one synthetic paragraph, _text-x_ replaces every paragraph with a generated paragraph with probability \(x\), for \(x\) in {0.1, 0.5, 0.9}, and _test-all-fake_ has all paragraphs generated, with each subsequent paragraph generated conditional on the previously generated paragraph. Two examples can be found in Appendix SSA.7, Table 13.

 



#### 5.2.2 Training Data

Here we describe the datasets used to build paragraph-level detectors.

SME-labeled dataNested subsets of 10,000 paragraphs (of sizes {0, 100, 500, 1k, 10k}) were used as SME-labeled (in-domain) training data, with equal numbers of real and generated paragraphs. The generated paragraphs are obtained using the same domain-tuned generator as for the test sets. For each paper, we sample one paragraph to use as real, and one paragraph to condition on.

Proxy dataThe proxy GPT-2 generator is used to obtain nested subsets of 10,000 paragraphs (of sizes {0, 100, 500, 1k, 10k}) in much the same way as for the in-domain data, except for one difference. Unlike for the in-domain data, the defender has access to every human paragraph that is being replaced by a (proxy) generated paragraph22 So for each paper, we sample a real paragraph at position \(i\), and use the previous paragraph at position \(i-1\) as a prompt for the generated paragraph.

Footnote 22: On the other hand, the in-domain data is labeled by a SME, who identifies generated paragraphs but does not have access to the human paragraphs that they replaced.

What if the defender uses a proxy generator designed for unconditional paragraph generation? Preliminary experiments on using proxy data generated without prompting showed only a small drop in accuracy under most dataset sizes, so this is not a strong assumption to make.23

Footnote 23: See Appendix §A.5 for details.

## 6 Results

### Detection of Generated Abstracts

Detection performance on Semantic Scholar abstracts depends on the model used for task-tuning (RoBERTa-base, RoBERTa-large, or RoBERTa-large-STEM), the proxy domain (biomedical, physics, or biomedical-physics), and the number of proxy and SME samples used for task-tuning, with full results shown in Appendix SSA.3. We consider the effects of these four dimensions below.

Interplay of SME and proxy labelsSome SME labels are always needed for good performance, even when the training proxy text is in a similar domain as the target domain (Table 3). Without any SME labels, the highest accuracy that could be achieved with RoBERTa-large using only biomedical proxy text was .67 (with 10k proxy samples). Task-tuning the 10k-proxy model checkpoint a second time with only 100 SME-labeled samples resulted in a large improvement (accuracy of .81, recall of .95).

Given a fixed number of SME samples, increasing the number of proxy samples improves performance, but only up to a point, after which the proxy data starts being detrimental. For example, given 100 SME examples (row 2 in Table 3), the highest performance for the biomedical proxy experiments was achieved when using between 500 and 1000 proxy samples (resulting in accuracy of .76-.77 for RoBERTa-base, .89 for RoBERTa-large and .91-.92 for RoBERTa-large-STEM). The same observation holds when using physics and biomedical-physics proxy text. Unsurprisingly, the effects are worse with increasing domain shift. The decrease in accuracy when jumping from 1k to 10k proxy samples is .08 for biomedical proxy data, .16 for biomedical-physics proxy data, and .22 for physics proxy data.

Effect of domain shiftWhen 1k or 10k SME labels were available, performance across task-tuning domains was similar. On the other hand, with 500 SME labels or less the impact of the proxy data domain was greater, as shown in Table 4 for the case of 100 SME labels. For most proxy dataset sizes, there is a decrease in performance as one moves from biomedical to physics.

Finally, we note that when using RoBERTa

\begin{table}
\begin{tabular}{l r r r} \hline \multicolumn{1}{c}{\multirow{2}{*}{\(n\)}} & Biomedical & Biomed-physics & Physics \\ \cline{2-3}
100 & .67 & .87 & .78 \\
500 & .89 & .82 & .83 \\
1k & .89 & .85 & .84 \\
10k & .81 & .69 & .62 \\
100k & .82 & .70 & .66 \\ \hline \end{tabular}
\end{table}
Table 4: Comparing proxy domains when task-tuning RoBERTa-large on \(n\) proxy samples (from different domains) and 100 SME samples.

\begin{table}
\begin{tabular}{r c|r r r r r r} \hline \hline  & & \multicolumn{6}{c}{Proxy samples} \\  & & 0 & 100 & 500 & 1k & 10k & 100k \\ \hline \multirow{5}{*}{
\begin{tabular}{l} Penalty \\ \end{tabular} } & 0 & & .59 & .58 & .54 & .67 & .65 \\  & 100 & .68 & .67 & .89 & .89 & .81 & .82 \\  & 500 & .69 & .68 & .82 & .75 & .88 & .84 \\  & 1k & .80 & .90 & .84 & .89 & .90 & .84 \\  & 10k & .92 & .95 & .94 & .94 & .95 & .92 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Detection accuracy when task-tuning RoBERTa-large with biomedical proxy data.



large-STEM, 100 SME samples are sufficient to achieve .91 accuracy when using biomedical proxy samples. However, if the proxy samples come from a different domain (physics, or a mix of physics and biomedicine), then 500 SME samples are required to achieve the same accuracy.

Effect of model sizeRoBERTa-large had higher accuracy than RoBERTa-base under most scenarios, with an absolute increase in accuracy ranging between 1 and 22 points. RoBERTa-large always had higher precision than RoBERTa-base.

Effect of domain-tuningPre-training RoBERTa on a diverse corpus of STEM technical text improved performance in most cases, sometimes by a large margin. RoBERTa-large-STEM outperformed RoBERTa-large even when the target and proxy domains were close (i.e., using biomedical proxy data), with 1 to 5 point gains in accuracy under most conditions.

Domain-tuning RoBERTa was more beneficial with increasing amounts of domain shift, and when task-tuning on a large number of proxy samples and a small number of SME-labeled samples, as shown in Figure 3. A domain-specific RoBERTa is better at recovering from being trained on a large volume of data from the wrong domain, when given a small amount of in-domain text.

### Detection of Tampered Documents

The performance of the RoBERTa-large detectors at the paragraph level is shown in Table 5. It is not unrealistic to assume a SME can label 100 paragraphs (50 real, 50 synthetic) to create a detector with .94 accuracy. Thus, in the rest of the section we shall only evaluate the classifier trained on 10k conditioned proxy samples and 100 SME samples.

Identifying documents with at least one synthetic paragraphHere we apply the scoring strategies **(S1)** and **(S1-T)** described in SS4.2 to predict whether a given document has at least one generated paragraph. We found that on all our test sets, scoring documents using **(S1)** resulted in recall of .99-1 but precision at nearly chance level (.55-.56). This is due to the high false positive rate for short paragraphs. To remedy this, we score using **(S1-T)**, ignoring all paragraphs shorter than a given threshold of \(T\) characters24. The results for \(T=500\) and \(T=1000\) are shown in Table 6.

Footnote 24: If all paragraphs in a document are shorter than \(T\), we score the longest three paragraphs, but this is a rare occurrence (less than 5% of documents when \(T=1000\)).

When \(T=1000\), performance is high for test-all-fake, test-0.9 and test-0.5; however, recall drops substantially for test-0.1 and test-1-fake. This is due to the fact that these test sets contain very few generated paragraphs, which are then more likely to be filtered out: all synthetic paragraphs were removed from 64% of tamperedest-1-fake documents, and 39% of tamperedest-0.1 documents. Unfortunately, filtering less aggressively with \(T=500\) improves recall at the cost of lower precision across all test sets.

Ranking documents by fraction of generated contentWe rank documents using **(S2)**, i.e., according to the estimated fraction of paragraphs clas

Figure 3: Increase in accuracy when switching from RoBERTa-large to RoBERTa-large-STEM, when task-tuning on 10k proxy samples.

\begin{table}
\begin{tabular}{l c|c} \hline Test set & \multicolumn{2}{c}{\(T=500\)} & \multicolumn{2}{c}{\(T=1000\)} \\ \hline test-all-fake & .87 [.79, 1.0] & .98 [.96, 1.0] \\ test-0.9 & .87 [.79, 1.0] & .97 [.96, .99] \\ test-0.5 & .86 [.79, .99] & .96 [.96, .96] \\ test-0.1 & .81 [.77, .89] & .80 [.94, .63] \\ test-1-fake & .76 [.74, .78] & .67 [.91, .37] \\ \hline \end{tabular}
\end{table}
Table 6: Performance (accuracy, [precision, recall]) when predicting whether documents contain at least one synthetic paragraph (after removing paragraphs shorter than \(T\)).

 

sified as generated. Table 7 shows the fraction of documents in the top-k ranked documents that were tampered with (P@K). It is possible to retrieve nearly all tampered documents, except for test sets test-0.1 and test-1-fake.

Effect of paragraph splitting errorsIt is unrealistic to assume that the adversary and the defender use the same paragraph splits. For example, text from a PDF file must first be extracted and split into paragraphs before detection can be done. Even when using a good paragraph splitter, it is unlikely that the paragraph splits would exactly match those used by the generator. To investigate the robustness of detection against paragraph splitting errors we process each test set as follows: each paragraph is sentence-segmented with scispaCy v.0.2.2 Neumann et al. (2019), and every five consecutive sentences is taken to be a paragraph, disregarding the original paragraph splits. This is a stress-test for our detectors, since one can probably achieve far fewer paragraph-splitting errors when using a paragraph splitter such as GROBID Lopez (2009).

When applying the detector on the incorrectly-split documents and scoring with (S1), we find that precision increases from .55 to between .61 and .67. This is due the fact that paragraphs in the human 5-sentence splits are generally longer than the original paragraphs. On the other hand, recall drops significantly for test-0.1 and test-1-fake (from .99 to .87, and .99 to .79, respectively). This is due to the fact that it is harder to detect paragraphs containing a mix of real and synthetic content: recall was .95, .66 and .33 for the the subsets of paragraphs with 5, 4, and 3 synthetic sentences, respectively25.

Footnote 25: This affected test-0.1 and test-1-fake the most, because these test sets had a greater fraction of paragraphs with mostly human sentences but with some generated sentences mixed in.

## 7 Conclusion

In this paper, we studied the problem of automatic detection of GPT-2-generated technical text. We found that RoBERTa-based detectors can be successfully adapted from one scientific discipline (physics) to another (biomedicine), requiring relatively small amounts of in-domain labeled data. These could be provided by a subject matter expert (SME) in a reasonable amount of time. We also evaluated these paragraph-level detectors on a document tampering task, assuming that the adversary replaces randomly-selected paragraphs in a document with generated ones.

Future work should evaluate the extent to which this methodology would work on detecting text from newer generators such as GPT-3. Other challenging scenarios include adding noisy labels (e.g., if a SME makes a certain fraction of mistakes), and class imbalance. Our results on document tampering (i.e., that it is significantly harder to detect small amounts of generated text intermingled amongst real text) also point to the need to develop detection pipelines for other threat models such as single word or phrase substitutions Schuster et al. (2020). As text generation techniques continue to improve, it may be that more interpretable, fact-checking approaches are required to detect both human and machine-generated misinformation.

### Acknowledgements

We would like to thank Greg Durrett, Katrin Erk, Jessy Li, and the anonymous reviewers for their helpful comments and suggestions.

### Ethical Considerations

Improvements in the detection of synthetic text could be used by an adversary to improve the quality of generated text or to help them avoid detection Darmetko (2021). False positives are another source of potential negative consequences of automated detectors. For example, incorrectly flagged human-written content could be a source of misinformation, and could additionally lead to a loss of trust in the detection system. Care should be taken that false positives do not affect certain demographics disproportionately Bommasani et al. (2021); SS5.2). Finally, widespread awareness of the mere possibility of synthetic scientific text can further undermine public trust in genuine science Makri (2017).

\begin{table}
\begin{tabular}{l|c c c} \hline Test set & P@100 & P@250 & P@500 \\ \hline test-all-fake & 1.0 & 1.0 & .99 \\ test-0.9 & 1.0 & 1.0 & .99 \\ test-0.5 & .98 & .97 & .95 \\ test-0.1 & .70 & .74 & .69 \\ test-1-fake & .57 & .60 & .59 \\ \hline \end{tabular}
\end{table}
Table 7: Ranking performance when ranking documents according to the estimated fraction of paragraphs classified as generated.

 



## References

* and machine-based detection. In Advanced Information Networking and Applications
- Proceedings of the 34th International Conference on Advanced Information Networking and Applications, AINA-2020, Caserta, Italy, 15-17 April, Vol. 1151 of Advances in Intelligent Systems and Computing, pp. 1341-1354. Cited by: SS1.
* N. Aliman and L. Kester (2021)Epistemic defenses against scientific and empirical adversarial ai attacks. In CEUR Workshop Proceedings, 2021 Workshop on Artificial Intelligence Safety, AISafety 2021, 19 August 2021 through 20 August 2021, CEUR-WS, Cited by: SS1.
* W. Ammar, D. Groeneveld, C. Bhagavatula, I. Beltagy, M. Crawford, D. Downey, J. Dunkelberger, A. Elgohary, S. Feldman, V. Ha, R. Kinney, S. Kohlmeier, K. Lo, T. Murray, H. Ooi, M. Peters, J. Power, S. Skjonsberg, L. Wang, C. Wilhelm, Z. Yuan, M. van Zwylen, and O. Etzioni (2018)Construction of the literature graph in semantic scholar. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 3 (Industry Papers), New Orleans and Louisiana, New Orleans, USA, pp. 84-91. External Links: Link Cited by: SS1.
* A. Bakhtin, S. Gross, M. Ott, Y. Deng, M. Runzato, and A. Szlam (2019)Real or fake? Learning to discriminate machine from human generated text. arXiv preprint arXiv:1906.03351. Cited by: SS1.
* A. Bartoli and E. Medvet (2020)Exploring the potential of GPT-2 for generating fake reviews of research papers. In Fuzzy Systems and Data Mining VI: Proceedings of FSDM 2020, Vol. 331, Pages 390-396, IOS Press, pp. 390-396. External Links: ISBN 978-1-4673-319-1, Document Cited by: SS1.
* I. Beltagy, K. Lo, and A. Cohan (2019)SciBERT: a pretrained language model for scientific text. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), Hong Kong, China, pp. 3615-3620. External Links: Link Cited by: SS1.
* A. Belaz (2019)Fully automatic journalism: we need to talk about nonfake news generation. In Proceedings of the 2019 Truth and Trust Online Conference (TTO 2019) London, UK, October 4-5, 2019, Cited by: SS1.
* M. Bhatt and S. Parthasarathy (2020)How effectively can machines defend against machine-generated fake news? an empirical study.. In Proceedings of the First Workshop on Insights from Negative Results in NLP, Online, Online, pp. 48-53. External Links: Link Cited by: SS1.
* R. Bommasani, D. A Hudson, E. Adeli, R. Altman, S. Arora, S. von Arx, M. S. Bernstein, J. Bohig, A. Bosseltu, E. Brunskill, et al. (2021)On the opportunities and risks of foundation models. arXiv preprint arXiv:2108.07258. Cited by: SS1.
* T. Brown, B. Mann, N. Ryder, M. Subbiah, J. D. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, S. Agarwal, A. Herbert-Voss, G. Krueger, T. Henighan, R. Child, A. Ramesh, D. Ziegler, J. Wu, C. Winter, C. Hesse, M. Chen, E. Sigler, M. Litwin, Scott Gray, B. Chess, J. Clark, C. Berner, S. McCandlish, A. Radford, I. Sutskever, and D. Amodei (2020)Language models are few-shot learners. In Advances in Neural Information Processing Systems, Vol. 33, pp. 1877-1901. External Links: Link Cited by: SS1.
* G. Cabanas and C. Labbe (2021)Prevalence of nonsensical algorithmically generated papers in the scientific literature. Journal of the Association for Information Science and Technology. Cited by: SS1.
* E. Clark, T. August, S. Serrano, N. Haduong, S. Gururangan, and Noah A. Smith (2021)All that's 'human' is not gold: evaluating human evaluation of generated text. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), Online, pp. 7282-7296. External Links: Link Cited by: SS1.
* E. Crothers, N. Jaykowicz, H. Viktor, and P. Branco (2022)Adversarial robustness of neural-statistical features in detection of generative transformers. arXiv preprint arXiv:2203.07983. Cited by: SS1.
* T. Darmetko (2021)Fake or not? generating adversarial examples from language models. Undergraduate thesis, Maastricht University. Cited by: SS1.
* C. Donahue, M. Lee, and P. Liang (2020)Enabling language models to fill in the blanks. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, Online, pp. 2492-2501. External Links: Link Cited by: SS1.
* Y. Dou, M. Forbes, R. Koncel-Kedziorski, N. A. Smith, and Y. Choi (2021)Scarecrow: a framework for scrutinizing machine text. arXiv preprint arXiv:2107.01294. Cited by: SS1.
* T. Fagni, F. Falchi, M. Gambini, A. Martella, and M. Tesconi (2021)TwepFace: about detecting deepfake tweets. PLoS ONE16 (5), pp. e0251415.



* Fan et al. (2018) Angela Fan, Mike Lewis, and Yann Dauphin. 2018. Hierarchical neural story generation. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Melbourne, Australia, pp. 889-898. External Links: ISBN 978-3-461-4695-5 Cited by: SS1.
* F. Hofling and A. Zubiaga (2021)Feature-based detection of automated language models: tackling GPT-2, GPT-3 and Grover. PeerJ Computer Science7, pp. e443. External Links: ISSN 0001-9002, Link, Document Cited by: SS1.
* S. Gehrmann, H. Strobelt, and A. Rush (2019)GLTR: statistical detection and visualization of generated text. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics: System Demonstrations, Florence, Italy, pp. 111-116. External Links: ISBN 978-3-642-4695-5 Cited by: SS1.
* V. Emily Gunser, M. Gottschling, B. Brucker, S. Richter, and P. Gerjets (2021)Can users distinguish narrative texts written by an artificial intelligence writing tool from purely human text?. In International Conference on Human-Computer Interaction, pp. 520-527. External Links: ISBN 978-3-642-4695-5 Cited by: SS1.
* S. Gururangan, A. Marasovic, S. Swayamdipta, K. Lo, I. Beltagy, D. Downey, and N. A. Smith (2020)Don't stop pretraining: adapt language models to domains and tasks. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, Online, pp. 8342-8360. External Links: ISBN 978-3-642-4695-5 Cited by: SS1.
* X. Han and J. Eisenstein (2019)Unsupervised domain adaptation of contextualized embeddings for sequence labeling. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), Hong Kong, China, pp. 4238-4248. External Links: ISBN 978-3-642-4695-5 Cited by: SS1.
* F. Harrag, M. Dabbah, K. Darwish, and A. Abdelali (2020)BERT transformer model for detecting Arabic GPT2 auto-generated tweets. In Proceedings of the Fifth Arabic Natural Language Processing Workshop, Barcelona, Spain, pp. 207-214. External Links: ISBN 978-3-642-4695-5 Cited by: SS1.
* A. Holtzman, J. Buys, L. Du, M. Forbes, and Y. Choi (2020)The curious case of neural text degeneration. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020, External Links: Link, Document Cited by: SS1.
* an adversarial study. In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), Berlin, Germany, pp. 351-356. External Links: ISBN 978-3-642-4695-5 Cited by: SS1.
* D. Ippolito, D. Duckworth, C. Callison-Burch, and D. Eck (2020)Automatic detection of generated text is easiest when humans are fooled. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, Online, pp. 1808-1822. External Links: ISBN 978-3-642-4695-5 Cited by: SS1.
* G. Jawahar, M. Abdul-Mageed, and L. Lakshmanan (2020)Automatic detection of machine generated text: a critical survey. In Proceedings of the 28th International Conference on Computational Linguistics, Barcelona, Spain, pp. 2296-2309. External Links: ISBN 978-3-642-4695-5 Cited by: SS1.
* P. Knoth and Z. Zdrahal (2012)CORE: three access levels to underpin open access. D-Lib Magazine18 (11/12), pp. 1-13. External Links: ISSN 0001-9002, Link, Document Cited by: SS1.
* S. Kreps, R. Miles McCain, and M. Brundage (2020)All the news that's fit to fabricate: alignerated text as a tool of media misinformation. Journal of Experimental Political Science. Cited by: SS1.
* Y. Liu, M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettlemoyer, and V. Stovanov (2019)RoBERTa: a robustly optimized BERT pretraining approach. arXiv preprint arXiv:1907.11692. Cited by: SS1.
* V. Liyanage, D. Buscaldi, and A. Nazarenko (2022)A benchmark corpus for the detection of automatically generated text in academic publications. arXiv preprint arXiv:2202.02013. Cited by: SS1.
* K. Lo, L. Lu Wang, M. Neumann, R. Kinney, and D. Weld (2020)S2ORC: The semantic scholar open research corpus. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, Online, pp. 4969-4983. External Links: ISBN 978-3-642-4695-5 Cited by: SS1.
* Patrice Lopez (2009)GROBID: combining automatic bibliographic data recognition and term extraction for scholarship publications. In International conference on theory and practice of digital libraries, pp. 473-474. External Links: ISBN 978-3-642-4695-5 Cited by: SS1.
* Kaixin Ma, Jonathan Francis, Q. Lu, E. Nyberg, and A. Oltramari (2019)Towards generalizable neuro-symbolic systems for commonsense question answering. In Proceedings of the First Workshop on Commonsense Inference in Natural Language Processing, Hong Kong, China, pp. 22-32. External Links: ISBN 978-3-642-4695-5 Cited by: SS1.
* Anita Makri (2017)Give the public the tools to trust scientists. Nature News54 (7637), pp. 261. External Links: ISSN 0001-9002, Link, Document Cited by: SS1.
* K. McGuffie and A. Newhouse (2020)The radicalization risks of GPT-3 and advanced neural language models. Technical report Center on Terrorism, Extremism, and Counterterrorism, Middlebury Institute of International Studies at Monterrey.

 

Shaoor Munir, Brishan Batool, Zubair Shafiq, Padmini Srinivasan, and Fareed Zaffar. 2021. Through the looking glass: Learning to attribute synthetic text generated by language models. In _Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguistics: Main Volume_, pages 1811-1822, Online. Association for Computational Linguistics.
* Neumann et al. (2019) Mark Neumann, Daniel King, Iz Beltagy, and Waleed Ammar. 2019. ScispaCy: Fast and robust models for biomedical natural language processing. In _Proceedings of the 18th BioNLP Workshop and Shared Task_, pages 319-327, Florence, Italy. Association for Computational Linguistics.
* Pennington et al. (2014) Jeffrey Pennington, Richard Socher, and Christopher Manning. 2014. GloVe: Global vectors for word representation. In _Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP)_, pages 1532-1543, Doha, Qatar. Association for Computational Linguistics.
* Phang et al. (2018) Jason Phang, Thibault Fevry, and Samuel R Bowman. 2018. Sentence encoders on STILTs: Supplementary training on intermediate labeled-data tasks. _arXiv preprint arXiv:1811.01088_.
* Radford et al. (2019) Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. 2019. Language models are unsupervised multitask learners. _OpenAI blog_, 1(8):9.
* Ranade et al. (2021) Priyamka Ranade, Aritan Piplai, Sudip Mittal, Anupam Joshi, and Tim Finin. 2021. Generating fake cyber threat intelligence using transformer-based models. In _International Joint Conference on Neural Networks, IJCNN 2021, Shenzhen, China, July 18-22, 2021_, pages 1-9. IEEE.
* Schuster et al. (2021) Roei Schuster, Congzheng Song, Eran Tromer, and Vitaly Shmatikov. 2021. You autocomplete me: Poisoning vulnerabilities in neural code completion. In _30th USENIX Security Symposium (USENIX Security 21)_, pages 1559-1575. USENIX Association.
* Schuster et al. (2020) Tal Schuster, Roei Schuster, Darsh J. Shah, and Regina Barzilay. 2020. The limitations of stylometry for detecting machine-generated fake news. _Computational Linguistics_, 46(2):499-510.
* Sellam et al. (2020) Thibault Sellam, Dipjanjan Das, and Ankur Parikh. 2020. BLEURT: Learning robust metrics for text generation. In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_, pages 7881-7892, Online. Association for Computational Linguistics.
* Singla et al. (2021) Yaman Kumar Singla, Swapnil Parekh, Somesh Singh, Junyi Jessy Li, Rajiv Ratn Shah, and Changyou Chen. 2021. AES are both overstable and oversensitive: Explaining why and proposing defenses. _arXiv preprint arXiv:2109.11728_.
* Solaimal et al. (2019) Irene Solaimal, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert-Voss, Jeff Wu, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, et al. 2019. Release strategies and the social impacts of language models. _arXiv preprint arXiv:1908.09203_.
* Stiff and Johansson (2021) Harald Stiff and Fredrik Johansson. 2021. Detecting computer-generated disinformation. _International Journal of Data Science and Analytics_, pages 1-21.
* Tay et al. (2020) Yi Tay, Dara Bahri, Che Zheng, Clifford Brunk, Donald Metzler, and Andrew Tomkins. 2020. Reverse engineering configurations of neural text generation models. In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_, pages 275-279, Online. Association for Computational Linguistics.
* Uchendu et al. (2020) Adaku Uchendu, Thai Le, Kai Shu, and Dongwon Lee. 2020. Authorship attribution for neural text generation. In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_, pages 8384-8395, Online. Association for Computational Linguistics.
* Weiss (2019) Max Weiss. 2019. Deepfake bot submissions to federal public comment websites cannot be distinguished from human submissions. _Technology Science_.
* Wolff (2020) Max Wolff. 2020. Attacking neural text detectors. In _Towards Trustworthy ML: Rethinking Security and Privacy for ML Workshop, Egighth International Conference on Learning Representations, 2020_.
* Yang et al. (2019) Zhilin Yang, Zihang Dai, Yiming Yang, Jaime Carbonnell, Ruslan Salakhutdinov, and Quoc V Le. 2019. XLNet: Generalized autoregressive pretraining for language understanding. In _Advances in Neural Information Processing Systems_, volume 32. Curran Associates, Inc.
* Yang et al. (2016) Zichao Yang, Diyi Yang, Chris Dyer, Xiaodong He, Alex Smola, and Eduard Hovy. 2016. Hierarchical attention networks for document classification. In _Proceedings of the 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_, pages 1480-1489, San Diego, California. Association for Computational Linguistics.
* November 03, 2017_, pages 1143-1158. ACM.
* Zellers et al. (2019) Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. 2019. Defending against neural fake news. In _Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurlPS 2019, December 8-14, 2019, Vancouver, BC, Canada.

 

Wanjun Zhong, Duyu Tang, Zenan Xu, Ruize Wang, Nan Duan, Ming Zhou, Jiahai Wang, and Jian Yin. 2020. Neural deepfake detection with factual structure of text. In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_, pages 2461-2470, Online. Association for Computational Linguistics.

## Appendix A Appendix

### Fine-tuning hyperparameters

Here we list the main hyperparameters used in our experiments.

Domain-tuning GPT-2 to generate abstractsThe GPT-2 generators (both proxy and target generators) were domain-tuned with a block size of 512 BPE tokens, and a batch size of 6 on two Titan RTX GPUs, with the Adam optimizer.

Domain-tuning GPT-2 to generate paragraphsin contextProxy and target GPT-2 generators were obtained by domain-tuning GPT-2 with a block size of 768 and a batch size of 3 for four epochs on two disjoint, random subsets of S2ORC biomedical papers, each consisting in about 890,000 paragraphs.

We formatted the fine-tuning data in order to generate complete paragraphs conditioned on previous paragraphs; i.e., each training instance consisted of text from consecutive paragraph pairs: the last 256 tokens of a paragraph, a special newline token, and the next paragraph. For each paragraph pair \((A,B)\), truncating \(A\) at 256 tokens allowed us to encode at least 512 tokens for each paragraph \(B\), and about 95% of paragraphs in the domain-tuning dataset are shorter than 512 tokens. Thus, the model could learn how to end paragraphs naturally.

Task-tuning RoBERTaWe task-tuned all RoBERTa models with a block size of 512 on two Titan RTX GPUs. For RoBERTa-base, we used a batch size of 40, while for RoBERTa-large and RoBERTa-large-STEM we used a batch size of 7. Preliminary experiments suggested that for the smaller task-tuning datasets training for more epochs improved performance. The 100-sample task-tuning dataset was trained for 80 epochs, the 500-sample dataset was trained for 16 epochs, and the other datasets were trained for 8 epochs. Task-tuning on the SME-labeled (target) text was done using the same hyperparameters as were used for the proxy task-tuning.

LR (BOW) indicates logistic regression with un-tigram count features, and HAN (Hierarchical Attention Network) is a hierarchical LSTM with two attention layers, one for words and another for sentences Yang et al. (2016).

Both the LSTM and the HAN used pre-trained GloVe embeddings26Pennington et al. (2014). They were trained for 60 epochs with early stopping (patience 10), with 128 hidden layer units, dropout of 0.5, a batch size of 64, learning rate of 0.001 and the Adam optimizer. For the HAN, abstracts were truncated at the first 20 sentences and only the first 50 tokens in each sentence were used. For the LSTM, abstracts were truncated at 200 tokens.

Footnote 26: [https://nlp.stanford.edu/data/glovec.42B.300d.zip](https://nlp.stanford.edu/data/glovec.42B.300d.zip)

### Full cross-domain results

Figures 4, 5 and 6 contain the full results (accuracy, precision and recall) for all the cross-domain experiments discussed in SS6.1.

 



### Effect of paragraph length on detection performance

There is a higher percentage of short paragraphs in the body of scientific papers than there is among abstracts. We noticed this can lead to difficulties in detection, since detector performance deteriorates with shorter text lengths (Ippolito et al., 2020; Munir et al., 2021).

To investigate the effect of paragraph length on performance, we ranked the human paragraphs by their length in characters and binned them (200 per bin), in order to calculate the false positive rate within each bin. The false negative rates were calculated similarly using the generated paragraphs. These are shown in Figures 7 and 8. The false positive and false negative rates can be seen to increase substantially for paragraphs with less than 500 characters.

### Effect of training on paragraphs generated without conditioning

Since it might be unrealistic to assume that both the adversary's (target) generator and the defender's (proxy) generator both generate text in the same way - by conditioning on the last 256 tokens of the previous paragraph - we verified that our results are not heavily dependent on this assumption by also testing detection performance using _unconditional_ (i.e., unprompted) synthetic paragraphs as proxy training data.

Tables 5 and 9 show paragraph-level accuracy when training on conditioned and unconditioned proxy data, respectively. As expected (Tay et al., 2020), performance is higher when training with conditioned proxy generations than with unconditioned proxy generations if no SME samples are used (e.g., an increase in .10 in accuracy when using 10k proxy samples). This is mostly due to a large increase in recall (up to .21 for 10k proxy samples). However, a second round of task-tuning with

SME samples helps close the gap between task-tuning with conditioned and unconditioned proxy samples. Indeed, 100 SME samples are enough to nearly close the gap (a difference of .02 in accuracy).

Figure 8: False negative rate as a function of paragraph length.

\begin{table}
\begin{tabular}{c|r r r r r r} \hline  & \multicolumn{6}{c}{Proxy samples} \\  & \multicolumn{3}{c}{0} & \multicolumn{3}{c}{100} & 500 & 1k & 10k \\ \cline{2-7}  & 0 & & .51 & .73 & .78 & .83 \\ \multirow{4}{*}{[noitemsep]} & 100 & .77 & .75 & .83 & .88 & **93** \\  & 500 & .85 & .83 & .89 & .89 & **94** \\  & 1k & .91 & .92 & .88 & .92 & **93** \\  & 10k & .96 & .95 & .96 & .96 & **96** \\ \hline \end{tabular}
\end{table}
Table 9: Accuracy when task-tuning RoBERTa-large on unconditioned proxy data, evaluated on a balanced subset of 1000 real and 1000 synthetic paragraphs.

 



### STEM subset of the CORE dataset

\begin{tabular}{l l l} \hline Subject & \% & Open access data providers \\ \hline Biomedical & 28.1 & PubMed Central \\  & Nature Precedings \\  & Publications from Karolinska Institutet \\  & Collection Of Biostatistics Research Archive (COBRA) \\  & e-publications@RCSI (Royal College of Surgeons in Ireland) \\  & DigitalCommons@TMC (Texas Medical Center) \\  & Digital Commons@Becker (Washington University School of Medicine) \\ Physics & 39.8 & CERN Document Server \\  & arxiv (astro-ph, cond-mat, gr-qc, hep, nlin-chao-dyn, nucl, quant-ph, physics) \\ Computer Science & 3.4 & arxiv (cs) \\  & Dagstuhl Research Online Publication Server \\  & CiteSeerX \\  & Computer Science Technical Reports at Virginia Tech \\ Mathematics & 6.1 & arxiv (math) \\  & University of Oxford Mathematical Institute Eprints Archive \\  & NUMDAM \\  & Bulgarian Digital Mathematics Library at IMI-BAS \\ Various subjects & 22.6 & Naval Postgraduate School \\  & University of Oxford Mathematical Institute Eprints Archive \\  & Massachusetts Institute of Technology \\  & California Institute of Technology \\  & Imperial College London \\  & National University of Singapore \\  & HAL-Polytechnique \\  & Theses en Ligne (TEL) \\  & Universitat Politecnica de Catalunya \\  & University of Strathclyde \\  & Digital library of Brno University of Technology \\ Total & 100 \\ \end{tabular} Table 10: Subjects, data providers, and fraction of (English-language) abstracts per subject in the STEM subset of CORE used to domain-tune RoBERTa-large-STEM. This subset contains 916,074 abstracts. The Biomedical portion (237,620 abstracts), and a subset of the Physics portion (237,620 abstracts) were used to domain-tune GPT-2 to generate physics and biomedical abstracts.





### Examples of generated technical text

Tables 11 and 12 show examples of GPT-2-generated biomedical and physics abstracts. Table 13 shows two examples of tampered documents, where some of the paragraphs were replaced by GPT-2-generated paragraphs. Some of the (human-detectable) errors in the generated abstracts are given in Appendix SSA.8.

Here we report an efficient assay to differentiate, precisely and quickly, human prostate cancer (PCa) cell lines from normal cells/prostatic tissue. In prostatic PCa from each patient, we measured CE kinase activation of 1,2-bromopentaneidin (BPP), calcitonin-3, bone morphogenetic protein-6, urokinase 21 and eukaryotic phospho-protein kinase-2 (EPSK-2). Cells from 2 patients and 1 patient with hepatitis C and provided at the same time were simultaneously PCR screened to detect chromosomal aberrations and restriction fragment length polymorphism variations (RFLP). We found one viable Gdp from each patient. We did not detect chromosomal aberrations and standard regulators of EGS in PCa patients. Most likely, our results, also for grade II PCA, show that Pca cells have a passive chromosomal integrity with DNA repair genes, but this is not found in intact androgen-depleted patients. Inadequate DNA repair genes and excessive chromosomal aberrations, due to non-genomic proportions of UGT-3, EDS1, ESG2, URP-88 and UAR6 compared to their value combined, lower DNA repair products of 9.66%, and reduced cell ploidy.(ABSTRACT TRUNCATED AT 250 WORDS) During age-dependent contractions, the forearm flexor isomerophilic is a loss of maximum strength of the abductor tendon, which influences flexor mode and resistance. At peak contraction strength, the level of higher order strength produced by the concentric contractions is higher than the lower order strength due to lower upper, lower, and lateral potentiometric torque respectively. Moreover, age affects the time interval over which the elastic torque of the tendon increases, which changes from several short to several long and gradual. The apparent loss of maximal strain strength of the tendon during WER occurs generally late in the range of resistance, but in rare cases of progressively superior mechanical strength, the contractile effects of the WER series from the same period may be preserved.

\begin{table}
\begin{tabular}{l} \hline
**Generated biomedical abstracts** \\ \hline Cognitive health remains a widely misunderstood area of dementia research. Findings from the Diagnostic and Statistical Manual of Mental Disorders, Fourth Edition (DSM-IV) continue to indicate that people with dementia have varying degrees of personality disorders, one of which is asocial functioning. Given that individuals with dementia frequently experience emotions and cognitions such as anger and blame, it is important to understand the factors that contribute to this range of dysfunctions in cognitive functions. To address this issue, we review current thinking regarding how people with dementia and their caregivers understand these issues. We describe the functional distinction between healthy and low-function functioning dementia, discuss the relationship between dementia and temperament, and suggest future directions for future research and development. \\ \hline \end{tabular}
\end{table}
Table 11: Examples of abstracts generated by GPT-2 fine-tuned on biomedical text.



We construct a free Kac-Moody algebra in terms of SU(N) bi-holomorphic maps. Our construction is not exactly as in the standard program, which is based on the Kac-Moody algebra itself. In this work, we address the question whether a general construction can be made using a 3-dimensional space with its boundary fixed to be a manifold. For such a construction, one can quantize the free Kac-Moody algebra exactly using the interior data of a closed submanifold, an example of which is given.

A general classification of the massive scalar field model is presented. This model can be taken to be the simplest of all models exhibiting super-Kahler group structure. The very general model is then interpreted as a manifestation of the infinite supersymmetry of N=2 supersymmetric Yang-Mills theory with a simple Kaluza-Klein U(1) gauge group. This theory has an analog of Seiberg-Witten theory with a U(1) gauge group. The two models are related by the fact that the massive scalar field model reduces to the Seiberg-Witten model when the negative cosmological constant is eliminated.

We have simulated a sample of 60,000 galaxies in order to study the spatial structure of halos and the formation properties of their wind-driven columns. The galaxy models (average virial radius \(R_{c}=0.25kpc\), total column density \(O_{n}u^{-1/2}=1.2cm^{-3}\), total column density \(K_{0}=0.3cm^{-3}\) and total column density \(L_{n}u-2/3=0.5cm^{-3}\)) were selected from a large database of spiral galaxy photometry. We have investigated the properties of the wind-driven column density as a function of the galaxy size, the radius and the column density in the inner Lyman limit. \(R_{c}\) and \(L_{n}u\) are defined as the fraction of the total column density, \(O_{n}u_{2}-L_{n}u\), of gas in the central region of the galaxy, and \(L_{n}u\) is defined as the fractional logarithm of the gas density. The simulations were carried out on a large 64x64 grid of 16x16 square degrees (\(3.6\times 3.6\) square degrees) in order to obtain a large number of potential galaxies. The cross-correlation of the radial profile of the radial intensity distribution and the velocity distributions of gas streams shows that the velocity distribution is strongly wave-like, with the velocity dispersion \(<0.5kms^{-1}\); the power law of the dispersion is also found. We also find that the density of gas passes through a strong exponential regime at the center, and that the central density exceeds that at the periphery by 2 solar masses per degree of freedom.

We propose a new solution to the cosmic censorship problem. It is based on the idea that all physical experiments have to be canceled at the same time, with a specific choice of the data. In this approach the data would be separated from the source region by a detector, whose response is controlled by the Planck energy. The data would be split into beams of different energies. The different beams, and their response to each other, would be synchronized in a second detector, which would then (miraculously) detect photons from the source region and carry out the corresponding measurements in the detector. In this way the cosmic censorship problem can be reduced to a second problem: how to determine the signal and the background in the detector. We give an explicit example for the case of neutrino astronomy, and show that we can solve the cosmic censorship problem without any special choice of the signals of the detectors.

We study two-dimensional XY spin models in the two-dimensional triangular lattice using the "dynamical" renormalization group method. For the first time, we study the ground-state phase diagram of the ground-state XY Heisenberg spin chain with non-zero exchange coupling. We perform a thorough analysis of the chemical potentials and the thermodynamic properties of the ground state. We find that the thermodynamic limit of the XY model exhibits a mean-field phase diagram characterized by a disordered phase, a first-order phase transition, and a thermal phase. Our calculation illustrates the rigorous approach to demonstrate the zero temperature properties of the XY model.Comment: 12 pages, 6 figure.

The KKP equation is an \(n\)-component Green function (GFF) Hamiltonian system. The KKP equation is known to be a Lie algebra in the sense that it is a subalgebra of the \(SO(n)\) algebra \(SO(n)_{1}\). In this paper we construct the \(n\)-component GS theory with a Gaussian Hamiltonian \(H\) and a \((1,1)\) trace-free action. We show that in this system the excitation spectrum of the \(n\)-component GS system is the same as in the sine-Gordon system except for the fact that the excitation spectrum in the KKP system is product of the spectrum in the sine-Gordon and in the KKP system. We derive the \(n\)-component GS equation using the KKP equation in the dilute state, and show that the solution of the KKP equation in a dilute state is equivalent to the solution in the sine-Gordon system. This equivalence holds, in particular, when the KKP equation is interpreted as an \(SL(2,R)\) system in terms of the second harmonic operator. We further show that this equivalence holds also for \(n\)-component GS systems with spin two and spin zero. We also derive the KKP equation for the quantum spin chain with \(n\)-component GS components, which has a non linear sine-Gordon Hamiltonian and a periodic potential.

## Appendix A

\begin{table}
\begin{tabular}{l} \hline
**Generated physics abstracts** \\ \hline \end{tabular}
\end{table}
Table 12: Examples of abstracts generated by GPT-2 fine-tuned on physics text.

 



**Tampered excerpt from Cooper et al. "Effect of dietary sodium reduction on red blood cell sodium concentration and sodium-lithium countertransport." Hypertension 6.5 (1984): 731-735.**

Two food lines were created in the cafeteria, and a record was maintained of each meal. For Group 2, food items high in sodium were eliminated, and reduced sodium products were substituted when possible, as in the case of cheese, peanut butter, and margarine. Study nutritionists worked closely with the cafeteria staff to structure an experimental diet that was moderately reduced in sodium relative to the regular diet, yet similar in other respects. The only regular source of food for the participants was the school cafetera. Participants were recruited on the basis of an agreement not to receive packages from home or eat meals away from school during the 24-day experimental period. A record was kept of attendance at meals. Acceptance of the experimental diet was good. As noted, only one participant withdrew based on unwillingness to adhere to the dietary regimen.

**For the study, subjects were offered a control diet consisting of potatoes, beans, noodles, bar snacks, cold cereal, sweetened sodas, milk, cookies, fruit (numerous fruits, yogurt, frozen yogurt), and instant soup. In total, the diet contained 2.1 servings of meat and 10.5 servings poultry and eggs per week.**

The first phase of the study lasted 24 days, with an intervening 5-day vacation, followed by a crossover of 24 days. On Days 1 and 24 of Phase I and Day 24 of Phase II, participants underwent a standard examination. Height and weight were measured in light indoor clothes, with shoes off. Blood pressure was measured after a 15-minute rest by a procedure previously described , 9 and a 15 cc sample of blood was subsequently withdrawn with minimal hemostasis from the antcheubtial fossa. All examinations took place between 600 and 800. Blood was transported to the laboratory within 1 hour. The batch was divided in half, and an equal number of specimens was taken from each group and analyzed either immediately or placed in storage for analysis in 48 hours.

**Tampered excerpt from Khandelia et al. "Triglyceride blisters in lipid bilayers: implications for lipid droplet biogenesis and the mobile lipid signal in cancer cell membranes." PLoS ONE 5.9 (2010): e12811.**

In this report, we investigate the biophysics of model membranes containing low concentrations of triglyceride molecules.

**Reduced incorporation of glycosylated proteins in these membranes has been reported in vivo**[26][27] and in vitro**[28] as well as in our analysis of a high salt environment**[29, 30]. The reduced distribution of protein is known to reflect a decreased total availability of available constituents for substrate binding. To address this issue, the surface structure of membrane-bound proteins is studied by a combination of an energy map**[31] **of the full (hexagonal) and unbound (quadratic) parts of each subunit, in which the diagonal portion of this subcomplex is spatially preferentially constrained. Averaged over time, this energy mapping demonstrates a reduced physical overlap between parts that are on average loosely bound, indicating that these subunits are almost always pulled together. The contrast between the unbinding observed in soluble polymeric membranes and these highly mobile proteins suggests that the monolayer of such membranes is unable to adequately differentiate between component atoms. We find that such a system exhibits a similar geometry as a "live" membrane by which particular proteins can separate into regions of homogeneous bulk or in features termed proteasomal environments. These are structures that don't have the same means of reducing the total loading of smaller proteins that create surface areas for binding, allowing them to serve as attractive targets for degradation. Indeed, although unconformity to this model may influence membrane biophysical properties, reducing this structure should increase the translational and kinetic properties of proteins found on the cell surface**[5]**.

Besides lipoproteins and LDs, TGLs are also present in several biological membranes at varying concentrations. The lamellar bodies of lung surfactant extracts in mammals can contain between 0.5% to 1.8% w/w TGLs**[6, 7] . Ocular lens lipids contain small amounts (mg TGLs/mg phospholipids) of TGLs. TGLs are also present in intestinal membrane extracts**[8] **. Lysosomes contain non-negligible amounts of TGLs, for example, in cultured hamster fibroblasts**[9] **. In rat hepatocytes, lysosomes contain nearly 3.7% TGLs**[10] **. Many proliferating or activated mammalian cells in particular, have a high concentration of TGLs in membranes. Cancer cells contain as high as 6.8% TGL fraction of total plasma membrane lipids**[11] **. Several malignant Chinese hamster ovary (CHO) cell lines contain 2.4-3.2% TGLs in their plasma membranes**[12]**. Human neutrophils contain as high as 5.2% and 6.8% TGLs in their plasma membranes before and after stimulation with lipopolysaccharidescraides**[13] **. Activated macrophages**[14] **, lymphocytes**[15] **and B cells**[16] **also contain high amounts of TGLs in their plasma membranes. In this report, we investigate the effect of low concentrations of TGLs, as found in a variety of cell types noted above, on the structure and dynamics of model membranes, with the objective of ultimately obtaining hints into the possible structural and functional role of TGLs in the plasma membrane of living systems. We have used triolein (TO) as our model TGL, and 1-Palmitoyl-2-oleoyl-sn-glycero-3-phosphocholine (POPC) as the model phospholipid.**

**We developed three models of the free lipoprotein fraction within the monolayer membrane: (1) a free TGN that mediates the GP diffusion chain; (2) conjugated to free human T2PP and T3PP of all lymphocyte types to subsequently allow uptake of lipospheres and membranes; and (3) cytothalasin C (CXCL) immunoprecipitation experiments were performed on media from mice treated with TgIII.**



### Human-detected errors in generated biomedical abstracts

The following are a list of errors we found in a subset of 75 synthetic biomedical abstracts generated by GPT-2. A similar, larger list of annotations of error types found in GPT-2 and GPT-3 generated text was recently provided by Dou et al. (2021).

Not a real wordThe following words caused the annotator to mark the abstract as computer-generated:

* 'ProBNER'
* 'Chaos-Tector Chargor'
* 'fibre preveller'
* 'gravidum'
* 'di-nitro-L-arginine'
* 'Cd-FPOs'
* 'halliopeusing'

Incorrect acronymThe following were acronym-related errors:

* 'left middle cerebral artery (LMCMA)'
* 'occlusion (MOOC)'
* 'In Situ Analysis (SIA)'
* 'semantic energy transport (STM)'
* 'cross-questionnaires (CCQs)'
* 'Noisy Distributed Execution (NDE)' [acronym introduced but never used again]

Coherence problem
* 'First, a proper description of Big Memory is required; In previous studies, it was stated that Stochastic Roughness is a Fundamentality for Big Memory.'
* 'The scheme is based on the framework called as a density functional, proportional basis' [has nothing to do with rest of abstract]
* 'nanofacial' [unrelated to rest of abstract]
* 'CONCLUSON From a therapeutic point of view, this multispectral imaging method allowed to measure all ultrasound values simultaneously and easily. Further studies with practical applications in pediatric emergency medicine could reveal specific features of various brain injury in this way.' [unrelated to rest of abstract]
* 'Parents and doctors share more in common than many researchers expect. What is available for use?'

Knowledge error: entity does not exist

* 'Nevographic Origin of Caustic Cygnosis'
* 'R402D nuclear phytoarray'
* 'the Sargento regime'
* 'SEPA insertion rule'
* '4-OHDA' [does not exist; but 6-OHDA does]
* 'The Europir position'

Knowledge error: other
* 'nonlinear RC receiver in a hydraulic grade' [strange combination of electrical and fluid mechanics terms]
* 'inflammation-related molecules staphylococcus aureus' [Not a molecule]
* 'the city of san real' [not a city]
* 'The State of Barack Obama' [not a state]
* 'premature diagnosis of asthma is significantly associated with overweight'
* 'Vaccine coverage is at such high levels in the United States that without additional initiatives, an epidemic likely will emerge within four years.'
* 'TESpassing into a host's natural area can confer adverse impacts such as diseases, extra costs, unexpected complications, disadvantages and adverse property rights' [unrealistic list]

Contradictory or illogical

* 'Sixty-six occlusions were identified in the 60 eyes for occlusions, 31 of these (90%) occurred in abscesses while the rest were non-occidental.'
* 'Six groups of 75 children were examined by means of retrospective analysis. The first group consisted of 66 children, who received care in the neonatal intensive care unit from 29 January 1971 to 24 June 1972. The second group, consisting of 166 children,'
* 'in patients aged over 65 y of gender between 52.7 years and 70.2 years'
* 'three inference rules:' [only two rules listed]
* 'can be partially filled'



### Odd grammar

* 'Participants' means of outcome'
* 'To compare different gastrointestinal tumors patients undergo for the intrauterine difficult caesarean section'
* 'High temperature polymer is potential display material, especially in film industry' [missing determiners]
* 'Therefore, new color model for high temperature polymer is proposed. This paper introduces carbon disulfide systems and their design. Simple model is found. We used the uncertainty principle to overcome this uncertainty. The scheme is based on the framework called as a density functional, proportional basis.' ["as a" should be "a"; also missing some determiners]
* 'associated with overweight.' [adjective needs a noun]

#### Strange adjective

* 'Voo-like Gene'
* 'non-dominant rodent'
* 'cat-like crystals'
* 'air-exposed mice'
* 'semantic energy transport'
* 'intervertebral sedimentation'
* 'double plasma-associated disease'

##### Repetition

* 'our algorithm usually yields evidence of a weak algorithm'
* 'Negotiation and negotiation'
* 'specialty medical specialty'
* 'discriminant discriminative'
* 'STM based STM system'
* 'processions, and subsequent processesions.'
* 'The two leading theories suggest that the incidence is an early event after acute expansion of spleen parenchyma, involving the clotting/permeability clique. In this article, we propose a new hypothesis: the incidence of double plasma-associated disease is an early event.'
* 'Interfaces and interfaces'
* 'where each property represents a property'
* 'all the vector representations (or all of them)'
* 'in making decision-decisions. Results from data from data'
* 'during the growth phase and during the growth phase,'

#### Semantically odd/sounds weird

* 'the aortic roots of rats'
* 'first-trimester of illness'
* 'Keeping the word has become an argument against any pretense of better strategy'
* 'Metabolic health refers to the state of health associated with the metabolism of a given substance or disease, not necessarily a testicular aspect of normal physical functioning'
* 'mothers share more than once with a physician, parent or relative'
* 'have not clarified the communication of the ultrasound wave motion to the patient'
* 'there are several non-invasive and sometimes invasive systems which would benefit from the use of these systems to an unlimited extent'
* 'reduce productivity and results of the US National Health Interview Survey'
* 'We used the uncertainty principle to overcome this uncertainty'
* 'The rate of change in hourly body temperature was recorded in the eyes of dogs'
* 'Monotreme rhythms in internal and external body temperature'