How Reliable Are AI-Generated-Text Detectors? An Assessment Framework Using Evasive Soft Prompts
Authors: Tharindu Sandaruwan Kumarage
Paras Sheth
Raha Moraffah
Joshua Garland
huan liu
Venue: EMNLP 2023 Findings (2023)
Keywords: AI-generated-text detection
soft prompts
Large language models

Abstract: In recent years, there has been a rapid proliferation of AI-generated text, primarily driven by the release of powerful pre-trained language models (PLMs). To address the issue of misuse associated with AI-generated text, various high-performing detectors have been developed, including the OpenAI detector and the Stanford DetectGPT. In our study, we ask how reliable these detectors are. We answer the question by designing a novel approach that can prompt any PLM to generate text that evades these high-performing detectors. The proposed approach suggests a universal evasive prompt, a novel type of soft prompt, which guides PLMs in producing "human-like" text that can mislead the detectors. The novel universal evasive prompt is achieved in two steps: First, we create an evasive soft prompt tailored to a specific PLM through prompt tuning; and then, we leverage the transferability of soft prompts to transfer the learned evasive soft prompt from one PLM to another. Employing multiple PLMs in various writing tasks, we conduct extensive experiments to evaluate the efficacy of the evasive soft prompts in their evasion of state-of-the-art detectors.

How Reliable Are AL-Generated-Tex Detectors? An Assessment Framework Using Evasive Soft Prompts
Tharindu Kumarage
Paras Sheth Raha Moraffah Arizona State University
Joshua Garland
Huan Liu
(kskumara, psheth5, rmoraffa, jtgarlan, huanliuJ@asu. edu
Abstract
a rapidly deteraratingg shuuton, Russian-Ukrinn
Evasaive Soltt Prompt
In recent years, there has been a rapid prolif- eration of Al-generteed text, primarily driven by the release of powerful pre-trained language models (PLMs). To address the issue of misuse associated with AT-generated text, various high- performing detectors have been developed, in- cluding the OpenAl detector and the Stanford DetectGI'T. In our study, ask how reliable these detectors are. We answer the question by designing a novel approach that can prompt any PLM to generate text that evades these high- performing detectors. The proposed approach suggests universal evasive prompt, novel type of soft prompt, which guides PLMs in pro- ducing "human-like text that can mislead the detectors. The novel universal evasive prompt is achieved in two steps: First, we create an evasive soft prompl tailored to specific PLM through prompt tuning; and then, leverage the transfcrability of soft prompts to transfer the learned evasive soft prompt from one PLM another. Employing multiple PLMSs in vari- ous writing tasks, we conduct extensive exper- iments evaluate the efficacy of the evasive soft prompts in their evasion of state-of-the-art detectors.
Human Writien
Figure 1: Evasive soft prompt guiding PLM to evade Al-generated-tex detector
Al-generated text, we observe the emergence of au- tomatic Al-generated-tex detectors, which include commercial products like GPTZero (Tian, 2023), Turnitin AI text detector I as well open-source methods as DetectGPT (Mitchell et al., 2023) and fine-tuned versions of OpenAl GPT-2 detector (So- laiman al., 2019).
Although Al-generated-text detectors exhibit impressive performance during standard evalua- tions using existing datasets, their efficacy can be challenged when deployed in real-world scenarios. For instance, malicious users may manipulate the PLMs to generate text in a way that misleads the detector into classifying it as scenarios can lead to detrimental consequences practical applications like academic fraud detec- tion or Al-generated news identification. Conse- quently, it is imperative to assess the reliability of current Al- Al-generated-tess detectors in such situa- tions. Therefore, in this study, we aim to answer the question of how reliable the existing state-of- the-art Al-generated-text detectors are.
Such
1 Introduction
Recent advances in transformer-based Pre-trained Language Models (PLMs), such PaLM (Thop- pilan al., 2022), GPT 3.5 (Ouyang al., 2022), and GPT 4 (OpenAI, 2023), have greatly improved Natural Language Generation (NLG) capabilities. As a result, there is proliferation of highly com- pelling Al-generated text across various writing tasks, including summarization, essay writing, aca- demic and scientific writing, and journalism. While Al-generated text can be impressive, it also brings potential risks of misuse, such as academic fraud and the dissemination of Al-generated misinforma- tion (Dergaa et al., 2023; Kreps et al., 2022). Con- sequently, to combat the misuse associated with
To answer this question, we propose an evasive soft prompt, a novel form of soft prompt specifi- cally crafted to enable the evasion of Al-generated- text detectors. As illustrated in figure 1, when combined with standard input prompt, this sive soft prompt effectively guides the PLM wards generating texts that convincingly resemble Human--ritted content, thus evading detection by Al-generated-text detectors. Given the rapid ad-

---

vancements of PLMs in recent times, the develop- ment of more generalized framework that can assess the reliability of the detectors on both cur- rent and future PLMs is very crucial. To facilitate this, we design our evasive soft prompt scheme to be "universal", making it feasible for any PLM to adopt it easily. The proposed universal evasive soft prompt is achieved through a two-step process. First, develop an evasive soft prompt tailored for a particular PLM using prompt tuning (PT) (Lester al., a)) Then, leveraging the transferability soft prompts, we efficiently transfer the acquired evasive soft prompt from one PLM to another. We refer to our framework for Evasive Soft Prompts for -e-ggeerrate--ext detectors as EScaPe.
"Human-written" and "Al-written." In the early days, several supervised learning-based classifi- cation methods were explored for detecting Al- generated text, such as logistic regression and SVC (Ippolito et al., 2019). In contrast, GLTR (Gehrmann et al., 2019) employs set of simple sta- tistical tests to determine whether an input text se- quence is Al-generated not, making the method zero-shot, In recent years, fine-tuned PLM-based detectors have emerged as the state-of-the thr, in- cluding OpenAT's GPT2 detector (Solaiman et al., 2019; Jawahar et al., 2020; Zellers et al., 2019; Kumarage et al., 2023). With the rapid advance- ment of newer large language models, there is an increasing emphasis on the capabilities of few-shot or zero-shot detection and the interpretabillity of these detectors (Mitrović al., 2023). Some new detectors include commercial products such as GPTZero (Tian, 2023), and OpenAI's detector (Kirchner et al., 2023). recent high-performing zero-shot detection approach called DetectGPT (Mitchell et al., 2023) operates on the hypothesis that minor rewrites of Al-generated text would ex- hibit lower token log probabilities than the original sample. Watermarking on PLM-generated text is also exciting approach gaining attention in the research community (Kirchenbauer al.. 2023). However, assumes that the AT generator itself sup- ports the implementation of watermarking, which reduces the practicality of the approach.
Our experiments on different PLMs and diverse writing tasks provides empirical evidence of the efficacy of EScaPe in evading state-of-the-art de- tectors. Furthermore, our experiments on trans- ferability demonstrate the successful application evasive soft prompts across multiple prominent PLMs. Additionally, we present the effectiveness of EScaPe in transferring across different state- of-the-art detectors. Our findings underscore the importance of further research in designing more reliable detection mechanisms for combating the misuse related to Al-generated text. In summary, our study makes the following key contributions:
1. We propose the framework EScaPe, which introduces the concept of evasive soft prompts-a novel type of soft prompt specifi- cally designed guide PLMs in evading state- of-the-art Al-generated-ee text detectors.
2.2 Al-generated-text Detector Evasion
Few recent studies have investigated the efficacy of paraphrasing as a technique for evading AI- generated text detection. (Sadasivan et al., 2023; Krishna et al., 2023) demonstrated that paraphras- ing the text can considerably undermine the per- formance of AT-generated text detectors, raising concerns about such detection methods' reliability. However, our work differs significantly from para- phrasing for the following reasons: 1) we aim to as- sess the reliability of existing detectors against the capabilities of the original PLM that generated the text. In paraphrasing, a secondary PLM is used to rephrase the original PLM's 's text to evade detection, resulting in two-step process, and 2) Paraphrasing attack evaluation provides a unified score for type I and type II errors of the detector. However, it is essential to distinguish between these two types of errors to validate the detector's reliability. real-world scenarios, the most probable situation
2.
We demonstrate the transferability of eva- sive soft prompts learned through the EScaPe framework across different PLMs, making it universal evasive soft prompt to assess the reliability of Al-generated-text detectors any current or future PLM.
3. We conducted extensive experiments by em- ploying a wide range of PLMs various real- world writing tasks to demonstrate the effec- tiveness of the proposed framework, conse- quently highlighting the vuinerability of the existing Al-generated-text detectors.
2 Related Work
2.1
Detection of Al-Generated Text
The task of AI text detection is generally consid- ered binary classification task, with two classes:

---

would involve type II errors, where malicious ac- tors attempt to generate AI text that can evade the detectors and result a false negative. Our study focuses explicitly on emulating such a scenario and evaluating the type II errors.
Evasive Soft Prompt Learming
Evasive Soft Prompt Trensfer
Human Wingen
All Test
Al Text Delecboor
Delector
Y:
ongoing Russian-Ulraai
a rapidly deteriorating
2.3 Soft Prompt Tuning
tenalond....
ganeesteg
Prompt tuning a widely used approach for guiding PLMs to generate desired outputs (Jiang et al., 2020). GPT-3 demonstrated early success in prompt tuning, achieving remarkable performance on multiple tasks using tailored prompts (Brown et al., 2020). This led to extensive research on manually automati-
RL Agent
PL.M
Lond
Write newa article...
Write news article-
Evasive Soft Pronpe
Evasive Solt Prompe
hard prompts, which cally crafted prompts in discrete space (Mishra et al., 2021; Gao et al., 2020). Simultaneously, researchers have explored the potential of soft prompts (Liu et al., 2023). Unlike hard prompts, soft prompts are in the continuous embedding space. Therefore, soft prompts can be directly trained with task-specific supervision (Wu and Shi, 2022: Gu et al., 2022). Notable methods for soft prompts, such as prompt tuning (PT) (Lester et al., 2021b), and P-tuming (Liu al., 2022), have achieved performance comparable full parameter finetuning of PLMs for downstream tasks. Further- more, recent works have presented the transferabil- ity of soft prompts across tasks and across PLM architectures (Su et al., 2022; Vu et 2021).
&+
Projector
The proposed framework, EScaPe, encom- passes learning evasive soft prompt on specific PL.M, followed by its transfer to a target PLM.
Figure 2:
et al., 2021b). Second, we input both the soft and natural language prompt, which reflects the spe- cific writing task (Figure I provides an example of news writing task), into PLM and generate the corresponding output text response. Next, we pass this generated text response to the Al-generated- text detector and obtain the probability values for the final classification classes. Finally, using the detector's s output as the reward, we propagate the learning error and update the soft prompt Pa using the Proximal Policy Optimization (PPO) method (Schulman et al., 2017; Ziegler et al., 2019).
3 Methodology
Figure 2 illustrates the process of generating the universal evasive soft prompt, which involves two main steps: evasive soft prompt learning and eva- sive soft prompt transfer. In the first step, we learn an evasive soft prompt for a specific frozen PLM (source PLM -PLM)). The second step is the evasive soft prompt transfer, which involves trans- ferring the learned soft prompt to frozen target PLM (PLM'). In the subsequent sections, we comprehensively discuss these two steps.
3.1.2 Configuring the Evasive Soft Prompt
We use the PT method for defining and configuring the evasive soft prompt on a given PLM Here the parameters of PLM* are frozen, and the only parameter we intend to update is the soft prompt ps. The soft prompt ps consists of collection of l virtual tokens pÉ....... P connected the input of PLM". Unlike regular input tokens, these virtual tokens are learnable embedding vectors that can be fine-tuned to guide PLM* in accom- plishing a specific task or goal. In our case, these learnable tokens aim to steer the generation of text that evades AT text detectors. Formally, given a natural language prompt sequence with q tokens X xf, 2ÿ ..,, we input X into the PLM and get the corresponding embedding representa- tions while prepending k randomly initialized soft prompts pi .i. ...: P before them. Here, p E R and e, is the input embedding size PLM*.
3.1 Evasive Soft Prompt Learning
3.1.1 Overview of Learning
Evasive soft prompt learning aims to tune the soft prompt pa so that once the learned ps is inputted into PLM it generates text classified as "Human- written" by the detector. To accomplish this objec- tive, our end-to-end learning framework is defined as follows: first, we configure the soft prompt pa based on the Prompt Tuning (PT) method (Lester

---

3.1.3 Text Generation
State consists of components: the evasive soft prompt and the detector. The agent acts an optimizer, updating the evasive soft prompt based on the detector's output.
After configuring the evasive soft prompt for PLM', we generate the corresponding output text Y This generation conditioned on the soft prompt tokens P = P2....... Pi and the input tokens X = 2f, 2 ... zz.. as shown below:
Reward is the reward function that aids the RL agent in performing actions more aligned to- wards the goal making the generated text looks human-written to the detector. Given the lan- guage model PLM we initialize the policy a as PLM and then fine-tune only the evasive soft prompt embedding P to perform the task well using RL. We fit reward model f using the loss:
p()) - si
In equation 1, N represents the size of the gen- erated output, determined by the stopping criteria used during text generation with PL. In our case, we utilize the default maximum sequence size criteria, which halts the generation after reaching the maximum defined sequence length.
(V,2) Σ. ef(Y&))
loss( = (Y.(E)))
log
(3)
3.1.4 Reward Generation from the Detector
where Y is the text generated by PLM for the prompt X, and é is the detector output. To keep x from moving too far from PLM we lever- age penalty with expectation (KL( PLM"). (where KL denotes the KL divergence) modify- ing the RL reward as.
Given the text output generated by PLM our ob- jective is to calculate reward value that indicates the degree to which the generated text resembles text for AI text detectors. For this purpose. we utilize proxy Al-generated-text de- tector. Given the generated text Y from PLM', we compute the probabilities Y being classified as "Human" " and "AI". Formally, we define the input text to the detector as = (vf 92. vf²), where (vi V2. .... vf") represents the tokens of input text Y based on the tokenizer of the detector model. The detector has learned the function dg. which takes the input tokens and predicts the class probabilities.
F(y, 2) = =(y, BKK(TT PLMS)
(4)
= [y,, - PLM*
(5)
[x)
Here E X and y Y (single instance of input prompt and generated text). Adding the KL term adds two benefits. First, it prevents the policy from moving too far from the range where f is valid, and second, enforces coherence and topicality in the generated text.
(clsp, (1s)) = (vi v2, .... vi)
(2)
8 cls..
where cls), represents the probability for class i, and denotes the probability of the "Human" class (i = 0). The ultimate objective of our framework is to fine-tune the soft prompt pa to maximize the reward é. In other words, aim guide P in generating text that enhances the "Human" class probability as predicted by the detector.
Action of the RL agent is updating the tokens of the evasive soft prompt Pa based on the policy objective formulated as,
((
EAA
Fi..
(6)
3.1.5 Finetuning via Reinforcement Learning After obtaining the reward from the detector, 2, we utilize reinforcement learning to update our prompt's 's parameters effectively. Specifically, RL is used incorporate the detector's feedback, i.e.. probability scores assigned to the labels "human- written" and "AT-generated"" to guide the gener- ation. The RL module abides by the following structure:
where is the language model's parameters re- lated to the soft prompt embedding, and F; is the reward for input yi and reward é, We use the gradient of this objective after each iteration to update the evasive soft prompt.
Optimizing the evasive soft prompt based on the de- fined reward signals, the model finally outputs text that detected as human- written by the detector.

---

3.2 Evasive Soft Prompt Transfer
ployed similar language generation parameters in both cases, setting the rop-p 0.96 and the temper- ature to 0.9.
After learning the evasive soft prompt on the PLM', we transfer the trained evasive soft prompt to the semantic space of target PLM'. Following the cross- architercee transferability work of soft prompts (Su et al., 2022), we train a projector to efficiently map the evasive soft prompt from the source PLM the target PLM.
4.2 Writing Tasks
In our experiments, we analyzed how well our framework works with different Al-related writ- ing tasks that have the potential for misuse. We focused on three main writing tasks: news writing, academic writing, and creative writing.
Formally, we define the soft prompts of the source PLM as ps
Pf.....PPP.. ps c RRokk The projector go aims to project P to p E Reixk, representing the semantic space of the target PLM'. Here, é, and é, denote the input embed- ding dimensions of the source and target PLMs, re- spectively. We parameterize the projector funetion go using two-layer feed-forward neural network:
For the news writing task, we combined two datasets to gather
news articles from reputable sources such as CNN, The Wash- ington Post, and BBC. We obtained CNN and The Washington Post articles from the Turing- Bench dataset (Uchendu et al., 2021) and BBC articles from the Xsum dataset (Narayan et al., 2018). To represent academic essays, used the SQuAD dataset (Rajpurkar al., 2016) and ex- tracted Wikipedia paragraphs from the context field, For creative writing, we used the Reddit writing prompts dataset (Fan et al., 2018). After collect- ing the numan-writter text for the above tasks, we used the selected Al generators to generate corre- sponding AI text. Prompts used for these AI text generations can be found in Appendix A.1.I.
p =0 (P*) (P', + by)) b2 (7)
In Equation (7), W1 Roaxx. W2 RRoeK are trainable matrices, bj E IR**, b2 E R are bi- ases, and is a non-linear activation function. Here en denotes the hidden layer size of the projector network. Finally, we train the above cross-model projection parameters using our RL framework for evasive soft prompt learning. However, given that we are now initializing the p from an already learned evasive soft prompt Pa, learning the eva- sive soft prompt for the target PLM is done in fewer iterations.
4.3 Al-generated Text Detection Setup
We followed a similar task setup to related works, considering Al-generated-tex detection as binary classification task with the labels "Human" (0) and "AI" (1), For each writing task mentioned above, we had "Human" text and "Al" text, which we split into a train, test, and validation ( 8:1:1 ratio).
4 Experiment Setup
Here we describes the experimental settings used to validate our framework, including the Al Gen- erators (PLMs), writing tasks (datasets), detection setup, baselines, and the implementation details of EScaPe to support reproducibility.
In our work, we experimented with two state-of- the-art Al text detectors representing the two main categories: zero-shot and supervised. For the zero- shot detector, we used DetectGPT (Mitchell al., 2023), and for the supervised detector, we used fine-tuned version of OpenAl's GPT-2 detector (OpenAI-FT) (Solaiman et al., 2019). Since the fine-tuned detector was only trained on GPT2 text, we further fine-tuned it on the text generated by each respective PLM considered in our study. More details can be found in Appendix A.1.3.
4.1 AI-Text Generators (PLMs)
We evaluate our framework on numerous open- source PLMs readily available on HuggingFace. Specifically, we selected the current state-of-the-an PLMS such as LLaMA(7B; (Touvron et al., 2023)), Falcon(7B: (Almazrouei et al., 2023)), as well as- established powerful PLMs like (20:;: (Black et al., 2022)) and (PT(2.7B; (Zhang et al., used the above
4,4 Baselines
2022)). In experiments, PLMs in two ways. Firstly, for zero-shot language generation, we generated Al text for different writ- ing tasks considered in our analysis. Secondly, we used them as the base PLMs for our frame- work's s evasive soft prompt learning task. We em-
We compare our method against the following cent paraphrasing- Al-generated-text detec- tion evasion techniques.
Parrot paraphrasing pparrot_pp): PLM-bbased paraphrasing approach that incorporates the T5

---

model to paraphrase the given input text while degrading the performance of Al-generated text detection (Sadasivan al., 2023).
on LLaMA, Falcon, and GPT-NeoX text. Conse- quently, the soft prompt learned through the re- ward from DetectGPT more limited compared to the soft prompt acquired through the reward from the high-performing OpenAI-FT detector. This claim can be further substantiated by analyzing the detection results of the OPT model. Detect- GPT exhibits higher performance in detecting OPT- generated text, and accordingly, the soft prompt learned using the reward of Detect- GPT on OPT is successful in evading the detector, unlike the cases observed with other PLMs.
DIPPER paraphrasing (DIPPER _pP): PLM that is specifically catered for the task of paraphrasing. This method augments the existing paraphrasing ca- pabilities by enabling paragraph-level paraphrasing and enabling control codes to control the diversity of the paraphrase (Krishna al., 2023).
observe that
4.5 Implementation Details of EScaPe
To implement evasive soft prompt learning, we first defined the soft prompt model using the PEFT li- brary on Huggingface". We set the task type to CAUSAL LM, select an initial prompt text to repre- sent the writing task (e.g,, for the news writing task, "write a news article on the given headline"), and specified the number of virtual tokens as k = 8. For tuning the evasive soft prompt through rein- forcement learning (PPO), we utilized the TRL library (von Werra et al., 2020) for the implementa- tion, and the framework trained using a learning rate of 1.41 x e until the detector performance on the validation set no longer decreased. To facili- tate the transfer of evasive prompts, we utilized the parameters outlined by (Su et al., 2022) in their work on transferability. Further information regard- ing the implementation can be found in Appendix A.1.4.
Lower False Negatives with Paraphrase Evasion
Upon analyzing the FI scores after evasion, it becomes apparent that EScaPe significantly out- performs Parrot paraphrasing. While the DIPPER paraphraser demonstrates superior evasion com- pared to Parrot, it falls short compared to EScaPe with the OpenAI-FT detector. Both paraphrasing methods show improved evasion capabilities with DetectGPT compared to OpenAl-FFT. We attribute this distinction to the initial performance gap of the DetectGPT. When the detector's performance is weak for the original AI-text, specific perturbations can significantly impact its performance.
In contrast to recent works (Sadasivan et al., 2023; Krishna et al., 2023), paraphrasing exhibits limited abilities to modify the detector's perfor- mance. To address this apparent discrepancy, we analyze the underlying factors. In the presented results of Table 1, we specifically focus on the Fl score the "Al" class, which assesses the effective- ness of the respective evasion technique in making the Al-generated text appear "Human" to the de- tector (false negatives). This evaluation approach differs from prior research on paraphrasing- bassdd evasion, where both false positives and false neg- atives of the detector are considered, resulting a more significant decline in the evaluation scores (AUROC) when paraphrasing is employed. How- ever, we argue that in real-world scenarios, the most likely situation would involve malicious ac- tors attempting to generate Al text that can evade detectors by producing false negatives.
5 Results and Discussion
5.1 Evading AI Text Detectors
We recorded the results of our AT-generated-text detector evasion experiment in Table 1. The "Orig- inal" row represents the Fl score of the detector when applied to Al-text generated by the respec- tive PLM without any modifications, while the pre- ceding rows present the Fl score of text that has undergone different evasion methods. EScaPe successfully evaded detectors
Our findings demonstrate that EScaPe effec- tively reduces the performance of the detectors across all PLMs and various writing styles. No- tably, the OpenAI-FT detector experienced an aver- age Fl score decrease of approximately 42%, while the DetectGPT detector encountered a decrease of around 22%. The discrepancy in evasion success between the two detectors may stem from their ini- tial performance levels. For instance, DetectGPT achieved an 80% detection Fl score before evasion
5.2 Transferbility of the Evasion Prompts
We investigate two aspects of transferability: 1) the ability of ESSaPe learned on one PLM to transfer to another, and 2) the ability of EScaPe learned through one detector to transfer to another detector.
Shtpss//gtthub.coo/ggggggggagggp

---

Writing Task
News Writing
Essay Writing
Creative Writing
Detector
PLM
GPI-
GPI- NEOX
GPT-
LLaMA
Falcon
OPT
LLaMA
Falcon
OPT
LLaMA
Falcon
OPT
Method
NEOX
NBOX
Original
0
0.943
0,973
0.993
0.933
0.957
0.902
0.968
0.952
0.932
0.965
0.985
Parmot Pp
0.924
0.903
0
0.972
0.915
0.918
0.884
0.933
0.931
0.911
0.947
0.962
OpenAl-FT
DIPPER PP
0.856
0.811
0.864
0.824
0.849
0.802
0.841
0.811
0.862
0.806
0.855
0.835
EScaPe
0.547
0.528
0.545
0.532
0.539
0.519
Original
0.817
0.754
0.798
0.923
0.825
0.781
0.771
0.918
0.813
0,732
0.786
0.929
DetecGGPT
PP
0.732
0.711
0,705
0,863
0.757
0.703
0.691
0.848
0,788
0.674
0.718
0.852
DIPPER_ PP
0.635
0.651
0.658
0.702
0.641
0.673
0.647
0.694
0.628
0.648
0.663
0.711
EScaPe
0.582
0.637
0.614
0.549
0.579
0.622
0.623
0.551
0.583
0.641
0.612
0.547
Table 1: Fl scores of the detector for text generated using various evasion techniques. 'Original' denotes text
generated by the corresponding PL.M without employing any evasion technique. The lowest Fl scores, indicating the highest evasion success, are highlighted in bold.
Writing Tasks
parameters, is the smallest model examined in our study. Consequently, the EScaPe trained on OPT might have limitations in its capabilities to trans- fer larger models. This becomes more evident when considering GPT-NeoX, the largest model we analyzed, which exhibits the lowest deviation in transferability, indicating strong transferability
Source
Target
News
Essay
Cre.
Falcon
0.599
0.611
0.593
LLaMA
GPT-NeoX
0.587
0.596
0.586
OPT
0.554
0.559
0.555
LLaMA
0.571
0.566
0.559
Falcon
GPT-NeoX
0.564
0.557
0.551
OPT
0.561
0.559
0.554
to all the other PLMs.
LLaMA
0.553
0.560
0.558
GPT-
Falcon
0.571
0.568
0.563
5.2.2 Transferbility Across Detectors
NeoX
OPT
0.541
0.552
0.546
Figure 3 illustrates the extent to which EScaPe ex- hibits transfcrability across different detectors. For the sake of brevity, have only presented the de- tection values for the news writing task, while the transferability of the detectors in the other two writ- ing tasks can be found in Appendix A.2.1. Figure 3a reports the F1 score of the Open detector in two scenarios: 1) Direct text generated using EScaPe trained with the reward from the OpenAl- FT detector, and 2) Transfer text generated using EScaPe trained with the reward from the Detect- GPT detector. Likewise, Figure 3b depicts the Fl score of the DetectGPT detector in the direct and transfer scenarios.
LLaMA
0.572
0.574
0.571
OPT
Falcon 0.604
0.613
0.611
GPT-NeoX
0.588
0.595
0.583
Table 2: Fl scores of the detector for the text gener- ated by the PLM in the "Target" column. Here EScaPe trained on the PLM in the "Source" column and trans- ferred the PLM in the "Target" column. The lowest Fl scores, showcasing the highest transferable success for a given "Source" " PLM, are highlighted bold.
5.2.1 Transferbility Across PLMs
Table 2 presents the transferability of EScaPe across different PLMs. For brevity, we provide the detection values of the OpenAI-FT detector, while the DetectGPT results can be found in Ap- pendix 1. We observe that EScaPe demon- strates remarkable transferable performance con- sistently across all writing tasks and the four PLMs investigated. For the LLaMA, Falcon, and GPT- NeoX PLMs, the deviation of transferability (max- imum Fl score of transferred EScaPe minus the Fl score of EScaPe trained on itself) is less than 5%. In the case of OPT, this value is slightly higher, around 10%. Notably, EScaPe trained on OPT ex- hibits limited transferability compared to the other PLMs. One possible reason for this disparity could be the size of the language model. OPT, with 2.7B
Based on the two figures, it is evident that the EScaPe framework trained one detector can be transferred another detector. In both scenarios considered for the detectors, we observe that the EScaPe effectively evades detection, resulting lower F1 scores ranging from 50% to 70%. No- tably, we observe that the EScaPe trained on the su- pervised detector OpenAI-FT exhibits strong trans- ferability to the zero-shot detector DetectGPT. Sur- prisingly, the EScaPe trained OpenAI-FT yields lower F1 score with the DetectGPT detector com- pared the EScaPe trained on DetectGPT itself. We attribute this significant transferability to the supervised training of OpenAI-FT in detecting AI- generated text. When comparing the original per-

---

Writing Tasks
Method
Bersler
News
Essay
Cre.
Parrot_PP
13.4
11.5
12.7
DIPPER PP
8.1
7.5
8.3
EScaPe
2.5
1.7
2.1
31
Raker
OfTeect
017
OT (b) OpenAI. Det.GTT
1ok4
Falcn
Table 3: Perplexity change the Al text after applying the evasion method. The lowest Perplexity change. in- dicating the highest similarity with the original AT text, are highlighted in bold.
(a) DeL.GPT + OpenAl.
Figure 3: Transferability of EScaPe across different de- tectors. (a) DetectGPT OpenAl-FT and (b) OpenAl- FT DetectGPT. Detector X Y denotes the evalua- tion of EScaPe trained through the reward of X using the detector Y ("Transfer" label). The "Direct" label de- notes F1 corresponding to the detector Y's performance on EScaPe trained through the reward Y itself.
LoRA
56
Preftx
52-
formance (see Table 1) of OpenAI-FT and Detect- GPT, OpenAI-FT clearly outperforms DetectGPT detector for each respective PLM-generated text. This performance disparity is intuitive, con- sidering that we fine-tune OpenAI-FT using the text generated by each PLM examined in our study. Consequently, EScaPe trained using rewards from a robust supervised detector demonstrates higher transferability.
GPT-NeoX
Figure 4: Evasion performance (Fl score of the detector) of EScaPe with different Tuning Methods
PT method, within our framework. Specifically, we explore Prefix-tuning (Li and Liang, 2021) and LoRA (Hu al., 2021) as alternatives to PT in tun- ing PLM generate evasive text. In Prefix-tuming, of prefix activations prepended to each layer in the encoder stack, including the input layer. On the other hand, the LoRA method involves learn- ing a pair of rank decompositions for the attention layer matrices while keeping the original weights of the PLM frozen. Figure 4 illustrates that LoRA yielded slightly better evasion performance com- pared to PT. However, it important to note that the transferability of LoRA's rank decompositions between different PLMs has not been thoroughly studied, limiting its applicability in our objective of creating universal evasive soft prompt.
5.3 Further Analysis
Here, we conduct detailed analysis of two as- pects: the quality of the generated evasive text and a comparison of different parameter-efficient tun- ing methods for evasive text generation.
5.3.1 Quality of Evasive Text
We evaluate the perplexity change to assess the disparity between the original Al-text and the text produced after applying evasive techniques. Table 3 presents the perplexity change values for each evasion technique in LLaMA generations. The per- plexity is computed using independent PLM, GPT2-XL (Radford al., 2019). We observe that the evasive text generated by EScaPe exhibits the lowest perplexity change when compared to the paraphrasing techniques, Parrot and DIPPER. This finding aligns with our expectations since we im- pose a KL loss between the frozen PLM and the evasive soft prompt during training. This constraint ensures that the generation, conditioned by the eva- sive soft prompt, remains close the original PLM and avoids significant divergence.
Conclusion
In this paper, we investigated the reliability of cur- rent state-of-the-art Al-generated-texx detectors by introducing a novel universal evasive soft prompt framework. Our framework, referred to as ES- caPe, was designed to learn an evasive soft prompt capable of efficiently guiding any PLM in gener- ating text that effectively deceive the detce- tors. Through experiments conducted various prominent PLMs across different writing tasks. our results reveal the unreliability of existing AI- generated-text detectors when confronted with text generated by PLMs guided by evasive soft prompts.
5.3.2 Parameter Efficient Tuning Methods
Here, we investigate the effectiveness of various parameter-efficient tuning methods, similar to the

---

In future research, exploring the potential bene- fits of adversarial training in developing more ro- bust detectors to combat the proposed evasive soft prompts would be an intriguing avenue to pursue.
8.3 Evaluating the Quality of Learned Evasive Soft-prompts
Soft prompts are primarily numerical vectors, which differ significantly from hard prompt tem- plates in interpretability aspect. This makes di- rect qualitative experiments on them impractical, shifting the focus analyzing performance the downstream tasks for which these prompts are tai- lored (Lester al., 2021a; Wang et al., 2022).
7 Acknowledgements
This material is based upon work supported by the Office of Naval Research (ONR) un- der contract/grant number N00014-21-1-4000, Army Rescarch Office under the grant number W91 INF21 10030, Army Research Lab under the grant number W91 INF2220112 and Defense Ad- vanced Research Projects Agency (DARPA) under the grant number HR001 120C0123. The views, opinions, and/or findings expressed are those of the author and should not be interpreted as represent- ing the official views or policies of the Department of Defense or the U.S. Government.
Ethics Statement
9.1 Malicious Use of Evasive Soft Prompts
We acknowledge the potential risks associated with adversarics misusing the proposed framework to evade Al-generated text detection systems. How- ever, we argue that the benefits of identifying limita- tions and vulnerabilities in state-of-the-art detector systems (red (red-teaming) outweigh the potential for misuse, primarily when we actively assist future rescarchers in addressing these issues. As a precau- tionary measure, we will not make the complete codebase or soft prompt weights publicly available. However, upon review, individuals or organizations engaged in legitimate research will be granted ac- cess to our framework.
8 Limitations
8.1 Soft-prompting Should be Enabled
our study, we construct the evasive soft prompt based on the assumption that the PLM is capable of using soft prompts. In other words, we con- sider the PLM as an open-source model, allowing us to seamlessly incorporate these learnable soft prompt embeddings into the model. This assump- tion restricts our framework to evaluating the AI- generated-text detectors on the PLMs that are acces- sible via an API, supporting only discrete natural language prompts (e.g.. OpenAl API). However, if soft prompting capabilities are eventually sup- ported through APIs in the future, our method can be upplied to PLMs accessible via APIs as well.
9.2 Al-generated Text
In work, experiment with multiple PLMs and generate text related essays, and creative writing tasks. We recognize the importance of not publicly releasing any Al- generated text used in our work, as we cannot guar- antee the factual accuracy of the content. Therefore, we will implement an on-demand release structure to release our Al-generated data. Individuals or organizations requesting access to the generated data for legitimate academic research purposes will be granted permission to download the data.
articles, academic
8.2 Detector Reliability from the Perspective of a Malicious Actor
Generally, the reliability of Al-generated text detec- tors can be evaluated based on two primary criteria: !) the misclassification of human-authored text as Al-generated, and 2) the misclassification of Al- generated text as numan-authored. However, this paper focuses on the latter reliability issue, specifi- cally addressing the detector's ' robustness against manipulation by malicious actors. Individuals in- tent leveraging AI for plagiarism the dissem- ination of misinformation will invariably explore and exploit vulnerabilities in these detection sys- tems. We aim to address this looming threat by adopting an ethical hacking perspective to uncover potential weaknesses.
9.3 Intended Use
crucial to consider the intended real-world ap- plication of EScaPe and its societal impact. Our re- search on evasive soft prompts focuses on enabling an assessment framework for existing Al-generated text detectors. As Al-generated text becomes in- creasingly prevalent in various domains, the poten- tial applications of Al-generated text detectors ex- pand, including their role a primary forensic tool in combating Al-generated misinformation. There- fore, assessing the detectors before their deploy- ment becomes essential, and we emphasize that

---

our framework should be used for this intended pur- pose. However, a significant ethical concern arises if our framework is utilized for purposes other than its intended use, guiding PLMs to generate harmful and derogatory text that could negatively impact the reputation of the organizations responsible for developing the aforementioned PLMs. Hence, we strongly advise users to adhere to the intended use of our framework only assessment tool for AI- Al-generated-Ee text detectors.
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Aluen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang. and Weizhu Chen. 2021. Lora: Low-rank adap- tation of large language models. arXiv preprint arXiv:2106.06655
Daphne Ippolito, Daniel Duckworth, Chris Callison- Burch, and Douglas Eck. 2019. Automatic detection of generated text is easiest when humans fooled.
arXiv preprint
Ganesh Jawahar, Muhammad Abdul-Mageed, and Laks VS Lakshmanan. 2020, Automatic detection of machine generated text: A critical survey. arXiv preprint 233.14201.
References
Ebtesam Almazrouei, Hamza Alobeidli, Abdulaziz Al- shamsi, Alessandro Cappelli, Ruxandra Cojocaru, Merouane Debbah, Etienne Goffinet, Daniel Hes- low, Julien Launay. Quentin Malartic, Badreddine Noune, Baptiste Pannier, and Guilherme Penedo. 2023. Falcon-40B: an open large language model with of-e-offthhe-r performance.
Zhengbao Jiang, Frank F Xu, Jun Araki, and Graham Neubig. 2020. How can we know what language models know? Transactions of the Association for Computational Linguisties, 8:423-438.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. A watermark for large language models. arXiv preprint urXiv:2301.102.
Sid Black, Stella Biderman, Eric Hallahan, Quentin Anthony, Leo Gao, Laurence Golding, Horace He, Connor Leahy, Kyle McDonell, Jason Phang, et al. 2022. -pt-neox-20b: An open-source autoregressive language model. arXiv preprint 220::22040067455
Hendrik Kirchner, Lama Ahmad, Scott Aaronson, and Jan Leike. 2023. New classifier for indicating ai-written text. OpenAl.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. Language models are few-shot learners. Advances in neural information processing systems, 33:1877-1901.
Sarah Kreps, R Miles McCain, and Miles Brundage. 2022. All the news that's fit fabricate: Ai- generated text as a tool media misinformation. Journal of experimental political science, 91)::144- 117.
Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit lyyer. 2023. Paraphras- ing evades detectors of ai-generated text, but re- trieval is effective defense. arXiv preprint arXiv:2303. 13408.
Ismail Dergaa, Karim Chamari, Piotr Zmijewski, and Helmi Ben Saad. 2023. From human writing to ar- tificial intelligence generated text: examining the prospects and potential threats of chatgpt in academic writing. Biology of Sport, 40(2):615-622 -622.
Tharindu Kumarage. Joshua Garland, Amrita Bhat- tacharjee, Kirill Trapeznikov. Scott Ruston, and Huan Liu. 2023. Stylometric detection of ai- generated text in twitter timelines. arXiv preprint arXiv:2303.03697.
Angela Fan, Mike Lewis, and Yann Dauphin. 2018. Hierarchical neural story generation. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), pages 889-898
Brian Lester, Rami Al-Rfou, and Noah Constant. 2021a. The power of scale for parameter-efficien prompt tuning. arXiv preprint 2xXiv:2104.0880
Tianyu Gao, Adam Fisch, and Danqi Chen. 2020. Making pre-trained language models better few-shot learners. arXiv preprint 1/2iv
Brian Lester, Rami Al-Rfou, and Noah Constant. 2021b. The power scale for parameter-efficient prompt tuning. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 3045-3059, Online and Punta Cana, Domini- can Republic. Association for Computational Lin- guistics.
Sehastian Gehrmann, Hendrik Strobelt, and Alexan- der M Rush. 2019. Gltr: Statistical detection and visualization of generated text. arXiv preprint arXiv:
Yuxian Gu, Xu Han, Zhiyuan Liu, and Minlie Huang. 2022. Ppt: Pre-trained prompt tuning for few-shot learning, In Proceedings of the 60th Annual Meet- ing of the Association for Computational Linguistics (Volume 1: Long Papers), pages 8410-8423.
Xiang Lisa Li and Percy Liang, 2021. Prefix-tuning: Optimizing continuous prompts generation. arXiv preprini arXi::2101.00/9

---

Pengfei Liu, Weizhe Yuan, Jinlan Fu, Zhengbao Jiang. Hiroaki Hayashi, and Graham Neubig. 2023. Pre- train, prompt, and predict: A systematic survey of prompting methods natural language processing. ACM Computing Surveys, 55(9):1-35.
Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert- Voss. Jeff Wu, Alec Rad- ford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, al. 2019. Release strategies and the so- cial impacts of language models. arXiv preprint arXiv: urXiv:79088 7900.09233.
Xiao Liu, Kaixuan Ji, Yicheng Fu, Weng Tam, Zhengx- iao Du, Zhilin Yang, and Jie Tang. 2022. P-tuning: Prompt tuning can be comparable to fine-tuning across scales and tasks. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 61-68.
Yusheng Su, Xiaozhi Wang. Yujia Qin, Chi-Min Chan, Yankai Lin, Huadong Wang, Kaiyue Wen, Zhiyuan Liu, Peng Li, Juanzi Li, et al. 2022. On transferabil- ity of prompt tuning for natural language processing. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computa- tional Linguistics: Human Language Technologies. pages 3949-3969.
Swaroop Mishra, Daniel Khashabi, Chitta Baral, Yejin Choi, and Hannaneh Hajishirzi. 2021. Reframing instructional prompts to gptk's 's language. arXiv preprint 2xx::2109007830
Romal Thoppilan, Daniel De Freitas, Jamie Hall, Noam Shazeer, Apoory Kulshreshtha, Heng-Tze Cheng, Alicia Jin, Taylor Bos, Leslie Baker, Yu Du et al. 2022. Lamda: Language models for dialog applica- tions. arXiv preprint arXiv:2201.082533
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. 2023. Detectgpt: Zero-shot machine-generated text detec- tion using probability curvature. arXiv preprint arXiv:2301.11305
Edward Tian. 2023, Gpizero. Retrieved Jan, 25:2023.
Sandra Mitrović, Davide Andreoletti, and Omran Ay- oub. 2023. Chatgpt or human? detect and explain. explaining decisions of machine learning model for detecting short arXiv:2301. 13852.
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et 2023. Llama: Open and effi- cient foundation language models. arXiv preprint 27X
text. arXiv preprint
Shashi Narayan, Shay B Cohen, and Mirella Lapata. 2018. Don't 't give me the details. just the summary! topic-aware convolutional neural networks for ex- treme summarization. In Proceedings of the 2018 Conference on Empirical Methods Natural Lan- guage Processing, pages 1797-1807.
Adaku Uchendu, Zeyu Ma, Thai Le, Rui Zhang, and Dongwon Lee. 2021. Turingbench: A benchmark en- vironment for turing test in the age of neural text gen- eration. In 2021 Findings of the Association for Com- putational Linguistics. Findings of ACL: EMNLP 2021, pages 2001-2016. Association for Computa- tional Linguisties (ACI.).
OpenAL. 2023. Gpt-4 technical report.
Long Ouyang. Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroli Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. 2022. Training language models to follow instruc- tions with human feedback. Advances in Neural Information Processing Systems, 35:27730-27744.
Leandro von Werra, Younes Belkada, Lewis Tunstall, Edward Beeching, Tristan Thrush, and Nathan Lam- bert. 2020. Trl: Transformer reinforcement learning. https: //gt thub. com//vwerra/trl.
Tu Vu, Brian Lester. Noah Constant, Rami Al-Rfou, and Daniel Cer. 2021. Spot: Better frozen model adap- tation through soft prompt transfer. arXiv preprint arXiv:2110007900
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, and Tlya Sutskever. 2019. Language models are unsupervised multitask learners. OpenAl blog. 18)):
Chaozheng Wang, Yuanhang Yang, Cuiyun Gao, Yun Peng, Hongyu Zhang, and Michael R Lyu. 2022. No more fine-tuning? an experimental evaluation of prompt tuning in code intelligence. In Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pages 382-394.
Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, and Percy Liang. 2016. Squad: 100,000+ questions for machine comprehension of text. In Proceedings of the 2016 Conference on Empirical Methods in Natu- ral Language Processing, pages 2383-2392.
Vinu Sankar Sadasivan, Aounon Kumar, Sriram Bala- subramanian, Wenxiao Wang, and Soheil Feizi, 2023, Can ai-generated text be reliably detected? arXiv preprint 2303v 11156.
Hui Wu and Xiaodong Shi. 2022. Adversarial soft prompt tuning for cross-domain sentiment analysis. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 2438 2447.
John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. 2017. Proxi- mal policy optimization algorithms, arXiv preprint 477.4:1707.06347.
Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. 2019. Defending against neural fake

---

news, Advances neural information processing systems, 32.
obtained train and test data. Consequently, for each writing task, we possessed a training dataset com- prising 3600 samples, a testing dataset comprising 200 samples, and a validation dataset comprising 200 samples.
Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen. Shuohui Chen, Christopher De- wan, Mona Diab, Xian Li, Xi Victoria Lin, et al. 2022. Opt: Open pre-trained transformer language models. arXiv preprint arx:v:2205.01063
A.1.3 Detector Implementations In our analysis, we utilized two prominent open- souree detectors for Al-generated text: DetectGPT (Mitchell et al., 2023) and OpenAI's GPT-2 detec- tor (RoBERTa-base) (Solaiman et al., 2019).
Daniel M Ziegler. Nisan Stiennon, Jeffrey Wu, Tom B Brown, Alec Radford, Dario Amodei, Paul Chris- tiano, and Geoffrey Irving. 2019. Fine-tuning lan- guage models from human preferences. arXiv preprint arXiv:199.008993
DetectGPT: This approach also employs a proxy Pre-trained Language Model (PLM) to calculate log probabilities for individual tokens. However, its Docision-making process involves comparing the log probability of the original input text with the log probability of a set of perturbed versions of the input text. These perturbations are generated using T5-base. The authors hypothesize that if the difference in log probabilities between the original text and the perturbed text consistently yields pos- itive value, it is likely that an Al model generated the input text. In our work, we used the original off ffff-the-she shelf implementation of DetectGPT 3. OpenAI-GPT2 detector: This detector is a RoBERTa model fine-tuned on the GPT-2-output dataset 4, which consists of 250K documents from the WebText dataset (Radford et al., 2019) and 500K GPT-2-generated data. Since the OpenAl detector is trained solely on GPT-2 data, in order to use this detector with other PLMs we have, we fine-tuned version of the OpenAl detector by combining all the training datasets from the three writing tasks. We performed fine-tuning of these detectors on an NVIDIA GeForce RTX 3090 GPU with 24 GB VRAM, setting the learning rate to 2 x é 5 and weight decay to 0.01.
A Appendix
A.I Reproducibility
A.1.1 AI Generators and Prompting
Our experiments involved multiple open-source PLMs readily available on HuggingFace. Specifi- cally, we selected the current state-of-the-art PLMs. such as LLaMA state-of-the-ar PLMs such as LLaMA (Touvron et al., 2023)), Falcon (Al- mazrouei et al., 2023), as well as-established pow- erful PLMs like GPT-NeoX (Black et al., 2022) and OPT (Zhang et al., 2022). We conducted exper- iments using the following model sizes: LLaMA 7 billion parameters, Falcon 7 billion parameters, GPT-NeoX 20 billion parameters, and OPT 2.7 billion parameters. These PLMs were employed in two use cases. First, they were used to generate Al text for the training and testing datasets. Second, they served the PLM in which we implemented evasive soft prompts. In both cases, the goal of the PL.Ms was to generate text responses given an input prompt. We set the following generation pa- rameters: a top-p value of 0.96, a lemperature of 0.9, and a max-len of 256 tokens. The choice of prompt used for text generation depended on the writing task. For news writing, we used the head- line the initial prompt, while for essay writing and creative writing, we selected the first 25 tokens as the prompt.
A.1.4 Implementation Details EScaPe
In Section 4.5, we discussed the implementation details of evasive soft prompt learning. For the im- plementation details of evasive soft prompt transfer, we followed the guidelines provided by (Su et al., 2022) in their cross cross-model soft prompt transfer- ability work. The additional component which we didn't 't discuss in our main implementation details is the feedforward network we utilized as the pro- jection network. Recall, we parameterized the pro- jector function go using a two-layer feed-forward neural network (cquation 7)
A.1.2 Dataset Sizes
For each respective writing task, we first extracted the Mluman-written" portions from the sources mentioned in Section 4. We obtained 2000 samples for each writing task and divided them into train, test, and validation sets. Specifically, we allocated 100 samples for testing, 100 samples for validation, and the remaining 1800 samples for training. Sub- sequently, we utilized the aforementioned PLMs to generate AI-written counterparts based on the
s "hups://github..com//rr http:///sssuubbbommmemmmmmccllld http:://gghhaaa..oommmm//gpggggp

---

Writing Tasks
Writing Tasks
Source
Target
PLM
News
Essay
Crea.
News
Essay
Crea.
Falcon
0.651
0.643
0.647
LLaMA
0.615
0.621
0.619
LLaMA
GPT-NeoX
0.659
0.622
0.636
Falcon 0.661
0.653
0.657
OPT
0.617
0.595
0.591
GPT-NeoX 0,638
0.644
0.637
LLaMA
0.697
0.690
0,684
OPT
0.577
0.581
0.578
Falcon
GPT-NeoX
0.662
0.665
0.658
OPT
0.657
0.651
0.649
Table 5: Transferability of EScaPe across different de-
LLaMA
0.659
0.644
0.652
tectors. Results for the DetectGPT - OpenAl-FT trans- ferability. EScaPe trained through the reward of Detect- GPT, evaluated using the detector OpenAI-FT
GPT-NeoX
Falcon
0.671
0.667
0.678
OPT
0.627
0.631
0.618
LLaMA
0.597
0.601
0.588
OPT
Falcon
0.635
0.628
0.619
Writing Tasks
GPT-NeoX
0.622
0.614
0.608
PLM
News
Essay
Crea.
LLaMA
0.589
0.580
0.588
Table 4: F1 scores of the detector for the text generated by the PLM in the "Target" column. Here EScaPe trained on PLM in the 'Source' column is transferred to the "Target" column PLM. The lowest F1 scores, showcasing the highest transferable success for given 'Source' PLM, are highlighted in bold.
Falcon 0.583
0.581
0.577
GPT-NeoX 0.591
0.599
0.592
OPT
0.537
0.540
0.539
Table 6: Transferability of EScaPe across different de- tectors. Results for the OpenAI-FT DetectGPT trans- ferability. EScaPe trained through the reward of OpenAI- FT, evaluated using the detector DetectGPT
We set the hidden size of the projector network to 768, following the same parameters defined by (Su et al., 2022), and employed the LeakyReLU activation function, denoted as a.
computed using an independent PLM, GPT2-XL. Our observations align with the findings discussed earlier. The evasive text generated by EScaPe ex- hibits the lowest perplexity change compared to the paraphrasing techniques, Parrot and DIPPER. This alignment with our expectations is due to the KI. loss constraint imposed during training between the frozen PLM and the evasive soft prompt. This con- straint ensures that the generated text, conditioned by the evasive soft prompt, remains close to the original PLM and avoids significant divergence.
A.2
Additional Results
A.2.1 Tranferbility of EScaPe
In the Experiment section, we investigated two as- pects of transferability: 1) the transferability of EScaPe learned on one PLM to another PLM, and 2) the transferability of EScaPe learned on one de- tector to another detector. However, due to space limitations, we did not include the transferability results across PLMs for the DetectGPT detector. Additionally, solely presented the detector trans- ferability results for the news writing task. Table presents the transferability of EScaPe across PLMs when trained using the reward of DetectGPT, while Tables and display the transferability results across detectors. These tables exhibit similar obser- vations to those in our main Experiment section.
Writing Tasks
PLM
Method
News
Essay
Crea.
Parrot_PP
13.4
11.5
12.7
LLaMA
DIPPER PP
8.1
7.5
8.3
EScaPe
2.5
1.7
2.1
Parrol PP
15.2
14.4
13.9
Falcon
DIPPER PP
10.3
9.7
10.2
A.2.2 Quality of Evasive Text
EScaPe
3.3
2.6
2.8
We assessed the disparity between the original AI- generated text and the text generated after apply- ing evasive techniques in the main experiments by evaluating perplexity change. However, due to space limitations, we only presented the perplexity change for I.LaMA generations. Table in this section presents the complete perplexity change values for all the PLMs investigated. Perplexity is
Parrot PP
12.7
12.1
11.8
GPT-NeoX
DIPPER PP
8.5
8.1
8.9
EScaPe
2.3
1.4
1.9
Parrot PP
17.3
16.9
17.7
OPT
DIPPER
11.2
10.4
9.9
EScaPe
2.1
1.3
1.8
Table 7: Perplexity change of the AI text after applying the evasion method.


Reviews:
[{"review_id": "6r5u4J0fUn", "reviewer": "Reviewer_u6Zn", "summary": "", "questions": "1. I'd like to see more details about the F1 analysis. How many cases are false positives and false negatives?\n\n2. Since u use soft prompts to control the output of LLMs, similarly, the generated text can be controlled to exactly match the human-written text, then the detector is meaningless. In this way, the soft prompt method seems not suitable for this problem.", "limitations": "", "rating": 3, "confidence": 3, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their thoughtful comments and constructive feedback. Please see our responses below.\n\n> **Q1)** It seems that the paper only focuses on a scenario where the AI-generated text is mistakenly identified as human-written text by the detector. It does not address the opposite case, where human-written text might be inaccurately classified as AI-generated. Both of these two situations comprise the reliability of detectors.\n\n**A1)** Recently, the malicious use of AI, particularly AI-generated text, has become increasingly evident. Notable instances include AI-facilitated plagiarism [1] and the spread of misinformation using AI-generated text [2, 3]. Therefore, the most pressing reliability concern for AI-generated-text detectors lies in their possible misclassification of AI-written text as human-written. Malicious actors aiming to exploit AI for plagiarism or misinformation dissemination will invariably seek ways to exploit any vulnerabilities present in these detectors. It is precisely this imminent threat scenario that our paper wants to address, approached through an ethical hacking perspective.\n\n[1] Cotton et al., Chatting and cheating: Ensuring academic integrity in the era of ChatGPT. Innovations in Education and Teaching International, pp.1-12.\n\n[2] Yanget al., Anatomy of an AI-powered malicious social botnet. arXiv preprint arXiv:2307.16336.\n\n[3] Zhouet al., Synthetic lies: Understanding ai-generated misinformation and evaluating algorithmic and human solutions. In Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems (pp. 1-20).\n\n\n\n> **Q2)** The evaluation of evasive soft prompts is missing. Although it is proven to be effective to deceive the detectors, it is hard to convince whether current evasive prompts are best or not. For example, putting Table 1 and Table 2 together, we can find that the used prompt (learned after initializing from projection) in Table 2 can not achieve comparable performance with prompts learned from scratch. Thus, how to determine whether current prompts are good enough?\n\n**A2)** It's important to emphasize that soft prompts are primarily numerical vectors, which differ significantly from hard prompt templates in interpretability. This makes direct qualitative experiments on them impractical, shifting the focus to analyzing performance on the downstream tasks for which these prompts are tailored [1, 2]. Therefore, in order to measure the quality of evasive soft prompts, we provide an extensive empirical evaluation on various benchmark datasets and detectors, demonstrating our prompts’ remarkable performance. Also, our proposed evasive soft prompts demonstrate good performance on unseen detectors, further showing that they are indeed effective. \n\n[1] Lester et al., The power of scale for parameter-efficient prompt tuning. arXiv preprint arXiv:2104.08691.\n\n[2] Wang et al., No more fine-tuning? an experimental evaluation of prompt tuning in code intelligence. In Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (pp. 382-394).\n\n\n\n> **Q3)** The applications of the proposed method are limited. It must access the input embedding of used LLMs as discussed in Limitation. In addition, it is highly sensitive to the used detector and LLMs. Since it relies on the reward signal from the detector model, it requires the detector to be reliable, which seems in contrast to the motivation of this paper.\n\n**A3a)** Access to the input embedding is primarily a constraint only when dealing with closed-source proprietary LLMs. However, given the rising popularity and impact of open-source LLMs like Llama 2, we see a growing adoption of open-source LLMs for various writing tasks. Hence, we believe that having methods to evaluate the reliability of detectors against malicious threats of these open-source LLMs is both critical and essential.\n\n**A3b)** The proposed evasive soft prompts can be learned with the feedback of any known AI-generated-text detector on any open-source LLM. Through our experiments, we have demonstrated that the evasive soft prompts learned from a known detector can be effectively used to evade an unknown detector. This is shown in Figure 3 on page 8. We have also proposed a method for transferring the evasive soft prompts across LLMs and have empirically shown its effectiveness in Table 2. Thus, we disagree with the notion that evasive soft prompts are sensitive to the used detector and LLM.\n\n**A3c)** The primary aim of the evasive soft prompt is to evaluate the robustness of state-of-the-art (SOTA) AI-generated-text detectors when confronted with malicious users attempting to evade AI-text detection. These detectors are known for their accuracy and reliability in standard testing scenarios, where they consistently distinguish between AI-generated and human-written text. Our research advances this understanding by exposing potential vulnerabilities of these SOTA techniques when facing malicious usage of LLMs, approached through an ethical hacking lens. Given this context, we contest the notion that relying on generally reliable detectors could be considered a limitation in our study.\n\n\n\n> **Q4)**  I'd like to see more details about the F1 analysis. How many cases are false positives and false negatives?\n\n**A4)** As detailed in Section 5.1 (line 506) of our paper, our primary emphasis is on the F1 score for the \"AI\" class. This metric directly reflects our research objective: to measure the efficacy of evasive soft prompts in making AI-generated text appear \"Human\" to the detector. Therefore, the ground truth label is always 1 (\"AI\") since we are evaluating the detector exclusively on the text generated by the evasive soft-prompted LLMs. In this context, the notion of False Positives is not applicable as there are no class 0 samples that could be misclassified as class 1. Kindly refer to the table below for false negative values (calculated from approximately 200 samples from both the test and validation sets for a specified writing task).\n\n1.  TN values for the Table 1 of the paper\n\n| Detector. | Writing Task | News Writing |        |          |     | Essay Writing |        |          |     | Creative Writing |        |          |     |\n|-----------|--------------|--------------|--------|----------|-----|---------------|--------|----------|-----|------------------|--------|----------|-----|\n|           | **PLM ->**          | LLaMA        | Falcon | GPT-NEOX | OPT | LLaMA         | Falcon | GPT-NEOX | OPT | LLaMA            | Falcon | GPT-NEOX | OPT |\n|           |              |              |        |          |     |               |        |          |     |                  |        |          |     |\n| **OpenAI-FT** | Original     | 15           | 21     | 10       | 3   | 25            | 23     | 35       | 12  | 18               | 25     | 13       | 6   |\n|           | Parrot_PP    | 28           | 34     | 25       | 11  | 31            | 30     | 41       | 25  | 26               | 33     | 20       | 15  |\n|           | DIPPER_PP    | 49           | 62     | 47       | 58  | 52            | 65     | 54       | 63  | 48               | 65     | 50       | 56  |\n|           | EScaPE       | 122          | 121    | 124      | 126 | 123           | 123    | 124      | 127 | 124              | 127    | 126      | 129 |\n| **DetectGPT** | Original     | 60           | 77     | 66       | 28  | 59            | 71     | 74       | 30  | 63               | 84     | 70       | 26  |\n|           | Parrot_PP    | 82           | 87     | 89       | 47  | 77            | 91     | 93       | 52  | 70               | 98     | 88       | 51  |\n|           | DIPPER_PP    | 104          | 101    | 99       | 90  | 105           | 98     | 103      | 93  | 108              | 104    | 100      | 89  |\n|           | EScaPE       | 115          | 104    | 109      | 121 | 117           | 109    | 108      | 123 | 117              | 105    | 111      | 124 |\n\n\n2.  TN values for the Table 2 of the paper\n\n|            |            | Writing Task |       |       |\n|------------|------------|--------------|-------|-------|\n| **Source PLM** | **Target PLM** | **News** | **Essay** | **Crea.** |\n| **LLaMA**      | Falcon     | 112          | 111   | 115   |\n|            | GPT-NeoX   | 114          | 114   | 117   |\n|            | OPT        | 120          | 121   | 123   |\n| **GPT-NeoX**   | LLaMA      | 120          | 121   | 122   |\n|            | Falcon     | 117          | 119   | 121   |\n|            | OPT        | 123          | 123   | 124   |\n| **OPT**        | LLaMA      | 117          | 118   | 119   |\n|            | Falcon     | 111          | 110   | 111   |\n|            | GPT-NeoX   | 114          | 114   | 117   |\n| **Falcon**     | LLaMA      | 117          | 120   | 122   |\n|            | GPT-NeoX   | 118          | 122   | 123   |\n|            | OPT        | 119          | 121   | 123   |\n\n\n\n3. TN values for the Figure 3\n\n\n\n*   DetectGPT -> OpenAI FT\n\n|          | Writing Task |       |       |\n|----------|--------------|-------|-------|\n| **PLM**      | **News**         | **Essay** | **Crea.** |\n| LLaMA    | 108          | 107   | 108   |\n| Falcon   | 99           | 100   | 100   |\n| GPT-NEOX | 104          | 102   | 104   |\n| OPT      | 116          | 115   | 116   |\n\n*   OpenAI FT -> DetectGPT\n\n|          | Writing Task |       |       |\n|----------|--------------|-------|-------|\n| PLM      | News         | Essay | Crea. |\n| LLaMA    | 114          | 115   | 114   |\n| Falcon   | 115          | 115   | 116   |\n| GPT-NEOX | 113          | 112   | 113   |\n| OPT      | 123          | 123   | 123   |\n\n\n\n> **Q5)** Since u use soft prompts to control the output of LLMs, similarly, the generated text can be controlled to exactly match the human-written text, then the detector is meaningless. In this way, the soft prompt method seems not suitable for this problem.\n\n**A5)** We find the statement \"similarly, the generated text can be controlled to exactly match the human-written text\" in the review somewhat ambiguous. If the reviewer is suggesting a scenario where a malicious actor orchestrates controlled text generation using a PLM to emulate the intricacies of human-written text with the intent of de, then that is precisely the behavior our proposed evasive soft prompt aims to simulate. Our intention is to highlight the vulnerabilities of existing detectors when confronted with such threat scenarios.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. The proposed method effectively reveals the unreliability of current AI-generated text detectors.\n\n2. The transferability of the evasive soft prompts enables the proposed method to be a universal prompt for current and future LLMs.", "reasons_to_reject": "1. It seems that the paper only focuses on a scenario where the AI-generated text is mistakenly identified as human-written text by the detector. It does not address the opposite case, where human-written text might be inaccurately classified as AI-generated. Both of these two situations comprise the reliability of detectors.\n\n2. The evaluation of evasive soft prompts is missing. Although it is proven to be effective to deceive the detectors, it is hard to convince whether current evasive prompts are best or not. For example, putting Table 1 and Table 2 together, we can find that the used prompt (learned after initializing from projection) in Table 2 can not achieve comparable performance with prompts learned from scratch. Thus, how to determine whether current prompts are good enough?\n\n3. The applications of the proposed method are limited. It must access the input embedding of used LLMs as discussed in Limitation. In addition, it is highly sensitive to the used detector and LLMs. Since it relies on the reward signal from the detector model, it requires the detector to be reliable, which seems in contrast to the motivation of this paper.", "questions_to_authors": "1. I'd like to see more details about the F1 analysis. How many cases are false positives and false negatives?\n\n2. Since u use soft prompts to control the output of LLMs, similarly, the generated text can be controlled to exactly match the human-written text, then the detector is meaningless. In this way, the soft prompt method seems not suitable for this problem.", "paper_topic_and_main_contributions": "This paper introduces an RL-driven technique for directing LLMs in producing text that can readily deceive AI-generated text detectors. The primary objective is to assess the reliability and trustworthiness of these AI-generated text detection systems. Additionally, the devised approach can be easily extended to other LLMs demonstrating similar performance levels.", "excitement": 3, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "F0QIzD85F0", "reviewer": "Reviewer_FphE", "summary": "", "questions": "A. Was there any human evaluation conducted for the text generated by these evasive prompts?\nB. Was there some qualitative analysis conducted to bucketize the ways in which the evasive prompts generate more human like texts?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 4, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their thoughtful comments and constructive feedback. Please see our responses below.\n\n> **Q1)** No human evaluation of the text generated by these evasive soft prompts is conducted. One cannot say if the generated text actually looks like human generated text or is indistinguishable to humans. \n\n>Was there any human evaluation conducted for the text generated by these evasive prompts?\n\n>Was there some qualitative analysis conducted to bucketize the ways in which the evasive prompts generate more human like texts?\n\n**A1)** The primary objective of the evasive soft prompting framework is to assess the reliability of current state-of-the-art detectors. We aim to guide the LLMs to produce text that successfully evades these detectors. While we cannot ensure that the generated text is indistinguishable to the human eye, our experiments confirm that it is indeed indistinguishable to the detectors. Even though we did not conduct any human evaluation or qualitative analysis of the text generated by the evasive soft prompted LLMs, as we discussed in section 5.3.1 of our paper, we employed the perplexity change measure to evaluate the quality of the text generated by our method, as utilized in related studies [1, 2]. We can gauge the magnitude of change in the generation by measuring an LLM's text perplexity before and after applying the evasive soft prompting technique. A significant difference in perplexity would indicate a considerable alteration. In our experiments, we observed that evasive soft prompting led to minimal changes in perplexity, especially when compared to paraphrasing-based perturbations introduced in [1] and [2]. This suggests that the text generated by the evasive soft-prompted LLM maintains a quality consistent with that produced by the original LLM.\n\n[1] Sadasivanet al., Can ai-generated text be reliably detected?. arXiv preprint arXiv:2303.11156.\n\n[2] Krishnaet al., Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. arXiv preprint arXiv:2303.13408.\n\n\n\n> **Q2)**  No examples to illustrate how this approach prompts PLMs to generate text that is more human-like\n\n**A2)** Please find below some illustrative examples of evasive soft-prompted LLM generations. These examples stem from the news writing task. For these illustrations, we employed the following two hard prompts to query the LLM.\n\n*   Alton Sterling’s death appears to be another police shooting that was both legal and preventable\n*   More than 40 killed in Yemen suicide attacks\n\n**Warning:** It's important to note that these generated examples may contain misinformation. For ethical reasons, we have refrained from publicly sharing these samples.\n\n| **PLM** | **Original** | **EScaPe** |\n|:---:|:---:|:---:|\n| **Llama** | “The president’s response to this incident is entirely appropriate,” he added. “He has correctly acknowledged that race relations are a serious problem in the United States. And as he indicated, he is committed to finding a way to improve the lives of all Americans.” President Barack Obama spoke with Dallas police chief David Brown on Wednesday to express his condolences for the police officers who were gunned down in the city. He also offered his “thoughts and prayers to the families of Alton Sterling and Philando Castile, as well as to all the victims of violence across our country.” “This kind of violence is no way to make any point,” he said. “There is no justification for violence against law enforcement. None. Those who choose to violence against police officers are criminals, and thugs, and, make no mistake, they are terrorists. They are traitors. There’s no other word for it.” The president urged Americans to “come together as one united people.” President Obama said he was “heartbroken” about the senseless and tragic deaths of the police officers... | The details are still emerging, but according to the police department’s account, Sterling was shot by police after being confronted outside a Baton Rouge convenience store. Sterling’s death is the latest in a string of black men killed by police in recent weeks, and it follows other recent police shootings of African-American men that have provoked outrage from communities across the country. In the wake of those shootings, many people have called for a national conversation about race, policing, and the criminal justice system. In the wake of Sterling’s shooting, many people have called for a national conversation about race, policing, and the criminal justice system. This is a good time for that conversation, and a good time for all of us to think about what we can do to help make our communities safer and more just. People of color are disproportionately likely to be victims of crime, and people of color are disproportionately likely to be arrested and imprisoned for crimes. This means that people of color are more likely to be harmed by police officers, and they are more likely to be harmed by the people they’re trying to protect... |\n|  | A suicide bomber killed at least 40 people at a mosque in southern Yemen on Friday, while a separate blast at a funeral killed at least 10 in Sanaa, a security official said. The official said the bombing at a mosque in Lahij province killed 40 people and wounded 30. The bomber was a woman and the target was a popular Sheikh who is a prominent figure in the province, he said. Separately, a bomb blast in the capital Sanaa killed at least 10 people and wounded 40 others, the official said. He said a suicide bomber at a funeral killed those people in the Salh district of Sanaa... | The bombers struck a mosque and a residential area in a Shiite-dominated neighbourhood in the capital, Sanaa A child is brought to a hospital after an airstrike by the Saudi-led coalition, in Sanaa, Yemen, March 31, 2018. Reuters At least 40 people have been killed in a pair of suicide attacks in Yemen, including 28 at a mosque, officials said. The bombers struck a mosque and a residential area in a Shiite-dominated neighbourhood in the capital, Sanaa, on Monday. The Shiite rebels known as Houthis, who are aligned with Iran ... |\n| **Falcon** | The 37-year-old black man was shot and killed after allegedly threatening someone with a knife, according to the Baton Rouge Police Department. The officers’ body cam footage suggests otherwise. A pair of officers was dispatched to investigate a man allegedly threatening someone with a knife at the All Star Food Store in Baton Rouge, Louisiana. After arriving, the officers “engaged” with Alton Sterling, who was standing outside the store, according to the BRPD. According to the department, “one officer fired his weapon and struck Sterling and he fell to the ground.” The department said Sterling was pronounced dead at a local hospital. But the department did not specify if Sterling’s knife was ever recovered or how he was allegedly threatening someone. Local media have reported that Sterling was shot in the back, but the BRPD’s timeline does not mention this. A report from the Advocate describes Sterling as a “disturbance.” The Advocate quotes Lt. Don Kelly as saying, “one officer was involved in a disturbance and a subject was disarmed.” The Advocate spoke to several people on the scene, who said Sterling was walking when the officers arrived... | The 37-year-old, who was black, was holding a gun at the time that he was shot dead by police. However, he was not a threat to the officers who were responding to a call of a man threatening people with a gun. The tragic incident took place on July 5, 2016, in Baton Rouge, Louisiana. The shooting occurred as Sterling was walking down the street. According to the police, he was allegedly threatening people with a gun. A security camera at the scene captured the incident. The video of the incident shows that Sterling was not threatening anyone when the police arrived on the scene. In fact, he was walking away from the police and was not facing them. A local police officer, Blane Salamoni, shot Sterling. Salamoni’s partner, Howie Lake II, also shot him with his Taser. Then, they both shot him in the chest with their guns. Even though the police have a history of shooting black people, Sterling’s death has not triggered any protests... |\n|  | A suicide bomber struck near the defence ministry in the Yemeni capital Sanaa on Wednesday, killing at least 52 people and wounding 122 in the latest in a series of attacks in the country, officials said. A string of attacks on military and civilian targets have hit the country since Al-Qaeda launched a Yemeni branch of its insurgency in 2009 and the army has struggled to contain them. The attack was the deadliest in Sanaa since October 2011 when 52 people were killed in a triple bomb attack blamed on Al-Qaeda. A security official and a medic said the bomber detonated his explosives at a checkpoint in the street leading to the defence ministry, which is also home to the presidential palace. \"The bomber detonated himself outside the checkpoint,\" a security official told AFP, adding that he was targeting \"one of the key locations of Sanaa\". A medic from Sanaa's main hospital, who asked not to be named, told AFP that 52 people were killed and 122 wounded. A statement from the defence ministry said \"the blast took place as a suicide attacker detonated a car packed with explosives outside a checkpoint to the defence ministry\". The statement said three guards were killed and two others injured... | SANAA, Yemen (AP) — Two suicide car bombs slammed into Yemen's Defense Ministry and the country's intelligence agency Tuesday, killing at least 44 people, including top security officials, in a devastating assault that raised fears of more such attacks. The Islamic State affiliate in Yemen claimed responsibility for the assault on the Defense Ministry, which was targeted by a suicide bomber who drove his explosive-laden car into the building's front gate. The attackers then stormed the ministry, leaving a large crater and a billowing cloud of smoke, before they were killed in a counter-attack by troops. IS militants also claimed responsibility for the second attack, which targeted the Sanaa headquarters of the General Intelligence Directorate, the country's main intelligence service. The country's powerful Houthi rebels, who are locked in a battle with a Saudi-led coalition for control of the country, denied any involvement in the attacks. The strikes were the deadliest in Yemen in recent months. At least 44 people were killed in the bombings, including the Interior Ministry's spokesman, the Yemeni presidency spokesman, the head of the country's national security council, the deputy head of the defense ministry and the head of the presidential guard, according to the country's government... |\n| **OPT** | The Baton Rouge police officer who shot and killed Alton Sterling has been identified as Blane Salamoni, a three-year veteran of the force.  His name was released by the East Baton Rouge Parish District Attorney’s Office Tuesday afternoon.  Salamoni responded to a call about a man with a gun at the Triple S Food Mart in Baton Rouge at approximately 5:30 p.m. on Tuesday.  Police said Salamoni shot and killed the man after he refused commands to surrender, fought with the officer, and reached for a gun in his pants.  Salamoni said on body camera footage obtained by CNN affiliate WBRZ that he was “fearing for his life” because the man threatened to shoot him and others.  But a witness who was shopping at the store at the time said Sterling never threatened the officer. The man told CNN affiliate WAFB he saw Sterling get shot.  “I’m just shocked,” said the witness, who was not identified. “I don’t know what to think, really. I just don’t understand why the officer was using lethal force.”  The video footage released by WBRZ showed Sterling pinned to the ground by a group of officers, struggling to get up, and telling the officers that he didn’t have a gun... | An autopsy shows the 44-year-old black man had six wounds to his chest and back, one of them fatal. Police said he was carrying a gun, but it was loaded with the safety off.  One officer is on paid leave; two others have been placed on administrative duty.  The case may remind some Americans of Michael Brown and Eric Garner. But the two cases are different, and the differences can be instructive.  The Garner case was about a police officer’s use of an illegal chokehold. The Brown case was about a police officer’s use of a banned chokehold, and the officer was justified in his use of deadly force. The Garner case was a tragedy. The Brown case was an avoidable tragedy.  The Alton Sterling case is also different. The officers involved in the shooting were responding to a 911 call about a man threatening people with a gun. It is unclear if Sterling was the person holding the gun. But it is clear that the officers did not know that.  The police are required to do a “reasonable” investigation when they are called to a shooting. But “reasonable” means more than “good enough.” It means more than getting the facts straight. It means getting to the bottom of what happened.  The officers say they saw Sterling fight with two people. They said Sterling grabbed one of the people and tried to take his gun. The video shows Sterling and the two men walking away from the officers. They are not fighting. They are not threatening to harm anyone. They are not even making physical contact... |\n|  | SANAA, Yemen — Yemeni officials say more than 40 people have been killed and dozens more wounded in two suicide attacks on a Shiite mosque in the country”s south. The officials say the attacks Tuesday in the town of Bayda, about 60 miles north of the city of Aden, were carried out by a suicide bomber and his two sons. They say the suicide bomber was shot by security guards, but he detonated the explosives. The second bomber then detonated his explosives next to his father, killing both. The officials spoke on condition of anonymity because they were not authorized to brief the media. Yemen”s Shiite rebels, known as Houthis, have carried out previous attacks on Shiite mosques... | At least 41 people were killed in suicide attacks in two Yemeni cities on Saturday, officials said, in the deadliest day for civilians in the country since last September.  In the southern city of Aden, security officials said two bombers blew themselves up at a military checkpoint near the city's main university, killing at least 25 people.  In the capital Sanaa, a suicide bomber set off his explosives outside the compound of the country's top military intelligence agency, killing at least 13 people, including six members of the agency.  The attacks come amid growing regional and international concern about the deteriorating security situation in Yemen, which is also being fought by Iran-backed Houthi rebels and a Saudi-led coalition.  The fighting has left more than 7,000 people dead and pushed the impoverished country to the verge of famine.  The Houthis have stepped up their attacks in recent months and claimed responsibility for the attack on Aden's airport on November 2, which killed 25 people, including a senior United Nations official... |\n| **GPT-NEOX** | The Cleveland police department has been under intense scrutiny since the Michael Brelo verdict.  Cleveland officer Timothy Loehmann shot and killed 12 year old Tamir Rice last year while he was playing with a pellet gun. The boy was holding a toy gun and never posed a threat to the officers. The only reason the officers stopped to check on Rice was because he was in a park that was known for gang activity. The officers shot and killed Tamir within two seconds of seeing him.  Rice’s death sent a shockwave through the community and across the nation. Protest erupted in Cleveland and other cities around the country. The officers were cleared of any wrongdoing.  The Brelo verdict may have finally forced the city and department to take a close look at the police department. The city has agreed to pay $6 million to the family of Brelo.  Sterling’s death occurred while he was on the ground. Police officers were called to the scene by witnesses that saw him being beaten by a group of men. The officers arrived on the scene and witnessed Sterling being pinned to the ground by a group of men. Sterling was unresponsive and he did not appear to be breathing... | On July 5, 2016, Alton Sterling was shot and killed by two police officers in Baton Rouge, Louisiana. Sterling was shot in the chest after an altercation with two police officers. The officers were responding to a call of a man in a International brand jacket selling CDs near a convenience store.  The officers were responding to a call of a man in a International brand jacket selling CDs near a convenience store.  The shooting took place in a convenience store parking lot. Surveillance video shows Sterling being tackled by one of the officers and then being shot.  Police were called to the scene because of a man selling CDs.  Sterling was shot in the chest by one of the two officers. He was taken to the hospital, but was pronounced dead.  There is no evidence that Sterling was armed or that he posed an immediate threat to the officers.  Alton Sterling’s death appears to be another police shooting that was both legal and preventable.  A legal shooting is one that is justified by the officer’s belief that his life or someone else’s life is in danger or that there is a threat of immediate bodily harm to the officer or others. A shooting is preventable when the officer could have taken other reasonable steps to avoid the shooting... |\n|  | At least 40 people have been killed and dozens more wounded in two separate suicide attacks in Yemen, officials say.  In one attack, a bomber wearing an explosives vest targeted an army base in the southern province of Shabwa, killing and wounding a number of soldiers.  Yemen's army has stepped up operations against al-Qaeda militants in the wake of a recent deadly militant assault on the security forces in the capital, Sanaa.  Meanwhile, a suicide car bomber targeted a police patrol in the city of Zinjibar, killing four people, local officials say.  The attacks come as the US is discussing how to support the Yemeni government amid reports that it is preparing for a major offensive against al-Qaeda strongholds in the country.  The US has been carrying out an air campaign against al-Qaeda in the Arabian Peninsula (AQAP) since last year... | (AP) SANAA, Yemen - More than 40 people were killed Wednesday in aoremulti-pronged suicide attacks targeting mosques and military checkpointsin northwestern Yemen. The blasts also wounded at least 50 others.  The bombings in Maarib province, which is located near the border with Saudi Arabia, underscore the challenges President Abed Rabbo Mansour Hadi faces in bringing stability to a country torn by a yearlong uprising.  There was no immediate claim of responsibility for the attacks, but al-Qaida-linked militants and separatist insurgents have exploited the chaos in Yemen. The military is increasingly stretched as it battles the rebels, who seized control of several cities in the south and parts of the west this year.  The blasts struck during the Muslim holy month of Ramadan, in which al-Qaida and other militant groups have often launched attacks.  Maarib is one of three provinces in the country where the rebellion has broken out. The other two are Abyan and Shabwa.  The U.S. Embassy in Sanaa issued a statement condemning the attacks, saying they \"represent a sad day for the Yemeni people and for the Yemeni government's efforts to build national unity and stability.\" It also called for an investigation.  In the southern city of Aden, a suicide bomber targeted a mosque, killing at least three people and wounding a dozen, said security officials.  The blast occurred at the entrance of a mosque during the time for evening prayers, they said, speaking on condition of anonymity because they were not authorized to talk to journalists.  In the central province of Bayda, a suicide bomber killed himself and four others at a mosque after meeting with other militants, said the officials, who also spoke on condition of anonymity because they were not authorized to talk to journalists... |", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "- The authors propose a novel approach using reinforcement learning to generate evasive soft prompts to evaluate the reliability of AI text detectors. This is an important application in these times with the increased use of generative AI.\n- The authors conduct an extensive experimentation across 2 different AI text detectors, with different PLMs, baselines and datasets.\n- The transferability of the evasive prompts is one strength as it enables checking future language models as well.\n- The evaluation datasets cover a very relevant threat scenario.\n- Experimentation is extensive and description of setup details is also precise and clear.", "reasons_to_reject": "- No human evaluation of the text generated by these evasive soft prompts is conducted. One cannot say if the generated text actually looks like human generated text or is indistinguishable to humans. \n- No examples to illustrate how this approach prompts PLMs to generate text that is more human-like\n", "questions_to_authors": "A. Was there any human evaluation conducted for the text generated by these evasive prompts?\nB. Was there some qualitative analysis conducted to bucketize the ways in which the evasive prompts generate more human like texts?", "paper_topic_and_main_contributions": "- This work proposes an adversarial technique to analyze the robustness of AI v/s Human generated text detection models. \n- Their technique generates \"evasive soft prompts\" that can guide language models to produce adversarial text that evades detection of human v/s AI generated text. These evasive prompts are learnt through reinforcement learning.\n- Once these prompts are learnt on the source model, they can be transferred to other models with further RL fine-tuning, enabling testing against future language models.\n- They show that existing (AI v/s human generated text) detectors are unreliable when subjected to adversarial attacks.", "excitement": 4, "reproducibility": 4, "ethical_concerns": "Yes", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {"Justification_for_Ethical_Concerns": "- Possible risks of this approach is that humans can use these evasive prompts to generate more human like texts which can evade these text detectors to generate more human like text and may possibly be misused?"}}, {"review_id": "XSHIXD4KtZ", "reviewer": "Reviewer_wSah", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their thoughtful comments and constructive feedback. Please see our responses below.\n\n>**Q1)** Can authors explain why utilize reinforcement learning to update the prompt parameters? Why do not optimize evasive soft prompts as supervised learning (e.g., directly consider the label of the Detector as the human written)?\n\n**A1)** Our framework utilizes the detector's feedback (i.e., probability scores assigned to the labels 'human-written' and 'AI-generated') to guide the generation. Note that the generated text is a sequence of discrete tokens that do not allow the gradients (used for updating the text) to pass through the LLM. To bypass this differentiation problem, we propose to model the LLM equipped with our proposed soft prompts as a stochastic policy and leverage the *reinforcement learning* to directly perform the updates without the need for gradients.\n\n\n\n>**Q2)** But I also want to highlight that the more important point is how evasive soft prompts can help current detectors. Therefore, it will be better for this work, if the learned soft prompt can guide the Detector to detect which texts are generated by AI or not.\n\n**A2)** In our paper, our primary focus is to expose the vulnerability of detectors. This study is the key step to understanding the limitations of the detectors and creating defense mechanisms to robustify them against such malicious behaviors (some references). In other words, though our focus is on exposing the susceptibility of the detectors through proposing the evasive soft prompt, our study is indirectly helping the detectors to become more robust.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. This topic sounds interesting. To avoid misuse of LLMs, some applications like detectors are proposed to address detect the text whether belongs to AI generation. And this paper investigates how to evaluate the reliability of these detectors, and this motivation is great.\n2. The proposed method applies reinforcement learning to optimize trainable prompt parameters and thus to mislead the detector. To extend its transferability, the authors employ projector layers to map the trainable prompt to other PLMs.\n2. The writing of this paper is great.  ", "reasons_to_reject": "1. Can authors explain why utilize reinforcement learning to update the prompt parameters? Why do not optimize evasive soft prompts as supervised learning (e.g., directly consider the label of the detector as the human written)? \n2. The motivation of this paper is interesting. But I also want to highlight that the more important point is how evasive soft prompts can help current detectors. Therefore, it will be better for this work, if the learned soft prompt can guide the detector to detect which texts are generated by AI or not.", "questions_to_authors": "", "paper_topic_and_main_contributions": "Recently, a lot of AI-generated text applications have emerged due to the powers of pre-trained language models. However, these AI-generated texts also bring a risk of misuse, and many high-performing detectors have been developed. In this paper, the authors investigate how reliable these detectors are. To answer this problem, this paper introduces a novel approach that prompts any PLM to generate texts by evading these high-performing detectors.  It utilizes a universal evasive prompt to guide PLMs in producing \"human-like\" text which can mislead the detectors. Extensive experiments validate the efficacy of the evasive soft prompts in their evasion of detectors.", "excitement": 3, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper presents a reinforcement learning-based technique to direct language models (LLMs) in generating text that can deceive AI-generated text detectors. The aim is to evaluate the reliability and trustworthiness of these detection systems. The proposed approach is transferable to other LLMs with similar performance levels.

Strengths:
* The paper addresses an important and timely issue, assessing the reliability of AI-generated text detectors.
* The proposed method effectively reveals the unreliability of current AI-generated text detectors.
* The transferability of the evasive soft prompts makes the proposed method applicable to current and future LLMs.
* The paper is well-written and has extensive experiments across different AI text detectors, baselines, and datasets.

Weaknesses:
* The paper does not fully address the case where human-written text is incorrectly classified as AI-generated, affecting the overall reliability of detectors.
* The evaluation of evasive soft prompts is missing, making it difficult to determine the effectiveness of the current prompts.
* The paper's applications are limited, as it requires access to input embeddings of used LLMs and is sensitive to the used detector and LLMs.
* No human evaluation of the text generated by the evasive soft prompts is conducted, so the actual resemblance to human-generated text remains unclear.

Overall, this paper has merits and makes significant contributions to the field. However, it has some key weaknesses that may benefit from further revisions. The topic is interesting, and the motivation is strong, but addressing the concerns raised by the reviewers could further strengthen the paper.
Decision: Accept-Findings