LLMDet: A Third Party Large Language Models Generated Text Detection Tool
Authors: Kangxi Wu
Liang Pang
Huawei Shen
Xueqi Cheng
Tat-Seng Chua
Venue: EMNLP 2023 Findings (2023)
Keywords: Text Detection
Large Language Model
Fine-grained Tracing
Proxy Perplexity
TL;DR: We propose LLMDet, a model-specific, secure, efficient, and extendable detection tool for Large Language Models Generated Text, which can determine the source of the generated text.

Abstract: Generated texts from large language models (LLMs) are remarkably close to high-quality human-authored text, raising concerns about their potential misuse in spreading false information and academic misconduct. Consequently, there is an urgent need for a highly practical detection tool capable of accurately identifying the source of a given text.
However, existing detection tools typically rely on access to LLMs and can only differentiate between machine-generated and human-authored text, failing to meet the requirements of fine-grained tracing, intermediary judgment, and rapid detection. Therefore, we propose LLMDet, a model-specific, secure, efficient, and extendable detection tool, that can source text from specific LLMs, such as GPT-2, OPT, LLaMA, and others. In LLMDet, we record the next-token probabilities of salient n-grams as features to calculate proxy perplexity for each LLM. By jointly analyzing the proxy perplexities of LLMs, we can determine the source of the generated text. Experimental results show that LLMDet yields impressive detection performance while ensuring speed and security, achieving 98.54\% precision and about $\times 5.0$ faster for recognizing human-authored text. Additionally, LLMDet can effortlessly extend its detection capabilities to a new open-source model. We will provide an open-source tool at \url{https://github.com/TrustedLLM/LLMDet}.

LLMDet: A Third Party Large Language Models Generated Text Detection Tool
Kangxi Wul Liang Pang'; Huawei Shen 1:2, Xueqi Chengl.? Tat-Seng Chua
Institute of Computing Technology, Chinese Academy of Sciences
2 University of Chinese Academy of Sciences
8 Nea-NExT Joint Lab, National University of Singapore
(wukangxi22s, pangliang, shenhuawei, cxq)@ict.ac.cn dcsctsênus. edu. sg
Abstract
LLaMA (Touvron et al., 2023a), OPT (Liu et al., 2021), ChatGLM (Du et al., 2022). These mod- els are capable generating coherent, fluent, and meaningful text. However, the formidable text gen- eration capabilities of generative language models have also raised concerns about their potential mis- use in domains such phishing, spreading false information, and academic fraud. Additionally, with the application of products like ChatGPT, the future abundance of machine muuchine-generated text data has the potential to contaminate genuine human- generated data (Hataya et al., 2022), altering the data ecosystem of the real world.
Generated texts from large language models (LLMs) are remarkably close to high-quality human-authored text, raising concerns about their potential misuse in spreading false in- formation and academic misconduct. Conse- quently, there an urgent need for highly practical detection tool capable of accurately identifying the source of given text. However, existing detection tools typically rely access to LLMs and can only differentiate between machine-generen
and human-authon authored text, failing to meet the requirements of fine-graa tne-grained tracing, intermediary judgment, and rapid de- tection. Therefore, we propose LLMDet, model-specific, secure, efficient, and extend- able detection tool, that can source text from specific LLMs, such as GPT-2, OPT, LLaMA, and others. In LLMDet, we record the next- token probabilities of salient n-gram as fea- tures caleulate proxy perplexity for each L.M. By jointly amalyzing the proxy perplexi- ties LLMss, we can determine the source of the generated text. Experimental results show that LLMDet yields impressive detection per- formance while ensuring speed and security, achieving 98 98.54% precision and about x5.0 faster for recognizing numan-authore text. Ad- ditionally, L.MDDe can effortlessly extend its detection capabilities to new open-source model. will provide an open-source tool at https://gi hhtp:b///gituu..... com/ TrsLttetddLLL/LLMDttt
Accordingly, the study of practical content gen- eration detection tools has attracted widespread attention from the community. Recently, the pri- mary focus of research is on approaching the text detection problem as binary classification task to distinguish machine generntte text and human- authored text, making it hard to assign responsibil- ity to a specific model or its provider. Nevertheless, Watermarking (Kirchenbauer et al., 2023) meth- ods necessitate altering the text generation process, leading compromise in the quality of the gen- erated content. Techniques like GPT-zero", Detect- GPT (Mitchell et al., 2023), and the classifier in OpenAI (OpenAI, 2023) require access to the de- ployed model, thereby resulting in high cost and intractability for third parties.
Thus, a practical LLM detection tool should possess the following capabilities, which are also the objectives of our method: Specificity: Merely focusing on identifying human and machine- generated text is insufficient for duty attribution. There is pressing need for the ability to recognize the specific model responsible for generating the text. Safety: Ensuring model security and mitigat- ing potential risks require a detection method that does not require accessing model parameters. This need is particularly urgent for commercial mod-
1 Introduction
Recently, the emergence of ChatGPT has heralded a "Cambrian Explosion" for generative large lan- guage models (LLMs). GPT-4 (OpenAI, 2023), Bard?, PaLM-2 (Anil et al., 2023), and other LLMs from internet companies are currently flourish- ing, while open-source communities are witness- ing a proliferation of open-source models like
"Corresponding author 'http:://opeaii. com/proouct//chatpt hhtps:///aard, gongle.com gomgg//e/
Phtps://gptzerr..m

---

els. Efficiency: With the increasing demand for detection and the exponential growth of models, it is crucial to develop detection algorithms that have low resource and low latency requirements. Extendibility: The detection tool should inher- ently possess the capacity to seamlessly accommo- date emerging model paradigms. This capability plays pivotal role in refining the detection ecosys- tem and effectively addressing the ever-expanding variety of LLMs.
tory detection results, demonstrating its robustness and adaptability.
2 Related Work
The existing methods for detecting generated text can be broadly categorized into two types: black- box and white-box detection (Tang et al., 2023).
2.1 Black-box Detection
Black-bor box detection methods can be further di- vided into three main branches: statistical learn- ing methods, supervised learning methods, and unsupervised learning methods. Traditional ap- proaches utilize statistical metrics such entropy, perplexity, and n-gram frequency for text classifica- tion (Gehrmann et al., 2019; Fröhling and Zubiaga, 2021).
Guided by the aforementioned capabilities, we propose pragmatic third-party detection method called LLMDet. Our approach is inspired by the observation that perplexity serves reliable signal for distinguishing the source of generated text, finding that has been validated in previous work (Solaiman et al., 2019; Jansen al., 2022; Mitchell et al., 2023). However, directly calculat- ing perplexity requires access to LLMs, which com- promises both safety and efficiency. In LLMDet, we address this challenge by capturing the next token probabilities of prominent n-gram in texts priors. This enables us to efficiently compute a proxy perplexity for each LLM. By comprehen- sively analyzing the proxy perplexities of LLMs, we can accurately trace the specific language model responsible for generating the text. Notably, our method eliminates the need to access the model at the detection end, ensuring the security of pa- rameters in large-scale models. It also offers the potential for seamless integration with emerging open-source models, well proprietary models under appropriate licensing. These factors con- tribute to the widespread adoption of our approach.
Compared to statistical learning methods, su- pervised learning methods are more commonly used in text detection. These works leverage text features train supervised classification model specifically designed for the detection of machine- generated text (Bakhtin et al., 2019; Uchendu et al., 2020; Fagni et al., 2021; OpenAI, 2023).
However, the study conducted by (Uchendu et al., 2020; Chakraborty et al., 2023) demonstrates that limitation of supervised models is the po- tential occurrence of overfitting within the domain, resulting in poor detection performance outside the domain.
To address the limitations of supervised learning methods, unsupervised learning methods such as DetectGPT (Mitchell et al., 2023) and GPT-Zero have been developed. These approaches utilize checks perplexity and burstiness in the text determine whether it is artificially generated or au- thored by a human.
LLMDet exhibits outstanding overall detection performance, with an F1-Macro score of 88.14 and near-perfect results for @@2, indicating that highly ranked predictions cover the correct labels for the majority of instances. Particularly notable is its exceptional discriminative ability in human text, ALLaMA-generatee text, and BART-generated text. In terms of detection efficiency, LLMDet significantly outperforms other similar methods such fine-tuned RoBERTa, GPT-zero*, Detect- GPT (Mitchell et al., 2023), and True-PPL with respect to speed. And, it has very low resource re- quirements, as text detection can be accomplished solely on a CPU, enabling easy accessibility for wider range of users. Additionally, when tested on perturbated text data, LLMDet produces satisfac-
2.2 White-box Detection
White-box detection methods require full access to LLMs, thereby enabling control over the gen- eration behavior of the model or embedding wa- termark within the generated text (Abdelnabi and Fritz, 2021; Ucoka et al., 2021; Dai et al., 2022). This enables the tracking and detection of machine- generated text within white-box settings.
The current state-of-the-arr approach, as pro- posed by (Kirchenbauer et al., 2023), partitions the model's vocabulary into whitelist and black- list tokens when predicting the next token given a prompt. During text generation, the goal is to
"haps://gptzero.me

---

produce whitelist tokens as much as possible, effec- tively creating strong watermark. Third parties can determine if the text is machine-generated by analyzing the frequency of whitelist tokens within the text. While watermarking methods offer ro- bustness and interpretability, they can compromise the quality of the generated text and may not be highly practical in certain scenarios (Sadasivan al., 2023).
to keep up with technological advancements and continuously enhance its own detection ecosystem to address the challenges posed by new models.
4 LLMDet
Combining the aforementioned motivations, we introduce LLMDet, a text detection tool capable of identifying the sources from which the text was generated, such as Human, LLaMA, OPT, or others.
The overall framework of the system is illustrated in Figure and consists of two main components: Dictionary Construction (see 4.1) and Text De- tection (see 4.2).
3 Motivation
A practical LLMs detection method should possess the characteristics of being specific, secure, effi cient, and extensible, which serve as the intention for developing our third-party detection tool.
The construction of the dictionary is performed offline by us or provided by the model owner, ensur- ing its independence from external systems. This ensures the fulfillment of the four characteristics proposed for our detection tool in $ 3. The text de- tection component can be distributed to tool users, allowing third-party detection without requiring the possession of the model. For the specific algorithm, please refer to Appendix A.
Specificity: The field of LLMs constantly evolves, indicating that a sole focus on identifying human and machine- machine-generated text is insufficient meet detection requirements. From the perspec- tive of copyright protection for works generated by artificial intelligence (Aplin and Pasqualetto, 2019), an ideal detection tool should be capable of identifying the specific language model responsible for generating the text, thereby exerting a lasting impact on intellectual property rights protection. Safety: The majority of existing detection meth- ods require accessing or modifying model parame- ters, which is deemed unacceptable for commercial models. Once the model is loaded, represents a financial loss for the owner and can also expose the model to potential attacks (Kurita et al., 2020). Hence, considering the security of the model, it is desirable to minimize the need for model loading during the detection process.
4.1 Dictionary Construction
Drawing from previous detection works, such as DetectGPT (Mitchell et al., 2023) and GPT-Zero", perplexity has shown promising results in detecting machine-generated text. Therefore, we consider uti- lizing perplexity as measurement of identifying the generated text from different LLMs. However, calculating the actual perplexity requires access to LLMs, which goes against the safety and effi ciency characteristics of the practical LLMs detec- tion method.
Perplexity is a measure used to evaluate the per- formance of language models. Specifically, it is the exponential average of the negative log likelihood of sequence generated by the model. The per- plexity score is calculated based on the probability of generating the next word, given all the previous words in the sequence, e.g. p(r,, xz4). In order to calculate the perplexity of text without access- ing the model, we need approximate p(æ;, r<i) by replacing कeс with n-gram thus dictionary should be constructed, with r--ram keys and the next token probabilities as values. This dictionary serves as prior information during the detection pro- cess, allowing us to compute the proxy perplexity of the text instead of the true perplexity. The con- struction process can be divided into three steps:
Efficiency: With the growing number of users utilizing large-scale models, the future of text de- tection is poised for exponential expansion in terms of demand and user base For instance, in the realm of education, there is significant need for text de- tection to combat cheating and plagiarism (Cotton al.), despite often constrained hardware condi- tions. This poses a formidable challenge exist- ing detection methods. Hence, the pursuit rapid and sesource-efficiees approaches has become a pivotal direction in developing efficient detection algorithms.
Extendibility: As for multi-model generated text detection approaches, is crucial seamlessly adapt to emerging model paradigms and extend de- tection capabilities to new models. This is because an excellent detection tool is not static but needs
hhttps///pptcrro.me

---

Dictionary Construction
Text Detection
Dictioma
Collection
GPT2
Collaticn
Malicle
GPT2
NuntTruum Inluuilly Sumplig
GPT2 Prusy
Perpeeily
Ranker
Digheme
Drgnene
Sampbng
Amticcall ginsligtt
Batiiaa
t
OPI
Colactss
Large aeglugh Mood
OPT
diaddlogee agent
GPI Prixy Perplexity
6.2
OPT
You are
011
Banan
Whatia
GPT Dictionary
LLaNA Proxy Perpleslly
Calletion
Suitick
D-grame
6.1
Pornet
Ii grarns
Dictionary
Provy Perplexity Estimation
Generated Text Samples
2. Word Frequency Statistic
3. Neat Tolus Prubability Sampling
5. Result Ranking
Figure 1: The detailed processes of the proposed tool LLMDet. It contains main phases, dictionary construction and text detection. The dictionary construction phase is carried out offline by us or provided by the model holder, independent external systems. The text detection phase can accessed by the tool user who, as third party, performs text detection without holding the model.
1) Generated Text Sampling: Due to the ab- sence of readily available model-generated text data, it is necessary to collect a sufficient number of corresponding generated texts for each model. We provide a prompt dataset and, for each model, randomly sample an equal number of prompts. We these prompts to generate corresponding texts and collect the required text data.
space is required, e.g. Onn If ri is set to 4, k is set to 100,000 (much smaller than the number of 4-gram), and K is set to 10,000 (most vocabulary size is larger than that), we need almost 22GB to store only probabilities for one model. Thus, we have to reduce the storage in practical use. The reduction can be considered in two folds, 1) se- lect suitable n. k and K, 2) reduce Float64 Float 6 and represent n-gram as Int16. We find that does not significantly affect LLMDet, while it reduces storage costs by approximately 11 times about 0.5GB.
2) Word Frequency Statistics: In this phase, we first utilize the generated texts collected in the previous step to perform n-gram word frequency statistics (Pang et al., 2016). The n-gram range from 2-gram to n-gram. Subsequently, we select the top-k n-gram based on their frequency.
In the end, constructed n-gram and proba- bility dictionary for each LLM, which was utilized for calculating proxy perplexity. The above three steps are repeated on GPT-2 (Radford et al., 2019). OPT (Liu et al., 2021), UniLM (Dong et al., 2019). LLaMA (Touvron et al., 2023a), BART (Lewis et al., 2019), T5 (Raffel et al., 2020), Bloom (Scao et al., 2022) and GPT-neo (Black et al., 2022), re- spectively.
3) Next Token Probability Sampling: In this phase, we use each n-gram s obtained from word frequency statistics as samples. We input the first n - 1 token 8]1=--1] into the corresponding gener- ative models for predicting next-token probabili- ties p" = vocabulary. Subsequently, we sample the top-K words based on next-token probabilities. For n- gram with different values of n, the optimal value of K for top-K sampling may vary.
where [W] is the size of
4.2 Text Detection
In $ 4.1, we have obtained the dictionary of r--gram and their probabilities. Therefore, we can use the corresponding dictionary of each model prior in- formation for third-party detection to calculate the proxy perplexity of the text being detected on each model. Immediately after, by inputting the proxy perplexity as a feature into trained text classifier. we can obtain the corresponding detection results.
We should consider the optimal values, the de- gree of n-gram, the number of n-gram k, and the number of next token probabilities K from two aspects: detection performance and storage cost. In terms of detection performance, the larger k. and K may improve the detection performance of LLMDet, this enables the proxy perplexity to approximate the true perplexity.
4.2.1 Proxy Perplexity Estimating
In terms of storage cost, due to the data type of the sampling probabilities being Float64 and n- gram being a string, a significant amount of storage
During text detection, for the input text X, our initial task is to estimate the proxy perplexity of

---

this text across various large language models as vector of feature information.
is denoted as,
Taking the estimation of proxy perplexity on
A = log (pi) + log
(2)
Modelm as an example, we begin by tokeniz- ing the input text X to obtain its sequence X 2f,, Te), assuming the length of the tok- enized sequence denoted as
with L is the length of the text to be detected, c denotes the number of LLMs.
Finally, apply softmax to the smoothed prob- abilities to obtain [Po. pi..... Pe.] Consequently, the detection results are transformed into the proba- bility of Model; is pú: Subsequently, the detection results are sorted based on the magnitude of the probability values in the result dictionary, yiclding the final detection outcome,
Then, the proxy perplexity of the sequence X on Model, can be mathematically represented by the following function, denoted as Proxy_PP PPL:
= - Σ log (xv n-gram). (I)
[Po, Pi...., ........ Pel softmax (1po PI.... Pel) (3)
More specifically, logp (ar; n-gram) represents the logarithmic likelihood of the i-th token, condi- tioned on the preceding tokens Tei matching the n-gram in the dictionary of Modelm. The like- lihood probability p (z: n-gram) corresponds to the value associated with the matching n-gram in the dictionary.
5 Experiments
We conduct experiments based on proxy perplex- ity and true perplexity according to the methods proposed in 4. By comparing the performance of the text detectors based on fine-tuned RoBERTa, proxy perplexity, and ture perplexity, we find that our proposed method outperforms existing meth- ods in terms of detection efficiency, security, and scalability while ensuring the performance of the detector.
Similarly, by repeating the above procedure on other models, we can obtain the proxy perplex- ity of the detection text on the respective mod- els. These proxy perplexities constitute the fea- ture information vector for detection, denoted (roxx__PL,,,Proxy Proxy_PPL2.......... Prox...P..... sub- script e denotes the number of LLMs.
5.1 Datasets
In our experiments, we use Wikipedia paragraphs from the SQuAD context (Rajpurkar et al., 2016) and news articles from the Xsum (Narayan et al., 2018) dataset for extraction. We extract the first 5 phrases of each text data to form prompt dataset. During the text generation phase, for each LLM, randomly select 32,000 data samples from the prompt dataset input and have the model gen- crate corresponding text. The generated text from each model is evenly split into two parts: 16,000 samples for the statistical dataset and 16,000 sam- ples for the validation dataset. The statistical dataset is used for n-gram frequency counting. The validation dataset from LLMs, along with 16,000 samples collected from HC3 (Guo al., 2023) human -enertteeee text, form combined dataset for the training and validation of text detectors.
4.2.2 Result Ranking
Before result ranking, we initially estimate the proxy perplexity of the generated texts from each language model and buman-gencrated texts. This estimation allows us to obtain separate feature in- formation vector for each text. Subsequently, these vectors employed train text detector.
Next, we input the feature information vectors F, obtained during the proxy perplexity estimation phase, of the text to be detected into the trained text detector for result prediction, yielding prediction result, such as for given Model, the probability is denoted as Ps. It is important to note that denote the probability H uman as po-
However, due to the fact that the text detector is trained based on perplexity a feature, it is not sensitive to the length information of the detected text, resulting in suboptimal detection performance for some short texts. Therefore, it is necessary to apply a smoothing technique to the probabilities of the detection results in order to enhance the success rate of detecting short texts. The smoothing process
5.2 Metries
To evaluate the ability of the detector distin- guish between text generated by different LLMSs and human-written text, we employ precision (P), recall (R), and Fl score to assess the discriminative

---

Table 1: Experimental results of text detector based on FT-ROBERTaaFine-umee RoBERTa), True-PPL(Trus
Perplexity), and LLMD Perplexity). Their detection environments respectively GPU-V 100 32GB, CPU, and CPU.
Label of Text Source
Metric
Method
Human
GPT-2
OPT
UniLM
LLaMA
BART
T5
BLOOM
GPT-Neo
FT-RoBERTa
90.82
85.61
53.35
91.67
44.62
100.00
73.95
70.80
42.08
P(%)
True-PPI.
97.97
98.54
98.25
79.02
98.54
98.94
89.77
94.41
97.09
LLMDet
98.54
76.09
79.08
90.81
95.61
97.55
86.86
84.67
84.45
FT-RoBERTa
94.00
58.05
81.48
73.41
95.24
94.18
27.98
27.09
18.22
R(%)
True-PPI.
98.99
95.92
95.70
82.25
98.46
99.73
88.44
94.29
97.61
LLMDet
99.00
78.13
73.88
91.74
97.30
98.41
87.56
83.08
83.90
FT-RoBERTa 92.38
69.19
64.48
81.53
60.77
97.00
40.60
39.19
25.13
True-PL
98,48
97.22
80.60
98.85
99.34
89.10
94.35
97.35
LLMDet
98.77
77.09
76.39
91.27
96.44
97.98
87.21
83.87
84.18
Table 2: Comparison of overall performance between text detectors based on true perplexity, fine-tuned RoBERTa, and proxy perplexity, Note: Ratio =
(Time/TTee imwe/TTemeeeeeeepPep
Method
Macro-P(%)
Macro-R(%)
Macro-F1(%))
Timc(s) (
Ratio 1
True-PPL
94.72
94.60
94.65
46410.15
x1.00
Fine-tuned RoBERTa
72.19
63.30
63.40
41799.76
x0.74
LLMDet
88.19
88.13
88.14
8678.76
X4.97
performance of the text detector on each of LLMs and human--eneranne text. Additionally, FI-Macro, R@1 1, R @2, 2, and @@3 metrics are used to analyze the overall performance of the detector,
RQ2: How significant the impact of the proxy perplexity-based approach on detection perfor- mance?
RQ3: Can LLMDet achieve the expected level of efficiency compared to existing methods?
2P.RR Fl, P.+ Ra'
ΣN
F1,
F1-Macro
(4)
N
RQ4: How is the extendibility of LLMDet demonstrated?
Eg 1i= IGG,KK; R@k
(5)
5.4 Experiments & Results
M
where P,, R2 and F1; respectively represent the precision, recall, and F1 score of Model, N de- notes the total number of categories, M represents the number of texts being tested. Gy represents the ground label of Text j. Kj refers to the top-k categories with the highest probabilities in the pre- dicted results, Tc,ck, takes the value of when Gy E Kj. and otherwise.
We conducted experimental verification for the aforementioned raised questions.
For Specificity (RQ1): We first compute the true perplexity of the combined datasets con- structed in $ 5.1 on GPT-2, GPT-2-Large. OPT- 1.3B, OPT-2.7B, UniLM, LLaMA-7B, BART, T5- Base, Bloom-650M and GPT-Neo-2.7B models. Subsequently, we joint these perplexity values to train a text classifier based on LightGBM (Ke et al., 2017).
5.3 Research Quesitons
Based on the characteristics and assumptions of proposed detection tool in $ 3, formulate four research questions regarding LLMDet.
The classifier is then tested, and the results are presented in Table 1. We observe that the text detector based on true perplexity achieved excel- lent detection success rates when confronted with texts generated by different models, with the ex- ception of the generated texts by UniLM. Despite
RQ1: Can perplexity-based methods trace the source of text from certain LLM?

---

the comparatively lower detection performance for -eiLM-ggeeerated texts, the Fl score reaches 80.60%, which is significantly higher than random guessing. These experimental results robustly vali- date the applicability of perplexity as a distinguish- ing metric for models that identify specific sources of text.
0.00
0.00
0.90
0.30
0/0
6.00
0.00
0.00
RUM0
0.12
0.00
0.00
9.01
0.24
0.66
0.32
004
D/0
6.01
0.00
0.00
Cioaad Lrrah Lake!
0.06
0.00
11:0
DAT
EXI
0.00
0.00
DJM
0.01
0.00
1603
DAM
CXM
0.00
0.00
$.00
0.00
0.00
0.00
000
EJ2
0.00
0.00
044
SJMI
0.00 0.00 1622 1600
016
0.08
For Safety (RQ2): We utilize the statistical datasets generated on GPT-2, GPT-2-Large, OPT- 1.3B, OPT-2.7B, UniLM, LLaMA-7B, BART, T5-
1.00
0.00 0.00 0,00 000
100
EJM
051
0.12
02
8.00 0.00 0.30 0.00 0000
0.13
051
C0P
Blow
Base, Bloom-650M, and GPT-Neo-2.7B. as men-
Proderoo Label
tioned in the $ 5. to construct dictionaries for each model using the method described in the š 4.1. Then, we employ these dictionaries to calculate the proxy perplexity of the combined dataset as features for training text classifier based on Light- GBM (Ke et al., 2017).
Figure 2: The confusion matrix of the detection per- formed by LLMDet.
Table
The detection time of GPT-Zero, De- tectGPT, and LLMDet on a dataset of 1000 texts. Note: Ratio = (Accuracy/ AccuracyTrae.PPL)
The classifier is then tested, and the results are presented in Table 1. Our proposed method based on proxy perplexity achieves comparable results the text detector based on real perplexity on Human, I.LaMA-generated and BART-generated texts, with detection success rates exceeding 95%. Additionally, our method outperforms the true perplexity-based detector when it comes to de- tecting U-geeM-geeertted texts. Furthermore, the Fl score for detecting texts from other sources is at least 76.39%, significantly higher than random guessing. Based on the confusion matrix in Figure 2, it can be observed that there a tendency for the text generated by GPT-2 and OPT to be easily con- fused with each other, while text generated by T5, Bloom, and GPT-Neo also exhibit a tendency to be easily confused. Although the overall performance is not high as the real perplexity -based text clas- sifier, our proposed method does not require model access during detection and offers advantages such as speed, scalability, and enhanced security.
(Time (ime//Tmmraar.rrz))
Method
Accuracy($:) f
Time(s)
Ratio (True-PPL)
GPT-Zero
86.56
2376.87
x0.46
DetecGPP
92.67
14354.61
x0.08
True-PII.
94.87
1199.11
x1.00
LLMDet
88.19
224.53
X4.96
tectGPT, Truc-PPL, and LLMDet. In terms of re- source requirements, both DetectGPT and True- PPL methods are run on V100-SXM-32GB, GPT- Zero utilizes its APT for detection on a GPU, while LLMDet only requires a GPU for the completion of the detection process.
Based on the efficiency analysis in Table 2 and Table 3, it can be observed that LLMDet outper- forms other detection methods significantly. Fur- thermore, in terms of resource requirements, our approach exhibits the lowest demands. Conse- quently, our detection tool demonstrates a substan- tially higher efficiency compared to other methods, making it more aligned with future detection needs. For Extendibility (RQ4): To illustrate the ex- tendibility of the LLMDet method, expand its detection capability from one model eight. Specifically, We sequentially add the LLM model into our LLMDet tool in the following sequence: GPT-2, LLaMA, OPT, UniLM, BART, T5, Bloom, and GPT-Neo. Thereby, continuously extending the detection capability to these models. Additionally, with each expansion, we retrain the text detector (LightGBBM and assessed the resultant changes in overall performance.
To assess the comprehensive detection capability of the detector, we compute the F1-Macro, R@ 1, @@2 and R@3 values. From Table 2, it is evident that our proposed method achieves an @ value of 98.00 80%.0 This indicates that, among the top two text sources with the highest predicted probabilities. there is typically one source that corresponds to the true source of the text.
For Efficiency (RQ3): In order to compare the efficiency of various methods, in addition to the main experiment Table 2, we also conduct tests using the same set of 1000 texts to measure the efficiency required for detection in GPT-Zero, De-
From Figure 3, it can be observed that during the expansion of LLMDet. there is only a slight fluc- tuation in the value of F1-Macro, which remains

---

lined in 5.1 generate 16,000 text instances using LLaMA-7B. For the generated text, we set the deletion rates 0.1, 0.3, and 0.5, respectively, subsequently introducing corresponding perturbed texts by randomly removing words from the text according to these specified rates.
100
GPTT2
95
<UnLM
+BART
418
+Bloom
GPT-Ne
90
4OPT
F1-Macro(%%
LaabA
85
80
For weight updates. we employ the approach outlined in 5.1 to generate 16,000 text instances using the Vicuna-7B, an instruction fine-tuned ver- sion of LLaMA-7B.
75
70
65
2
3
4
5
6
7
8
These text instances are then utilized as test data to assess the robustness of LLMDet, and the experimental outcomes are presented in Table 4. LLMDet exhibits strong robustness against certain types of perturbations in the text, such as random deletions, slight weight updates in the generative model, and adjustments to temperature settings. For more analysis of experimental results, please see Appendix C.
The number of LLMs
Figure 3: The impact sequentially adding the L.M into LLMDet the comprchensive detection perfor- mance measured by F1-Macro.
consistently around 85%. Therefore, it can be con- cluded that in the future, LLMDet can be easily expanded to a new model with sightly performance affection.
6.2 The Influence of N-gram
In addition, in order to explore the performance changes of LLMDet when using newer and larger LLM, we also conducted additional experiments. The detailed experimental steps and results can be seen in Appendix B.
We compute the proxy perplexity each model for the combined dataset in the 4.1 using dictionaries built on 2-gram, 3-gram, and 4-gram, respectively. By jointly analyzing the proxy perplexities to train and test the text classifier using the LightGBM. It should be noted that (n-1)-gram are subset of n-gram. Based on the results shown in Table 5, it can be observed that the overall detection perfor- mance text within the domain does not increase significantly as the value n increases, but rather exhibits a slight improvement. Considering that the number of n-gram increases exponentially as n increases, we only consider 4-gram in LLMDet.
6 Analysis
In this section, conduct several additional exper- iments to facilitate more comprehensive analysis of LLMDet. Firstly, we verify the detection ro- bustness of LLMDet. Subsequently, we investigate the impact of n-gram in dictionary construction on the detection performance of LLMDet. Finally, we explore the influence of the top-k of the next token samples in dictionary construction on the detection performance of LLMDet.
6.3 Next Token Top-K Sampling
The construction of the dictionary incurs significant storage overhead due to the necessity of storing the top-K K probabilities along with their correspond- ing n-gram, presenting a challenge our method. Consequently, determining the optimal value of K requires a comprehensive consideration of both detection performance and storage costs.
6.1 The Robustness Testing of Detector
Many LLMs can change their probability of the next token via different methods, for example, changing hyperparameters like temperature, even updating weight by fine-tuning. Furthermore, generated text may encounter deliberate perturba- tion, such as random delctions. worth consid- ering the robustness of this method these situa- tions.
In order to gain a more intuitive understanding of the impact of the K value on the detection per- formance of LLMDet, while keeping the number of 2- gram, solely vary the K value and examine the changes in F1-Macro of LLMDEt across differ- K values. The result is presented in Figure 4. We observe that as the value of K increases, the detection performance of LLMDet gradually improves. However, the performance improvement
For hyperparameter changes, we use the ap- proach outlined in $ 5.1 of this article to generate 16,000 text instances using LLaMA-7B tempera- tures of 0. 0.4, 0.7, and 1.0 respectively.
For random deletion, we use the approach out-

---

Table 4: The detection performance of LLMDet in three scenarios: temperature changes, random deletion, and weight updates.
Temperature
Delete Ratio
Weight Update
Metric (%)
0.1
0.4
0.7
1.0
0.1
0.3
0.5
Fine-tuned LLaMA (Vicun))
@ ((Aceuracy) 1
91.23
92.05
93.02
94.37
90.06
89.31
87.80
97.78
@@2 f
97.55
97.48
97.48
98.06
97.07
99.12
99.53
99.07
R@3 f
99.46
99.33
99.24
99.33
99.52
99.53
99.82
99.39
Table The impact the value in n-gram on the overall detection performance.
rity in the detection process. Additionally, method enables text tracking, allowing for the iden- tification of the underlying language model from which the text originates. Importantly, our detec- tion tool can be continuously enhanced by expand- ing to new open-source LLMs, enabling ongoing improvements.
Metric (%)
2- A-gram
3 3-gram
g-gam
FI-Macro
87.44
87.79
88.14
R@I 1 f
89.61
90.18
89.51
R@21 f
97.84
98.04
98.00
R@31 f
99.58
99.56
99.64
In the future, we aim to further refine our de- tection tool. Firstly, we will improve the dictio- naries used to compute proxy perplexity, thereby enhancing the detection performance. Secondly, for -ousre models, we are unable to build their corresponding dictionaries. To mitigate some extent, we have considered two possible ap- proaches:
100
F1-Macro
80
60
1) In the process of implementing LLMDet, we offer not only detection capabilities but also an ex- tensible interface for closed-source model owners. Details about this implementation Algorithm of Appendix A. The extended inter- face aims secure the model effectively without compromising the interests of the model owners. Through this approach, we hope to encourage more closed-source model owners to participate and con- tribute to the continuous improvement of the detec- tion ecosystem of LLMDet.
40
1000
1500
2000
The K of top-K samples in Next Token Sampling
be found in
Figure 4: The impact of the K value in top-K K sampling of 2-gram the detection performance of LLMDet.
becomes less pronounced after reaches 1500. Nonetheless, the corresponding storage overhead still increases linearly. Therefore, considering the overall trade-off between detection performance and storage cost, recommend adopting top- 2000 sampling for 2-gram. For 3-gram and 1-gram, their quantities are immense. Therefore, following the completion of similar experimental analyses, we employ a top-100 sampling for these n-gram.
2) We have also explored using statistical tech- niques to estimate the next-token probability in pro- prietary commercial models. However, due to lim- ited data volume, achieving the anticipated results has been challenging. Additionally, generating a significant amount of statistical data comes with considerable costs. As result, we have included this approach on our list of future work items.
7 Conclusions and Future Work
In the era dominated by machine-generated text, there is growing need for an efficient and se- cure detection tool. However, existing detection methods typically require interaction with language models, which inherently compromises speed and security. Our proposed detection tool, LLMDet, overcomes these limitations by leveraging pre- mined prior probability information to compute proxy perplexity, ensuring both speed and secu-
Furthermore, the distillation method is valu- able avenue for future exploration. We will cer- tainly consider it in our future research endeavors.
Limitations
One of the limitations of the current L..MDet is its restriction to detecting English text, thus unable to detect text in other languages. the future, we can

---

extend our approach to encompass models for other languages, thereby equipping with the capability to detect text in diverse languages.
Sid Black, Leo Gao. Phil Wang. Connor Leahy, and Stella Biderman. 2022. Gpt-neo: Large scale autore- gressive language modeling with mesh-tensorfloww 2021.
URL: https://di. org/10.5281/zenndl 5297715.
Furthermore, at present, the number of models detectable by LLMDet is limited. We will expand the capabilitiies of our detection tool to encompass a broader range of models, providing more possi- bilities for text tracing and attribution.
Souradip Chakraborty, Amrit Singh Bedi, Sicheng Zhu, Bang An, Dinesh Manocha, and Furong Huang. 2023, On the possibilities of ai-generated text detection.
Debby RE Cotton, Peter A Cotton, and Reuben Ship- way. Chatting and cheating: Ensuring academic in- tegrity in the era of chatgpt.
Ethics Statement
We honor and support the ethical guidelines of EMNLP. This paper primarily focuses on the detec- tion of text generated by LLMs, aiming construct a detection tool suitable for the user base from var- ious domains. The tool is designed to efficiently and securely perform text detection to prevent the misuse of generated text. Overall, our approach ex- hibits advantages over previous methods in terms of efficiency and granularity of detection, making this work meaningful. Additionally, the datasets used in this study are sourced from previously pub- lished works and do not involve any privacy or ethical concerns.
Long Dai, Jiarong Mao, Xuefeng Fan. and Xiaoyi Zhou, 2022. Deephider:
and invisibility watermarking scheme for language model. arXiv preprint arXiv:2208 04676.
Li Dong. Nan Yang. Wenhui Wang, Furu Wei. Xi- aodong Liu, Yu Wang, Jianfeng Gao, Ming Zhou, and Hsiao-Wirn Hon. 2019. Unified language model pre-training for natural language understanding and generation. Advances in neural information process- ing systems, 32.
Zhengxiao Du Yujic Qian, Xiao Liu, Ming Ding, Jiezhong Qiu, Zhilin Yang, and Jie Tang. 2022. Glm: General language model pretraining with autoregres- sive blank infilling. nual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), pages 320-335.
Proceedings of the 60th An-
Acknowledgements
This work was supported by the National Key R&D Program of China (2022YFB3103700, 0022YFB3103704 the National Natural Science Foundation of China (NSFC) under Grants No. 62276248, and the Youth Innovation Promotion Association CAS under Grants No. 2023111.
Tiziano Fagni, Fabrizio Falchi, Margherita Gambini, An- tonio Martella, and Maurizio Tesconi. 2021. Tweep- fake: About detecting deepfake tweets. Plas one, e6(5)ee055
Leon Fröhling and Arkaitz Zubiaga. 2021. Feature- based detection of automated language models: tack- ling gpt-2, gpt-2..ptt3 and grover. PeerJ Computer Science. 7:e443.
References
Sebastian Gehrmann, Hendrik Strobelt, and Alexan- der M. Rush. 2019. Gltr: Statistical detection and visualization of generated text.
Sahar Abdelnabi and Mario Fritz. 2021. Adversarial wa- termarking transformer: Towards tracing text prove- nance with data hiding. In 2021 IEEE Symposium on Security and Privacy (SP), pages 121-140. IEEE.
Biyang Guo, Xin Zhang, Ziyuan Wang, Minqi Jiang, Jinran Nie, Yuxuan Ding, Jianwei Yue, and Yupeng Wu. 2023. How close is chatgpt to human experts? comparison corpus, evaluation, and detection. arXiv preprint arxiv2301..05597.
Rohan Anil, Andrew M. Dai, Orhan Firat, Melvin John- son, Dmitry Lepikhin, Alexandre Passos, and Sia- mak Shakeri et al. 2023. Palm technical report.
Ryuichiro Hataya, Han Bao, and Hiromi Arai. 2022. Will large-scale generative models corrupt future datasets? arXiv preprint arXiv:2211.08095
Tanya Aplin and Giulia Pasqualetto. 2019, Artificial intelligence and copyright protection. Chapter in Rosa Maria Ballardini, Petri Kuoppamáki, Olii Pitkä- nen (eds) Regulating Industrial Internet Through IPR. Data Protection and Competition Law (Kluwer, 2019).
Tim Jansen, Yangling Tong, Victoria Zevallos, and Pe- dro Ortiz. Suarez. 2022. Perplexed by quality: A perplexity- based method for adult and harmful con- tent detection in multilingual heterogeneous web data. arXiv preprint 2212
Anton Bakhtin, Sam Gross, Myle Ou, Yuntian Deng, Mare' Aurelio Ranzato, and Arthur Szlam. 2019. Real or fake? learning to discriminate machine from human generated text.
Guolin Ke, Qi Meng, Thomas Finley, Taifeng Wang. Wei Chen, Weidong Ma, Qiwei Ye, and Tie-Yan Liu.

---

2017. Lightgbm: A highly efficient gradient boost- ing decision tree. Advances in neural information processing systems, 30.
Vinu Sankar Sadasivan, Aounon Kumar, Sriram Bala- subramanian, Wenxiao Wang. and Soheil Feizi. 2023. Can ai-generated text be reliably detected?
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, lan Miers, and Tom Goldstein. 2023. A watermark for large language models.
Teven Le Scao, Angela Fan, Christopher Akiki, El- lie Pavlick, Suzana Ilić, Daniel Hesslow, Roman Castagné, Alexandra Sasha Luccioni, François Yvon, Matthias Gallé, et al. 2022. Bloom: A 176b- parameter open- access multilingual language model. arXiv preprint arXiv:2211.051000
Keita Kurita, Paul Michel, and Graham Neubig. 2020.
Weight poisoning attacks on pretrained models. In Proceedings of the 58th Annual Meeting of the Asso- ciation for Computational Linguistics, pages 2793- 2806, Online. Association for Computational Lin- guistics.
Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert- Jeff Wu, Alec Rad- ford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, et al. 2019. Release strategies and the so- cial impacts of language models. arXiv preprint 1rXiv:1908.0922
Mike Lewis. Yinhan Liu, Naman Goyal, Marjan Ghazvininejad, Abdelrahman Mohamed, Omer Levy, Ves Stoyanov, and Luke Zettlemoyer. 2019, Bart: De- noising
pre-training for natural language generation, translation, and comprehension. arXiv preprint arXiv: 13461.
Ruixiang Tang, Yu-Neng Chuang, and Xia Hu. 2023. The science of detecting llm-generated texts.
Hugo Touvron, Thibaut Lavril. Gautier Izacard, Xavier Martinet. Marie-Anne Lachaux. Timothée Lacroix. Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, Aurelien Rodriguez, Armand Joulin, Edouard Grave, and Guillaume Lample. 2023a. Llama: Open and efficient foundation language models.
Jing Liu, Xinxin Zhu, Fei Liu, Longteng Guo, Zijia Zhao, Mingzhen Sun. Weining Wang. Hanqing Lu, Shiyu Zhou, Jiajun Zhang, et al. 2021. Opt: Omni- perception pre-trainer for cross-modal understanding and generation. arXiv preprint 107v:2107.000249
Eric Mitchell, Yoonho Lee. Alexander Khazatsky, Christopher D. Manning. and Chelsea Finn. 2023. Detectgpt: Zero-shot machine-generated text detec- tion using probability curvature.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Al- bert, Amjad Almahairi. Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull. David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, Brian Fuller, Cynthia Gao, Vedanuj Goswami, Naman Goyal, An- thony Hartshorn, Saghar Hosseini, Rui Hou, Hakan Inan, Marcin Kardas, Viktor Kerkez, Madian Khabsa, Isabel Kloumann, Artem Korenev, Punit Singh Koura, Marie-Anne Lachaux. Thibaut Lavril, Jenya Lee, Di- ana Liskovich, Yinghai Lu, Yuning Mao, Xavier Mar- tinet, Todor Mihaylov, Pushkar Mishra, Igor Moly- bog, Yixin Nic, Andrew Poulton, Jeremy Reizenstein, Rashi Rungta, Kalyan Saladi, Alan Schelten, Ruan Silva, Eric Michael Smith, Ranjan Subramanian, Xi- aoqing Ellen Tan, Binh Tang, Ross Taylor, Adina Williams. Jian Xiang Kuan, Puxin Xu, and Zheng Yan. 2023b. Llama 2: Open foundation and fine- tuned chat models.
Shashi Narayan, Shay B. Cohen, and Mirella Lapata. 2018. Don't give me the details, just the summary! topic-aware convolutional neural networks for ex- treme summarization.
Proceedings of the 2018 Conference on Empirical Methods in Natural Lan- guage Processing, pages 1797-1807, Brussels, Bel- gium. Association for Computational Linguistics.
OpenAI. 2023. Gpt-4 technical report.
Liang Pang, Yanyan Lan, Jiafeng Guo, Jun Xu, Shengx- ian Wan, and Xueqi Cheng. 2016. Text matching image recognition. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 30.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. 2019. Language models are unsupervised multitask learners. OpenAl blog. 18)):
Adaku Uchendu, Thai Le, Kai Shu, and Dongwon Lee. 2020. Authorship attribution for neural text gener- ation. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 8384 8395, Online. Association for Computational Linguistics.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. 2020. Exploring the limits of transfer learning with a unified text-to-text trans- former. The Journal of Machine Learning Research, 21(1):5485-5511
Honai Ucoka, Yugo Murawaki, and Sadao Kuro- hashi. 2021. Frustratingly easy edit- based linguistic steganography with a masked language model. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computa- tional Linguistics: Human Language Technologies, pages 5496, Online, Association for Computa- tional Linguistics.
Pranav Rajpurkar. Jian Zhang. Konstantin Lopyrev, and Percy Liang. 2016. SQuAD: 100,000+ questions for machine comprehension of text. In Proceedings of the 2016 Conference Empirical Methods in Natu- ral Language Processing, pages 2383-2392, Austin, Texas. Association for Computational Linguistics.

---

A Algorithm of LLMDet
Algorithm 2: Text Detection
Input :A piece of text for detecting
A list D Mor..... DM.l for c LLMs and D, denotes human Output: : detection result Rt
For the detailed implementation process of LLMDetd, please refer to the pseudocode provided below. Algorithm 1 is dictionary construction al- gorithm that is completed offline by us or provided to the model holder independently of external sys- tems. Algorithm 2 will be provided to users third-party tool.
Step4: Proxy perplexity estimation Procedure ProxyPerplexitytt. DM)
// Ngram O generate one text span in 1 wi length n for 8, n in Ngram (t) do
Algorithm 1: Dictionary Construction
Get Dn from DM
Input :A prompt dataset P
if $[1==-]] in D, then
A large language model M
p log (eng(D,,ines (st=x)))
Output: A dictionary for M
Proxy_PPP +=p;
// Step1: Generate text samples Procedure GenerationTest(M, P)
end end
// is a generation text set
return Proxy_ PPL
+- 0;
// Step5: Result ranking Procedure Rank(t, D) for in {0. (0....,cc) c) do
for x do
// Use M to generate text + MM ;x)generate(x);
PPL:
T.pppen(());
ProxyPerplexity(' Dar);; end
end return
p Classifier(PPLoo.. PPL.))
// Step2: Word frequency statistic Procedure WordStatistic(T, n)
ÿ 4- smooth(p)
P f softmat(f)
// Do counter for text sequence to get top-k n-gram n-gram < CountNgram(T,,n k))
R < sort(p)
return R
return 7--rram
B LLMDet Using Newer and Larger LLM
// Step3: Next token probability sampling Procedure Nex/TokenSamplingg.. P. K)
In order to explore whether the gap between proxy perplexity (our method) and true perplexity be- comes more apparent as the size of LLMs increases, we conduct additional experiments. We replace LLaMA-7B with LLaMA2-13B (Touvron et al., 2023b) while keeping all other experimental set- tings the same as in the original paper. The detailed experimental results are shown in Table and Ta- ble 7.
// Das stores information for model M
Dar + 0 is empty list;
T + GenerationText(MM
for in 3, 4} do
D, is empty dictionary;
n-gram + WordStatistic(T,n)
for in n-gram do
n M.next_token(set (1 11)
From the experimental results, when we re- place the original LLM with better-performing and larger-scale LLM, such replacing LLaMA- 7B with LLaMA2-13B, the detection performance remains essentially consistent with the original performance. This indicates that when better- performing and larger-size LLM is used, the perfor- mance gap between proxy perplexity (our method)
D add(
(8[1:-11) add(((((mnn))))
)):
end
D append(DD)
end
return DM

---

Table 6: Experimental results text detector based on proxy perplexity with LLaMA-7B, and proxy perplexity with LLaMA2-13B.
Label Text Source
Metric (%)
Model Size
Human
GPT-2
OPT
UniLM
LLaMA
BART
BLOOM
GPT-Nco
LLt with LLaMA-7B
79.08
90.81
95.61
97.55
LLMDet with LLaMA2-13R
74.67
79.97
91.47
95.70
97.46
86.64
83.15
84.60
True perplexity
98.54
98.25
79.02
98.54
97.09
LLMDet with LLaMA-7B
78.13
73.88
91.74
97.30
98.41
87.56
LLMDet with LLaMA2-13B
99.04
79.07
72.64
90.53
97.49
98.11
86,99
83.15
83.98
Thue perplexity
95.92
95.70
82.25
98.46
88.44
94.29
97.61
LLMDet with LLaMA-7B
98.77
77.09
76.39
91.27
96.44
97.98
87.21
83.87
84.18
FL
LLMDet with LLaMA2-13B
98.74
76.80
76.13
91.00
96.58
97.78
86.82
83.47
84.29
True perplexity
98.48
97.22
96.96
80.60
98.85
99.34
89.10
94.35
97.35
Table 7: Comparison of overall performance between text detectors based on proxy perplexity with LLaMA-7B and proxy perplexity with LLaMA2-13B.
Method
Macro-F1 (%6)
RI(ACC)(%)
R2(%)
R3(%)
proxy perplexity with LLaMA-7B
88.14
89.51
98.00
99.64
proxy perplexity with LLaMA2-13B
87.96
89.30
98.07
99.69
True perplexity
94.65
95.54
99.33
99.80
and true perplexity does not become more obvious.
the samples for OPT. Table 10 shows the samples for LLaMA. Table shows the samples for T5. Table 12 shows the samples for UniLM. Table 13 shows the samples for BART. Table 14 shows the samples for GPT-Neo. Table 15 shows the samples for Bloom.
Additional Analysis for Robustness Testing
From Table 4, it can be observed that as the tem- perature increases, the accuracy text generation detection improves.
Regarding this phenomenon, what we need to clarify is that our method calculates proxy perplex- ity by building dictionary based the probability of sampling the next token. When calculating the probability of the next token, we directly use the softmax with default temperature of 1.0. When the temperature LLM set to 1.0, the generated text actually conforms more closely to the probabil- ity distribution of the next token in the dictionary we have constructed. At this point, the calculated proxy perplexity is closer to the true perplexity, re- sulting in higher detection accuracy. Therefore, can observe that when the temperature is higher, the text distribution generated by the LLM is closer to the probability distribution of the next token in the dictionary, leading to higher detection accuracy.
D Sample of n-gram for each LLM
Specific examples 2-gram, 3-gram, and 4-gram for each LLM can be referred to the tables. Ta- ble 8 shows the samples for GPT-2. Table shows

---

Table 8: Samples of n-gram for GPT-2.
2-gram
3-gram
4-gram
('not, 'normal")
('on', 'a', 'robust") ('make', 'those', 'customer') ('mental', 'health', "clinic") ("tower', "also", 'features') ('lost,, 'both', 'matches') ('of", 'soccer', """) ("have', "been", "accused") ('forms", 'of", 'discipline") ('man', 'who', 'may') Cguesssing, 'you', "might") ('the", 'court,, 'ruled") ('service', "., T))
("to', 'the', 'alleged', 'health")
('rape', 'her") ('to', "agree")
('on', 'pace', 'for', 'an') (rreeeption, 'at', 'the", 'BBC") ("the", 'rule', 'to', 'mean') ('to','get', "away", "with") ("she", 'was', "g', 'ored") ("the", 'area", ; 'JJ', 'C'
( (political', "campaigning")
("with'. ('with'''patieett')
("the", "Common') C'private', 'men') ('were'. 'victorious') Cyouung, 'team') ('said', 'Se")
('world', 'economic', 'crisis', '.) ("to", 'Argentina', 'on') (' ('people", 'who', 'are", 'loyal") C'partners', "., 'C'.GG)
C'or', 'suspects') ('sound', 'energy") ('she', "beat")
('our', 'community', 'from', 'this") ("train', 'young'. 'hoys', "about") ('the', 'problem' '"", '"!)
Cphysical', "., 'If")
('political', 'career') ('not', prrposs') ("today', "accepted")
('that', 'Mexicans', 'who") ('one', 'We') ('share", "of", 'online") ('was', 'walking', 'with") ('the', 'largest', 'ever') ('the", 'shark', ('to', 'have', 'abused') ('inquest', 'is', 'now") ('meet', 'President'. 'Ts') ('in', 'the', 'procession") (that', 'is', 'littered') ('own', 'right', 'which') Cjustice", 'is', 'fair") Cit', 'was', 'before") ('to', "gtt", 'land") ("has', 'remained", 'silent") ('match', '-) ('in', 'these', 'jobs') ('installed', 'with', 'proper") ('season', 'at', 'Villa") ('same", 'venue', '() ('when', 'a', 'report') ('that', 'Mrs', 'Mat') ('great', 'work', 'we") ('the", "groupp, 'of") (ffor, "all', 'involved') (i', 'h', IIf") ('on', 'all', 'his') ('time", 72, "They") ('new", "'s", 'ocial') ('the', 'pub', 'in') ('let', 'out", "ut",""" """
('to', 'Barb', 'ados', 'on') ("them', "., T, "m") Cof", 'the', 'UEFA', 'presidential") (qquestioned', 'for', 'a', 'week') ('think', "this', 'is", "incorrect') ('who', 'had", 'been', 'shot') C'other', 'animals', 'that', 'have') ('sale", 'on', 'the", 'market') ('struck', 'our', 'city', '.) Con', 'Sky'. 'Sports', "1") ('of', 'the". 'film', 'has') ('that', 'is", 'made", 'for") ('where', 'Richard', 'III' 'was') ("teaching', 'children", "about', ""))
('was", 'slow')
('receive', 'government') ('v', 'Arsenal') ('the,, 'notes") ('smooth', 'and") ('their', 'views") (ppoeerull, 'laser") Cperspecttiv'. '") ('was", 'introduced") ('said,, 'Theresa') ('train'..)) ('was", 'initially') (ret')" ('now", 'no')
("winner', 'will', "receive', 'a')
('the.. 'state', 'government', 'dissolved') ('the", 'money'. 'people") ('the", 'Irish', 'Cup', 'in')
('their', 'tuition') ("seas", 'off")
('play, 'Miss") ('then', 'punched") ('patients', 'living')
('on', 'the'. 'Rights', 'of")
('shore', 'line', ". 'It')
Cproduuctonn, 'company" 12 (C") ('play. 'a', 'movie', '!)
('not', 'right') ('spin', 'a') ('usual", '"))
(remmeber'' 'that', 'mid', '-
('to', 'say", 'that', 'your') ("taken', 'it', 'down', '?)
C'push', 'their') ('z00', 'or") ('was", 'talking') ('obvious', ":")
('that', 'E', 'On', 'continues') ('to', 'a", 'harmful', 'retribution') ('still', 'in', 'college', 'in') ('violence', 'in', 'the'. 'gay') ('with', 'him', :. 'His') ('where', 'they", 'train', 'for") Cour', 'finances', ". 'We') ('to', 'ensure', 'their', 'success") ('the,, 'stolen', "car","" Cto', 'prevent', 'future", 'attacks') ('our', 'series", 'and", 'will')
('said'. 'Pac') ('overflow', 'lane") ('the", "Gibraltar') ('showed', 'great') ('that', 'year') ('yours',"" Coff' 'iveetmentt'' ('other', 'hints')
("was', 'released' 'on') ('the', 'couple", 'with') ('is', "at', ?.") ('have", 'obtained", 'a') ('to', "le',, 'it')
"withl"

---

Table 9: Samples of n-gram for OPT.
2-gram
3-gram
4- gram
(speciiicc, "types") ('with', "payments") C'producer', 'for') ('was', "naked') ('place', "play" ('visible", "etnnic') ("trained', "by')
('from', 'Sam', 'Jones") ('industry', 'to', "get') ('then', 'the', "County") ('sab', 'er', 'instructor') ("the", " 'economic', 'impact') ("the", 'surgeon', "actually") ('is", 'a', "wicked") ('ten', 'years'.". ('one', 'by", 'a")
('within', 'the', "opening', "few") ('the", 'services', 'of", 'the") ('whether', 'the", "police", "watchdog") ('sport,, 'interesting', 'to', 'most") ('shows', 'that', 'there", "osre""""")) ('racial', 'discrimination" !. "The')
("much', 'better', "at', 'this") ('of', 'leaving', 'the", 'club') ('thread', ,'!, CC', 'C") ('ship', "is","?,"T" ('ll',, "keep'. 'is', 'the") ('protected', 'from', 'over', 'f) ("moment', "the", 'drill,, 'sergeant')
('placed', 'a') ("rspposibilitty.. """)
("situation", 'from")
('it', "was', 'Lawrence") ('read', 'a'. 'particular') ('for', 'one', 'gaame) ('very', 'strong', 'turnout') ('he', 'is', 'a') ('private,, 'college', 'should') ('then', "come", "back") ('idiot',". 'This')
('their'. 'best") (recommendd' "buying") ('seen', "since")
Cyeaa',, "by")
('things', '., 'And', 'they') ('started', 'collaborating', 'to', 'solve') 'Guardian,,,, 'last', "year") ('other', 'candidates', ". 'C') ('tourist', 'was', 'missing', '.') ('outfit', 'for', 'a', 'wedding") ('who', 'Mar', 'low", 'ee) ('seen', 'used', 'on', 'the') ('managed', "to", 'maintain', 'my') ('of", 'the', 'London', "bombings") ('run', '.. 'The', 'problem') ('this", 'movie", 'is', 'complete') ('the', 'front', 'door', 'to') ('page'. 'of", "of" 'the', 'Hong') ('vandalism', "without", 'the', 'people") ('the', 'energy', 'sector', 'in') ('natural', 'selection', '.. 'Sometimes') ('the", 'same", 'stadium', 'and') ("selling", 'information', 'regarding', 'a') ('limit', "., 'especially', 'in') ( ('that', "ha T, 'just') ('some', 'sort', " 'at')
('of", "Mosul") ("recent', 'video")
C'o', 'lymp') ('to', 'Sel') ("requests,, 'to') ('that', 'four') ('pattem'.') '.) ('ultimate', 'opportun') "oltimate,"oppportun") ('you', ('team'. (playr''players') ('quicker'," '.)
('on', 'to', 'her')
('pl', "umes", 'was') ("material', "?, 'He') ('doctor', "prescribed', 'me') ('to', 'win", "promotion') ('got', 'no', 'problem') ("published', 'in', 'February') ('want', 'to', 'move') ('offence', 'of",""" '")
('systems', '") ('team', 'culture') ('son', 'away") ('themselves', 'for") Cyour', 'school') ('winding', 'roads')
('without', 'undermining', 'the") ('event', 'on', 'February') ("not', "officially', 'recognised")
('than', 'a', 'typical') ('first', ::. 'I') ('effort', 'from', 'C')
('of", 'Idlib')
Cof", 'seven')
("progressed', 'through', 'the") ('the', 'Blues'. ".)
('subsequently', 'charged') ('site', 'AH') ('perform', "tasks')
('tigers', pours"","te 'in', 'captivity") ('gl', "iding'." ('this', 'has", 'not') ("hosts', 'Japan', ':) ('signed", '20', '-") ('term', .. 'less') (' ('excessive', 'force', 'against') ("make", 'the", "match") ('to", 'Europe'. ('which', 'won', 'the")
('one', 'is", 'the', 'most') ('to', 'Deputy'. 'First', 'Minister') ('lists', 'and', 'the", 'fact') ('they,, " "'re, 'old', 'enough') ('pay', 'a', 'tax", 'in') ('their', 'fury', 'and', 'carnage') ('were", 'to', "acknowledge", 'him') ('now', '., 'T' 'don') ('that', 'the", 'collision', 'was') ('repeat', "of", 'the", "previous") ('then', ".' 'f',"", 'course") ('man', 'who', 'beat', 'the")
('to', 'these") (rremebeer, 'who')
('participate', 'and"" ('worked', 'because') ('too'.'ite "if")
('otherwise', 'damaged') Con', 'Ukrainian') ('smack', 'in')
(T', T ('owner', 'did') ('single', 'run')
("think", "he", "d""
('no', 'and", 'they")
('of", 'glass,, 'and')
('was", "pulling)) ('te', 'influenza') (fof", "pressure')
('how", "his", "team') ('of', 'data", 'that") ('friend", 'who", 'suffers')
Coff', 'someone', 'on", "that') (' ('when', 'the", 'victim', 'was') ('siid', 'captain', 'Jamie', 'Stir')

---

Table 10: Samples of n-gram for LLaMA.
2-gram
3-gram
4 4-gram
('trees",.)
Cparttcullr', "author', '.)
('which', 'affect', 'millions, 'of")
('tall", 'man') ('tax", 'ing") ('second', 'Local") ("public', "oubllc".'mien 'mecting') ('when', 'John') ("to', "Australian') ("services'. 'during') ('the", 'IT") (" ("woman', 'on") ('while".''r 'G') ('reports', 'make") (ssigned', 'Ar')
('together', "as', 'a')
(*), 'person', 'al', "") ("to", 'put', 'its', 'foot') ('type', "of", "aircraft', 'that') ("work', 'for', 'a', 'machine") ('would', 'mean", 'E', '4')
('one", hhand".";)
('only', , 'make', ; "an') ('there', 'were", 'none") ("when', 'the", 'organization')
("this', "situation", ".")
("two', 'Jewish', 'women', 'in') ('the', 'Masters', 'in', 'his') ('to', 'follow', 'the', 'next') (" ("walking', "along', 'the', "edge") ('will', "use', 'the', 'E" ('the', 'injured', 'were', 'children') ('the', "Title", 'VII', 'of") ('to', 'Son', 'ar', "Qu') ('the', 'resources', 'to', 'respond') ('volunte', 'ering', 'at', 'her') ('which', 'are', 'responsible', 'for') ('shows', 'ins', 'ur', 'ers') ('to', 'current', 'Health', 'Secretary') ('way', 'to", 'New', 'Hope') ('to', 'the', 'aircraft'," ')) ('signs", "to", 'better', 'represent') ('the', AAstrrliian, 'Govermment' "has') ('under', 'ne', 'ath',"!) ('week', 'in', 'the", 'U') ('the', 'trip', 'to", "S")
('their', 'compla', 'ints') (proofessionll, 'Hollywood", 'set')
('the', "streets", ":)
('strong', 'squad', 'da''' '.)
('touched', 'as", 'a")
('workers', "above') (requirement', 'does') ("some", 'thousands') ('the', 'bigger') ('study', 'but')
('to', 'light', 'after') ('tent', 'that', 'he')
('opening', "took", 'place")
"plaa''':. "Henry') ('tie", "against', 'D') ('officials', 'im", 'Py')
('then', 'return") ('the', 'purs")
('of', 'negative', "economic') ('should', 'consider', 'an') ("year', 'reve", 'als") ('that', 'libraries', 'offer') ('on', 'Russia',.." ('the', 'super', 'visor")
('the', 'tall')
('remain", 'unclear") ('stronger', 'start"
('that', 'while")
('with". 'Niger')
('she", "holds")
(r', 'ides', ('sector', 't'))
('spot', 'where")
(shooting'.'on 'Sunday'. 'morning') ('the', "discovery', 'of", 'the") ("to", "a', 'Liberal', 'Dem') ('wo', 'take', "action', '.)
('spot',
('su', 'cker', 'p')
("take", 'responsibility" ('week', 'since') ('what', "actions') ('week", 'announced') ('were', 'split') "oensitive',".) ('the", 'stem')
C'put,, 'an", 'end') C'use', 'the', 'art') ('some', 'new', 'people') ('team', "call', '-)) Coff, 'CR', 'PF") ('province', 'of". 'Gal') ('slo", "ppy', 'at') ('when', ; 'she', 'fought') ("pay', 'rise". 'thee"" ('to', 'the", 'bands") ('our', 'operations', 'and') (" ('underlying', 'coll', 'ater')
('went', 'wrong', " 'T'
Cyoung', 'woman', 'while", 'she") ('with', 'clubs", 'such', 'as') ("total',": '., 'approximately', ") ('these", 'suspect', 's', 'are') ('the', 'pool", 'f', 'encing') ('the', 'process', 'is', 'that') ('visitors', 'a', 'year', ("to', 'GI', 'ouc", 'esters") ('with', '1". '9')
('with", 'cred') ('regarding'. 'Islam') ('this", 'before') ('their', "hands") ('supp', 'lier') ('shoot', 'and') (recovery': '?)
("now', ".,", 'she") ('of', 'deb", 'ts')
('surv', 'ive", "", 'and') (' ('was", "still,, "very", 'tight') ("tax', 'bill', 'ever', 'handed') ('wild', 'f', 'ires', 'that') ('vehicle', 'and', 'a', 'ped') ('simple', 'concept', '.. 'Well') C'to', 'driving'. 'an', 'older') ('which', 'he", "highlight', 'ed') ('tr',, 'illing', 'cl', 'ash') ('village', 'of", 'V" 'ran')
('to', 'migr') ("struggling'. 'this")
('team', 'that', 'took') (rremaining,, 'to', 'take") Coff', 'the", 'del') ('the,, 'problem', "before") ('whose', 'client', 'died") C'yard', "lines", 'and') ('recip', 'ient', 'will')
('summar', "ize")
('socicty", 'which') ('settlement', 'with") ('that', "fac))
('was', 'smart') C", 'K"
('series", '. "winning")

---

Table 11: Samples of n-gram for T5.
2-gram
3-gram
4- 4-gram
('with', 'Bill") ('eeerall', 'bands")
('very', 'impressed', ".)
C'there', 'is", 'nothing', 'in') ('won', 'the", 'bronze', 'at') ('was", 'what', T, 'was") ('the', 'Ca', 'ffe', 'N") ('year', 'to', 'assess', 'the") ('world', "., 'Land', 's') ('to', "achieving", "that") ('their', 'home', 'games', '.)
('with', 'Jamaica', 'n')
('that', 'recognized") ('y""
('the", 'tour", (pacckaged', 'and', 'transported") ('the', 'products", 'and")
(1o"."1977")
('stunning', 'terrace") ('hoocked', 'that')
('of", 'assets', "including")
("to", "the", 'Super") (rurall, '., 'The") ('they", "hope", 'to') ('our', 'mouth', 's") ('then', 'to', 'take) ('support', 'the". ''commmnitty"
('purchase'. 'Abdul")
('right', 'while')
('with', 'him', 'was', 'the") ('worth", 'mentioning', 'that') C"to', 'basic', 'health', 'care") ('time", '., 'The', 'company") ('to', "win,, """) ('would', 'score', 'in', 'the') ('with', "business', 'activity", 'up') ('wrong', "on'" 'U",".) ('was', 'first', 'introduced", 'in') ( ('that', ".'a', 'German') ('to", '2003', 'and', 'was") ('they', 'came", 'into', ") ('we', 'have', 'signed', 'the') ("waste", "must', 'be', 'removed") ('which', 'is', 'funded', "by") ('the', 'British', 'government', 'is') ('the", 'anterior', 'anterior"." ")
("training', "after") ("received""" ") ("respiratory', 'syndrome") "ntrrrtorr""ssyddoomme"" ('visitors', "got') ('understood', 'the") ('software', 'provides')
('one', 'shot', )on") ('wedding', 's',"))
('opposition', 'of",") ('then', ", "withdrawn") ('out', 'how', 'you')
('show", 'any") ('speaks', 'on') ('still', "outstanding') ('trial', 'may") ('their', 'medical") C'use', 'appropriate") ('the', 'events")
('the', 'final', 'spot') ('per' '100",." (rregion', ": "while") ('writer', 'for', 'iTunes') ('who", 'are', "assigndd") ('the", 'Syrian', 'people') (sold', 'in', '1986")
(" "proposed', "location)) ('way', 'our')
('working'. 'pitches") ('sixth', 'minutes") ('thirst',".)
('report', 'his', 'disappear') ("which', 'was', 'discovered") ('was', ''iven'. 'bail') ('the", "experiecce" 'and') ('to', 'the', 'left') ('under', 'the", 'following') ('that', 'Mr', 'Cro') ('station", 'in', 'London') (sseck', 'to', 'to''''romii 'promote"" ('office', 'closed', '.) ('that', 'Walt', 'Disney") ('seemed', 'like', 'it') C'very', 'few', 'people") ('unhealthy', 'fat', 'fat') ('of', 'the', 'heavy") ('strong'. 'transport', 'network') ("so", 'unfortunately', 'no') ("","Un" 'der')
('very', 'difficult', 'job",".")
('was', 'be', ('troops', 'are", 'transferred', 'to") ('what', 'we', 'did', '.)
('successor',") ".)
('we', 'all") ('want', 'me') (rretuned', 'with") ('was", 'watch")
(tto', 'provide', 'for', 'their') ('the', 'math', 'is', 'only") ('track', ". 'The", 'San') ('website', "! 'Mr', 'Burke') ('the', 'first', 'lady', 'is') ('was', 'cleared', 'of", 'all') ('work', "due",'to""" ('to', 'use'. 'its', 'own') ('while', "., 'but', 'the') ('with', 'the', 'Securities', 'and') ('that', "ann," 'arrest', 'has") ('was', ", 'largely', 'used') ('there", """ ('the', ". 'Gen') ('the', 'best', 'known', 'play') ('then', "charged", ", 'a')
('their', 'faces")
('shot', 'past')
('trainer', 'Dann)
('the', 'lower')
('the'. 'Caribbean') ('wildlife', 'groups') ('the', (the'' Cyour', 'advanced") (' ('winning', 'player') ('successful', "?')
"more")
('were', 'disappointed") ('why', 'an')
('was', 'driving.. '
('project', 'has", 'raised') ('opportunity', 'to', 'help') ('our', 'products', 'and")
("represented' 'her') (proomoee', 'investment') ('soldier', 'and') ('started', 'shooting') ('visiting'. 'the') ('questions",".""
('the', 'drug'. 'on', 'the") ('them', 'from', 'becoming'. 'the")
('plunge', 'in', 'the") C'rr,, 'delete', 'any")
('to', 'tell', ": 'It') ('which', 'ram', 'from', '12') ('that', 'Scotland', 'can', 'win')
('of', "my,, 'way") ('raised', 'the', 'limit')

---

Table 12: Samples of n-gram for UniLM.
2-gram
3-gram
4-gram
('our', "hard")
('s', "a', "ho")
('minister', "for', "immigration',
(thee."))
(ff,, '."
('will', 'help'. 'to', 'di')
C'parts'""" (")
('back', 'around', 'the")
('under', 'p', 'ri', 'vil")
(lead", 'with")
("window', ,',, 'to")
('was', "transferred", 'to,, 'q')"")
("na",
('to", 'm', 'east')
('haze', "'nz", 'In','ut', 'co'' ('k', "ha",""" 'kaa, 'g")
("meets', aat)
('way', 'you', 'would") ("arch', "er',""" ('and', 'legs'. ".)
('lit,, "hua")
('that,, "m', 'cca", 'be')
('she', '
C'on', 'the', 'future', (r'', 'aj'. 'esh'. '.)
('third", 'night')
('hanged', 'and") ('litle", "flu', "stered") C''', 'araa, 'v")
("play,, "them")
('strangers', '", "was", "released") ('suspended', "his', 'journalist', 'conduct')
('oldest', 'and")
('informal', 'economy") ('wword', 'that')
( ("earnings', 'were', "affected") ('round', 'stone", 'co')
( ('scored', 'a', 'few', 'goals') ("he", "was', "talking", 'about') (parkedd, 'his', 'car', 'in') ("national', 'team', "., 'winning") ('out", 'her', ,J, "'''''") ('would', 'see', 'her', 'father") ('say', 'it', """ """.'') (ttee, "mid', "-, '18th') ('they', ". 're', 'spa') C'n',, 'thieves', ",, 'den') ('the', 'throat', 'of", "ka) ("to', 'the', "haze", 'In') (the', 'title', 'is', 'initially') ('ransom", 'ware", ": 'it') ('nak', 'hir', 'ni', 'sa') Cof', 'the', 'following'. ('put', 'pressure', 'on', 'people") ('s', 'a", 'little,, 'more') Choo', 'isted', 'itself", 'into') ('in', 'their', '-") (suure, 'what", "he", 'meant") C'sa', 'ssa', 'was', 'a') ("have", "us', 'here", "yet") Choot' "., "", 's") (thee,, 'floor', ",, 'm') ('he', 'pa', '., 'and') ('girl', 'who', 'he", 'would') ('with', 'a', 'fellow,, 'r') ('won', 'every', 'tournament,, '.)
('great,, 'are')
("ka', 'wasaki', 'from') ('super', 'sh', 'ow")
('which', 'features") Cresponsibilityy, "is") (' ('was', 'convicted') ("grandparents'. !.)
('modern", '", 'd') ('and', 'investment', ('division', 'was', 'never') ('facto', '",, 'protector") ('nak', 'a',")) (224', 'de', 'c') ('changes', 'to', 'the') ('new', "estimate","" ?.)
('she', "gets") ('showing', 'the') Cis', 'really') ('thank', "goodness") ('smaller', 'bathroom") ("main', 'reason')
('not', 'con')
(hher',painn"
"team",,;)
('her', 'were', 'at')
('my', 'car')
('that', 'the', 'hero') ('con', 'ni', 'tor')
("parking", 'lots')
('in', 'terror") C'n', 'wy") ('re", 'journalists') ("native", 'town") ('protect'," '.) ("happy', 'features") ('they",'turne"""" 'turned') ('so','d') ('si', 'un')
('that', "the", 'uk')
('the', 'official', 'w')
('the', 'crowd', 'was')
(-1,, 'black', 'boy") ('most,, 'k', 'usa')
('performed', '",, 'm') ("here', 'and', 'you') ('published', 'in', '1977")
('26', '2')
('no', 'organised")
('them', 'as', 'independent') ('into', 'the', 'water') ('on', 'plan', 'kt')
('her', 'album") ('v','il) ('partner', "") (respectively'. '.) ("second', 'fastest') (' ('marry, "men")) ('my', 'lady") ('were', 'found') ('sixth',
('library", 'and', 'archives') ('br','id', 'id', "sf") ('cafe', 's)
('verdict', 'was', 'overturned', "by') ('see', 'the", 'last', 'one") ('order', 'of', 'the', 'ta')
('terror"."" 'the")
('they', 'moved', 'into", 'a')
('money", 'for', "life")
('saying', ".. ""> 'it') ('innocent', 'pcople', ",, '') ('would', 'not', 'book', 'the") ('the", 'album', "", 'is")
('are", "b', 'on')
('had', 'taken', 'her')
('with", 'a', 'video')
('fund', 'has')
C'mii, 'e', 'cht')
('te',, 'north', 'k', 'ore")
Cyears', "
Cyou', 'what,,'
('had', 'killed', 'her',

---

Table 13: Samples of n-gram for BART.
2 2-gram
3 3-gram
4-gram
("travellers', 'were')
( (searcc', 'is', "beginning')
('who', 'was', 'in', 'the")
("tossed', '.)
('television', 'News', 'media')
('up'. "", ....... 'Family") ('them', "They", 'fought', 'they')
("targeted', 'online") ("to', "tell")
('she", 'told', "her')
("team", 'team"))
("was', 'a", ",.".. 'Ar') ('village', 'today', "!", 'Article") ('will', 'provided', 'master", 'classes') ('were', "cited', "including", ":)) ('then', 'he', 'born.. 'here") ('with', 'force". "they") ("was', 'jailed', 'in'. '2010")
('two", 'won") ('was', "bullied") ("transaction', "details") ('trouble', 'Officials") ('victim', 'left')
('the", 'Empire', .")
('survive', 'and", 'thrive') ('the", 'reason', "for")
('would', 'choose', 'this') ('the', 'strong', 'mann) (GG', 'Dean', "Andrews") ('while', "his'. 'comments') ('the', 'report', 'inccudes") ('were', '...., 'they") ('they', 'are', ''working') ('still', 'is', 'a')
('use", 'There") ('team', ......))
('victories', 'being', scored'.'." ('they', 'start', 'again', 'After') ("the", 'suspects'. '., 'The") ('this', 'youthfull, "group', 'of") ('were'. 'false', 'claims', 'that') ("to', "explain', 'why", "!?)
('A', 'School') ('wrong', ......)
('worlds'.'. '.) ('to', aaboiis') ('was", "among") ('to', 'Chad') ('took,, '4") ('team', 'Behind') ('visitor', 'st")
('universe', "The") ('was', 'sentenced', 'for') ('walk', 'out', 'end') ('then', 'he", "and") ('the', ":,"" ':''PI" ('who', 'is', 'based") ('the", "isst"."..."
("train', 'operators', 'The', 'train') (tthe'. 'whole', ("the''whole',
'scries', 'is')
('wishes', 'to', 'remain', "anonymous") ('thee', 'to", 'the', 'number') ('unbeaten', 'and', 'the', 'victory") ("want', "them', ", "They") C'years', 'ago', 'The', 'strike") ('the', 'she'''slot', '.."', 'Brian') ("was', "at', 'board'. ".)
('that', 'North') ('stand", '-)
Cyourr, ''thing')
('thousand', "peoopl""""" 'missing') ('was", "hes', 'over') ('weather', 'forecast', "keeps") ('singers', 'and', 'designers') ('will', 'merge'. 'it') ('to", 'saying'. 'goodbye') (2, "Assistant', 'manager") ('through', 'its", 'share')
('the,, 'Greck') CIs'', 'My")
('they,, !!!!)
('which', 'stand', 'Hide', 'Transcript')
('wheel', 'is')
('the', 'univeesiityy "!") ('the", 'service', 'that', 'does') ('their', 'website", ',, 'TV) ('who', 'were', 'sacked', 'in') ('to', 'passing'. 'the', 'mark') ('yet', .......,, 'And', ".....)
('tower', 'house")
('the', ( ('verified', ".)
('the", 'bastard') ("targeted', 'it')
('selling', 'properties', '?)
('sure", "., "Especially') ('speak', 'is', 'sure') ('who', 'was', '82") ('was', 'And', 'That') ('who', 'came", 'to')
('weeks", 'later') ('summer'." !.)
('this', 'club', 'Article') ('was", "likely'. 'disappointed", 'in') ('us', """""" ('they', 'say', 'Turn') ('who', 'the", 'artist', 'The') ('the", 'south', "Crew,, 'sm') ('with', 'a', 'golf', 'club") (GG', 'The', 'ail"" ('while,,"......r"" 'as')
(" ('then', 'is') (the', 'Sam') ('team', 'is') ('topic', '-²)
('the', 'race", 'was') ("services', 'are", 'resumed') ('today,,:s 'Jack') ('she', 'never', 'heard") ('with', 'the', 'age')
('spotted', 'nearby') ('understandable' 'to") ("victim', 'refused') ("A7, "advertisement") ('strife', 'G!')
('survives", 'military", 'tests") ('to', 'gain', 'insights') ('the", "holidays', 'will')
('with', 'women', 'are', 'is')
('trial', 'was'. 'strike', 'after') ('where', 'are', 'you', '?.)
('trader', 'Bryan') ("temlles,, 'From") ('surprised', 'and') ('widespread', aas") (twoo, "titles") ('whose', 'whose')
('space", 'The', "policy") ('the', 'items", 'They') ('starts', '!. 'When') ('union', 'and', 'to") Ctoo', 'change", 'A') Cy', "o'''s"""' 'Is"."")
('unavailable", "?, 'for', 'Advertisement') ('was', 'attacked', 'she', 'was') (GG,, "The', 'former','..") ('were", 'there", 'were", 'some') ('website', 'said', ":, 'advertisement") ('then', 'travels", 'C', 'hen')
('than', 'live")

---

Table 14: Samples of n-gram for GPT-Neo.
2 Z-gram
3 3-gram
4-gram
('where', "about")
("the", "bag'. "and")
('transferred", 'to", 'the", 'Auckland')
('these', 'talks") ('ticket',
('this", 'context', 'that')
('told', 'that', 'they'. 'had') (T, "Bul", "ger', 'G') ("touch', 'of", 'the', 'night") ("will', 'be", "drawn'. 'in') ("was', " 'proposed', 'by". 'Swedish") ("with", "some", "describing', 'it') ('why', 'more', 'needs', 'to") ('very,, 'powerful", 'and', 'personal') ('ways", 'that', 'participants' 'can") ('your', "country', 'and', yyou") ('uphill', 'battle', 'to', 'get') ('whatever', T, 'had", 'to") C'universe', 'today', 'is', 'driven') ('L''ss, 'first', 'cash') C'wtth, 'men', 'and', 'had') (L' 's', 'NFL', 'coverage") ('year'. 'after', 'which') ("L,, 's', "other', 'five") ("translation', 'the', 'performance') ('will', 'be', 'rolled', 'out') ("was", 'condemned', 'by", 'the") ('who', 'have', 'been', 'ravaged') ('young'. 'players.. 'GK', 'Wade') ('top', 'five", 'moments'."") ('work', ":, 'His', 'anger') ('vision', 'to', 'life', :")) ('toward', 'the', 'port', 'ico') ('which', 'saw', 'ormmer, 'owner") ('trunk', 'of', 'her', 'car') ('violate', 'the", 'UN', 'Charter') ('was", 'hijacked', 'by", 'a') ('was', 'managed', 'by', 'the') ('who', 'felt', 'that', 'the") ('using', 'a", 'rapid', "HIV") ('was", "born', 'in', '1971") ('trying', 'to', 'develop'''' 'nuclear') ('were", ''also,, 'up', 'by") ('us", 'for,, 'a', 'new") ('was", 'invited", 'to', 'an') (r,' 'The', 'BCC', TT) ("was", 'proud', 'to", 'represent') ('was', 'also", 'a', 'featured') ('with', 'your', 'message", 'to') (as","s", 'the', "Boeing') ('win', 'over', 'Sporting', ".")
('with', 'Hell", 'fire")
("week',":)
("to', 'schools", 'that")
('the', 'drones")
('to', 'anyone", 'in'))
("things', 'happen')
('then', 'grabbed', 'M')
('to', "expose")
('to', 'sit', 'on')
('the', "graphene') ('with', "'girl') ('where', "residents") ('their', 'compliance") ('to'. 'getting") ('then', 'headed') ('undermined', ".")
('together', 'on', 'this")
('the', 'store", 'was') (T, "viol", 'ation") ('the', "early", "universe") ('with', 'his', "ability") ('with', 'someone", 'that') ('was','s 'ustiing""""" ("told,, "prosecutors', 'that') ("to', "persuade"" 'S") ("the', 'end', 'users") ('unique', 'to', 'humans') ('the", "regeneration", "of") (tto', 'memor", 'ise") (vvrry,, 'unusual', 'case') (',, '23', 'mmilion)" ("time", ; 'in', "recent") (" ('they', 'are', 'in) ('very', 'sick", 'ly")
("unconscious', 'when') ('the', "stroke') ('works', "ahead")
('trying'. "several')
('tourists', "away")
('with', '64")
(' ('was', 'sidelined") ("to', "bed")
(r, 'Secret')
(1', 'List')
('why", 'not')
('to", 'bow") ('which', "already') (" ("with'," 'Art') ("twice", 'about")
('us', "because") ('trans', 'people', 'can')
(' ('were", 'working', 'towards') ('way", 'narrowing') ('the', 'embass''' "'s")
'arrest') ('rrest" ('wherever', 'T') ('used', 'Photoshop') ('the', 'tradition') (" ('ward', 'electing") ('zoo", 'then')
('their', 'resistance', 'over') CAB', '80', 'bn')
(L', "they', 'said") ('the", 'outcome', 'the")
("we', "'re, 'frustrated') ('this', 'VIP', 'club')
('wrote', 'that')
('visa', 'program') 'stre")
('L', 'the', 'officer') ('L', 's', 'then')
('usually', "accompanied""
('used', "by", 'Democratic") 'slain', 'soldier')
('with', 'developers')
(' ('use",'ahead"" 'ahead')
('without', 'starting', "quarterback") ('we", 'can', 'talk') ('the', 'heated', 'swimming') ('the', "cocaine"," "!")
("wealthy', "neighborhood') ('L', 'Fil')
('under', 'this')
('was", "waiting")
('word', "?, 'He') ('to', 'keep', 'using') ('woman', '." 'T)
(T', 'R') ('will,, 'forgive')
('total', "assets',", '., 'as') ('L', 'said", 'John', 'F)
('the", "groove")
('world', 'of", "acting")
("trial',, 'in')
(well', 'as", 'delivering') ('the', 'World', 'Retail")
('was", 'the", 'second', 'most') ('went', 'to', 'Old', 'Trafford')
('turning,, 'his')

---

Table 13: Samples of re-gram for Bloom.
2-gram
3-gram
4-gram
('the,, "tribes))
('the", 'data', "optim")
('they,, 'are', 'not', "legally") ("to', 'a', 'weak", 'ening") ('work', 'men', 'were", 'allowed") ('were", 'also', 'used', 'for") ("way', 'we", 'think', "aink'." 'about") ("two', "appearances', 'for', 'Portugal")
"estt"""s")
('the", 'police', "goo")
("various", "colors')
('the', 'human'; "system")
('tickets', "for")
("lagged', 'A, 'idan')
('than', 'Rp")
("thoory', 'of", 'an')
('state", "might")
('their', "recent', 'poor") ("were', 'the", "Reds")
('theatre', 'special") ('strategic', 'planning') ('were', "
('time", 'that', "they', 'have") (GG', 'Women', 'with', 'Phot') ('unclear', 'whether', 'or', 'not') ("using', 'this', "again', "!) ('who', 'is', 'still,, 'chairman') ("tool', 'to', 'educ', 'ate') ('unit', 'in', 'the", "nation") ('trial', 'court' ' 'he') (' ('was', 'a', 'handsome', 'young') ('think', 'he', 'GL", 'II') ('ireatment', 'of", 'any', 'individual") ('woman', 'claiming'. 'she', 'was') ('will', 'return', 'from', 'the') Cyou', "can', 'hear', 'me')
('used', 'for', "advertising') ('up', "'the, 'Blue') ('the', 'same", "pricing') ('total', , 'annual', 'revenue') ("tests', 'and', 'normal") (transport', ) ('surrounding', 'it', ('suite' ' "The")
('the", "hhe","Cunn 'General") ("wrotc', ' ('wife", ' ('student', "assaulted")
'US')
('special', 'equipment") ('vessel', 'with')
('top', "employer') ("undoubledll', "have") "ttyee,.at") ('the", "fiscal')
('use", 'in', "this") ('the', 'House', 'Finance') ('were', "arrested", 'by") ('staff", "C) ('was', 'a', "bank") ('visitors'.". "These') ('the', "brain', "() ('with', 'new", 'talent') ('that', 'is', "distinguished") ('so", 'impressed', 'with') ('with', 'Jon', 'ah') ("echnology', 'and', 'financial') (" ('someone", 'enjoy', 's') ('up', "over', ('ue'''over', '4") ('successful', 'films', 'ever') ('the', 'American', 'Bar') ('will', 'have", 'lots") ('the', 'pandemic', 'continues") ('wave', hadd' 'reached") ('the", 'opposition"' 'play") ("statements', 'that', 'are")
('with', 'obs") ('wedding', 'plan')
Cuse', 'their', 'violence', ('was", 'mentally', 'ill', 'after") ("these", 'materials', 1. "The') ('to', 'the', 'Detroit', 'Pist') ('think', 'there", 'is', 'very') ('was', 'then', 'advised', 'that') (wwiich', 'is', 'their', 'honey") ('which', 'is', 'widely", 'regarded') ('to', 'be", 'much", 'of") (tto', 'write", 'the', 'article') ("years', "., 'Le", 'igh') ('used', 'to', "identify', 'new") C'to', 'my', 'daughter', 'GL) ("to', 'worry', 'about', 'my") ('was", "aas","" 'shot', 'from") ("'op",'3', '3',""" 'and')
('tumor,, 'and"" ('small', "fee")
("unnecessary'. 'burden') C'yet', "reviewed") ('yam', "having") ('wonder', 'over')
('stop',':') ("tennis', 'game') ('the'. 'micro')
('three', "aspects") ('website", ';)
('will', 'rise") ('your', 'C")
('that', 'orph')
('west',")) ('will', 'state') Cyour", 'pocket') ('tee,, ("thee,'Andes") 'Andes") ('train', 'had') ('trusted'." ".) ('will, "know") ('time', 'varies') ('training', '()
('unemployed', 'was", 'around') ('to', 'data', 'compiled') ('with', 'a', 'project') ('would', 'not', 'back') ('the', 'Summer', 'Olympics') ('the', 'British', 'off") ('the', 'storm', 'had") ('violence', :. 'exploitation') ("was', 'GI, 'perfect') ('substance'. 'use", '.) ("two', 'human', 'B") ('to', "assist", "Liverpool') C'tggtthe'', 'for', 'nearly") ('well', 'supported", "by')
('to', 'do', 'a', 'lot') ('weight', 'of", 'the', 'animal') ('to', 'keep', 'our', 'state") ('varies', 'from', '0', ('up", 'a', 'new', 'office') ('they', 'have', 'looked', 'to')
('to', 'fall', 'asleep', 'in') ("vessel', 'which', 'was', 'responsible") ('to', "the", 'Governor', 'for') ("to', 'the', 'Dallas', 'Cow') ('varicty", 'of", 'insight', 'into') ('video", 'playback', ?., 'The") C'very,, 'strong', 'team', "") ('where', 'we", 'need', 'to')
('who', 'ran") ('that', 'treaty")
("to', '2014') ('store', "page") ('they', 'satisfied')
('the", effectivee)


Reviews:
[{"review_id": "aZg47BdxzI", "reviewer": "Reviewer_Nwjg", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear reviewer, thank you for your recognition and valuable suggestions. We appreciate your positive\nfeedback on our method and performance. We understand your concerns and would like to address them as follows: \n\n**Q1**: The result is much worse compared to using true perplexity. Especially here all the experiments are based on small LLMs, the gap might be more obvious when the size of the LLMs increases. We believe you are concerned about the effectiveness of LLMDet as the scale of LLM increases, right? \n\n**A1**: We appreciate your concern and would like to clarify that employing the true perplexity method serves as an upper bound for detection effectiveness. However, our approach offers greater robustness. This is because true perplexity is sensitive to changes in each word, while our method is not. Additionally, our approach strives to outperform methods based on true perplexity in terms of both model security and computational efficiency, all while maintaining a high level of detection accuracy.\n\nRegarding the issues you are concerned about, the answer can be found in **Figure 3 of the paper**. The scale of the Language Models (LLMs) used in Figure 3 varies, ranging in size from 110 million (UniLM) to 7 billion (LLaMA). From the experimental results, it is evident that whether we extend our approach to a smaller LLM (110 million) or a larger LLM (7 billion), the overall detection performance consistently hovers around 85%, without any significant downward trend. Consequently, when we incorporate new LLMs, the performance gap compared to the method based on real perplexity won't become significantly wide.\n\n**Q2**: The paper did not compare to any baselines. Here, are you concerned that it might be our lack of a baseline to demonstrate the effectiveness of our method and the difficulty of the task?\n\n**A2**：In response to this concern, we would like to clarify that the absence of baselines in the paper is due to the fine-grained nature of the detection of LLMDet compared to existing works. Current methods, such as DetecGPT and GPT-Zero, primarily aim to distinguish between human-generated and machine-generated text. In contrast, LLMDet focuses on identifying whether the text was generated by humans or by a specific language model (LLM), making our task more challenging.\n\nTo address your concerns, we have conducted additional experiments comparing LLMDet with DetecGPT and GPT-Zero. For the sake of fairness, we categorized all detection results from LLMDet for a specific language model as \"machine-generated\", without further fine-grained distinction. We use a dataset containing 1,000 text samples for this analysis. Below are the results obtained from these experiments:\n\n| Method              | Accuracy $\\uparrow$ (\\%) | Time(s) $\\downarrow$ | Ratio(GPT-Zero) $\\uparrow$ |\n| :---------------- | :------: | :------: | :------: | \n| GPT-Zero        |   86.56   | 2376.87  |  x 1.00 |\n| DetectGPT          |  92.67    | 14354.61 | x 0.17|\n| LLMDet    |  88.18   |  321.90 | x 7.38|\n\nFrom the experimental results, it is evident that, in terms of detection accuracy, LLMDet outperforms GPT-Zero but lags behind DetectGPT. However, LLMDet demonstrates exceptional capabilities in fine-grained discrimination, as shown in **Table 2 of the paper**, and efficiency—achievements that current existing methods have yet to attain.\n\nThank you once again for your thorough review. We genuinely hope that the response provided above can address your concerns.\n\nBest wishes!", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "(1) The classification is more fine-grained. Most of the machine generated text detection problem studies binary classification while in the paper, the ourcome is multi-class and can tell the which LLM the text is from.\n(2) The proxy perplexity is efficient to compute than the real perplexity, and requires less resources", "reasons_to_reject": "1) The result is much worse compared to the using true perplexity. Especially here all the experiments are based on small LLMs, the gap might be more obvious when the size of the LLMs increase.\n2) The paper didn't compate to any baselines.", "questions_to_authors": "", "paper_topic_and_main_contributions": "This paper proposes a text detection tool that can identify which generation source the text is from. It uses n-gram probability sampled from specific language model to calculate the proxy perplexity of LLMs and use these as feature to train a text classifier.", "excitement": 3, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "F7dQDGQzMu", "reviewer": "Reviewer_RV13", "summary": "", "questions": "1. As you mentioned in Section 4.1, constructing a statistics n-gram dictionary needs the next-token probability of the generation model. It constrains the utility of LLMDet only on white-box settings. Why don't you also estimate the next-token probability by statistical methods? Is this because of the limited number of training datasets? Moreover, is there any possibility to do something similar to distillation?\n2. In Table 1 and Table 2, it seems stronger models like LLaMA and BART are easier to detect compared to GPT-2 and OPT. It is counterintuitive because stronger models should be more similar to human-written ones, which means harder to discriminate. Do you have any future analysis or explanation for this phenomenon?\n3. Since LLMDet is rely on next-token probability, is it robust to some perturbation on text? like paraphrasing or random deletion. Moreover, if the generation model slightly updates weights or changes hyperparameters like temperature, top-p, and top-k, will the model still work well?\n4. As there will always be generation models that LLMDet did not learn before, what will happen if we input a text generated by a totally new model? Will it be clarified as human-written? Or do we have some rejection mechanism?", "limitations": "", "rating": 3, "confidence": 4, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear reviewer, thank you for providing us with constructive and valuable feedback on our paper. We appreciate your recognition of the motivation and experimental aspects of our paper, as well as your feedback on improving it. We understand your concerns and are committed to addressing the following issues:\n\n**Q1**: As you mentioned in Section 4.1, constructing a statistics n-gram dictionary needs the next-token probability of the generation model. It constrains the utility of LLMDet only on white-box settings. Why don't you also estimate the next-token probability by statistical methods? Is this because of the limited number of training datasets? Moreover, is there any possibility to do something similar to distillation?\n\n**A1**: Before answering this question, we wish to clarify that the inability to detect text generated by commercial closed-source models is not unique to LLMDet; it is a common limitation of existing detection methods as well. Moreover, our approach is more feasible compared to existing methods because it does not require holding the third-party model. We only need to gather some statistical information about it, which can be provided by closed-source model holders.\n\nWe became aware of this limitation during the experimental phase. To mitigate it to some extent, we have considered two possible approaches:\n\n(1) In the process of implementing LLMDet, we offer not only detection capabilities but also an extensible interface for closed-source model owners. Details about this implementation can be found in **Algorithm 1 of Appendix A in the paper**. The extended interface aims to secure the model effectively without compromising the interests of the model owners. Through this approach, we hope to encourage more closed-source model owners to participate and contribute to the continuous improvement of the detection ecosystem of LLMDet.\n\n(2) We have also explored using statistical techniques to estimate the next-token probability in proprietary commercial models. However, due to limited data volume, achieving the anticipated results has been challenging. Additionally, generating a significant amount of statistical data comes with considerable costs. As a result, we have included this approach on our list of future work items.\n\nFurthermore, the distillation method you mentioned is a valuable avenue for future exploration. We will certainly consider it in our future research endeavors.\n\n**Q2**: In Table 1 and Table 2, it seems stronger models like LLaMA and BART are easier to detect compared to GPT-2 and OPT. It is counterintuitive because stronger models should be more similar to human-written ones, which means harder to discriminate. Do you have any future analysis or explanation for this phenomenon?\n\n**A2**: Before addressing this question, we would like to clarify that LLMDet is designed specifically for fine-grained text detection, which fundamentally constitutes a multi-class classification problem. Therefore, lower detection accuracy for a specific category (such as GPT-2 or OPT) does not necessarily indicate difficulty in distinguishing it from human-generated text. Instead, it might stem from the high similarity that these models share with text generated by other models, leading to potential confusion.\n\nThe specific experimental results can be observed in the confusion matrix presented in **Figure 2 of the paper**. The lower detection accuracy for GPT-2 and OPT, compared to other categories, arises primarily because these categories are prone to being confused with each other, rather than being difficult to distinguish from human-generated text. Additionally, the level of confusion among other models, such as LLaMA, can also be clearly observed in Figure 2.\n\n**Q3**: Since LLMDet is relying on next-token probability, is it robust to some perturbation on text? like paraphrasing or random deletion. Moreover, if the generation model slightly updates weights or changes hyperparameters like temperature, top-p, and top-k, will the model still work well?\n\n**A3**: Examining the robustness of LLMDet requires taking into account the influence of various factors. Due to time limitations, we only consider three scenarios: random deletion, weight updates, and temperature changes. More detailed robustness testing will be included in future work.\n\n(1) For random deletion, we use the approach outlined in Section 5.1 of this article to generate 16,000 text instances using LLaMA. We assigned their corresponding text labels as LLaMA. For the generated text, we set the deletion rates at 0.1, 0.3, and 0.5, respectively. After randomly deleting words in the text according to these rates, we obtain corresponding test texts for evaluating the robustness of LLMDet. The experimental results are as follows:\n\n| Deletion Rate | R1(Accuracy) $\\uparrow$ (\\%) |   R2 $\\uparrow$ (\\%)   |  R3 $\\uparrow$ (\\%) |\n| :----------------: | :------: |  :------: |  :------: |\n| 0.1  |   90.06   |  97.07  | 99.52 |\n| 0.3  |   89.31   |  99.12  | 99.53 |\n| 0.5  |   87.80   |  99.53  | 99.82 |\n\nFrom the experimental results above, the accuracy of LLMDet still remains at around 90% in the face of random deletions. Therefore, this indicates that LLMDet exhibits strong robustness against random deletions.\n\n(2) For weight updates, we employ the approach outlined in Section 5.1 of this paper to generate 16,000 text instances using the 7B Vicuna model, an instruction fine-tuned version of LLaMA, and set their corresponding text labels as LLaMA. These instances are then utilized as test data to assess the robustness of LLMDet. The test outcomes are presented below:\n\n| R1(Accuracy) $\\uparrow$ (\\%) |   R2 $\\uparrow$ (\\%)   |  R3 $\\uparrow$ (\\%) |\n| :------: |  :------: |  :------: |\n|   97.78   |  99.07  | 99.39 |\n\nBased on the experimental results above, LLMDet demonstrates a high level of robustness against changes in model parameter weights, at least for this particular configuration.\n\n(3) For hyperparameter changes, we use the approach outlined in Section 5.1 of this article to generate 16,000 text instances using LLaMA at temperatures of 0.1, 0.4, 0.7, and 1.0 respectively, and assign their corresponding text labels as LLaMA. These instances are then used as test data to assess the robustness of LLMDet. The test results are as follows:\n\n| Temperature | R1(Accuracy) $\\uparrow$ (\\%) |   R2 $\\uparrow$ (\\%)   |  R3 $\\uparrow$ (\\%) |\n| :----------------: | :------: |  :------: |  :------: |\n| 0.1  |   91.23   |  97.55  | 99.46 |\n| 0.4  |   92.05   |  97.48  | 99.33 |\n| 0.7  |   93.02   |  97.48  | 99.24 |\n| 1.0  |   94.37   |  98.06  | 99.33 |\n\nBased on the experimental results above, LLMDet achieves a text detection accuracy of over 90% across four different temperature values. This indicates that LLMDet is highly robust to variations in hyperparameters.\n\nIn summary, LLMDet exhibits strong robustness against certain types of perturbations in the text, such as random deletions, slight weight updates in the generative model, and adjustments to temperature settings.\n\n**Q4**: As there will always be generation models that LLMDet did not learn before, what will happen if we input a text generated by a totally new model? Will it be clarified as human-written? Or do we have some rejection mechanism?\n\n**A4**: Before addressing this issue, we would like to clarify that the output of LLMDet is not a single definitive label. Instead, it generates a combination of multiple labels, each with an associated confidence level (i.e., the probability of each label being correct). Therefore, if users find results with low confidence levels, it indicates that the predictions are either not reliable or that LLMDet is abstaining from classification.\n\nWhen inputting a text generated by a totally new model that LLMDet has not previously encountered, the system tends to assign relatively low probabilities to each output label. Consequently, the overall prediction confidence is low. This suggests that the predictions are not reliable or that LLMDet chooses not to classify the input.\n\nThank you once again for your valuable suggestions. We hope this clarification addresses your concerns.\n\nBest wishes!", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. LLMDet is a detector framework that can be extendible and transferable to various LLMs.\n2. LLMDet is aimed at a higher standard detection task -- clarify which model generated the text.\n3. LLMDet is safe and neutral since it is based on an independent third-party statistics n-gram dictionary.\n4. The writer design a sufficient analysis of the model and align well to their motivation.", "reasons_to_reject": "1. Since current dominant LLMs are commercial closed-source models, i.e., OpenAI models, LLMDet could only apply on white-box models (those with access to probability) but are not helpful for black-box settings.\n2. Many LLM models can change their probability via different methods, for example, updating parameters (like GPT-4, and some models on Huggingface), changing hyperparameters (like temperature, word penalty, etc., or even fine-tuning on backbone model), and adding noise on prompt or prefix. It is worth considering the robustness of this method in these situations.\n3. As it is hard to cover all the LLMs (some of them may be undisclosed), the research question of LLMDet should be viewed as a classification task with out-of-domain classes.", "questions_to_authors": "1. As you mentioned in Section 4.1, constructing a statistics n-gram dictionary needs the next-token probability of the generation model. It constrains the utility of LLMDet only on white-box settings. Why don't you also estimate the next-token probability by statistical methods? Is this because of the limited number of training datasets? Moreover, is there any possibility to do something similar to distillation?\n2. In Table 1 and Table 2, it seems stronger models like LLaMA and BART are easier to detect compared to GPT-2 and OPT. It is counterintuitive because stronger models should be more similar to human-written ones, which means harder to discriminate. Do you have any future analysis or explanation for this phenomenon?\n3. Since LLMDet is rely on next-token probability, is it robust to some perturbation on text? like paraphrasing or random deletion. Moreover, if the generation model slightly updates weights or changes hyperparameters like temperature, top-p, and top-k, will the model still work well?\n4. As there will always be generation models that LLMDet did not learn before, what will happen if we input a text generated by a totally new model? Will it be clarified as human-written? Or do we have some rejection mechanism?", "paper_topic_and_main_contributions": "The paper proposes LLMDet, a framework to classify the source of a given text. Unlike traditional machine-generated text detection works, LLMDet aims to clarify which model generated the text. LLMDet adopts a statistics n-gram dictionary to estimate perplexity, which makes it an independent third-party detector. The writers also mention four principles for their model, namely specificity, safety, efficiency, and extendibility. LLMDet well perform on the four aspects. Moreover, the paper includes further discussion on the effect of hyper-parameters.", "excitement": 3, "reproducibility": 5, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "GEqg0nXtEU", "reviewer": "Reviewer_WGR6", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear reviewer, we sincerely appreciate your thorough review and recognition of our work and experimental results. We completely understand the concerns you've raised, and we hope the following response can address your questions: \n\n**Q**: One problem I see is the claim that LLMDet is faster than other perplexity-based algorithms. I don't think there is sufficient data to support this claim, mainly because GPT-Zero, DetectGPT, and True-PPL are tested on different platforms based on Section 5.4 For Efficiency (RQ3). I think you could claim LLMDet is faster because it precomputes the dictionary instead of computing on the fly, but there should not be a number specifically to be \"x3.7\" based on the reasons above.\n\n**A**: For any confusion that may have arisen, we sincerely apologize. We would like to clarify that the discussion about 'Efficiency' in Section 5.4 is in terms of the speed and hardware requirements of the detection end.\n\nThe creation of the dictionary is a one-time process carried out locally by us, the detection tool provider. During the detection stage, this precomputed dictionary can be utilized directly without any additional computation. As a result, the computational overhead associated with dictionary calculations can be disregarded in the detection stage. \n\nThe experimental setup in **Table 4 of the paper** involves DetecGPT and True-PPL running on a V100-32G GPU. In contrast, GPT-Zero relies on the CPU for API calls, which may additionally be supported by server-side hardware behind it. LLMDet, on the other hand, performs calculations directly on the CPU. \n\nOur approach not only has the lowest hardware requirements but also achieves the most advanced computational speed. Consequently, our method is more efficient compared to other methods.\n\nThank you again for your feedback. We hope the previous response addresses your concerns. \n\nBest wishes!", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "I would like to accept the paper because it's a solid paper, with extended experimental results. It would also be great if the author release their datasets to construct the dictionary, that would be very useful for benchmarking different detection algorithms for the communities.", "reasons_to_reject": "One problem I see is the claim that LLMDet is faster than other perplexity-based algorithms. I don't think there is sufficient data to support this claim, mainly because for GPT-Zero, DetectGPT and True-PPL are tested on different platform based on Section 5.4 For Efficiency (RQ3). I think you could claim LLMDet is faster because it precomputes the dictionary instead of computing on the fly, but there should not be a number specifically to be \"x3.7\" based on the reasons above.\n\nUpdate: This has been fully addressed by the authors in the following response.", "questions_to_authors": "", "paper_topic_and_main_contributions": "LLMDet is a third-party detection tool developed to identify the source of generated text from specific large language models (LLMs) such as GPT-2, OPT, LLaMA, and others. The tool records the next-token probabilities of salient n-grams as features to calculate proxy perplexity for each LLM. By jointly analyzing the proxy perplexities of LLMs, the source of the generated text can be determined.\n\nThough calculating perplexity for language models for machine-text detection is not new, the author proposed \"Dictionary Construction\" to do ensemble averaging, improving the final classification accuracy.", "excitement": 3, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "L7tq4t3pRD", "reviewer": "Reviewer_d37J", "summary": "", "questions": "- Question A: Why is the human-generated text collected from another source (lines 424-427 in the paper)?", "limitations": "", "rating": 3, "confidence": 4, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear reviewer, thank you for your recognition and valuable feedback. We sincerely appreciate your positive evaluation of the effectiveness and efficiency of our approach. We also understand your concerns, and we would like to address them as follows:\n\n**Q1**: Although the proposed method runs faster than other detectors, the performance comparison is missing. Here, are you concerned that it might be our lack of baselines to demonstrate the effectiveness of our method and the difficulty of the task?\n\n**A1**: In response to this concern, we would like to clarify that the absence of baselines in the paper is due to the fine-grained nature of the detection of LLMDet compared to existing works. Current methods, such as DetecGPT and GPT-Zero, primarily aim to distinguish between human-generated and machine-generated text. In contrast, LLMDet focuses on identifying whether the text was generated by humans or by a specific language model (LLM), making our task more challenging.\n\nTo address your concerns, we have conducted additional experiments comparing LLMDet with DetecGPT and GPT-Zero. For the sake of fairness, we categorized all detection results from LLMDet for a specific language model as \"machine-generated\", without further fine-grained distinction. We use a dataset containing 1,000 text samples for this analysis. Below are the results obtained from these experiments:\n\n| Method              | Accuracy $\\uparrow$ (\\%) | Time(s) $\\downarrow$ | Ratio(GPT-Zero) $\\uparrow$ |\n| :---------------- | :------: | :------: | :------: | \n| GPT-Zero        |   86.56   | 2376.87  |  x 1.00 |\n| DetectGPT          |  92.67    | 14354.61 | x 0.17|\n| LLMDet    |  88.18   |  321.90 | x 7.38|\n\nFrom the experimental results, it is evident that, in terms of detection accuracy, LLMDet outperforms GPT-Zero but lags behind DetectGPT. However, LLMDet demonstrates exceptional capabilities in fine-grained discrimination, as shown in **Table 2 of the paper**, and efficiency—achievements that current existing methods have yet to attain.\n\n\n**Q2**: An attacker can also estimate the perplexity of the text and encourage the model to generate text with similar perplexity to human text. Such kind of adaptive attack should be mentioned. Therefore, are you perhaps more concerned about the robustness of LLMDet?\n\n**A2**: Yes, we are indeed focused on the robustness of LLMDet. Concerning the adaptive attack you mentioned—where the aim is to encourage the model to generate text similar in complexity to human-generated text—we believe this could be achieved via methods like contrastive learning or model fine-tuning. Due to time constraints, however, we have only explored model fine-tuning in our supplementary experiments.\n\nTherefore, we employ the approach outlined in Section 5.1 of this paper to generate 16,000 text instances for the Vicuna model, which is an instruction fine-tuned version of LLaMA. These instances were labeled with corresponding text labels set as 'LLaMA.' Subsequently, this test data was utilized to assess the robustness of LLMDet. The test outcomes are presented below:\n\n| R1(Accuracy) $\\uparrow$ (\\%) |   R2 $\\uparrow$ (\\%)   |  R3 $\\uparrow$ (\\%) |\n| :------: |  :------: |  :------: |\n |   97.78   |  99.07  | 99.39 |\n\nBased on the above experimental results, we observe that LLMDet exhibits strong robustness against this specific adaptive attack. In future work, we plan to further explore the resilience of LLMDet to other variations of adaptive attack methods.\n\nIn addition to adaptive attacks, we also explored the robustness of LLMDet from various other perspectives, such as random deletion and hyperparameter changes.\n\n(1) For random deletion, we use the approach outlined in Section 5.1 of this article to generate 16,000 text instances using LLaMA. We assigned their corresponding text labels as LLaMA. For the generated text, we set the deletion rates at 0.1, 0.3, and 0.5, respectively. After randomly deleting words in the text according to these rates, we obtain corresponding test texts for evaluating the robustness of LLMDet. The experimental results are as follows:\n\n| Deletion Rate | R1(Accuracy) $\\uparrow$ (\\%) |   R2 $\\uparrow$ (\\%)   |  R3 $\\uparrow$ (\\%) |\n| :----------------: | :------: |  :------: |  :------: |\n| 0.1  |   90.06   |  97.07  | 99.52 |\n| 0.3  |   89.31   |  99.12  | 99.53 |\n| 0.5  |   87.80   |  99.53  | 99.82 |\n\nFrom the experimental results above, the accuracy of LLMDet still remains at around 90% in the face of random deletions. Therefore, this indicates that LLMDet exhibits strong robustness against random deletions.\n\n(2) For hyperparameter changes, we use the approach outlined in Section 5.1 of this article to generate 16,000 text instances using LLaMA at temperatures of 0.1, 0.4, 0.7, and 1.0 respectively, and assign their corresponding text labels as LLaMA. These instances are then used as test data to assess the robustness of LLMDet. The test results are as follows:\n\n| Temperature | R1(Accuracy) $\\uparrow$ (\\%) |   R2 $\\uparrow$ (\\%)   |  R3 $\\uparrow$ (\\%) |\n| :----------------: | :------: |  :------: |  :------: |\n| 0.1  |   91.23   |  97.55  | 99.46 |\n| 0.4  |   92.05   |  97.48  | 99.33 |\n| 0.7  |   93.02   |  97.48  | 99.24 |\n| 1.0  |   94.37   |  98.06  | 99.33 |\n\nBased on the experimental results above, LLMDet achieves a text detection accuracy of over 90% across four different temperature values. This indicates that LLMDet is highly robust to variations in hyperparameters.\n\n**Q3**: Why is the human-generated text collected from another source (lines 424-427 in the paper)?\n\n**A3**: Before addressing this question, we would like to clarify that the categorization of human text is one of the outcomes of our detection process. To enable LLMDet to effectively learn features from human text, it is essential to ensure diversity in the sourcing of that text.\n\nTo fulfill this need, we have sought to collect as much human text as possible from various fields. Our review of the HC3 dataset reveals that it includes human text sourced from multiple domains such as Wiki-CSAI, Reddit-ELI5, Open-QA, Medicine, Finance, and others. This meets our criteria for diverse human data. Therefore, we chose to incorporate human text from the HC3 dataset into our own dataset.\n\nThank you again for your valuable feedback. We hope that our previous response adequately addresses your concerns.\n\nBest wishes!", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "- This paper conducted extensive experiments on 8 large language models and demonstrated that the proxy perplexity is comparable to the true perplexity. \n- The proposed method runs much faster than previous works.\n", "reasons_to_reject": "- Although the proposed method runs faster than other detectors, the performance comparison is missing. Therefore, I could not evaluate the difficulty of this task.\n- An attacker can also estimate the perplexity of the text and encourage the model to generate text with similar perplexity to human text. Such kind of adaptive attack should be mentioned.\n", "questions_to_authors": "- Question A: Why is the human-generated text collected from another source (lines 424-427 in the paper)?", "paper_topic_and_main_contributions": "This paper proposes a method to estimate the perplexity of a text generated by a large language model. The authors record the next-token probabilities of salient n-grams from the training text generated by this model. They demonstrate that the proposed method satisfies four capabilities, including specificity, safety, efficiency, and extendibility.", "excitement": 3, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"Typos_Grammar_Style_and_Presentation_Improvements": "- Line 587: ‘n-gram .’ should be ‘n-gram.’"}, "extra_text": {}}, {"review_id": "ZUUu6IBMkT", "reviewer": "Reviewer_eKex", "summary": "", "questions": "- How is the real \"perplexity\" calculated in RQ1? Is it calculated for the entire text or only for the N-grams?\n\n- How does your method take into consideration that not all the humans have the same writing style? Isn't the fact that all the humans are put into one category a problem?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear reviewer, we sincerely appreciate your thorough review and valuable feedback. Your agreement with the four proposed requirements regarding the testing is greatly acknowledged. We also understand your concerns and hope our following response addresses your inquiries:\n\n**Q1**: Missing performance comparison with other approaches. \n\n**A1**: In response to this concern, we would like to clarify that the absence of baselines in the paper is due to the fine-grained nature of the detection of LLMDet compared to existing works. Current methods, such as DetecGPT and GPT-Zero, primarily aim to distinguish between human-generated and machine-generated text. In contrast, LLMDet focuses on identifying whether the text was generated by humans or by a specific language model (LLM), making our task more challenging.\n\nTo address your concerns, we have conducted additional experiments comparing LLMDet with DetecGPT and GPT-Zero. For the sake of fairness, we categorized all detection results from LLMDet for a specific language model as \"machine-generated\", without further fine-grained distinction. We use a dataset containing 1,000 text samples for this analysis. Below are the results obtained from these experiments:\n\n| Method              | Accuracy $\\uparrow$ (\\%) | Time(s) $\\downarrow$ | Ratio(GPT-Zero) $\\uparrow$ |\n| :---------------- | :------: | :------: | :------: | \n| GPT-Zero        |   86.56   | 2376.87  |  x 1.00 |\n| DetectGPT          |  92.67    | 14354.61 | x 0.17|\n| LLMDet    |  88.18   |  321.90 | x 7.38|\n\nFrom the experimental results, it is evident that, in terms of detection accuracy, LLMDet outperforms GPT-Zero but lags behind DetectGPT. However, LLMDet demonstrates exceptional capabilities in fine-grained discrimination, as shown in **Table 2 of the paper**, and efficiency—achievements that current existing methods have yet to attain.\n\n**Q2**: Missing performance comparison on out-of-domain data.\n\n**A2**: In order to assess the out-of-distribution (OOD) performance of LLMDet, we introduce an additional experiment. We apply the approach described in this paper to create a novel testing dataset. This dataset consists of 10,000 text samples from various domains, including Wiki-CSAI, Reddit-ELI5, and Open-QA, as well as medical and financial. We employ the LLMDet method for text detection and obtained the following experimental outcomes:\n\n| F1-micro  $\\uparrow$ (\\%)            | R1(Accuracy) $\\uparrow$ (\\%) |   R2 $\\uparrow$ (\\%)  |  R3 $\\uparrow$ (\\%) |\n| :---------------- | :------: |  :------: |  :------: |\n|     82.00    |   83.36   |  93.78  | 97.33  |\n\nBased on the experimental results, and considering the outcomes in terms of both F1-micro and R1, we observe that LLMDet achieves an out-of-domain (OOD) test accuracy of approximately 82%. Additionally, the metrics for R2 and R3 both exceed 90%, indicating that LLMDet's predictions are highly accurate for the top 2 or 3 labels, often including the correct answers. As a result, our approach exhibits commendable performance in OOD testing.\n\n**Q3**: L259 \"Perplexity is the probability that the model generates the current sentence\". This is not what perplexity is. Eq1 - This does not look like perplexity either, this looks like cross-entropy. \n\n**A3**: We apologize for the lack of clarity in our initial explanation. Perplexity is not the probability of generating a sentence; rather, it is derived from the negative logarithm of the probability. In Equation 1, what is represented is a form of cross-entropy, which is essentially the logarithmic version of perplexity. The measure we define here is based on an n-gram grammar, and therefore, we refer to it as 'proxy perplexity.'\n\nWe chose to use cross-entropy as a proxy for perplexity for the following reason: Compared to traditional measures of perplexity, cross-entropy is more sensitive to discrepancies between predicted and actual probabilities. It imposes stricter penalties for significant deviations, which is advantageous for tasks like LLMDet that require precise and fine-grained categorization.\n\n**Q4**: The writing of the paper seems rushed and there are many grammatical mistakes and unfinished sentences. E.g., in the abstract L016 \"tool that can be sourcing text\", L026 \"achieving x3.7 faster for recognizing text\". GPT-Zero (or GPT-zero) has a footnote with the link to FAQ on the first three pages. Etc. \n\n**A4**: Thank you very much for pointing out the grammar errors. We will make the necessary corrections in the paper.\n\n**Q5**: I don't like the inclusion of GPT-Zero in the efficiency comparison. It is an API that you have no control over. I don't find the comparison fair.\n\n**A5**: We sincerely apologize for any potential confusion that may arise from this. Here, we would like to reiterate that in the evaluation of text generation efficiency, the experimental setup in **Table 4 of the paper** involves DetecGPT and True-PPL running on a V100-32G GPU. In contrast, GPT-Zero relies on the CPU for API calls, which may additionally be supported by server-side hardware behind it. LLMDet, on the other hand, performs calculations directly on the CPU. \n\nIt is observed that LLMDet required the lowest computational resources. Thus, in terms of efficiency comparison, there is no unfair comparison between LLMDet and GPT-Zero.\n\n**Q6**: I don't like the mapping between the four requirements and the four RQs. Especially the first two seem to be forced. How does the fact that the true perplexity can be used for classification say anything about the specificity of your method?\n\n**A6**: We sincerely apologize for any confusion caused and would like to clarify the following points: The motivation behind our work is guided by four key requirements—Specificity, Safety, Efficiency, and Extendibility. The term \"four RQs\" refers to the research questions we formulate based on these requirements. These questions also outline the issues that our method, LLMDet, aims to address.\n\nWhen a detection method exhibits specificity, it signifies that the method can achieve refined differentiation, going beyond the simple categorization of human and machine-generated text. Given that our approach falls under the category of perplexity-based methods, the first research question(RQ) is tailored to such methods. Consequently, we use true perplexity to assess whether this category of methods indeed exhibits Specificity. \n\nThe second RQ focuses on the safety aspects of LLMDet. Since users can deploy LLMDet for text detection without requiring direct access to the model, LLMDet can, to some extent, ensure that the model remains resistant to external attacks.\n\n**Q7**: How is the real \"perplexity\" calculated in RQ1? Is it calculated for the entire text or only for the N-grams?\n\n**A7**: The real \"perplexity\" in RQ1 is calculated by the equation $PPL(X) = exp \\lbrace -\\frac{1}{t} \\sum_{i}^t \\log p_ {\\theta}(x_{i} | x_{<i})\\rbrace$. It calculates for the entire text.\n\n**Q8**: How does your method take into consideration that not all humans have the same writing style? Isn't the fact that all humans are put into one category a problem?\n\n**A8**: Distinguishing between types of human-generated text at a finer granularity is certainly a topic worthy of thorough discussion. However, LLMDet is primarily focused on specialized human texts and does not delve into more nuanced distinctions. Moreover, the finer differentiation of human texts, whether based on educational level, nationality, or age, remains an open topic for discussion. This is an area we may consider exploring in future research endeavors.\n\n**Q9**：Authors sometimes refer to a tool, sometimes to a method. It should be clear what you want to propose in this paper. The method is interesting enough on its own. The fact that you have it wrapped in a tool somewhere is, at least for me, not that interesting.\n\n**A9**: We sincerely apologize for any inconvenience that the wording of the paper may have caused you. Our original intention is to convey that the 'method' refers to the implementation process of LLMDet, whereas the 'tool' pertains to the detection and utilization processes of LLMDet. We chose to encapsulate LLMDet into a tool to enhance user convenience.\n\n**Q10**: L304, I appreciate the O-complexity for the method, but I don't understand the discussion about the parameters here. Why do we need to know that this is a wrong set of parameters? Why is this even discussed in this Section?\n\n**A10**: The complexity here mainly pertains to the efficiency of storage for the dictionary constructed by LLMDet. Calculations of these parameters demonstrate that LLMDet is efficient in terms of storage.\n\n**Q11**: I am not sure if the term safety is the correct one for the second constraint (L076). There are many other reasons why we might not want to require parameters of the model, e.g., they are not accessible.\n\n**A11**: The concept of safety that we discuss in this context pertains to enabling users to operate LLMDet without needing access to the language model parameters. This feature not only enhances user convenience but also adds a layer of security to the model. While we acknowledge that there could be various other reasons to avoid requiring access to model parameters, such as their potential inaccessibility.\n\nFurthermore, we greatly appreciate the constructive feedback you provided on the weaknesses in our writing. Rest assured, we will make the necessary revisions to the paper based on your insightful suggestions.\n\nWe hope this response adequately addresses your concerns.\n\nBest wishes!", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "- The method seems promising and the four constraints that authors defined make sense\n- The method is efficient and intuitive", "reasons_to_reject": "- Missing performance comparison with other approaches. Missing performance comparison on out-of-domain data. *Edit:* This concern seems to be partially addressed during the rebuttal phase and the authors provided some additional baseline results.\n\n- L259 \"Perplexity is the probability that the model generates the current sentence\". This is not what perplexity is. Eq1 - This does not look like perplexity either, this looks like cross-entropy. \n\n- The writing of the paper seems rushed and there are many grammatical mistakes, unfinished sentences. E.g., in the abstract L016 \"tool that can sourcing text\", L026 \"achieving x3.7 faster for recognizing text\". GPT-Zero (or GPT-zero) has footnote with link to FAQ on the first three pages. Etc.\n\n- I don't like the including of GPT-Zero in the efficiency comparison. It is an API that you have no control over. I don't find the comparison fair.\n\n- I don't like the mapping between the four requirements and the four RQs. Especially the first two seems to be forced. How does the fact that the true perplexity can be used for classification says anything about the specificity of your method?", "questions_to_authors": "- How is the real \"perplexity\" calculated in RQ1? Is it calculated for the entire text or only for the N-grams?\n\n- How does your method take into consideration that not all the humans have the same writing style? Isn't the fact that all the humans are put into one category a problem?", "paper_topic_and_main_contributions": "The paper proposes a new method for machine generated text detection. The method is based on the idea of calculating a proxy \"perplexity\" based on a corpus of generated N-grams. The authors evaluate the performance of this method and its time efficiency.", "excitement": 4, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {"Typos_Grammar_Style_and_Presentation_Improvements": "- Section 3 reiterates what is already said in the Introduction. \n\n- Authors sometimes refer to a tool, sometimes to a method. It should be clear what you want to propose in this paper. The method is interesting enough by its own. The fact that you have it wrapped in a tool somewhere is, at least for me, not that interesting.\n\n- L304, I appreciate the O-complexity for the method, but I don't understand the discussion about the parameters here. Why do we need to know that this is a wrong set of parameters? Why is this even discussed in this Section? \n\n- There are experiment-specific details in Section 4 (parameters, LMs) that should be moved to Section 5\n\n- The LMs used in the experiments are listed at three different places\n\n - LightGBM should be mentioned in Section 4 already\n\n- I am not sure if the term safety is the correct one for the second constraint (L076). There are many other reason why we might not want to require model's parameters, e.g., they are not accessible."}}]

Author rebuttal:

Meta-review: **quality, clarity, originality**

The work, as further evidenced by the deep discussion by both reviewers and authors, is of great quality and originality. The paper, further than just detecting LLM generated or not, works to identify which LLM generated the text. There are limitations that are highlighted through the reviews that the detection tool requires access to the full model, limiting its application as most commercial models are closed. The question on the perplexity calculation was addressed by authors and further provided updated tables (that should be put in the paper itself) as this provides for more clarity and also shared understanding. 

The work would benefit for another round of proof reading as highlighted by a number of reviewers just to fix lagging issues. 

**Significance**

The work provides insight not just on detection but also on the LLMs themselves. This I think is significant for the field and the audience of this conference. 

**Meta review suggestions**

It would be a good idea for the authors to make further notes on how to get over the limitation of not having access to closed source models. For people who might want to build on your work, where should they look to be able to identify steps that could be taken with black box models? There is a large amount of literature on interpretability (even of black box models), could this be useful?
Decision: Accept-Findings