Counter Turing Test (CT2): AI-Generated Text Detection is Not as Easy as You May Think - Introducing AI Detectability Index (ADI)
Authors: Megha Chakraborty
S.M Towhidul Islam Tonmoy
S M Mehedi Zaman
Shreya Gautam
Tanay Kumar
Krish Sharma
Niyar R Barman
Chandan Gupta
Vinija Jain
Aman Chadha
Amit P. Sheth
Amitava Das
Venue: EMNLP 2023 Main (2023)
Keywords: AI-generated text detection

Abstract: With the rise of prolific ChatGPT, the risk and consequences of AI-generated text has increased alarmingly. This triggered a series of events, including an open letter, signed by thousands of researchers and tech leaders in March 2023, demanding a six-month moratorium on the training of AI systems more sophisticated than GPT-4. To address the inevitable question of ownership attribution for AI-generated artifacts, the US Copyright Office released a statement stating that "if the content is traditional elements of authorship produced by a machine, the work lacks human authorship and the office will not register it for copyright". Furthermore, both the US and the EU governments have recently drafted their initial proposals regarding the regulatory framework for AI. Given this cynosural spotlight on generative AI, AI-generated text detection (AGTD) has emerged as a topic that has already received immediate attention in research, with some initial methods having been proposed, soon followed by the emergence of techniques to bypass detection. 
 
This paper introduces the Counter Turing Test (CT2), a benchmark consisting of techniques aiming to offer a comprehensive evaluation of the robustness of existing AGTD techniques. Our empirical findings unequivocally highlight the fragility of the proposed AGTD methods under scrutiny. Amidst the extensive deliberations on policy-making for regulating AI development, it is of utmost importance to assess the detectability of content generated by LLMs. Thus, to establish a quantifiable spectrum facilitating the evaluation and ranking of LLMs according to their detectability levels, we propose the AI Detectability Index (ADI). We conduct a thorough examination of 15 contemporary LLMs, empirically demonstrating that larger LLMs tend to have a lower ADI, indicating they are less detectable compared to smaller LLMs. We firmly believe that ADI holds significant value as a tool for the wider NLP community, with the potential to serve as a rubric in AI-related policy-making.

Counter Turing Test (CT2): Al-Generated Text Detection is Not as Easy as You May Think Introducing Al Detectability Index
Megha Chakraborty! S.M Towhidul Islam Tonmoy? M Mehedi Zaman?
Krish Sharma² Niyar R Barman² Chandan Gupta* Shreya Gautam
Tanay Kumar Vinija Jain Aman Chadha Amit P. Sheth
Amitava Das
AI Institute, University of South Carolina, USA
UU,, Bangladesh
NIT Silchar, India
+IIT Delhi, India
'BITS Mesra, India Stanford University, USA
Amazon AI, USA
Abstract
establish a quantifiable speetrum facilitating the evaluation and ranking of LLMS according to their detectability levels, we propose the Al Detectability Index (ADI). We conduct thor- ough examination of 15 contemporary LLMs, empirically demonstrating that larger LLMs tend to have higher ADI, indicating they less detectable compared to smaller LLMs. We firmly believe that ADI holds significant value tool for the wider NLP community, with the potential to serve as a rubric Al-related policy-making.
With the rise of prolific ChatGPT, the risk and consequences of Al-generated text has in- creased alarmingly. This triggered series of events, including open letter (Marcus, 2023), signed by thousands researchers and tech leaders in March 2023, demanding six-monte moratorium on the training of Al systems more sophisticated than GPT-4. To address in- evitable question of ownership attribution for Al-generated artifacts, the US Copyright Office (Copyright- Office, 2023) released a statement stating that "If work's 's traditional elements of authorship were produced by a machine, the work lacks human authorship and the Office will not register it". Furthermore, both the US House, 2023) and the EU (European- Parliament, 2023) governments have recently drafted their initial proposals regarding the reg- ulatory framework for AL. Given this cynosural spotlight generative AT, Al-generated text detection (AGTD) has emerged as a topic that has already received immediate attention in re- search, with some initial methods having been proposed, soon followed by emergence of tech- niques to bypass detection. This paper intro- duces the Counter Turing Test (CT9), ), a bench- mark consisting of techniques aiming to offer comprehensive evaluation of the robustness of existing AGTD techniques. Our empirical findings unequivocally highlight the fragility of the proposed AGTD methods under scrutiny. Amidst the extensive deliberations on policy- making for regulating Al development, it is of utmost importance to assess the detectabil- ity of content generated by LLMs. Thus, to
Proposed AI-Generated Text Detection Techniques (AGTD) - A Review
Recently, six methods and their combinations have been proposed for AGTD: (i) watermarking, (ii) perplexity estimation, (ii) burstiness estimation. (iv) negative log- log-likelihood curvature, (v) stylomet- ric variation, and (vi) classifier-bused approaches. This paper focuses on critiquing their robustness and presents empirical evidence demonstrating their brittleness.
Watermarking: Watermarking Al-generated text, first proposed by Wiggers (2022), entails the incor- poration of an imperceptible signal to establish the authorship of a specific text with high degree of certainty. This approach analogous to encryption and decryption. Kirchenbauer et al. (2023a) (w,1) were the first to present operational watermark- ing models for LLMs, but their initial proposal faced criticism. Sadasivan et al. (2023) shared their initial studies suggesting that paraphrasing efficiently eliminate watermarks. In subse- quent paper (Kirchenbauer et al., 2023b) (Wv2), the
Work does not relate to position at Amazon.

---

authors put forth evidently more resilient water- marking techniques, asserting that paraphrasing does not significantly disrupt watermark signals in this iteration of their research. By conducting extensive experiments (detailed in Section 3), our study provides thorough investigation of the de- watermarking techniques Wyl and Wi2, demonstrat- ing that the watermarked texts generated by both methods can be circumvented, albeit with slight decrease in de-watermarking accuracy observed with wy2. These results further strengthen our con- tention that text watermarking is fragile and lacks reliability for real-life applications.
rool Phomon
x Pa())
X
log (00)
Figure 1: (Top) The negative log-curvature hypothesis pro- posed by Mitchell al. (2023). According to their claim, any perturbations made to the Al Al-generated text should predom- inantly fall within a region of negative curvature. (Bottom) Our experiments using L.LMs with 20 perturbations indi- cate that the text generated by GPT 3.0 and variants do not align with this hypothesis. Moreover, for the other LLMs, the variance the negative log-curvature was so minimal that it had to be disregarded as a reliable indication. and O represent fake and real sample respectively. whereas and depict perturbed fake and real sample.
Perplexity Estimation: The hypothesis related to perplexity-based AGTD methods is that hu- mans exhibit significant variation in linguistic constraints, syntax, vocabulary, and other fac- tors (aka perplexity) from one sentence other. contrast, LLMs display a higher degree of consistency in their linguistic style and struc- ture. Employing this hypothesis, GPTZero (Tian, 2023) devised an AGTD tool that posited the over- generated text should sur-
standard deviation of the language spans and the mean of the language spans. Burstiness (b) is (=/m==]]
all perplexity pass that of Al-generated text, in the equation: (ogpo(h (A > 0 (Appendix C). Furthermore, GPTZero assumes that the varia- tions in perplexity across sentences would also be lower for Al-generated text. This phenomenon could potentially be quantified by estimating the entropy for sentence-wise perplexity, as depicted in the equation: ( AAl [)] 2 0; where s and S/
calculated as d IT) and is bounded within the interval [-1, 1]. Therefore the hypothesis is by bar 2 O, where by is the mean burstiness of human writers and bas is the mean burstiness of Al aka a particular LLM. Corpora with anti- bursty, periodic dispersions of switch points take on burstiness values closer -1. In contrast, cor- pora with less predictable patterns of switching take on values closer to It is worth noting that burstiness could also be calculated centence-wise and/or text fragment-wist and then their entropy could be defined as: Eburst logpp ( { - logps ( Sxx 'DI] 2 Neverthe- less, our comprehensive experiments involving 15 LLMs indicate that this hypothesis does not consis- tently provide a discernible signal. Furthermore, re- cent LLMs like GPT-3.5/4, MPT (OpenAI, 2023a: Team, 2023) have demonstrated the utilization of wide range of vocabulary, challenging the hy- pothesis. Section 4 discusses experiments perplexity and burstiness estimation.
Eperp- logpo 2 (1s "/ + s+1
represent ttth sentences of human and Al-written text respectively.
Burstiness Estimation: Burstiness refers to the patterns observed in word choice and vocabulary size. GPTZero (Tian, 2023) was the first to intro- duce burstiness estimation for AGTD. In this con- text, the hypothesis suggests that Al-generated text displays a higher frequency of clusters or bursts of similar words phrases within shorter sections of the text. In contrast, humans exhibit broader vari- ation in their lexical choices, showcasing more extensive range of vocabulary. Let o, denote the

---

Negative Log-Curvature (NLC): DetectGPT (Mitchell et al., 2023) introduced the concept of Negative Tog-Curvature (NLC) to detect AI- generated text. The hypothesis is that text gener- ated by the the model tends to lie in the negative curvature areas of the model's log probability, i.e. text generated by source LLM Pe typically lies in the areas of negative curvature of the log prob- ability function of Po, unlike human- human-written written text.
and is relatively straightforward. OpenAl initially developed its own text classifier (OpenAI, 2023b), which reported an accuracy of only 26% on true positives. Due to its weaker performance among the proposed methods, we did not further investi- gate this strategy.
OUR CONTRIBUTION A Counter Turing Test (CT3) and Al Detectability Index (ADI).
Introducing the Counter Turing Test (CT),, a bench- mark consisting techniques aiming offer com- prehensive evaluation of the robustness of prevalent AGTD techniques.
In other words, we apply small perturbations to a passage x Pe. producing E. Defining P) as the quantity (o)pe(x) - logpe (é), P should be larger on average for Al-generated samples than human-written text (see an example in Table and the visual intuition of the hypothesis in Fig. 1). Ex- pressed mathematically: PizC PWCC O. It is important note that DetectGPT's findings were derived from text-snippet analysis, but there po- tential to reevaluate this approach by examining smaller fragments, such as sentences. This would enable the calculation of averages or entropies, akin to how perplexity and burstiness are measured. Finally, the limited number of perturbation patterns per sentence in (Mitchell et al., 2023) affect the reliability of results (cf. Section 5 for details).
Empirically showing that the popular AGTD methods are brittle and relatively easy circumvent.
Introducing Detectability Index (ADI) sure for LLMs to infer whether their generations are detectable Al-generated not.
Conducting thorough examination of 15 contempo- rary LLMs establish the aforementioned points.
Both benchmarks CT² and ADI be published open-source leaderboards.
Curated datasets will be made publicly available.
2 Design Choices for CT and ADI Study This section discusses our selected LLMs and elab- orates on our data generation methods. More de- tails in Appendix A.
Input Type
Original
This sentence
is generated by an Al or human
Perturbed
This
writing
created
by Al person
2.1 LLMs: Rationale and Coverage
Table I: An example perturbation as proposed in DetectGPT (Mitchell 2023).
We chose a wide gamut of 15 LLMs that have exhibited exceptional results on a wide range of NLP tasks. They are: (i) GPT 4 (OpenAI, 2023a): (ii) GPT 3.5 (Chen et al., 2023); (iii) GPT 3 (Brown et al., 2020); (iv) GPT 2 (Radford et al., 2019); (v) MPT (Team, 2023); (vi) OPT (Zhang et al., 2022); (vii) LLaMA (Touvron et al., 2023); (viii) BLOOM (Scao et al., 2022); (ix) Alpaca (Maeng
Stylometry is dedicated to analyzing the linguistic style of text in order to dif- ferentiate between various writers. Kumarage et al. (2023) investigated the examination of stylistic fea- of Al-generated text in order to distinguish from human-written text. The authors reported im- pressive results for text detection generated from RoBERTa. However, we observe limitations in applying such methods to newer advanced models (cf. Section 6).
Stylometric variation:
et al., 2017); (x) Vicuma (Zhu et al., 2023); (xi)
Dolly (Wang et al., 2022): (xii) StableLM (Tow et al.); (xiii XLNet (Yang et al., 2019); (xiv) T5 (Raffel et al., 2020); (xv) TO (Sanh et al., 2021). Given that the field is ever-evolving, we admit that this process will never be complete but rather continue expand. Hence, we plan keep the
Classification-basee approach: This problem for- mulation involves training classifiers to differen- tiate between Al-written and numan-written text,

---

CT benchmark leaderboard open researchers, allowing for continuous updates and contributions.
3.1 De-watermarking by Spotting and Replacing High Entropy Words (DeW))
2.2 Datasets: Generation and Statistics
The central concept behind the text watermark- ing proposed by Kirchenbauer et al. (2023a) is to identify high entropy words and replace them with alternative words that are contextually plausible. The replacement is chosen by an algorithm (anal- ogous to an encryption key) known only to the LLM's creator. Hence, if watermarking has been implemented, it has specifically foeused those words. High entropy words are the content words in a linguistic construct. contrast, low entropy words, such as function words, contribute to the linguistic structure and grammatical coherence of a given text. Replacing low entropy words can disrupt the quality of text generation. Appendix B provides more details on high entropy vs. low en- tropy words.
To develop CT and ADI, we utilize parallel data comprising both human-written and Al-generated text on the same topie. We select The New York Times (NYT) Twitter handle as our prompt source for the following reasons. Firstly, the handle com- prises approximately 393K tweets that cover a va- riety of topics. For our work, we chose a sub- set of 100K tweets. Secondly, NYT is renowned for its reliability and credibility. The tweets from NYT exhibit high level of word-craftsmanship by experienced journalists, devoid of grammat- ical mistakes. Thirdly, all the tweets from this source include URLs that lead to the correspond- ing human-written news articles. These tweets serve as prompts for the 15 LLMs, after eliminat- ing hashtags and mentions during pre- pre-processing. Appendix G offers the generated texts from 15 cho- sen LLMs when given the prompt "Al generated text detection is not easy."
Challenges of detecting high entropy words: High entropy words aid in discerning ambiguity in L.MM's as observed through the probability dif- ferences among predicted candidate words. While detecting high entropy words may seem techni- cally feasible, there are two challenges in doing SO: (i) many modern LLMs are not open-source. This restricts access to the LLM's probability dis- tribution over the vocabulary; (ii) assuming text snippet is Al-generated, in real-world scenarios, the specific LLM that generated is challenging to determine unless explicitly stated. This lack of in- formation makes difficult to ascertain the origin and underlying generation process of a text.
3 De- De-Watermarking: Discovering its Ease and Efficiency
In the realm of philosophy, watermarking typi- cally regarded as a source-side activity. is highly plausible that organizations engaged in the develop- ment and deployment of LLMs will progressively adopt this practice in the future. Additionally, reg- ulatory mandates may necessitate the implemen- obligatory measure.
tation of watermarking The question that remains unanswered is the level of difficulty in circumventing watermarking, i.e., de- weterrrrmaa,,ngg when dealing with watermarked Al ge-eenrrteed text. In this section, we present our rigorous experiments that employ three methods capable of de-waatrrarkkng an Al-generated text that has been watermarked: (i) spotting high en- tropy words and replacing them, (ii) paraphrasing, (iii) paraphrasing replacing high-entropy words Table 2 showcases instance of de- de-watermarking utilizing two techniques for OPT as target LLM.
Spotting high-entropy words: Closed-source LLMs conceal the log probabilities of generated text, thus rendering one of the most prevalent AGTD methods intractable. To address this, we utilize spen-source LLMs to identify high-entropy words in given text. As each LLM is trained on a distinct corpus, the specific high-entropy words identified may vary across different LLMs. To mit- igate this, we adopt comparative approach by employing multiple open-source LLMss.
Replacing high-entropy words: We can employ

---

X-acure
p-sallee
Prompt
Wal writer be molut?
Watermarked
I'm very skeptical that the "grest witter' going be robor, thy'll be muchi effective
4,24
x 10
text
expressing the subtleties depths human, thought than buraan is. However, imost interesting,
rol that Eniemet cuald play in bringing these "rufiot" writers into the public IfI could (ind vary encitad this proshility), I would pay small montlly fee read well-writen
De-Watermarked
I'm anmeschal skepeicul that the nest "great writer" is going to a robot, given tuat they II he Lin more of Taxtivve
1.76
0,039
text by replacing
grasping deeper subtleties and degtts of philosogiical thought than a robox is. However, what is pamiculartty
(58
(3.5x 10%% f>
high-entropy
interesting is the rule that the Internl may play in bringing now grest writers into the public eye. If did (and I'm
words
eunemnlly excited by this possibility), I would hefly subscription fiee publish something
De- Watermarked text by para- phrasing
I have iscnoos doubts about the possibility of robot becoming the exceptional wriser and surpossing humans the potestial impact of Intemnet showcassng these "roboc" writers the general public. The idea of being able pay
-0.42 (112.8% 42
0.706
expeessing munooss profoundnoss
thoughts. Novertukes,,
(6.4 10% f)
mombly
subscription to access
impoocallly writion and carofully refined works milyy thrills me...
Table 2: An illustration of de-watermarking by replacing high-entropy words and paraphrasing. p-value is the probability under the assumption of null hypothesis. The z-seore indicates the normalized log probability of the original text obtained by subtracting the mean log probability of perturbed texts and dividing by the standard deviation of log probabilities of perturbed texts. DetectGPT (Mitchell et al., 2023) classifies text to be generated by GPT-2 if the z-score is greater than 4.
Devaacmantiiu mokkls
Albert-lrggeve
bart-baae-ureaaed uncaaaed
distiirobrtte buae
Madking mndels
Delti
Zerto
Bulti
Zarth
Bello
albert- Baarg-- w2
513
29.3
47
19387
75.8
52.5
kert-base-unsssed
261
31
30.5
24
Table 3: The performance evaluation encompassed 16 combinations for de-watermarking OPT generuted watermarked text. The accuracy scores for successfully de watermarked text using the entropy based word replacement technique are presented in the DeWi columns. is worth highlighting that the accuracy scores in the DeW, columns reflect the application of automatic paraphrasing after entropy-based -bssed word replacement. The techniques proposed Kirchenhauer al. (2023a) are denoted as Wyl- while the techniques proposed in their subsequent work Kirchenbauer et al. (2023b) are represented as Wy2.
any LLM to replace the previously identified high- entropy words, resulting in a de-wattrmarked text. To achieve this, we tried various LLMs and found that BERT-based models are best performing to generate replacements for the masked text.
wwwrrobbrrabbbsseee achieving a 75% accuracy in removing watermarks, while (distilroberta base, bert-base-uncarl performs best for (Kirchenbauer et al., 2023b) (wrz), attaining 72% accuracy in de-watermarking The results for the remaining 14 LLMs reported in Appendix B.
Winning combination: The results of experiments on detecting and replacing high entropy words are presented in Table for OPT. The findings indicate that ALBERT (albert-large-v2) (Lan et al., 2020) and DistilRoBERTa (distil base) perform exceptionally well in identifying high entropy words in text generated by the OPT model for both versions, vl and v2. On the other hand, DistilRoBERTa (distilroberta- base) (Sanh et al., 2019) and BERT (bert-base- uncased) (Devlin et al., 2019) demonstrate supe- rior performance in substituting the high entropy words for versions v and v2 of the experiments. Therefore, the optimal combination for Kirchen- bauer et al. (2023a) (wel) is (albert-large-v2,
3.2 De-watemmarking by Paraphrasing (DeW,) We have used paraphrasing as yet another tech- nique to remove watermarking from LLMs. Idea 1) Feed textual input to a paraphraser model such as Pegasus, T5, GPT-3.5 and evaluate watermark- ing for the paraphrased text. Idea 2) Replace the high entropy words, which are likely to be the wa- termarked tokens, and then paraphrase the text to ensure that we have eliminated the watermarks.
We perform a comprehensive analysis of both qualitative and quantitative aspects of automatic paraphrasing for the purpose of de-watermarking, We chose three SoTA paraphrase models: (a) Pe- gasus (Zhang et al., 2020), (b) T5 (F1an-t5-xxl

---

LLMs
Perplexity
Burstines
NLC
Paraphrasing
Acc.
Human
A1
Knta
Enta1
Human
A1
Eing
Emtar
or
Human
A1
Models
3,777
-0.3001
0.3645
6.119
4.175
d
68.541
65.178
0,26164
0.3155
0.336
0.654
Pogasus
79.32
67.12
GPT-2
143.198
76.296
5.362
4.700
0.16
40,3001
6.333
5,843
0,5006
3436
3.778
0,507
TS-Large GPT-3.5
80.86
72.00
60.866
67.315
0,26161
0.2947
0.829
0.391
90.32
70.35
XINN
106.776
104.091
8,378
9.712
0.532
-0,2902
-0.0153
6,380
4,563
0.49%
4.207
4,185
01498
57,091
62.152
0,0032
Table 5: De-watermarking
Table 4: Perplexity, burstiness, and NLC values for 3 L.MMs across the ADI spectrum along with statistical measures.
acc. of paraphrasing on OPT.
Model
Coverage
Correctness
Diversity
10
3P5 turbo -0301
9.95
Pogasus
32,46
94.38%
3.76
PEGASUS
30,26
83.84%
3.17
T5 Large
2-13
GPT-3.5
35.51
88.16%
7.72
2.54
7.05
Table 6: Experimental results automatic paraphrasing mod- els based on three factors: (i) coverage, (ii) correctness and (ii)) diversity; GPT-3.5 (gpt-3, 5-turbo-0300 be seen as the most performant.
Diversity
8.53
5 5.38
J-42...
3.3.
variant) (Chung et al., 2022), and (c) GPT-3.5 3opt-3.5-turbo--
2:58
variant) (Brown al., 2020). We seek answers to the following ques- tions: (i) What is the accurucy of the paraphruses generated? (ii) How do they distort the origi- nal content? (iil) Are all the possible candidates generated by the paraphrase models successfully de-watermarked? (iv) Which paraphrase module has greater impact the deewaatrmarking pro- cess? To address these questions, we evaluate the paraphrase modules based on three key dimen- sions: (i) Coverage; number of considerable para- phrase generations, (ii) Correctness: correctness of the generations, (iii) Diversity: linguistic diver- sity in the generations. Our experiments showed that GPT-3.5 (gpt-3.55 3gpt-3.5-turbo 5-t55-ttroo000 0301 variant) is the most suitable paraphraser (Fig. 2). Please see details of experiments in Appendíx B.3.
p1
p2
b3
p4
p5
increasing number of paraphrases
Figure 2: A higher diversity score depicts an increase in the number of generated paraphrases and linguistic variations in those generated paraphrases.
ing paraphrasing model. This yields set of pi- .... ph Next, we make pair-wise comparisons of these paraphrases with c, resulting in c- Pi. and c ph- At this step, we identify the examples which are entailed, and only those are chosen. For the entailment task, we have utilized RoBERTa Large (Liu et al., 2019) SoTA model trained on the SNLI task (Bowman et al., 2015).
Key Findings from De- Wetermmannn Exper- iments: As shown in Table 3 and Table 5, our experiments provide empirical evidence suggest- ing that the watermarking applied to AT-generated text can be readily circumvented (cf. Appendix B).
For given text input, we generate multiple para- phrases using various SoTA models. the pro- cess of choosing the appropriate paraphrase model based on a list of available models, the primary question we asked is how to make sure the gen- erated paraphrases are rich in diversity while still being linguistically correct. We delineate the pro- cess followed to achieve this follows. Let's say we have a claim c. We generate n paraphrases us-
4 Reliability of Perplexity and Burstiness AGTD Signals
In this section, we extensively investigate the reli- ability of perplexity and burstiness AGTD sig- nals. Based on empirical findings, it is evident that the text produced by newer LLMs is nearly

---

indistinguishable from human-written text from statistical perspective.
4.2 Estimating Burstiness Human AI In Section 1, we discussed the hypothesis that ex- plores the contrasting burstiness patterns between human-written text and Al-generated text. Previous studies that have developed AGTD techniques based on burstiness include (Rychly, 2011 1) and (Cummins, 2017). Table 4 shows that there is less distinction in the standard deviation of burstiness scores between AI ---geerrated and human text for OPT. However, when comes to XLNet, the difference becomes more pronounced. From several such examples, we infer that larger and more complex LLMs gave similar burstiness scores as humans. Hence, we conclude that as the size or complexity of the mod- cls increases, the deviation in burstiness scores di- minishes. This, in turn, reinforces our claim that perplexity or burstiness estimations cannot be con- sidered as reliable for AGTD (cf. Appendix C).
The hypothesis assumes that Al-generated text displays a higher frequency of clusters or bursts of similar words or phrases within shorter sections of the text. In contrast, humans exhibit broader variation in their lexical choices, showcasing more extensive range of vocabulary. Moreover, sentence-win wise human shows more variety in terms of length, and structure in comparison with AI- generated text. To measure this we have utilized entropy. The entropy p,logp; of a random variable is the average level of surprise, or uncertainty.
4.1 Estimating Perplexity Human vs. AI Perplexity is a metric utilized for computing the probability of a given sequence of words in natu- ral language. It is computed as e to,, where N represents the length of the word se- quence, and p(w:) denotes the probability of the individual word w/. As discussed previ- ously, GPTZero (Tian, 2023) assumes that human- generated text exhibits more variations in both overall perplexity and sentence-wise perplexity as compared to Al-generated text. To evaluate the strength of this proposition, we compare text sam ples generated by 15 LLMs with corresponding numan-generated text on the same topic. Our em- pirical findings indicate that larger LLMs, such as GPT-3+, closely resemble human-generated text and exhibit minimal distinctiveness. However, rela- tively smaller models such XLNet, BLOOM, etc. are easily distinguishable from human human-generated text. Fig. demonstrates a side-by-side compari- son of the overall perplexity of GPT4 and T5. We report results for 3 LLMs in Table 4 (cf. Table 22 in Appendix C for results over all 15 LLMs).
5 Negative Log-Curvature (NLC)
In Section 1, we discussed the NLC-based AGTD hypothesis (Mitchell al., 2023). Our experimen- tal results, depicted in Fig. demonstrate that unable corroborate the same NLC pattern for GPT4. To ensure the reliability of our experiments, we performed 20 perturbations per sentence. Fig. (bottom) presents a comparative analysis 20 per- turbation patterns observed in 2000 samples of OPT- generated text and human- written text on the same topic. Regrettably, we do not see any discernible pattern. To fortify our conclusions, we compute the standard deviation, mean, and entropy, and conduct a statistical validity test using bootstrapping, which more appropriate for non-Gaussian distributions (Kim, 2015; Boos and Brownie, 1989). Table 22 documents the results (cf. Appendix C). Based on our experimental results, we argue that NLC is not a robust method for AGTD.
density
density
6 Stylometric Variation
Stylometry analysis is well-studied subject (Lagutina et al., 2019; Neal et al., 2018) where schol- have proposed comprehensive range of lexical, syntactic, semantic, and structural characteristies for
avg perplexity
2Vg parplesity
Figure Perplexity estimation for GPT4/TS (left/right).

---

the purpose of authorship attribution. Our investiga- tion, which differs from the study conducted by Ku- marage et al. (2023), represents the first attempt to explore the stylometric variations between human- written text and Al-generated text. Specifically, we assign 15 LLMs as distinct authors, whereas text composed by humans is presumed to originate from hypothetical 16th author. Our task involves identi- fying stylometric variations among these 16 authors. After examining other alternatives put forth in pre- vious studies such as (Tulchinskii et al., 2023), we encountered difficulties drawing meaningful con- clusions regarding the suitability of these methods for AGTD. T'errefoee we focus our investigations on a specific approach that involves using perplexity (as a syntactic feature) and burstiness (as a lexical choice feature) as density functions to identify specific LLM. By examining the range of values produced by these functions, we aim to pinpoint specific LLM associated with a given text. Prob- ability density such as L Ee= (r(() 2tr' XT
in Fig. 5, the LLMs can be classified into three groups: (i) easily detectable, (ii) hard to detect, and (iii) not detectable. Fig. 7 demonstrates that Le Cam's 's lemma learned for one LLM is only appli- cable to other LLMs within the same group. For instance, the lemma learned from GPT 4 can be successfully applied to GPT-3.5, OPT, and GPT-3, but not beyond that. Similarly, Vicuna, StableLM, and LLaMA form the second group. Fig. 4 offers visual summary.
7 AI Detectability Index (ADI)
As new LLMs continue to emerge at an accelerated pace, the usability of prevailing AGTD techniques might not endure indefinitely. To align with the ever-changing landscape of LLMs, we introduce the AI Detcctability Index (ADI), which identifies the discemable range for LLMs based on SoTA AGTD techniques. The hypothesis behind this pro- posal is that both L.MMs and AGTD techniques' SoTA benchmarks can be regularly updated to adapt to the evolving landscape. Additionally, ADI serves as a litmus test to gauge whether contempo- rary LLMs have surpassed the ADI benchmark and are thereby rendering themselves impervious to de- tection, whether new methods for Al Al-generated text detection will require the ADI standard to be reset and re-calibrated.
and 1H = EE_o Pr((St Are are calculated us- ing Le Cam's lemma (Cam, 1986-2012), which gives the total variation distance between the sum of independent Bernoulli variables and a Poisson ran- dom variable with the same mean. Where Pr(st, pix) is the perplexity and Pr(St (tssy) is the brustiness of the of tth sentence respectively. In particular, it tells us that the sum is approximately Poisson in specific sense (see more in Appendix E). Our exper- iment suggests stylistic feature estimation may not be very distinctive, with only broad ranges to group LLMs: (i) Detectable (80%+): TO and T5, (ii) Hard to detect (70%+)) XeNet, StableLM, and Dolly, and (iii) Impossible to detect (<50%): LLaMA, OPT, GPT, and variations.
Among the various paradigms of AGTD, we se- lect perplexity and burstiness as the foundation for quantifying the ADI. We contend that NLC is a derivative function of basic perplexity and bursti- ness, and if there are distinguishable patterns in NLC within AI Al-generated text, they should be well captured by perplexity and burstiness. We present a summary in Fig. 4 that illustrates the detectable and non-detectable sets of LLMS based on ADI scores obtained using stylometry and classification methods. is evident that the detectable LLM set is relatively small for both paradigms, while the combination of perplexity and burstiness consis- tently provides a stable ADI spectrum. Further- more, argue that both stylistic features and clas- sification are also derived functions of basic per-
Our experiment yielded intriguing results. Given that our stylometric analysis solely based on den- sity functions, we posed the question: what would happen if we learned the search density for one LLM and applied it to another LLM? To explore this, we generated relational matrix, as depieted in Fig. 7. As previously described and illustrated

---

LLM
ADI (8-100)
2019). However, having damping factors is an easier option for exponential smoothing while we have handful of data points. Finally, for better human readability ADI is scaled between 0 0- 100. From the methods we considered, it is unlikely that any of them would be effective for models with high ADI, shown by our experiments and results. As LLMs get more advanced, we assume that the current AGTD methods would become more unreliable. With that in mind, ADI will remain spectrum to judge which LLM is detectable and vs. which is not. Please refer to Appendix F for more discussion.
iaman
GPT4
1.77
92-
GPT 35
1.38
86
125M
1758
Vicuna
70
61
StableLM
56
MPT
LLaMA
7B
48-
Alpurz
7B
47
Dally
BLOOM
1750
35
TO
152
11000
38
Figure 4: ADI gamut for a diverse set of 15 LLMs.
plexity and burstiness. ADI serves to encapsulate the overall distinguishability between Al-written and human-written text, employing the formula:
The ADI spectrum reveals the presence of three distinct groups. TO and T5 are situated within the realm of detectable range, while XLNet, StableLM, Dolly, and Vicuna reside within the difficultto-deteel range. The remaining LLMs are deemed virtually impervious to detection through the utilization of prevailing SoTA AGTD tech- niques. It is conceivable that forthcoming advance- ments may lead to improved AGTD techniques and/or LLMs imbued with heightened human-like attributes that render them impossible to detect. Regardless of the unfolding future, ADI shall per- sist in serving the broader AI community and con- tribute to AI-related policy-making by identifying non-detectable LLMs that necessitate monitoring through policy control measures.
(R-45 44"
(8-47))
ADI:
100 E (x))
(82(x)
31 (1)
[1-=6")
(1-A7")
where,
B= +
(logp's - logpst
and
B. do ( (lugph
logpb (-31)66)))66655)
When confronted with a random input text, it is difficult to predict its resemblance to human- written text on the specific subject. Therefore, to calculate ADI we employ the mean perplex- ity (ugl)) and burstiness (1)) derived from human-written text. Furthermore, to enhance the comparison between the current text and human text, Le Cam's 's lemma has been applied using pre- calculated values (Lif and L bratt) as discussed in Section 6. To assess the overall contrast a summa- tion has been used over all the 100K data points as depicted here by U. Lastly, comparative measures are needed rank LLMs based on their detectabil- ity. This is achieved using multiplicative damp- ing factors, 8, (x) and (x).. which are calculated based on 4 + rank, X G. Initially, we calculate the ADI for all 15 LLMs, considering 8, (x) and (x) as 0.5. With these initial ADIs, we obtain the mean (μ)) and standard deviation (o), allowing us to recalculate the ADIs for all the LLMs. The resulting ADIs are then ranked and scaled provid- ing comparative spectrum as presented in Fig. 4. This scaling process is similar to Z-Score Normal- ization and/or Min-me max normalization (Wikipedia,
8 Conclusion
Our proposition is that SoTA AGTD techniques exhibit fragility. We provide empirical evidence to substantiate this argument by conducting exper- iments on 15 different LLMs. We proposed Al Detectability Index (ADI), quantifiable spectrum facilitating the evaluation and ranking of LLMs according to their detectability levels. The excite- ment and success of LLMs have resulted in their extensive proliferation, and this trend is anticipated to persist regardless of the future course they take. In light of this, the 2T benchmark and the ADI will continue to play vital role in catering to the scientific community.

---

Ethical Considerations
was derived from a human an LLM is detectable, irrespective of the LLM used for Al-generated text. The sample size of this dataset a function of the difference in the distribution of human text vs AI- text, with a smaller sample size enabling detection if the distributions show significant differences. However, the study does not provide empirical ev- idence specify the required sample size, thus leaving the claim hypothesis at this stage. Furthermore, the authors propose that employ- ing techniques such as watermarking can change the distributions of Al text, making it more sep- arable from human-text distribution and thus de- tectable. However, the main drawback of this argu- ment is that given single text snippet (say, an on- line article written essay), detecting whether it is Al Al-generated is not possible. Also, the proposed technique may not be cost-efficient compute-wise, especially as new LLMs emerge. However, the authors did not provide any empirical evidence to support this hypothesis.
Our experiments show the limitations of AGTD methods and how to bypass them. We develop ADI with the hope that it could be used for guiding further research and policies. However, it can be misused by bad actors for creating AT-generated text, particularly fake news, that cannot be dis- tinguished from human-writeed text. We strongly advise against such use of our work.
10 Limitations
Discussion: On June 14th 2023, the European Parliament successfully passed its version of the EU AI Act Guuropean-Parliamennt 2023). Sub- sequently, a team of researchers from the Stan- ford Institute for Human Human-Centered Artificial Intel- ligence (HAI) embarked on investigating the extent to which Foundation Model Providers comply with the EU AI Act. Their initial findings are presented in the publication by (Bommasani et al., 2023). In this study, the authors put forward a grading system consisting of 12 aspects for evaluating Language Models (LLMs). These aspects include (i) data sources, (ūi data governance, (ii) copyrighted data, (iv) compute, (v) energy, (vi) capabilities & limitations, (vīi) risk & mitigations, (viii) evalua- tion, (ix) testing, (x) machine- muchine-generatel content, (xi) member states, and (xii) downstream documen- tation. The overall grading of each LLM can be observed in Fig. 5. While this study is commend- able, it appears to be inherently incomplete due to the ever-evolving nature of LLMs. Since all scores assigned manually, any future changes will re- quire a reassessment of this rubric, while ADI is auto-computable. Furthermore, we propose that ADI should be considered the most suitable metric for assessing risk and mitigations.
Limitations: This paper delves into the dis- cussion of six primary methods for AGTD and their potential combinations. These methods in- clude (i) watermarking, (ii) perplexity estima- tion, (iii) burstiness estimation, (iv) negative log- likelihood curvature, (v) stylometric variation, and (vi) classifier-based approaches.
Our empirical research strongly indicates that the proposed methods are vulnerable to tamper- ing or manipulation in various ways. We provide extensive empirical evidence to support this argu- ment. However, it is important to acknowledge that there may still exist potential deficiencies in our experiments. In this section, we explore and discuss further avenues for investigation in order to address these potential shortcomings. subsequent paragraph, we outline the potential lim- itations associated with each of the methods we have previously investigated.
the
10.1 Addressing Opposing Views by Chakraborty et al. (2023)
It is important to note that recent study (Chakraborty et al., 2023) contradicts our findings and claims otherwise. The study postulates that given enough sample points, whether the output
10.2 Watermarking
Although Kirchenbauer al. (2023a) the pi- onecring paper introduce watermarking for AI-

---

Grading Foundation Model Providers' Compliance with the Draft EU Act
Conter
Foundation (CBFV), toreddd ficll Intel Inseligance (H4)
OpenAA
coheze
stabilityai
Google
00
A121
Requiremeets
Cohera Command
Difluzion
Cloude
Jurassic-2
Totals
Data sources
22
Data gevernance
19
Copyrighned data
17
Energy
16
Capabllhiess & Uniitations
0.0.0
O.0.O
27
mitigations
Evaluations
0.0.0.0
0000
10000
0.000
0000
0.0.
15
Nachine- generated content
00000
0000
000
21
Member
0.0.
0000
Downstream decumentation
0.0.0.0
0000000
Totals
23/46
7/45
27 46
36 40
21
$1440
25
Figure 5: Grading of current LLMs proposed by report entitled Do Foundation Model Providers Comply with the EU Al Act? from Stanford University (Bommasani et al., 2023).
generated text, this research has encountered nu- merous criticisms since its inception. A major concern raised by several fellow researchers (Sada- sivan et al., 2023) is that watermarking can be eas- ily circumvented through machine-generater para- phrasing. In experiment, we have presented two potential de-watermarking techniques. Subse- quently, the same group of researchers published a follow-up paper (Kirchenbauer et al., 2023b) in which they asserted the development of more advanced and robust watermarking technique. We assessed this claim well and discovered that de- we-tarmmmarknnggg remains feasible. However, al- though the overall accuracy of de- de-watermarking has decreased, it still retains considerable strength. As the paper was published on June 9th, 2023, we will include the complete experiment details in the final version of our report.
extensive testing on de- de-watermarking possibilities, considering both machine-generatee paraphrasing and human paraphrasing, and observed dilution in the strength of the watermark, which aligns with their findings.
Although paraphrasing is a powerful technique for attacking watermark text, we argue that high- entropy-based word replacement offers a superior approach. When using high-entrops word replace- ments, it becomes exceedingly difficult for water- mark detection modules to identify the newly gen- erated text, even after paraphrasing. We will now elaborate on our rationale. their work, Kirchen- bauer et al. (2023b) identify content words such as nouns, verbs, adjectives, and adverbs as suit- able candidates for replacement. However, any ad- vanced techniques employed to select replacement watermark keys for these positions will result in high-entropy words. Consequently, these replace- ments will always remain detectable, regardless of the strength of the hashing mechanism.
In their work, Kirchenbauer et al. (2023b) put forward improved watermarking techniques by en- hancing the hashing mechanism for selecting wa- termarking keys and introducing more effective watermark detection techniques. They conducted

---

10.3 Perplexity and Burstiness Estimation
flective of reality. Furthermore, texts composed by different authors inevitably leave behind their unique traces and characteristics. Furthermore, recent paper by Tulchinskii et al. (2023) introduced the concept of intrinsic dimensionality estimation, which can be described as stylometric analysis. However, this paper is currently available only on arXiv and lacks implemented solution. We are currently working replicating the theory and evaluating the robustness of the approach.
Liang et al. (2023) and Chakraborty et al. (2023) among others have shown perplexity and bursti- ness are often reliable indicators of human written text. The fallibility of these metrics be- come especially prominent in academic writing or text generated in a low-resource language. Our experiments have also pointed towards similar find- ings. Moreover, in our experiments, we computed perplexity and burstiness metrics both at the overall text level and the sentence level. It is also feasible calculate perplexity smaller fragment levels. Since each language model has unique attention mechanism and span, these characteristics can po- tentially manifest in the generated text, making them detectable. However, determining the precise fragment size for language model necessitates extensive experimentation, which we have not yet conducted.
10.6 Classifter-based Approaches
Numerous classifiers have been proposed in the literature (Zellers et al., 2020; Gehrmann et al., 2019; Solaiman et al., 2019). However, the ma- jority of these classifiers are specifically created to identify instances generated by individual mod- els. They achieve this by either utilizing the model itself (as demonstrated by Mitchell et al. (2023)) or by training on a dataset consisting of the gen- erated samples from that particular model. For example, RoBERTa-Large Large-Detector developed by OpenAl (OpenAI, 2023b) is trained or fine-tuned specifically for binary classification tasks. These detectors are trained using datasets that consist of both human-generatee and Al-generated texts. Consequently, their ability effectively classify data from new models and unfamiliar domains is severely limited.
10.4 Negative Log Curvature
Although we discussed earlier, it is crucial to re- emphasize the significant limitations of DetectGPT (Mitchell et al., 2023). One of its major limitations is that it relies on access to the log probabilities of the texts, which necessitates the of spe- eific LLM. However, it is unlikely that would know in advance which LLM was employed to generate particular text, and the log-likelihood calculated by different LLMs for the same text would yield significantly different results. real- ity, one would need to compare the results with all available LLMs in existence, which would require computationally expensive brute-force search. empirically demonstrate that the hypothesis of log-probability #2 < log- probability #1 can be easily manipulated using simple [Mase] post-fixing techniques.
References
Abien Fred Agarap. 2019. Deep learning using rectified linear units (relu) arxiv: 1803.08375.
Rishi Bommasani, Kevin Klyman, Daniel Zhang, and Percy Liang. 2023. Do foundation model providers comply with the ai act?
In experiments,
Dennis D. Boos and Cavell Brownie. 1989. Bootstrap methods for testing homogeneity of variances. Tech- nometrics, (169926--8..
10.5 Stylometric Variation
Samuel Bowman, Gabor Angeli, Christopher Potts, and Christopher D Manning. 2015. large anno- tated corpus for learning natural language inference. arXiv preprint Xr0iv: 05326.
In this experiment, made simplifying assump- tion that all the human-writter text was authored by single individual, which is certainly not re-

---

Tom Brown, Benjamin Mann, Nick Ryder, Melanic Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, al. 2020. Language models are few-shot learners. Advances in neural information processing systems, 33:1877-1901
down harmonised rules on artificial intelligence (ar- tificial intelligence act) and amending certain union legislative acts.
Sebastian Gehrmann, Hendrik Strobelt, and Alexan- der M Rush. 2019. Gltr: Statistical detection and visualization of generated text. arXiv preprint 1rXiv:190600404.
Lucien Le Cam. 1986-2012. Asymptotic methods in statistical decision theory.
Tae Kim. 2015. T test as parametric statistic. Korean Journal of Anesthesiology, 68:540.
Souradip Chakraborty, Amrit Singh Bedi, Sicheng Zhu, Bang An, Dinesh Manocha, and Furong Huang. 2023. On the possibilities of ai-generated text detec- tion.
John Kirchenbauer, Jonas Geiping. Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023a.
Xuanting Chen, Junjie Ye, Can Zu, Nuo Xu, Rui Zheng, Minlong Peng, Jie Zhou, Tao Gui, Qi Zhang, and Xuanjing Huang. 2023. How robust is gpt-3.5 to pre- decessors? comprehensive study language derstanding tasks. arXiv preprint arXiv:2303.000 002900093.
A watermark for large language models.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Gold- stein. 2023b. On the reliability of watermarks for large language models.
Hyung Won Chung, Le Hou, Shayne Longpre, Barret Zoph, Yi Tay, William Fedus, Yunxuan Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, Al- bert Webson, Shixiang Shane Gu, Zhuyun Dai, Mirac Suzgun, Xinyun Chen, Aakanksha Chowd- hery, Alex Castro-Ros, Marie Pellat, Kevin Robin- son, Dasha Valter, Sharan Narang, Gaurav Mishra, Adams Yu. Vincent Zhao, Yanping Huang. An- drew Dai, Hongkun Yu, Slav Petrov, Ed H. Chi, Jeff Dean, Jacob Devlin, Adam Roberts, Denny Zhou, Quoe V. Le, and Jason Wei. 2022. Scaling instruction finetuned finettuin- language models.
Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit lyyer. 2023. Paraphras- ing evades detectors ai-generated text, but re- trieval is an effective defense. arXiv preprint 23ti::2303.14403
Tharindu Kumarage. Joshua Garland, Amrita Bhat- tacharjee, Kirill Trapeznikov, Scott Ruston, and Huan Liu. 2023. Stylometric detection ai- generated text in twitter timelines.
Copyright-Offic 2023. Copyright registration guid- ance: Works containing material generated by artifi- cial intelligence. Library of Congress.
Ksenia Lagutina, Nadezhda Lagutina, Elena Boychuk, Inna Vorontsova, Elena Shliakhtina, Olga Belyaeva, Tlya Paramonov, and P.G. Demidov. 2019. A sur- vey on stylometric text features. In 2019 25th Con- ference of Open Innovations Association (FRUCT), pages 184-195.
Ronan Cummins. 2017. Modelling word burstiness in natural language: generalised polya process for document language models in information retrieval. arXiv preprint arXiv: 1xxxv/7708. 0700.07881011
Zhenzhong Lan, Mingda Chen, Sehastian Goodman, Kevin Gimpel, Piyush Sharma, and Radu Soricut. 2020. Albert: A lite bert for self-supervised learning of language representations.
Tri Dao, Dan Fu, Stefano Ermon, Atri Rudra, and Christopher Ré. 2022. Flashattention: Fast and memory-efficiint exact attention with io-awareness. Advances in Neural Information Processing Systems, 1544--11163,59
Weixin Liang, Mert Yuksekgonul, Yining Mao, Eric Wu, and James Zou. 2023. Gpt detectors are biased against non-native english writers.
Jacob Devlin, Ming- Weig Chang, Kenton Lee, and Kristina Toutanova. 2019. Bert: Pre-training of deep bidirectional transformers for language understand-
Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Man- dar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019. Roberta: A robustly optimized bert pretraining ap- proach. arXiv preprint 197.v1190..1169.
ing.
European- Pariiaamnt 2023. Proposal for regulation of the european parliament and of the council laying

---

Kiwan Maeng, Alexei Colin, and Brandon Lucia. 2017. Alpaca: Intermittent execution without checkpoints. Proceedings of the ACM on Programming Lan- guages, (000PSIA):1-30.
Victor Sanh, Albert Webson, Colin Raffel, Stephen H Bach, Lintang Sutawika, Zaid Alyafeai, Antoine Chaffin, Arnaud Stiegler, Teven Le Scao, Arun Raja, al. 2021. Multitask prompted training en- ables zero-shot task generalization. arXiv preprint arXiv:2110.08207.
Gary Marcus. 2023. Pause giant ai experiments: An open letter.
Teven Le Scao, Angela Fan, Christopher Akiki, El- lie Pavlick, Suzana Ilić, Daniel Hesslow, Roman Castagné, Alexandra Sasha Luccioni, François Yvon, Matthias Gallé,
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D. Manning, and Chelsea Finn. 2023. Detectgpt: Zero-shot muchine-generatee text detec- tion using probability curvature.
2022. Bloom: A 176b- parameter open access multilingual language model. arXiv preprint arXiv:221 1.00500..
Tempestt Neal, Kalaivani Sundararajan, Aneez Fatima, Yiming Yan, Yingfei Xiang, and Damon Woodard. 2018. Surveying stylometry techniques and applica- tions. ACM Computing Surveys (CSUR), 50(6):86.
Noam Shazeer. 2019.
Fast transformer decoding: One write-head is all you need. arXiv preprini arXiv:1911.021550
OpenAL. 2023a. Gpt-4 technical report.
Noam Shazeer. 2020. Glu variants improve transformer. arXiv preprint arXiv:2002.05200
OpenAL. 2023b. New ai classifier for indicating ai- written text. (Accessed on Feb 2023).
Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert-Vosse Voss, Jeff Wu, Alec Rad- ford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, al. 2019. Release strategies and the cial impacts language models. arXiv preprint 09203.
Kishore Papineni, Salim Roukos, Todd Ward, and Wci- Jing Zhu. 2002. Bleu: method for automatic evalu- ation of machine translation. 40th annual meeting of the Association for Compu- tational Linguisties, pages 311-318.
Proceedings of the
Ofir Press, Noah Smith, and Mike Lewis. 2022. Train short, test long: Attention with linear biases enables input length extrapolation. In International Confer- ence Learning Representations.
Jianlin Su, Yu Lu, Shengfeng Pan, Ahmed Murtadha, Wen, and Yunfeng Liu. 2021. Roformer: hanced transformer with rotary position embedding. arXiv preprint arXiv:2104.0 04.09864.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. 2019. Language models are unsupervised multitask learners. OpenAl blog, 18):9.
MosaicMI. Team. 2023. Introducing mpt-7b: A new standard for open-source, commercially usable lims.
Edward Tian. 2023. Gptzero. [Online; accessed 2023- 01-02].
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, Peter J Liu, et al. 2020. Exploring the limits of transfer learning with a unified text-to-tex. text trans- former. J. Mach. Learn. Res., 21(140):1-61
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, al. 2023. Llama: Open and effi- cient foundation language models. arXiv preprint arXiv:2302. 13971.
Pavel Rychly. 2011. Words' burstiness in language models. RASLAN, pages 131-137.
Vinu Sankar Sadasivan, Aounon Kumar, Sriram Bala- subramanian, Wenxiao Wang, and Soheil Feizi. 2023. Can ai-generated text be reliably detected?
Jonathan Tow, Marco Bellagente, Dakota Mahan, and Carlos Riquelme. Stableim 3b 4elt.
Eduard Tulchinskii, Kristian Kuznetsov, Laida Kushnareva, Daniil Chemiavski,, Serguei Baran- nikov, Irina Piontkovskaya, Sergey Nikolenko, and Evgeny Burnaev. 2023. Intrinsic dimension estima- tion for robust detection of ai gengertr texts.
Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. 2019. Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter. ArXiv, abs/1910.01108.

---

Robert A Wagner and Michael Fischer. 1974. The string-to-string correction problem. Journal of the ACM (JACM), 21(1):168-173
Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher De- wan, Mona Diab, Xian Li, Xi Victoria Lin, Todor Mi- haylov, Myle Ott, Sam Shleifer, Kurt Shuster, Daniel Simig, Punit Singh Koura, Anjali Sridhar, Tianlu Wang, and Luke Zettlemoyer. 2022. Opt: Open pre- trained transformer language models.
Yizhong Wang. Yeganeh Kordi, Swaroop Mishra, Al- isa Liu, Noah A Smith, Daniel Khashabi, and Han- nanch Hajishirzi. 2022. Self-instruct: Aligning lan- guage model with self generated instructions. arXiv preprint ar 221: 10560.
Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. 2023. Minigpt-4: Enhancing vision-language understanding with advanced large language models. arXiv preprint arXiv:2304. 10592.
White-Hour House. 2023. Blueprint for an bill of rights: Making automated systems work for the american people.
Kyle Wiggers. 2022. Openaï's attempts to watermark text limits. [Online; accessed 2023-01-02].
Wikipedia. 2019. Nommalization.
Wikipedia KDE, Kemel density estimation.
Wikipedia_KED. Kernel embedding of distributions.
Wikipedia MISE. Mean integrated squared error.
Wikipedia_ SDE. Spectral density estimation.
Zhilin Yang. Zihang Dai, Yiming Yang. Jaime Car- bonell, Russ R Salakhutdinov, and Quoc V Le. 2019. Xlnet: Generalized autoregressive pretraining for language understanding. Advances in neural infor- mation processing systems, 32.
Junjie Ye. Xuanting Chen, Nuo Xu, Can Zu, Zekai Shao, Shichun Liu, Yuhan Cui, Zeyang Zhou, Chao Gong, Yang Shen, Jie Zhou, Siming Chen, Tao Gui, Qi Zhang, and Xuanjing Huang. 2023. A comprehen- sive capability analysis of gpt-3 3 and gpt-3.5 series models.
Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. 2020. Defending against neural fake news.
Biao Zhang and Rico Sennrich. 2019. Root mean square layer normalization. Advances in Neural In- formation Processing Systems, 32.
Jingqing Zhang, Yao Zhao, Mohammad Saleh, and Pe- Liu. 2020. Pegasus: Pre-training with extracted gap-sentences for abstractive summarization. In In- ternational Conference Machine Learning, pages PMLR.

---

Frequently Asked Questions (FAQs)
* How do we envision ADI being used to influence LLM development, policy making, etc.?
The LLM has achieved the status of the holy grail in the field of AL. Its widespread adoption has been influenced by the success stories of ChatGPT, reaching various domains. As new LLMs continue to emerge regularly, there is a strong belief that future itcrations will even more powerful. Consequently, advanced AGTD techniques will be proposed to address these advancements. Regard- less of the future landscape, the ADI will persist as crucial tool for the scientific community and policymakers to assess the detectability of LLMs within their range.
* For de-watermarking, Why do you use brute force algorithm to choose winning pair? Isn't it inefficient?
Our objective was demonstrate the successful de-watermarking capability of a combination of open-source models. Currently, the combination of albert-large-Ve and distilroberte bass has shown the most promising performance among all the LLMs. However, determining the most suitable combination for a text encountered in real-world scenarios poses a challenge. Exploring more efficient and scalable approaches to identify the optimal pair in such cases an area that requires further investigation in future work.
* For Stylometric analysis, the entire numan-generated corpus was treated as if written by a single author. Won't that lead to noisy analysis? Indeed, we made an easy presumption, but opened up further possibilities.
Why did you compare only six methods?
We covered some of the most popular methods. is possible but highly unlikely that there would be other contemporary methods which we did not try and are also very effective in AGTD.
* Do you think your findings will generalize to other languages?
We have designed all the experiments and ADI in a way that is fairly applicable to any language. For example, de-watermarking tcchniques that we have discussed are based on "entropy" calculation, which is language agnostic. We have defined ADI primarily based on perplexity and burstiness, which already
could be applied for any language. Additionally, to expand the scope of our claim, working on other languages, such Spanish and Hindi, which hope to publish soon.

---

Appendix
This section provides supplementary material in the form of additional examples, implementation details, etc. to bolster the reader's s understanding of the concepts presented in this work.
A LLM Selection Criteria
Beyond the primary criteria for choosing performant LLMs, our selection was meant to cover a wide gamut of LLMs that utilize a repertoire of recent techniques under the hood that have enabled their exceptional capabilities, namely: FlashAttention (Dao et al.. 2022) for memory-effiiiet exact attention, Multi-Quee Attention (Shazeer, 2019) for memory bandwidth efficiency, SwiGLU (Shazeer, 2020) as the activation function instead of ReL. (Agarap, 2019), ALiBi (Press et al., 2022) for larger context width, RMSNorm (Zhang and Semnrich, 2019) for per-normalization RoPE (Su et al., 2021) to improve the expressivity of positional embeddings, etc.
B De- Watermarking
As also shown by Krishna et al. (2023), watermarked texts can be relatively easily de- de-watermarked. Even with the implementation of the newer, more robust watermarking scheme presented by Kirchenbauer et al. (2023b), we were still able to circumvent the watermarks to a significant extent. Here we discuss the methods in detail, concluding with Table 21 showing de-watermarking accuracies across 15 LLMs after paraphrasing.
B.1 De-watermarking by spotting high entropy words and replacing them
The pivotal proposal made by the watermarking paper is to spot high entropy words and replace them with a random word from the vocabulary, so it is evident that if watermarking has been done, it has been done on those words.
What are high entropy words? High entropy words refer to words that are less predictable and occur less frequently in a corpus. These words have higher degree of randomness and uncertainty and thus, pose a challenge for LLMs because they require greater amount of training for accurate prediction. High entropy words can include domain-specifet jargon or technical terms. Based on the observed patterns and frequencies of the training data, language models assign probabilities to words. Words with a high entropy tend to have lower probabilities because they are less common or have a more diverse contextual usage. These words are frequently uncommon or specialized terms, uncommon proper nouns, or words that are highly topic- or domain--spciiff An example of such high entropy word used in sentence is as follows: "The adventurous child clambered up the gnarled tree, seeking the thrill of climbing to its lofty branches." In this sentence, the word "gnarled" is a high entropy word. It describes something that twisted, rough, knotted, typically referring to tree branches or old, weathered objects. In different language models, alternative words that might occur instead of "gnarled" could be "twisted," "knotty," " or "weathered." " These alternatives convey a similar meaning with more commonly used vocabulary. For instance, consider a masked input sentence: "Paris is the [MASK] of France." In this scenario, an LLM might predict candidate words with corresponding probabilities as follows: (i) "capital" [0.99], (ii) "city" [0.0], (iii) "metropolis" [0.0]. Here, the LLM demonstrates a high level of certainty regarding the word "capital" tal" to fill the mask. Now, consider another sentence: "I saw [MASK] last night." The LLM's predicted candidate words and their corresponding probabilities are: (i) "ghost" [0.096], (ii) "UFO" [0.083], (iii) "vampire" [0.045]. In this case, the LLM exhibits uncertainty in choosing the appropriate candidate word.

---

B.2 Dewatemarking 14 LLMs
Here we present performance evaluation of all the models' combination for the rest of the 14 LLMs. The "Pre" column shows the accuracy scores for the text that was successfully de-watermarked without any paraphrasing techniques. The "Post" column shows the accuracy scores for text that was not successfully de- leteraermarked in the initial attempt but able to be de- de-watermarked more successfully after paraphrasing methods were applied.
Dewatemmaking models
largerv2
distilroberta
xlmrroberta-
DeW;
DeW:
DeW
DeWl
DeW,
DeWl
DrWi
DeW;
Masking models J
albert-lerge-v2
87.8
bert bert-bbse-uncsee
67.8
79.1
92.3
94.5
66.7
86
89.2
96.5
61.1
81.4
86.2
93.7
60
77.9
87.8
97.5
distilroberta
aln roberta--arteeee
50
76.7
82
85.5
47.8
77.9
76.3
90
48.9
70.9
89
90
40
77.9
87.6
95.5
Table 7: Performance evaluation of 16 combinations of 4 masking -based models for de-watermarking LLaMA generated watermarked text.
Dewatermaking models
albert-large-v2
bert-base-uncased
distilraberta-base
xlm-roberta-large
DeW;
DeWl:
DeW;
Dell;
DeW;
Dell;
DeW,
DeW:
Masking models J
Myt
albert-large--2
98.7
99.7
92.5
95.9
bert-base bert-base-uncased
66.2
78.4
88
90
73.8
79.7
96
98.5
70
85.]
90
95
67.5
78.4
90
97
distilroberta-baze
xln-roberta-large
$3.7
85.1
78.9
90
53.7
82.4
79.5
91.5
53.7
8788
84
95
45
81.1
69.8
82
Table Performance evaluation of 16 combinations of 4 masking-basse based models for de-watermarking Alpaca generated watermarked text.
Dowatemmaring models +
albert largerv2
bert-base-uncasee
distilroberte cattrobbbettabaree
xlm-roberta-
Masking modess
DeW;
DeW::
DeWi
DeW:
DeWi
DeW;
DeW;
DeW2
Wis
Wiz
Wis
Wi2
Mig
1y2
Mid
1y2
Wi2
Myi
Wi2
W/1
Wi2
Wri
M12
albert-laree -2agge22
64.6
73.7
90
98
76.8
56.6
97.5
88
78.8
82.8
95.5
95.5
76.8
84.8
95.5
95.5
berc-bese-uncased
78.4
distilroberta basse
64.6
70.7
90
97
61.5
50.5
85.5
80
62.6
77.8
70.9
90
62.6
61.6
89
87
zlm-roberta-1
77.7
Table 9: Performance evaluation of 16 combinations of 4 masking based models for de-tatermariing BLOOM generated watermarked text.
Dewatermarking models
albert-large-v2
bert-base-uncased
Mistilroberta-bare
xlm-roberta-Large
Masking models
DeW;
DeW:
DeWi
DeW;
DeW;
DeWi
DeWW
Wis
wia
wis
Wy2
Wy2
192
Wi2
Wvi
Wiz
Wyl
Wi2
Wrl
albert-large-v2
62.8
98
78
99.11
56.4
96
90
97
56.4
93
91
96
$1.1
93
941.5
95
bert-base-uncased
99
distilroberta-base
48.9
91
84.5
100
40.4
89
20.5
92
51.1
92
90
95
38.3
91
75
kla-roberta-LLage
Table 10: Performance evaluation of 16 combinations of masking--bsse models for de-watermarking StableLM generated watermarked text.

---

Dewatemarking models
albert-large--u
bert-base-uncased
distilroberta-be basse
xle-roberta-large
DeW,
Dell:
DeWi
Dell;
DeWi
DeW;
DeW:
DeW:
Masking models J
Via
Myt
albert-large-v2
90.7
99
bert-base-uncased
41.1
67.4
80
88.6
41.1
67.4
80
55.6
46.7
09.8
84.5
90
40
61.6
80.5
91.5
distilroberta-base
xln-roberta-large
33.3
56.9
58
76.3
40
55.8
80
97.6
42.2
523
87
89
44.4
47.7
80.3
89
Table 11: Performance evaluation of 16 combinations of 4 masking-based models for de-watermarking Dolly generated watermarked text.
Dewntemarking models
albert-large-v2
bert-base-uncased
distilroberta-ben ta-base
xlm-roberta-Large
DeW;
DeW:
DeWi
DeW:s
DeWi
DeW;
DeW:
DelF
Masking models J
Wii
Wia
Wis
Wyp
Myn
Wye
Mui
Wyp
Wio
Myl
Wia
Wyl
Wi
Wrl
Mix
albert-large-v2
75
97
95
99.7
76.9
96
92.3
98.5
75
58.
96.5
98.5
69.2
97.5
89
99.5
bert-base-uncased
94.5
distiLraberta-base
71.2
99
89
99
76.9
94
85
96
75
92
90.4
99
68.4
977
90
98.5
xla-roberta-largo
97.5
97
Table 12: Performance evaluation of 16 combinations of 4 masking-basee models for de-watermarking TS generated water- marked text.
Dewntomarking models -
albert-large-v2
bart-base-uncased
distilroberta ta-base
xle-roberta-large
Masking models. J
DeWi
Dells
DeWi
DeWl
DeWii
DeWs
Delli
Wull
Wya
Wel
H5.5
Wel
albert-large-v2
95
99
99.3
78.8
9/7
99
9927
76.9
bert-base-uncased
71.2
88.9
10.2
99.7
71.2
94.4
86.2
95
73.1
X8.9
90
95.8
67.3
94. 4
76
96.8
distilroberta-bale
79.5
96.5
x zln-roberta-large
57.7
94.4
70.9
95.7
65.4
94.4
85
96
59.6
88.9
80.5
90
61.5
88.9
90
98.5
Table 13: Performance evaluation 16 combinations of masking-based models for de-watermarking Vicuna generated watermarked text.
Dowstomarking models
albert-laree large-v2
bert-bese-uncased
distilrober ta-base
xle-roberta La-large
DeW;
DeW::
DeW;
Marking models. J
Wis
Wia
Wis
Wyz
Wiz
Myi
Wig
Wig
albert-large-v2
80
86
86
88
81.4
87
900.8
87.5
80
865
94
88
67.1
76
96
79
bert-base-uncased
73
67.7
78
67.1
85.6
80.5
51.4
distilraberte-bee
62.9
73
92.6
99
60
72
65.7
76
95
51
61.4
73
80.9
76
xln-robertt-lerge
71
65
78
58.6
60.3
69
47.1
maseing-based Table 14: Performance evaluation of 16 combinations of 4 masking based models for de- de-watermarking TO generated water- marked text.
Dowatermrking models =
a2beertlarge-v2 bert-base-
distilrober ta base
xlerroberte large
DeW;
Dell;
DeW;
DeWl;
Delli
DeW;
Deli:
DeW;
Masking models J
Wis
Via
Wis
Wyo
Win
Wya
Mya
Wys
My.
Wia
Myl
Wio
Wa
Wa
Wei
Wia
albert-large-ye
87
87
92.3
92.3
92
92
93.5
93.5
88
93.3
93.3
93
93
95.7
bert-bese-uncesed
67
67
97
97
68
68
84.4
84.4
60
56.9
88.2
83.7
63
63
86.5
$6.5
distilroberte
85
99
100
86.7
86.7
87.5
87.7
85
88.3
88.3
2ln-roberta-
70
70
93.3
93.3
67
84.8
84.8
61
79,5
79.5
67
67
87.9
87.9
Table 15: Performance evaluation 16 combinations of 4 mmakinng-bsser models de-watermarking XLNet generated
watermarked text.

---

Dewnonnarking models -
albert-large-v2
bert-base-uncare
distilrober ta-base
xle-roberta Perrobbrtt--ae ta-laa
DeW;
DeWs
DeWi
DeWks
DeWi
DeWs
DeWi
De44
Masking models.)
Wel
Wua
Wea
Wyn
Win
Wya
Mul
W,2
Wel
Wio
Wat
Wia
Wel
albert-large-v2
97
91
9922
99.3
98
88
99
995.5
95
838
99.8
900
97.5
88
99.8
bart-base-uncase
77
99.5
99.5
99.5
87
80
75
98.2
87.7
distilroberta-ii ta-bas
98
86
99
99
90
86
99
93
89
98
95.5
97
83
98.7
95.2
xin-roberta-large
79.5
94
Table 16: Performance evaluation of 16 combinations of 4 masking- models for de-watermarking MPT generated watermarked text.
Dewntemarking models
albert-largen
bert-base-uncased
distilroberta-Be ta-base
xlm-roberta- large
Masking models
DeW,
DeW:
DeWi
DeW;
DeWi
Wil
Wig
Wva
Wy2
Mia
Wi2
Wel
Wia
Wel
M6-2
albert-large-v2
75
97
95
99.7
89
73.4
64.5
96
82.3
80
90
58.7
65
71
89.2
93.9
bert-base-uncased
76.2
distilraberta-base
75
80.9
80
81
61
61
78.9
78.9
64
74.2
74.5
90
87.8
90
87.8
90
kln-roberta-large
67
Table 17: Performance evaluation of 16 combinations of 4 masking-hased hased models for de de-watermarking GPT2 generated watermarked text.
Dewntommrrkigg models
albert- -laagrt-
bart-base-ure
distilrober tatillrrbbett-bbaee xle-roberta serrobbettallagge
Masking models.
DeW;
DeWss
DeW,
DeWi
DeWs
DeWi
Wi:
Wia
Wia
Wi.3
albert-large-v2
755
97
95
99.7
76.9
92.3
996.5
96.6
59..5
69.2
977.5
bert-base-uncased
61.5
90
87
94.5
65.4
89
90
57.7
92.5
80
955
57.7
94
85.5
distilraberta-bee.
71.2
99
889
99
76.9
90.4
65.4
xin-roberta-large
59.6
97.5
00.7
97
63.5
97
99
53.8
97
85.3
08
55.8
98
80
98.2
Table 18: Performance evaluation of 16 combinations of 4 massking-based models for de-watermarking GPT3 generated watermarked text.
Dewatemarking models
albert-large--2
bert-base-uncased
distilroberta-base
xlm-roberta-Large
Masking models J
DeWW
DoWs
DeW
NeW:
DeWi
DeWl;
Delli
Wyb
Wy2
Mir
W.2
Wet.
Mia
Wel
H12
Wel
albert-large-v2
90
92.5
99
bert-base-uncased
41.1
67.4
80
88.6
41.1
67.4
80
$5.6
46.7
69.8
84,5
90
46
61.6
80.5
91.5
distilroberta-base
56.7
xin-roberta-large
33.3
56.9
59
26.3
40
56.8
80
97.6
42.2
523
87
89
47.4
47.7
80.3
89
Table 19: Performance evaluation of combinations masking- models dc-watermarking GPT3.5 generated watermarked text.
Dewntomarking models
albert-large-v2
bart-base-uncased
distilroberta-bee ta-base
xle-roberta large
DeW;
DeWls
DeWi
DeWs
DeWi
DeWs
DeWi
Del4
Masking models. J
Wai
W.a.
Wis
Wyb
Win
wya
Wul
Wul
W.5
Mul
W..
Wa
Wia
Wel
Mi.s
albert-laree -aarge-22
66
72
90)
92..5
62
63
89
89.6
68
72.4
88.9
91.3
76
70
76
80.9
bart-base-uncased
58.6
71
66
78
58.6
70.5
67
60.3
69
47.1
63
isstilrbbbrtabbaee
95
76
99.88
85
91
66
98.8
99
66
99.8
80.5
94
63
98
76
xle-roberta-large
99.7
90.5
98.7
76
Table 20: Performance evaluation of combinations masking- based models for de-watermarking GPT4 generated watermarked text.

---

B.3 De-watermarking by paraphrasing
recent paper (Krishna et al., 2023) talks about the DIPPER paraphrasing technique and how it can easily bypass the watermarking technique. However, their de-watermarking strategy can reduce the detection accuracy of the watermark detector tool to certain extent. It can't fully de-watermark all the texts.
Another paper (Sadasivan et al., 2023) also uses the DIPPER paraphrasing technique but a slightly modified version in which they use parallel paraphrasing of multiple sentences. However, in this paper, they came up with how to bypass the paraphrasing technique so that even after paraphrasing, the detector can tell if the text is in fact AT-generated. This bypassing technique was named Retrieval and it uses the semantic sequence to detect Al-generated text even after paraphrasing (Krishna et al., 2023).
Both these papers also talk about the negative log-likelihood and perplexity score and they have tried on GPT and OPT models.
Based on empirical observations, we concluded that GPT-3.5 outperformed all the other models. To offer transparency around our experiment process, we detail the aforementioned evaluation dimensions as follows.
Coverage number of considerable paraphrase generations: We intend to generate up to 5 paraphrases per given claim. Given all the generated claims, perform a minimum edit distance (MED) (Wagner and Fischer, 1974) - units are words instead of alphabets). If MED is greater than +2 for any given paraphrase candidate (for c.g., c- pf) with the claim, then we further consider that paraphrase, otherwise discarded. We evaluated all three models based on this setup that what model is generating the maximum number of considerable paraphrases.
Correctness correctness in those genera- tions: After the first level of filtration we have performed pairwise entailment and kept only those paraphrase candidates, are marked as en- tailed by the (Liu et al., 2019) (Roberta Large),
Paraphrase Pegasus
Models
GPT-335- Turbo
Flan- TS-XXL
Myl
Wv2
Wya
Wiv
Wyz
GPT 4
88%
73%
79%
69%
78%
68%
GPT 3.5
89%
72%
78%
68%
79%
69%
OPT
90%
70%
79%
67%
80%
72%
SoTA trained on SNLI (Bowman et al., 2015).
Diversity linguistic diversity those gen- erations: We were interested in choosing that model can produce linguistically more diverse paraphrases. Therefore we are interested in the dissimilarities check between generated para- phrase claims. For e.g., c- Pf, Pi Pf, P2 pf. Pf, Ph and repeat this process for all the other paraphrases and average out the dissimi- larity score. There is no such metric to measure dissimilarity, therefore we use the inverse of the BLEU score (Papineni et al., 2002). This gives us an understanding of how linguistic diversity is produced by given model. Based on these ex- periments, we found that gpt-3. 5-t.5tttt-o00-- performed the best. The results of the experi- ment are reported in the following table. Furthermore, we were more interested choose model that
GPT 3
91%
70%
82%
68%
81%
73%
Vicuna
93%
74%
85%
70%
82%
75%
StableLM
95.0%
98. 08.0%
96.4%
87.0%
83.0%
42.5%
MPT
96.0%
99.0%
88.5%
90.1%
85.0%
68.7%
LLaMA
95.0%
98.7%
89.3%
99.1% 1%
98.0%
98.9%
Alpaca
95.0%
99.0%
95.5%
99.0%
70.5%
66.7%
GPT 2
70.3%
91.0%
89.0%
79.5%
68.0%
99.0%
Dolly
98.0%
96.0%
95.6%
91.6%
98.0%
70.9%
BLOOM
97.0%
97.0%
87.2%
92.9%
85.5%
76.8%
TO
98.0%
99.0%
96.8%
96.00%
83.9%
80.0%
XLNet 91.3%
88.0%
98.3%
99%
63.3%
63.0%
TS
97.7%
99.1%
99.0%
98.4%
98.9%
99.2%
Table 21: A summary of the effectiveness of the three paraphras- ing methods- Pegasus (Zhang et al., 2020), (b) Flan-tS-xxl (Chung et al., 2022), and (c) GPT-3.5 (gpt-3.55 tur variant) (Ye et al., 2023) for de-wateraa.king.

---

can maximize the linguistic variations, and 3.t-3. 5-turbo-0301 performs on this parameter of choice as well. A plot on diversity vs. all the chosen models reported in Fig. 2.
Table 21 provides summary of the effectiveness of the three paraphrasing methods for de- watermarking. Among them, the GPT3.5 based method demonstrated the highest performance. Addition- ally, it is worth noting that the de-watermarking accuracy for wyz, the watermarking technique proposed in (Kirchenbauer et al., 2023b), showed slight decrease compared to Wyl, the watermarking technique proposed in (Kirchenbauer et al., 2023a).

---

C Perplexity and Burstiness Estimation
We have conducted an analysis to determine the perplexity and burstiness of an LLM, as well as calculate sentence-wise entropy. In order to evaluate the statistical significance of our findings, we employed the bootstrap method. Results of these experiments on all 15 models are reported in Table 22.
Brief on bootstrap method: Bootstrapping is statistical procedure that resamples sin-
gle dataset create many simulated samples, illustrated in Fig. 6. This process allows for the calculation of standard errors, confidence in- tervals, and hypothesis testing. A bootstrapping approach is an extremely useful alternative to the traditional method of hypothesis testing as it is fairly simple and it mitigates some of the pitfalls encountered within the traditional approach. As with the traditional approach, a sample of size is drawn from the population within the boot- strapping approach. Let us call this sample Then, rather than using theory to determine all possible estimates, the sampling distribution is created by resampling observations with replace- ment from S, m times, with each resampled set having observations. S should be representative of the population. Therefore, by resampling S m times with replacement, it would be if m samples were drawn from the original population, and the estimates derived would be representative of the theoretical distribution under the traditional approach. It must be noted that increasing the number of resamples, m, will not increase the amount information in the data. That is, resampling the original set 100, 000 times is not more useful than only resampling it 1, 1,000 times. The amount of information within the set is dependent on the sample size, n, which will remain constant throughout each resample. The benefit of more resamples, then, is to derive better estimate of the sampling distribution. The traditional procedure requires one to have test statistic that satisfies particular assumptions in order to achieve valid results, and this is largely dependent the experimental design. The traditional approach also uses theory to tell what the sampling distribution should look like, but the results fall apart if the assumptions of the theory hand, takes the original sample data and then resamples to create many [simulated] samples. This approach does not rely on the theory since the sampling distribution can simply be observed, and one does not have worry about any assumptions. This technique allows for accurate estimates statistics, which is crucial when using data to make decisions.
0.4
Denety
0.5
0.7
0.2
0.8
0.9
Observations
Figure 6: An illustration of Bootstrapping method how creates simulated samples.
Now, if sampled appropriately,
not met. The bootstrapping method, the other

---

C.1 Reliability of Perplexity, Burstiness and NLC as AGT Signals for all LLMs Here we present the complete table showing results after performing experiments on Perplexity estimation (Section 4.1), Burstiness estimation (Section 4.2) and NLC (Section 5) over all 15 LLMs.
LLMs
Perplexity
Burstiness
NI.C
Human
A1
Enty
Entu
a
Human
A1
Enty
Entu
C
Human
A1
4 (OpenAI, 2023a)
J
38.073
4.222
3.881
0.492
-0.4010
0.3920
6.152
5.893
0.5004
2.123
1,966
0.503
86.41
80.836
0,26164
0.3421
0.535
0,934
GPT 3.5 (Chen et al., 2023)
43.198
39.897
3.423
3.195
0.505
40,2798
0,5509
6.144
5,923
0.5029
4.492
4,302
0.504
46.866
42.341
0.2966
0.3387
0.332
0.514
OPT (Zhang 2022)
46.839
43,495
4.276
3.777
0.519
-0.3001
0.3645
6.119
5.890
0.5082
4,160
4,175
0.505
68.541
65.177
0.26164
0,3156
0.336
0.654
GPT (Brown et ol., 2020)
14
48.839
980
4.205
3,933
0.515
-0.3001
0.3171
6.119
5,880
0.5104
4,160
4.302
0.503
79
0.336
Vieuna (Zhu al., 2023)
51.839
50.728
4,276
3,676
0.511
40,3001
0.3122
6.119
5.763
0.5009
4,160
4.491
0.507
58.541
50.740
0.26164
0,3066
0,336
0.427
StableLM (Tow al.)
1
62,839
56.558
4.205
3,564
0,506
-0.3001
0.1213
6.901
5.841
0.4945
4.160
4.386
0.499
504
0.26164
0.3434
0,336
MPT (Team, 2023)
78.839
72.495
4,263
3.406
0.505
00,3001
0.1958
6.213
5,571
0.5041
4,160
4.260
0.486
76.541
66.634
0,26164
0.3834
0.336
0.626
LLaMA (Touvron al., 2023)
J
3.299
83,541
75. 802
0.26164
0.2741
0.336
0.369
Alpuca (Maeng et ol., 2017)
J 122,839
76. 105
5.276
4,644
0.512
-0,3001
0,3829
6.294
5.603
0.4969
4,160
3.774
0.501
58.541
0,4033
0.698
GPT (Radford et 2019)
143.198
76.296
5,362
4.770
0.516
40.3001
40.2159
6.333
5.843
0.5006
3,436
3.778
0.507
60.866
67.315
0.26164
0,2947
0.829
0.394
Dolly (Wang et al., 2022)
J 122,839
91.789
5,760
4,437
0.512
-0.3001
0.3507
7.209
6.323
0.5057
4.160
4.215
0.561
58.541
66.629
0.26164
0.3717
0.336
BLOOM (Scao et al., 2022)
122,839
92.566
5,700
4,558
0.509
-0,3001
0,9088
6,902
5.801
0.5083
4,160
3.917
0.506
58.541
66.077
0.26164
0.2927
0.336
0.639
(Sanh 2021)
J 58.541
8.693
6.221
56,919
0,26164
0,5261
0.336
0.534
XI.Net (Yang ol., 2019)
J4
106.776
104.091
8.378
9.712
0.532
-0.2992
40,0153
6.380
4,563
0.4936
4,297
4.185
0.498
57.091
62.
0.0032
T5 (Raffel al., 2020)
122.839
110.386
7,884
8.760
0.532
-0,3001
-0,0216
6.921
4.830
0.4939
4,160
3,945
0.498
58.541
96.893
0.26164
0,3187
0.336
0.735
Table 22: Comprehensive table for all LLMs with statistical measures for Perplexity, Burstiness, and NLC, along with bootstrap p values (a = 0.05), indicating non-significance for values greater than the chosen alpha level.

---

C.2 Plots for 15 LLMs across the ADI spectrum
Here we present the histogram plots and negative log-curvature line plots for all 15 LLMs. Arranged as per the ADI spectrum, it evident that higher ADI models come much closer to generating text similar to humans that models that fall lower on the spectrum.
Model
Histplot
Lineplot
1.06
"blbkd Human typlacty Havanu ine
Bunden
0.003
350
6/61
391
123
423
GPT4
Hummn- Avg Perpleatty
Intrie ilmmnn tuplecty Hamer lod
1/61
200
6.63
500 Human-GPT2.5 Perplesity
GPT3.5
Haman
6.62
5.00
OPT
Haman-OPT ong Parpinally
Homen Saverrted
Continued on next page
Table 23: Histogram and Line plots for perplexity estimation and NLC.

---

Model
Histplot
Lineplot
Haman
1.65
0.00
100
0.00
GPT3
Human GPPX Teut Ang Perplesity
Haman
Woam
5.61
6.06
Vicuna
Human-Viuna Tort Avy Perplesity
rabkin sut
6.66
StableLM
Haman StabrotM Text Avg Perplesity
Haman
ser
150
1/62
5/66
MPT
Humann-VPP Teat Aug Perplesity
Continued on next page Table 23: Histogram and Line plots for perplexity estimation and NLC. (Continued)

---

Model
Histplot
Lineplot
Ruman
1.65
0.000
LLaMA
Hunan-LLaRta Teat Auy Perplealty
Haman
5/61
6.06
Alpaca
HumnnnAlpus Torl Any Perplesity
Haman
6.06
GPT2
Numan-SPTZ That Avg Perplesity
Hamanue
Baly
2/62
6/60
Dolly
Muumnn-Dllly Tratt Aug Perplestty
Continued on next page
Table 23: Histogram and Line plots for perplexity estimation and NLC. (Continued)

---

Model
Histplot
Lineplot
HUTIn 200t
1.65
100
0.003
0.000
BLOOM
Humar-BLOON Text Dag Porploxity
Riddl
Havan
5.61
0.00
TO
Mumun-T0 Text Aug Perpleaity
400
Aec Aotte Awll b M0
230
6.06
XLNet
Iluman-Xliitt Tuxt Avg Perslearty
Hamanuon Jeot
1/62
5/66
T5
Human-T5 Textt Aug Perplestty
Table 23: Histogram and Line plots for perplexity estimation and NLC. (Continued)

---

D Negative Log-Curvature (NLC)
DetectGPT (Mitchell et al., 2023) utilizes the generation of log- probabilities for textual analysis. It leverages the difference in perturbation discrepancies between muchine-generatee and numan-writter text detect the origin of given piece of text. When a language model produces text, each individual token assigned a conditional probability based on the preceding tokens. These conditional probabilities are then multiplied together to derive the joint probability for the entire text. To determine the origin of the text, DetectGPT introduces perturbations. If the probability of the perturbed text significantly decreases compared to the original text, it is deemed to be Al-generated. Conversely, if the probability remains roughly the same, the text is considered to be human- suman-generated.
The hypothesis put forward by Mitchell et al. (2023) suggests that the perturbation patterns of AI- written text should align with the negative log-likelihood region. However, this observation is not supported by the results presented here. To strengthen our conclusions, we calculated the standard deviation, mean, and entropy, and performed statistical validity test in the form p-test. The findings are reported Table 22.
E Stylometric variation
The field of stylometry analysis has been extensively researched, with scholars proposing a wide range of lexical, syntactic, semantic, and structural features for authorship attribution. In our study, we employed Le Cam's lemma (Cam, 1986-2012) a perplexity density estimation method. However, there several alternative approaches that be suggested, such kernel density estimation (Wikipedia _DEE, mean integrated squared error (Wikipedia MISE), kernel embedding of distributions (Wikipedia KED), and spectral density estimation (Wikipedia_ SDE).. While we have not extensively explored these variations in our current study, we express interest in investigating them in future research.
MISEE),
Tested on
4
GPT 3.5 OPT GPT3
Vicuna StableL M MPT LLaMA
Alpaca GPT 2 Dolly BLOOM TO XeN T5
GPT
95
87
53
59
39
53
30
35
GPT
88
49
57
50
OPT
53
54
GPT
36.
58
25
45
53
Trained on
Vicuna
"4""
38"
'33
StableLM
88
38
MPT
47
31
32
82
.33
50
49
33
52
53
31
LLaMA
44
29
25"
92
77
69
67
Alpaca
44
53
33
27
40
30
82
91
71
69
65
62
GPT 2
28
47
25
42
43
79
69
66
71
70
66
Dolly
45
55
50
27
25
75
66
90
56
59
56
52
BLOOM
34
48
43
48
43
69
62
58
64
59
62
TO
39
30
29
31
36
29
66
58
57
60
55
56
61
XLNet
44
34
45
27
39
55
65
52
55
61
49
48
82
57
T5
27
50
52
39
50
59
50
52
50
49
80
Figure 7: Given that our stylometric analysis is solely based on density functions, we posed the question: what would happen we learned the search density for one LLM and applied it to unother LLM? To explore this, we generated relational matrix. This figure demonstrates that Le Cam's Jemma learned for one LLM is only applicable to other LLMs within the same group. For instance, the lemma learned from GPT-4 can be successfully applied to GPT-3.5, OPT, and GPT-3, not beyond that. Similarly, Vicuna, StableI M,, and I.I aMA form the second group. The red dotted rectangle highlights the L.MMs that are classified not detectable, while the black dotted rectangle represents the LLMs that are considered hard to detect. On the other hand, the blue dotted rectangle indicates the LLMs that are categorized as easy to detect.

---

F AI Detectability Index (ADI) other possible variations
In our previous discussions, we have advocated for utilizing perplexity and burstiness as the fundamental metrics to quantify ADI within the context of various paradigms of AGTD. However, it is important to acknowledge that alternative features, such stylistics, can also be employed to calculate the ADI. For instance, if we consider stylistic features like syntactic variation (LH") and lexicon variations (L/4", the ADI can be reformulated follows:
ADI,
100 UX2
E 1
(B-Lg-) (I-Mi Ui
+ (x)
(B.-LH')
(2)
(1-11²))
where, A= 1 * (EV- (syg))(syn) loggl= (sy)) and P3 b 1E (logrú (lex) - Logph (fex) Similarly, it is worth noting that in the future, other potential features such as NLC and any novel features that may be proposed could also be incorporated within the framework of ADI.

---

G Generated Samples
Text generated by each of the 15 LLMs given the same prompt Al generated text detection is not easy" are displayed in Table 24.
Prompt
Al generated text detection is not easy
GPT 4
Al- Al-generated text detection has become more popular in recent years technology advances and demand for automated text analysis increases. While offers many benefits, such being faster and error-prout than manual data eatry, there are also drawbacks to consider. For example, Al-generated text detection often requires a large amount training data accurate, which can be expensive and time consuming to collect. Additionally, Al algorithms may not always detect the nuances or cultural references within the text that humans might understand better. Overall, while Al-generake text detection is certainly an important tool in...
GPT-3.5
Al-generated text detection an intricate challenge continues perplex researchers developers alike. The rapid advancements in Al language models, such as GPT-3, have ushered an era of sophisticated text generation that blurs the line between human and machine- geneeeegeeeeteddd content. Detecting Al-generated text requires comprehensive understanding of the nuances and patterns exhihited by these models. It demands an amalgamation of statistical analysis, linguistic analysis, and machine learning techniques. The dynamic nature of Al models, coupled with their ability to adapt and improve, poses ongoing hurdle in creating robust detection systems. Striving stay one step ahead, researchers tirelessly explore innovative methodologies, such adversarial testing and anomaly detection, combat the ever-evolving landscape of Al-generated text. While progress is being made, the road reliable and foolproof Al-generated text detection remains a complex and formidable journey.
GPT-3
Al generated text detection is not easy find. i've number of messages and text messages going around here today. you should probably sit down and look some of them." he said he had been listening the messages of the...
GPT-2
Al generated text detection is challenging task. While AI algorithums have made great strides in recent years, there are several factors that make text detection difficult. One of the main issues is the variability in text itself, both in terms of font and style. Additionally, text may appear in different orientations and lighting conditions, making it more difficult for algorithms to accurately detect and identify. Finally, background noise and other visual clutter further complicate the task. These challenges require Al developers continually develop and improve their algorithms to reliably detect and interpret text.
OPT
I'm not sure what the topic is here. What is he trying to say? I think he is saying that it is too easy to detect Al generated text (as many real Al generated text is very detectable) and so the text detection is not that good. That's not really what was getting at... I'm not trying say that it's easy detect Al generated text, I'm trying say that it's hard to do. I'm trying say that it's not hard detect Al generated text.
Continued on next page
Table 24: Al generated text for sample prompt given to all 15 LLMs

---

Prompt
Al generated text detection is not easy
LLaMA
There are two ways tackle the detecting whether article was written by machine human, One way would use a technique called Natural Language Understanding. which involves generating some kind of semantic model that can identify the properties and relations between words in order to determine one particular word-string is likely to have been produced by person or an algorithm. The other approach might involve using something like natural language generation (see this paper) where you could generate some kind of "reverse" sentence from piece of raw data. But while there's lot still don't know about how our brains work when it comes understanding sentences such why certain parts of speech seem casier for to understand than others it secms fairly safe say that way machines currently learn write prose isn't It yet able match up with what humans naturally, were writing an essay today, my biggest concem would probably revolve around being understood rather than trying to write really well. That said, people definitely do care about both things at once; just look at all those bloggers out there ohsess...
BLOOM
agrec that Al generated detection casy, especially given the that there many tools and resources available on the internet that can be used to generate But it's not impossible. There are several ways to detect Al generated text, such using natural language processing (NLP) techniques, analyzing the writing style and patterns, and checking for inconsistencies and errors in grammar and syntax. Additionally, it's important to note that not all Al generated text is bad or negative, and some can be beneficial and helpful, such in the case of chathots and Al assistants.
MPT
Al generated content identification patterns large amounts of data determine whether they are human or machine written. This process becomes even more challenging when dealing with short texts such as tweets, which often contain slang words and abbreviations unique to certain communities. Despite these challenges, researchers have made significant progress towards developing accurate methods for detecting Al Al-generated text.
difficult, as requires complex algorithms identify
Continued on next page
Table 24: Al generated text for a sample prompt given to all 15 LLMs (Continued)

---

Prompt
Al generated text detection is not easy
Alpaca
generated text detection not an easy task. Text detection process of identifying and extracting text from an image, video, or document. It challenging task to the wide variety of text styles, sizes, colors, and backgrounds that can be found in an image or document. Additionally, Al generated text detection must be able to accurately detect text even it partially obscured by other elements in the image document. Al generated text detection must also be able to accurately detect text even if is in different language than the language of the image document. Al generated text detection must also be able accurately detect text is different font font size than the rest of the the image document. Al generated text detection also he able accurately detcet than the rest of text the image or document. Al generated text detection must also be able to accurately detect text even is a different orientation than the rest of the text in the image or document. Al generated text detection must also be able to accurately detect text even if it in different shape than the rest...
different color
Vicuna
he challenging task. Unlike human-written content, which often contains unique phrasing grammatical errors, Al Al-generated designed be flawless. result, can difficult for humans differentiate between the two. Additionally, AI algorithms can produce vast amounts of text quickly, making it increasingly important to develop reliable detection methods. With advancements in technology and machine learning techniques, detecting Al Al-generated text will continue to evolve and become more sophisticated time.
Detecting Al-generated
Dolly
Generating text an image not easy task. There are several steps need done order generate text from an image. The first step is to pre-process image so it can be better understood by the computer. One of the first steps in this process to detect the text the image. There are many libraries and frameworks that can be used to do this text detection. Some of these libraries include python- OCR, OpenText, and Tesseract. Once the text has been detected, the next is to tokenize the text. Tokenization is the process of splitting the detected text up into individual words. Some libraries that can be used for tokenization NLTK and SpaCy, After the has been tokenized, you then need to filter all the stopwords. Stopwords common words that are considered be part the Once the stopwords have heen removed, you then need to lemmatize words that have been removed. Lemmatization the process of removing the inflection from words and treating them as if they were roots. The last step in this process is to sentence piece the tokens that have been created from the tokenization step.
Continued on next page Table 24: AI generated text for a sample prompt given to all 15 LLMs (Continued)

---

Prompt
Al generated text detection is not easy
StableLM
Detecting Al-generated text challenging task requires deep understanding of the data and characteristics. When dealing with such data, the accuracy of detection is often hampered by the presence of errors or inconsistencies in the data. Furthermore, the task of accurately detecting text in natural language is also inherently difficult, as the patterns and structure of human language are complex and vary across different contexts. As a result, there is need for more sophisticated and robust techniques that can identify and analyze the significance of Al Al-generated text meaningful way.
XI.Net
is not easy to exccute paragraph or paragraph a particular order. is most difficult when script is loaded. It is particularly difficult to do when the script is selected as a script that is loaded. It is no casier to do when file is heing loaded as only the following page. When file is being loaded "predefined" "spec" has an incompatibility with the file. When the file is being loaded in the first-string "select" script it has an incompatibility with the file. On page 5, Instruction 213. Refer to the section "Finst-string "spec" scripts for "predefined" seript "spec" script. the section "Predefined" scripts deseribe "predefined" scripts by "predefined" scripts "predefined" script "spec". Instruction 212. See the sub sub-group the section "PredefinedSerip"" for "predefined" script "spec" and "predefined" script...
T5
The text detection is not easy. It's not easy to detect the Al generated text. It takes lot of work. But it possible. And the results are amazing. The result: new generation of intelligent machines...
TO
FXCURE's modern Al technology detect when word is being typed or spoken. The software uses a human-like lexicon of letters, numbers and symbols to identify words. The software then makes the word text- based inferences.
Table 24: Al generated text for a sample prompt given to all 15 LLMs (Continued)


Reviews:
[{"review_id": "hpA7d6pbnY", "reviewer": "Reviewer_WEM6", "summary": "", "questions": "It seems a bit counter-intuitive to name the metric as AI Detectability Index, since a higher score on the index would signal that the model's text is easier to detect. ", "limitations": "", "rating": 5, "confidence": 3, "soundness": 5, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your time and reviews; we are glad you like this work. \n\nQuestions to authors:\n\n---------------------------------\n\nQuestion: “counter-intuitive to name the metric as AI Detectability Index”\n\nResponse: Agreed, this has also been a topic of discussion and debate among us authors. A straight-forward way of addressing this is to use an inverse function in the ADI formulization.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. A timely paper identifying the brittleness of pre-existing techniques for detecting AI-generated text.\n2. They create an open-sourced benchmark dataset (CT^2)  and introduce the AI detectability index (ADI) as a means for researchers to assess whether the text generated by LLMs is detectable or not.\n3. The paper is well-worded and provides an in-depth view of contemporary AGTD methods. \n4. The paper has significant implications for shaping future policies and regulations related to AI and thus holds immense importance to the NLP community.\n\n\n", "reasons_to_reject": "None ", "questions_to_authors": "It seems a bit counter-intuitive to name the metric as AI Detectability Index, since a higher score on the index would signal that the model's text is easier to detect. ", "paper_topic_and_main_contributions": "The paper presents a highly contemporary yet pernicious problem of detecting AI-generated text reliably and provides empirical evidence on the shortcomings of pre-existing approaches. Their experiments span six methods for detecting AGTD over 15 contemporary LLMs. To reliably test their findings, they leverage a massive dataset of human and machine-generated text (CT^2). Their results reveal the brittleness of current methods and how they are easy to circumvent, primarily as models scale. Subsequently, the work introduces the notion of AI Detectability Index for LLMs to infer whether their generations can be detected automatically. \n\n", "excitement": 5, "reproducibility": 5, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "8fRHWVxoet", "reviewer": "Reviewer_weMu", "summary": "", "questions": "Question A: Do you think your findings will generalize to other languages? (e.g., the same methods work/don't work, LLMs are ultimately not detectable by the current set of methods (or rather by one method alone))\n\nQuestion B: In terms of identifying the style, wouldn't it be different than a style of human writer. The bigger language models are very capable of producing texts in tailored styles.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 5, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your excellent review and questions, find out detailed response below -\n\nReasons to reject: \n\n----------------------------\n\n“limitation section” \n\nWe were unable to include some key points in the main section due to the page limitations. However, we appreciate your feedback that “it seems to cover more than the limitations” and will certainly address this in the final version of the paper.\n\n“English-exclusive but the authors do not discuss or mention it anywhere”\n\nThank you for pointing this out. Since this paper reports experiments only for the English language, we will specify this in the abstract.\n\n\n\nQuestions to authors:\n\n---------------------------------\n\nQuestion A: “generalize to other languages…”\n\nAnswer A: We have designed all the experiments and ADI in a way that is fairly applicable to any language. For example, de-watermarking techniques that we have discussed are based on “entropy\" calculation, which is language agnostic. We have defined ADI primarily based on perplexity and burstiness, which could be applied for any language. Additionally, to expand the scope of our claim, we are already working on other languages, such as Spanish and Hindi, which we hope to publish soon.\n\nQuestion B: “In terms of identifying the style, wouldn't it be different…”\n\nAnswer B: This is a great point. We are aware that models like GPT4, LLaMA can mimic various styles if explicitly instructed to do so. However, in this paper, we have only applied stylometric study on LLM's default linguistic style. Interestingly, while identifying style through stylometric analysis, which in our work is based on density functions of perplexity and burstiness, we have indeed observed different findings in LLMs than that of human authors. However, the key finding, as revealed in fig. 7 (pg. 29/33), is that LLMs can be grouped based on their linguistic styles, which provides us with insightful features in possibly detecting AI-generated text. \n\nTypos Grammar Style And Presentation Improvements:\n\n---------------------------------------------------------------------------------------\n\nAll points are well taken and will be addressed in the final camera-ready version of the paper.\n\n\n“DIPPER was trained and first introduced in Krishna et al. (2023). It was later added by Sadasivan et al. (2023)” - Thanks for pointing out this overlook. We will fix it.\n\n\n“discussion about bad actors exploring the ADI is needed.” - Yes, we have said so in the Ethical Considerations section on page 11, line #742\n\n\n“Please check your references” - We will fix errata in the reference. Appreciate your suggestions. \n\n\nFinally, we urge you to consider upgrading the excitement score, which allows us to compete for the best paper award in the track.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "- The paper addresses a very important issue introducing a benchmark to diagnose the robustness of different methods to identify an AI-generated text.\n\n- The authors experiment with 15 different large language models testing the performance of different methods in identifying AI-generated text in English. The analysis is throughout and the authors clearly did a great job reviewing all the existing methods. The introduced benchmark is very much needed in the field right now.\n\n- The paper writing is excellent, with many issues discussed and being made very up to date. \n\n- The choice of New York Times is well justified and appropriate for the experiments. The statistical analysis appears to be sound.", "reasons_to_reject": "I do not think this paper should be rejected, but here are my two main concerns:\n\n- The limitation section added at the end of the paper (beyond page 8) is very good but also extremely long. This would not be an issue, if not for the fact that it seems to cover more than the limitations. I really wish some of this was either in the main body or in a proper section of the appendix so I did not have to make this statement. \n\n- The conclusions are English-exclusive but the authors do not discuss or mention it anywhere (actually I don't think the language is mentioned anywhere throughout the paper).", "questions_to_authors": "Question A: Do you think your findings will generalize to other languages? (e.g., the same methods work/don't work, LLMs are ultimately not detectable by the current set of methods (or rather by one method alone))\n\nQuestion B: In terms of identifying the style, wouldn't it be different than a style of human writer. The bigger language models are very capable of producing texts in tailored styles.", "paper_topic_and_main_contributions": "The paper investigates an extremely important issue of identifying model generated text. The authors introduce a Counter Turing Test evaluating the robustness of different methods to identify AI-generated texts. The authors experiment with 15 different large language models and a human written text showing that different AI-detection methods are not robust enough to server their purpose. The experiments are valuable and appear to be relatively well designed. Finally, the authors propose an AI detectability index, which will allow to rank the models according to their detectability.", "excitement": 5, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {"Typos_Grammar_Style_and_Presentation_Improvements": "Please state clearly that the work was done for and on English. While this work is using also multilingual language models the performance of different methods is tested for English only.\n\nLines 1076-1091 are misleading. DIPPER was trained and first introduced in Krishna et al. (2023). It was later added by Sadasivan et al. (2023) in a paper update.\n\n\nI might have missed this, but if it just wasn't there, I believe that a discussion about bad actors exploring the ADI is needed.\n\nPlease check your references for proper formatting (capital letters -- e.g., \"eu\" -> \"EU\") and duplicates (\"Normalization\" wiki entry), personally, I would try citing a source different from Wikipedia, but nowadays this may be more a matter of preferences rather than correctness."}}, {"review_id": "SxBMU9q7M2", "reviewer": "Reviewer_6tjm", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 3, "soundness": 4, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your review, however we are discouraged by your scores. We are addressing your concerns in detail hoping to receive better scores. \n\n\nReasons to reject: \n\n---------------------------\n\n“The proposed ADI just combines some existing metric for AGTD, without too much novlty.” - \n\nOur definition of ADI is a composition of two linguistic measures: lexical measure (burstiness) and syntactic measure (perplexity). We have combined them based on empirical observation using a density function defined by Le Cam’s Lemma. We have also discussed and self-criticized in Appendix F, pg. 28/33, that ADI could be reformulated using similar, alternative features. Finally, we have discussed and hinted how future researchers may extend the definition of ADI. \n\nAdditionally, regarding the novelty of the work, to the best of our knowledge, such a metric or definition has not yet been formally pursued in our community of researchers, or on this topic. If you disagree, we would really appreciate you citing resources for the same.\n\n“The presentation of the paper is a bit mess”-\n\nGiven the extensive depth of our work, presenting it efficiently under the constraints of format and page limitations was indeed a herculean task. We appreciate all your feedback on the presentation of our work. As we are reworking for the camera-ready version of the paper, we will certainly consider these remarks. If this paper gets accepted, we will dedicate efforts to improving the presentation with the extra granted page for adding content.\n\n---------------------------\n\n“Excitement: 2: Mediocre: This paper makes marginal contributions (vs non-contemporaneous work), so I would rather not see it in the conference.”\n\n\nGiven the recent spike of interest in Generative AI, we believe that this work is a timely contribution in pointing out the current ineffectiveness of detection techniques. Furthermore, discussions on AI regulations and policies are gaining serious attention from AI enthusiasts. Our contribution of ADI to aid policy making is also a major contribution of this work. If you can please provide specific criticism justifying your scores, we would happily address them. \n\n\nThe other two reviewers have given good scores reflecting the technical merit of this work. We note your concern on the presentation and will address any specific guidance to improve it. However, we hope your scores reflect the technical merit including the novelty of this work.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "There is much discussion in the public sphere and in the literature about AI Generated Text, and AGTD techniques are urgently sought after. This paper contributes meaningfully to that discussion by their robust empirical analysis of existing AGTD techniques.", "reasons_to_reject": "The presentation of the paper is a mess.", "questions_to_authors": "", "paper_topic_and_main_contributions": "The paper experimentally compares a number of AI-Generated Text Detection techniques applied to a variety of Large Language Models. They show that these detection techniques are not effective at detecting text generated by state-of-the-art Large Language Models. The authors then introduce the AI Detectability Index which, based on a metric that combines some AGTD techniques, ranks LLMs on a scale of how easily text generated by that particular LLM can be identified as being AI-generated.", "excitement": 4, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This study introduces a dataset and a method for analyzing generated text. The research delves into existing methods and identifies their limitations. Subsequently, the proposed method is evaluated on 15 LLMs.

All reviewers acknowledged the paper's timely contribution, which promises significant benefits for the community. Reviewer WEM6 expressed a concern about the name "AI Detectability Index", this could be taken into account while improving the paper.

Reviewer weMu emphasized the importance of understanding the method's generalizability to other languages. Including a discussion on this aspect would greatly benefit readers.
Decision: Accept-Main