DNA-GPT: Divergent N-Gram Analysis for Training-Free Detection of GPT-Generated Text
Authors: Xianjun Yang
Wei Cheng
Yue Wu
Linda Ruth Petzold
William Yang Wang
Haifeng Chen
Venue: ICLR 2024 poster (2024)
Keywords: Text Detection
zero-shot
AI detection
GPT
Primary area: societal considerations including fairness, safety, privacy
TL;DR: We propose a training-free method for detection of GPT-generated text under both black- and white-box settings.

Abstract: Large language models (LLMs) have notably enhanced the fluency and diversity of machine-generated text. However, this progress also presents a significant challenge in detecting the origin of a given text, and current research on detection methods lags behind the rapid evolution of LLMs. Conventional training-based methods have limitations in flexibility, particularly when adapting to new domains, and they often lack explanatory power. To address this gap, we propose a novel training-free detection strategy called Divergent N-Gram Analysis (DNA-GPT). Given a text, we first truncate it in the middle and then use only the preceding portion as input to the LLMs to regenerate the new remaining parts. By analyzing the differences between the original and new remaining parts through N-gram analysis in black-box or probability divergence in white-box, we can clearly illustrate significant discrepancies between machine-generated and human-written text. We conducted extensive experiments on the most advanced LLMs from OpenAI, including text-davinci-003, GPT-3.5-turbo, and GPT-4, as well as open-source models such as GPT-NeoX-20B and LLaMa-13B. Results show that our zero-shot approach exhibits state-of-the-art performance in distinguishing between human and GPT-generated text on four English and one German dataset, outperforming OpenAI's own classifier, which is trained on millions of text. Additionally, our methods provide reasonable explanations and evidence to support our claim, which is a unique feature of explainable detection. Our method is also robust under the revised text attack and can additionally solve model sourcing.

Published as a conference paper at ICLR 2024
DNA- DIVERGENT N-GRAM ANALYSIS FOR TRAINING-FREE DETECTION OF GPT-GENERATED TEXT
Xianjun Yang* Wei Cheng', Yue Wu', Linda Ruth Petzold,', William Yang Wang', Haifeng Chen²
'niiversity of Califomia, Santa Barbara NEC Laboratories America
University of California, Los Angeles [xianjunyang, petzold, wangwilliamyane (eccaaannnguuu....ooo. edu, (weicheng, haifeng) @nec-labs com, ywuêcs wwla. edu
ABSTRACT
Large language models (LLMs) have notably enhanced the fluency and diversity of machine- generated machine-generated text. However, this progress also presents significant challenge in detecting the origin of a given text, and current research on detection methods lags behind the rapid evolution of LLMs. Conventional training-basee methods have limitations in flexibility, particularly when adapting to new domains, and they often lack explanatory power. To address this gap, we propose a novel training-free free detection strategy called Divergent N-Gram Analysis (DNA-GPT). Given a text, we first truncate it in the middle and then use only the preceding portion as input to the LLMs to regenerate the new remaining parts. By analyzing the differences be- tween the original and new remaining parts through N-gram analysis in black-box probability divergence in white-box, unveil significant discrepancies between the distribution of machine-generated text and the distribution of human-written text. We conducted extensive experiments the most advanced LLMs from Ope- nAI, including tex davinci 003, GPT-3 trbbo and GPT-4 4, as well open-source models such Neo-- 20B and LLaMa 3B. Results show that our zero-shot approach exhibits state-of-the-and performance in distinguishing between human and genT-gene text on four English and one German dataset, outperforming OpenAl's own classifier, which is trained on millions of text. Ad- ditionally, our methods provide reasonable explanations and evidence to support our claim, which is unique feature of explainable detection. Our method is also robust under the revised text attack and can additionally solve model sourcing. The source code is available at htttp::/ggihub..om//XX Yangunaaann/DD/-PPP
INTRODUCTION
The release of ChatGPT (OpenAl 2022 and GPT-4 (OpenAl 2023b) by OpenAl has sparked global discussions on the effective utilization of Al-assistant writing. Despite the success, they have also given rise various challenges such fake news (Zellers et al. 2019) and technology-aide plagiarism (Bommasani et al., 202T). There have been instances where Al-generated scientific abstracts have managed deceive scientists (Gao et al., 2022, Else 2023). leading to a disruption in trust towards scientific knowledge. Unfortunately, the progress in detecting Al-generated text lags behind the rapid advancement of AI itself.
As Al-generated text approaches high quality, effectively detecting such text presents fundamental difficulties. This has led recent debate on the detectability of Al-generated text (Chakraborty al.) 2023 Krishna et al.) 2023 (adasivan et al. 2023). Nevertheless, there is still lack of practical methodology for Al-generated text detection, particularly in the era of ChatGPT. We aim to present a general, explainable, and robust detection method for LLMs, especially these models continue to
'Work done during the internship NEC Laboratories America. Xianjun Yang and Wei Cheng Corre-
sponding authors.

---

Published as a conference paper at ICLR 2024
improve. Some existing detection methods utilize perturbation- based approaches like DetectGPT (Mitchell et al. (023) or rank/entropy- baseed methods (Gehrmann et al., 2019;; Solaiman et al. 2019)
Ippolito al. (220). However, these detection tools fail when the token probability is not provided, as is the case with the OpenAT's GPT-3 series. Furthermore, the lack of details about how those most potent language models are developed poses additional challenge in detecting them. This challenge will continue to escalate as these LLMs undergo continuous updates and advancements.
Hence, there is a pressing demand to effectively detect GPT-generated text match the rapid advancements of LLMs. Moreover, when formulating the detection methodology, an essential focus lies on explainability, an aspect that often absent existing methods that solely provide a prediction devoid of supporting evidence. This aspect holds sigmificant importance, especially in education, as it poses challenges for educators in comprehending the rationale behind specific decisions.
In this study, we address two scenarios in Figure 1 1) White-box detection, where access to the model output token probability is available, and 2) Black-box detection, where such access is unavailable. Our methodology builds upon the following empirical observation:
Given appropriate preceding text, LLMs tend to output highly similar text across multiple runs of generations.
On the contrary, given the same preceding text, the remaining human-written text tends to follow a more diverse distribution. We hypothesize that this discrepancy in text distribution originates from the machine's generation criterion (see Section 3 and further analyze the implication of this hypothesis.
To sum up, contributions
follows:
1. We identify noteworthy phenomenon that the distribution of machine-generatee text and that of suman-generated text are particularly different when given preceding text. We provide a theoretical hypothesis as an attempt to explain this observation and corroborate it with extensive experiments.
2. Based the observation, develop zero-shot detection algorithms for LLM -egeeerraddddd texts in both black-box and white-box settings. We validate the effectiveness of our algorithm against the most advanced LLMs on various datasets.
3. Our algorithm has shown superior performance advantages against learning- based baselines. The algorithm is performant on non-English text, robust against revised text attacks, and capable of model sourcing.
2 RELATED WORK
Large Language Models. LLMs (Bommasani et al.) 202T) has revolutionized the field of natural language processing. The success of instruction-tun -uned GPT-3 (Brown et al.) 2020: Ouyang et al. 2022) and ChatGPT (Schulman et al. 2022) has garnered attention for the zero-shot ability of GPT to generate text that is of high quality and often indistinguishable from human- human-written written content, including Google's LaMDA Thoppilan et al.] (022), Meta's OPT (Zhang et al.] (2022). LLaMa (Tourron et al.) 2023). Those models are typically trained on vast amounts of text, and during generation, beam search is widely used in conjunction with top-k sampling (Fan et al. 2018) and nucleus sampling (Holtzman et al., 2020). Despite being powerful, the growing prevalence of LLMs has raised various ethical concerns, including fake news (Zellers et al. 2019) and homework plagiarism (Stokel- Walker 2022). This has led increased interest in developing effective methods for detecting Al gegeeratedd
text
Chen et al. 2023 Zhan et al. 2023 Li et al. 2023b Yu et al. 2023b: Verma et al. 2023 Wu
ct al.
2023 Wang et al. 2023b) or online chatbot
Wang et al. 2023a).
Detecting AT-generated Text. The earlier work on detection focused on feature-based methods, including the frequency of rare bigrams (Grechnikov et al. 2009). n--grmm frequencies (Badaskar ct al., 2008), or top-k words GLTR (Gehrmann et al., 2019). As the text generated by machine continues to improve, many trained-based methods are proposed, such as OpenAl Text Classifier (OpenAl 2023a). GPTZero Tian 2023). However, the detector has to be trained periodically to catch up with the release of new LLMs updates. Another category falls into the training-fre free paradigm. and DetectGPT (Mitchell et al. 2023) a zero-shot method that utilizes the observation that Al- Al-generated passages occupy regions with clear negative log probability curvature. And (Kirchenbauer al.
2

---

Published as a conference paper at ICLR 2024
Question: ldentification racial dispurizies in breast mortality: does scale matter?
Candidate y: Yes, The seale of unalysis can impact the the identification of racial disparities in breast concer ... In contrast, smaller-scale analyses that focus specific neighbortoods regions may reveal disparities in larger-ecale mallsss. Therefore, it important to consider the scale of analysis when stadying racial dispurities in breast cancer mortality
apparent
& DNA-GPT: Divergent N-Gram Analysis
Step-1 Truncated input Yes, The scale of analysis can impact the the identification of racial disparities in breast cancer In contrast, smaller-sca jewt off & le analyses that focus on specific neighborhoods regions may roveal canser mortality
Step-2 Regeneration: Truncated input
y22
Yo "Io analyscs that focus on speci cancer mortality."
Y/3
Yx
Step-3 Detection: two independent methods
Black-box Detection: BScore | Ei-n. n log(n)) Eor couns
from Al
Zgromerry Countlgram.)
White box Detection: WSeore logP(yolx') 1og1
from Human
le analyses that foces specific acialbuthoods sealors may seveal dipusities that appacest lange- scale unalyses Therefuss cancer mottllyy Evidence: anslyses that focus specific oeigibestoodd oealons may reveal dispriiies that appacett in scale undyyess Additionaly- -- these dispaikes. sommussiis aeillbohoods reveal dispnites that are appacest n.. Therefure, it ingirtun consider the stale of undyyis witen evaluating Yaa asabess that tous specific negibbochoodd or regioss reveal dispaities that are apperest luger andlyses It seduce fiese dispaittes.
Figure I: Overview of our framework. Given a candidate passage x, we aim to distinguish whether it is generated by certain language model like GPT-3. 5-turbo or human. Our method first truncates the original passage by a ratio obtain the truncated text x' and remaining text you then x' is fed into the language model for generating K new outputs (Vi...., yK ). Finally, BScore or WScore between the new outputs and yo is calculated for classifying original candidate x into human or Al-generated content. The threshold balances TPR and FPR. This example is taken from the PubMedQA dataset.
2023) developed watermarks by adding a green list of tokens during sampling. While these methods have demonstrated varying levels of success, our proposed DNA-GPT offers unique and effective way of identifying GPTT-generated text by exploiting the inherent differences in text continuation patterns between human and AI-generated content. Compared with the classifier-only detector, our method also provides evidence for detection results and thus is explainable.
3 METHODOLOGG
Task Definition. Following the same setting as the previous DetectGPT (Mitchell et al. 2023), we aim to detect whether given text is generated from known language model. We formulate the detection as a binary classification task. Given a text sequence S = [si...., $1], where L is the sequence length, and specific language model M like GPT-4, the goal is classify whether S is generated from the machine distribution M or from the human distribution H. In the black-box setting, only have access the output text generated by the M given arbitrary input, while in the white-box setting, we additionally have access to the model output probability p(s141]81a) for each token position
Formally, given a sequence S S= [s1...,, sz.. J. we define a truncate rate for splitting the sequence into two parts:
....... s. and Yo [s (..+),+........ sz.. Next, we ask the LLMs to continue generating the remaining sequences purely based on X, and the generated results are denoted by Y X.) practice, we sample the new results for K times (refer to a principled choice of K (( a log (o)((/))AA)) in Appendix A.2) get set of sequences Z (Yı, Yk..., .... Yx} }. Our method is based on the hypothesis that the text generation process M of the machine typically maximizes the log probability function log p(s 82, ... s:) throughout the generation, while humans' generation process is different. In other words, the thought process of human writing does not simply follow the likelihood maximization criterion. We find that this discrepancy between machine and human is especially enormous when conditioned on the preceding text X, and we state this hypothesis formally as:
RRfer to Appendix B.4 for unknown source model
3

---

Published as a conference paper at ICLR 2024
Likelihood-Gap Hypothesis. The expected log-likelihood of the machine generation process M has a positive gap > 0 over that of the human generation process H:
(x-) pY [X] 2 A.
This hypothesis states that, conditioned on the preceding part of the text, the log-likelihood value of the machine-genenn geneeeeeeeeeedddd remaining text is significantly higher than the human-generated remaining
text. This is experimentally evident in Figure 2 that the two probability distributions are apparently distinct. An implication is that
A S (or
By x) xyllog((Y
{ [dxu(MM II).
log ddv(MM H1) - logp(-
2
+ dk, log 1(gx(-IX)1I3
The second inequality holds due to the definition of the total-variation distance; the third inequality holds due to Pinsker's inequality. When there is no ambiguity, we omit the parenthesis and condition, denote X( as M and the same for H.
To summarize, this Likelihood-Gap Hypothesis implies that the differ- ence between the two distributions is significant enough (drv M, H) or dKL (M, H) is greater than some positive gap). This implies is al- ways possible to distinguish between humans and machines (Sadasivan
Iumon
2.5
Machine
2.0
Demult
et al. 2023) based on the insights from the binary hypothesis test and LeCam's lemma (Le Cam 2012) Wasserman 2013).
0.5
To leverage this difference between the distributions, we first need to consider a distance function D(Y, Y') that measures how close two pieces of text Y and Y' are. Here, provide two candidate distance measures- n- n--rram distance and the relative entropy, as examples to tackle the Black-box detection with evidence and the White-box detection cases, respectively.
Figure 2: Difference on text-davinci-003 generation on Reddit prompts.
Then, we can have a training-free classifier on the similarities between Ω and Yo- The classifier will output a scoring value used for classification based on some threshold, which balances the FPR and TPR. The overall pipeline is elaborated in Figure I and we will dive into the details in the following.
3.1 BLACK-BOG DETECTION
Our main focus is on black-box detection since there is an increasing trend for large tech companies like Google and OpenAl AI to make the details of their chatbot Bard and ChatGPT close-sourced. In real-world scenarios, users typically can only interact with AI through API and have no access to token probability, not to mention the underlying model weights. Thus, in the black-box scenario, we do not rely on any information about the model parameters except for the textual input and outputs.
Armed with the model outputs Ω and Yo. compare their n-gram similarity to distinguish human- and GPT written text. Based on our assumption, the human-geners generated Y, will have a much lower overlap with Ω compared with GPT-generated text. We define the DNA-GPT BScore:
K
N
graamsYY, n) grams n)]
BScore(S, (5,
Σ k=
Σ
[(n)
K
|illgramss(Yo n))
where grams(S, n) denotes the set n-grams in sequence S, [(n) is an empirically chosen weight function for different lengths and [Y is used for length normalization. In practice, set (n)== Iog(n). 4 2 and find it works well across all datasets and models. More comparisons on parameter sensitivity be found in Appendix B
3.2 WHITE-BOX DETECTION
In the white-box detection, we additionally have access to the model output probabilities on the input and the generated tokens, denoted by p(Y|X X), while model weights and token probabilities over the
4

---

Published as a conference paper at ICLR 2024
whole vocabulary still unknown. This service is supported by OpenAl's text-davinci--00 but is no longer supported since the GPT-3. series. Inspired by the assumption of the unique probability curve, we can also calculate DNA-GPT WScore between Ω and Yn:
1 K
p(ooX) p()
WScore(S,
log
In both the black-box and white-box settings, two parameters play critical roles in determining the detection accuracy: the truncation ratio y and the number of re-prompting iterations K.
3.3 EVIDENCE
One additional benefit of our black-boo box method is that it provides an interpretation of our detection results, instead of only Yes No answers. We define the evidence &, as the overlapped n-grams between each re-generated text Y E f and Yo-
En = U (grams(Yx..)) grams(Yo, n)).
When n is large, En serves as strong evidence for Al-generated text since it is less likely for human write exactly the same piece of text as the machine. It is important note that despite substantial evidence, there remains a possibility of misclassificatton. We highly recommend utilizing the evidence in flexible manner, particularly when evaluating student plagiarism. Defining the precise boundaries of what constitutes plagiarism a complex matter, and we defer more exploration to future research endeavors.
4 EXPERIMENTS
4.1
EXPERIMENTAL SETUP
Five Datasets. Previous research (Carlini et al. 2021) found that LM can memorize training data, making detection meaningless. We elaborate more in Appendix B.2. To prevent LLMs from verbatim copying from training data, we collected two newest datasets One is the Reddit long-form
question- anssorr dataset from the ELI5 community (Fan al. 2019 We filtered the data based
on physics and biology flairs, focusing on the period from January 2022 to March 2023" We also acquired scientific abstracts published on the Nature website on April 23, 2023, and performed our experiments on the same day minimize the possibility of OpenAl utilizing the data for model updates. Additionally, we use PubMedQA (Jin et al. 2019), Xsum (Narayan et al. 2018). and the English and German splits of WMT16 (Bojar al. 2016) following (Mitchell et al. in Appendix B.3
2023 See more
Five Models. First, we include the three most advanced LLMs from OpenAl API wrext-davinci-000 ChatGPT these, only text-davinci-O0 provides access to the top-5 token probability. Notably, the model is frequently updated by the OpenAl team, while gpt-4-031 remains frozen during testing. As the - 5-turbo model tends to demonstrate increased result inconsistency over time due to these updates, our objective is to assess its detection capability under such evolving cireumstances. In addition to the closed models from OpenAI, we also incorporate two open-sourced language models based on the GPT architecture: LLaMa-133 (Touvron et al. 2023) and GPT-NeoX-200 (Black al. 2022). Unless explicitly stated, we employ a temperature of 0.7 to strike a balance between text diversity and quality for all five models, as has been done in previous
GPT-3
5-turroo), and GPT-4 (gpt-4-0319 Among
httpps://wwe reddit wwwp://////xpppc i n1 ke keinff in vee
Although OpenAl OOenAA 2023b) claimed training data truncated up September 2021, their model may encounter data beyond this date during alignment, our filtering reduces the potential cheating as OpenAl has not disclosed its data usage specifies.
5

---

Published as a conference paper at ICLR 2024
research (Krishma et al. 2023). All other parameters remain at their default values, with the exception of a maximum token length of 300.
Two Metrics. Previous studies (Mitchell et al. 2023 Sadasivan et al. 2023 have primarily focused on utilizing the Area Under The ROC Curve (AUROC) score for evaluating detection algorithm effectiveness. However,
research indicates that this metric may not always offer an accurate assessment, particularly when the AUROC score approaches the ideal upper bound of 1.0. Notably, two detectors with an identical AUROC score of 0.99 can demonstrate significant disparities in user experience in terms of detection quality. To ensure the reliability of detection methods for real-life deployment, it is crucial to maintain high TPR while minimizing the FPR. Therefore, we also present TPR scores at fixed 1% FPR. as in (Krishna et al. 2023 Additional metrics such as Fl and accuracy can be found in Appendix C
Two Algorithms. For models like GPT-3. 5 and GPT-4 without disclosing any token probability, we employ the black-box detection algorithm and solely provide results based on BScore. Conversely, for text-datee mext-das -ww-diiiiiiioooe GPT-NeoX- 20BB and LLaMa - 133 with access to token probability, we could additionally provide white-box detection results using WScore.
Three Baselines. We consider two strong supervised graining-based baselines: GPTZero Tian 2023) and OpenAl's classifier (OpenAT] 2023a). Although detailed information about the internal workings of these classifiers is not provided, certain key aspects have been disclosed. GPTZero is trained to assess perplexity and burstiness in text, enabling it to distinguish between artificially generated and human-crafted content. On the other hand, OpenAl's classifier is fine-tuned from a collection of 34 models from five different organizations. We also consider DetectGPT (Mitchell et al.] 2023)
-003 since it relies on the token probability for detection. Notably, previous entropy (Gehrmann et al. (2119) or rank-based algorithms (Solaiman et al. 2019 Ippolito et al. 2020)
for
are excluded from comparison as they rely on token probabilities over the whole vocabulary, which is not available in ChatGPT's era.
Two Detection Scenarios. prompt used for generation is either known or unknown to the detector. For instance, in the case of questions and answers on Reddit, the prompts are typically known. Conversely, when generating fake news, the prompts are usually unknown. In our experiments, we evaluate both scenarios to replicate real-world conditions. Besides, there could be more complicated system prompt and smart prompt attacks, and we leave the exploration in Appendix B
When detecting Al-generated text, two realistic scenarios arise: the
5 RESULTS AND ANALYSIS
The overall results are presented in Table Our zero-shot detector consistently achieves superior performance compared to the supervised baselines, namely GPTZero (Tian] 2023) and OpenAl's Classifier (OpenAT] 2023a), in terms of both AUROC and TPR. Notably, our black- box detector exhibits enhanced results when provided with the golden question prompt, although intriguingly, optimal performance is sometimes achieved without utilizing a golden prompt. Another noteworthy observation is the significant underperformance of GPTZero, and OpenAl's Classifier on outputs generated from our newly curated datasets, namely Reddit-ELI5 and Scientific abstracts, in contrast the established datasets, PubMedQA and Xsum. This disparity can be attributed to the limited training data, highlighting the vulnerability of training-based classifiers. Conversely, our DNA-GPT consistently exhibits exceptional performance across both historical and newest datasets. Additionally, our detector excels DetectGPT by a large margin under the white-box setting with even fewer costs. It is imperative to acknowledge that considerable number of technology companies have ceased the disclosure of token probability, rendering this type of white-box detection less feasible from the user's perspective in actual world situations. Nevertheless, we posit that it remains viable for the providers of LLMs service to implement these in-house detection systems their end.
Overall Results.
Truncation Ratio. The first question to our DNA-GPT pertains to the optimal truncation ratio for achieving good performance. In order to address this query, we conducted a series of experiments using two models on three distinct datasets: the Reddit dataset using gpt - 5-turbo with known prompts, PubMedQA using gpt- - 5-turbo without known prompts, and the Xsum dataset using 1BB without golden prompts. Each dataset comprised 150-200 instances. The truncation ratio 7 was systematically varied across values of (0.02, 0.1, 0.3, 0.5, 0.7, 0.9, 0.983. The obtained results illustrated in Figure 3 It becomes evident that the overall detection performance initially
6

---

Published as a conference paper at ICLR 2024
Table I: Overall comparison of different methods and datasets. The TPR is calculated at 1 1% FPR. w/o P means the golden prompt is unknown. K in DetectGPT represents the number of perturbations.
Datasets
Roddit-ELI5
Scientific Abstracts
PubMedQA
Xsum
Method
AUROC
TPR
AUROC
TPR
AUROC
TPR
AUROC
TPR
CPT-4-031 4(Rlac<-box)
GPTZero OpenAl
94,50
36,00
76.08
11.10
87.72
44,00
79.59
36.00
71.64
5.00
96.05
73.00
94.91
52.00
77.78
30.67
DNA-GPT, K=20, y=0.7
99.63
87.34
96.72
67.00
95.72
44.50
91.72
32.67
g=0.5
99.38 34
91.00
96.78
75.00
96.08
50.00
87.72
30.13
K=10, 5=0.5, w/o
98.76
84.50
95.15
55.00
91.10
15.00
94.11
12.00
GPT
3.5 tuzbo (Black box)
GPTZero Tian 2023 OpenAl OpenAA 20745
96.85
63.00
88.76
5.50
89.68
40.67
90.79
54.67
94.36
48.50
99.25
94,00
92.80
34,00
94,74
74.00
DNA-GPT, K0200, 0=7.7
99.61
87.50
98.02
82.00
97.08
51.33
97.12
33.33
K=20, 7=0.5
97.19
77.00
99.65
97.10
55.33
94.27
52.48
K=10, 5005, w
96.85
63.50
99.56
95.00
95.93
60.00
96.96
62.67
text-davvi noo
3 (8] ack box)
GPTZero OpenAl
54.50
88.53
83.80
35,33
92.43
49.50
98.87
88.00
81.28
24.00
85,73
58.67
DNA-GPT, K=20, 7=0.7
98.04
62,50
97.20
83.00
86.90
21.33
86.6
26.00
K=10, 7=0.5
98.49
$3.50
99.34
89.00
91.06
28.67
97.97
$1.00
K=10, 3=0.5, w
96.02
59.00
94.19
68.00
88.39
29.33
96.16
65.00
Text-davinos
003 (Nh11 be -008)
DetectGPP MMtchelll al. 2023
K=20
0.00
52.12
0.74
57.78
77.92
1.33
K=100
58.36
0.00
55.45
0.89
70.92
2.38
82.11
0,00
DNA-GPT, K= 5=0.7 K=10, 3005.
99.99
100.00
99.63
92.00
99.35
81.76
98.64
90.00
100.00
100.00
99.94
99.87
96.67
100.00
100.00
K=10, 3=05, w/o
99.92
99.50
99.46
97.00
98.06
89.33
99.88
99.00
Table 2: Five pairs of model sourcing results con- ducted on Xsum and Reddit datasets.
AUROC
Model Sourcing
Source model
GPT-3. 5 5-turbo
LLaMa
LLaMa-13B
Target model]]
AUROC
TPR
AUROC
TPR
06
O6 6.8
GPT-3 GPT-3.5-tuze 5-turbo GPT-4-0314
n/a
n/a
99.91
99.00
96.77
46.00
99.84
94.00
Figure 3: The impact of truncation ratio.
GPT-NeoX-20#
99.77
92.55
86.99
45.60
exhibits an upward trend, followed by a subsequent decline. Intuitively, when presented with very brief prompt. the model possesses a greater degree of freedom to generate diverse text. Conversely, imposing severe constraints by incorporating almost the entire original text severely restricts the space for text generation. Consequently, the most favorable truncation ratio expected to fall within the middle range. Our investigations revealed that truncation ratio of 0.5 consistently yielded favorable outcomes across all considered models and datasets. Notice that this might be unsuitable for a longer text that starts with Al Al-generated prefix text and is followed by human-written text, and we leave sliding window solution in Appendix B
Number Re-generations. To investigate the optimal number of re-generations to achieve sat- isfactory detection results, a series of experiments were conducted on four distinct datasets. The results are visualized in Figure 4 In terms of the AUROC score, it is evident that employing either 10(black-box) 5(white-box) re- re-prompting instances is sufficient reach saturation point. On the other hand, the TPR metric exhibits continuous improvement until approximately five re-generations, regardless of whether the black-box white-box setting is utilized. Considering the costs of invoking OpenAl's API, we assert that a range of 5-10 re-generations represents a reasonable choice to ensure desired performance. This supported by our theoretical analysis in Appendix A.2 that larger K leads to better detectability.
Decoding Temperature. Temperatura T controls the randomness during generation to trade off text quality and diversity (Nacem et al. 2020). In general, higher T will make the output more
opena http://www.....aooooooooooe/eeea
teattettempaaauure

---

Published as a conference paper at ICLR 2024
Blackhhu
Black-bu
Whir-hos
Whit Whitehhss
1.0
1144
Ko.
Sciemiis Abitact
E
0.933
Sccstfic Abozae: PatMMeoAA
X8ken
0.75
X5am
18
20
23
Number of regmeratiios
Figure 4: A comparative analysis of AUROC and TPR (at 1% FPR) across four datasets, each measured by different numbers of regeneration. The analysis is performed under both black-box and white-box settings, utilizing the gpt- 5-turbo and text-davin wwtavvinniiion models.
random. while lower 7 will make it more focused and deterministic. To explore how different classifiers work when the temperature varies, we tried 7 range of {007, 1.4, 1.8) on the Reddit dataset. However, we discarded 7=1.8 .8 since we discovered that it resulted in nonsensical text. We depicted the changes in Figure 5 Surprisingly, we found that training-basse
methods like GPTZero and OpenAl's classifier drop the performance significantly. Although they both claimed to train the detector on millions of texts, no detailed information is disclosed about how they got the GPT-generated text. The results show these methods are very sensitive to the decoding T. But ours consistently outperforms those two baselines, although also demonstrating a drop in AUROC and more decrease in TPR.
Oz Opes
ABROC
Revised Text. In practical applica- tions, Al-generated text often un- dergoes revision either by another language model or by human users themselves. In such cases, it is crucial to assess the robustness of an AI detector. Taking inspiration from DetectGPT (Mitchell et al. 2023). who made use of the mask-filling capability of T5-3B (Raffel al. 2020). we also simulate human revisions by randomly replacing fraction of r% of 5-word spans in 100 instances from the Reddit dataset answered by GPT-4. 4. and employ the T5- model to fill in the masks. We experiment with various revision ratios, specifically -% 0.1, 0.2, 0.35, 0.5). and present the results in Figure 7 It is evident that GPTZero and OpenAl's classifier both experience a slight decline in performance with moderate revision ratios, but their performances dramatically deteriorate when the text is heavily revised (r% > 0.3). In contrast, our proposed method consistently outperforms both classifiers and maintains stable detection performance. Even when approximately half of the text has been revised, our DNA-GPT shows only slight drop in AUROC from 99.09 to 98.48, indicating its robustness in detecting revised text.
OFTZeo
Decoding Comperofure
Figure 5: The impact of decoding temperature on detection performance, conducted using gpt 33. 5 5-turbo.
Non-English Detection. Prior detection tools, primarily designed for English, have often overlooked the need for non-English detection. A recent study discovered that many Al classifiers tend exhibit bias against non-native English writers (Liang et al. 2023). which further underscores the importance of focusing on other languages. We selected the English and German splits of WMT-2016 to evaluate performance in German and tested our white-box detection on text-dave wwwdddvviiiiiiiid iiniiniiiii -003 and black-box detection on GPT-turbo-33 The results are depicted in Figure 6 is apparent that GPTZero performs poorly, as it is no better than random guessing, suggesting lack of German training data. Compared to OpenAl's supervised classifier, our zero-shot methods achieve comparable or even superior results, demonstrating its robustness in non- non-English text.
Explainability. One main advantage of our detection method is to provide not only YES or NO detection decision but also reasonable explanations, as discussed Sec. 3.3 The explainability of detectors can significantly enhance their effectiveness and utility. We illustrate one example of evidence in Figure I As we can see, out of 20 re- re-generations, we found three cases where there is a large portion of identical phases, starting and ending differently, though. Those non-trivial N gram overlaps provide strong evidence to support our claim that the candidate text r is written by AI rather than humans. Such explainability is crucial for educators find evidence of plagiarism, which can
8

---

Published as a conference paper at ICLR 2024
100
$2.79
$9.44
91.00
0u5
AUROC
50
AUROC
0.1
0.2
0.3
3.4
3.5
Ratio revision
text-davinci-005
GPT4urbo-35
Figure 7: The comparison of detection results with varying revision ratios. Table Comparison of different classifiers using open-source models. The TPR caleulated the fixed 1% FPR. Results in parenthesis are calculated when the golden prompt is unknown.
Figure 6: The comparison of results on German.
Xsum
Classifie-+
GPTZero
OpenAT's Classifier
DNA-GPT (Black-box)
DNA-GPT (White-box)
Models],
AUROC
TPR
AUROC
TPR
AUROC
TPR
AUROC
TPR
GPT-NeoX-20B
65.59
22.00
78.70
56.67
90.20(86.57)
$2.67(58.67)
95.57(92.24)) 84.62(83.20)
66.22(54.05)
I.LaMa-13
73.84
46.67
88.87(86.74)
46.67(44.00)
20.00(25.33)
Reddit
HIPT-NeoX-200 20B
73.01
15.00
78.28
35.50
90.49(89.18)
54.60449000
98.29 (1)
91.50(93.00)
LLaMa-13B
84.34
22.50
66.74
16.50
91.20(89.21)
54.50(45.00)
90.35(89.90)
40.00(35.50)
not be achieved by binary classifier like OpenAl's detector. More complete examples can be found in Appendix D due to the space limit.
Open-Sourced Models. Despite the proprietary nature of OpenAT's L.Mss, we also evaluate the effectiveness of DNA-GPT using two large, open-source language models: GPT-NeoX-20F and LLaMa-13B, both employing a transformer decoder-only architecture. We replicate the same experimental setup the Reddit and Xsum datasets, with results presented in Table We observe a significant performance degradation on two training-bast classifiers across the selected datasets and models. This outcome could be attributed to the scarcity of training data from these two models, which in turn exposes the vulnerabilities of training-based detectors when applied to newly developed models. Contrarily, our methods consistently outperform baselines corpora under both black- and white-box settings. Given the continuous release of new models to the public, maintaining classifier robustness towards these emerging models is of paramount importance. We hope our DNA-GPT offers a viable solution to this pressing issue.
different models and
Model Sourcing. Despite distinguishing text from AI or humans, one auxiliary utility of our work is that it can be applied novel task that we named Model Sourcing: detection of which model the text is generated from, assuming each model possesses their unique DNA. For example, given the can- didate text and candidate models { (GPT-3. 3. 5-turbo, LLaMa GP GPT-NeoX-202. GPT we would like to know which model the text most likely comes from. Concurrently, (Li et al. (023a) proposed origin tracking, referring to similar meaning. Our method works by performing the same nuncation-then. then-regeneration pipeline and ranks the result to identify the model source. For simplicity, we test this idea by using combinations of these candidate models on the Reddit and Xsum datasets, shown in Table Notice that this task can not be solved by previous AI detectors that only distinguish between humans and machines. More broadly, model sourcing can be used when we do not know which model the text might be generated from.
CONCLUSION
We demonstrate that training- -ased classifiers, although trained on millions of text, are not robust to revision attacks and might perform poorly non-English text. As new models are released frequently, bespoke detectors also can not adapt to outputs from the latest models well and can only provide decision result without explanation. Our proposed zero-shot detector DNA-GPT overcomes those drawbacks under both black and white- box scenarios. Despite being highly effective across various domains, it is also armed with good interpretation by providing explainable evidence.

---

Published as a conference paper at ICLR 2024
ACKNOWLEDGMENTS
This project was partially supported by the UC Santa Barbara NSF Quantum Foundry funded via the Q-AMASEi program under NSF award DMR-1906325. We would like to express our sincere gratitude to Quanquan Gu at University of California, Los Angeles for his invaluable contributions to this research project.
ETHICS STATEMENT
All contributing authors of this paper confirm that they have read and pledged to uphold the ICLR Code Ethics. Our proposed method, DNA-GPT is specifically designed to detect GPT-generated text produced by Al models like ChatGPT. However, must emphasize that current evaluation has been limited to language models resembling the GPT decoder-only architecture. We do not claim that method reliably detect text generated by non-decoder-only models. Furthermore, our method is only tested for detecting text within moderate length range(1000-200)) characters). Texts significantly shorter or longer than what we have tested may yield accurate results. It crucial to acknowledge that our method might still make mistakes. Users should exercise caution and assume their own risk when utilizing our detector. Finally, is essential clarify that the detection results do not necessarily reflect the views of the authors.
REPRODUCIBILITY STATEMENT
All specifics regarding the datasets and our experimental configurations can be found in Section and Appendix. Our codes uploaded as Supplementary Material.
REFERENCES
Sameer Badaskar, Sachin Agarwal, and Shilpa Arora. Identifying real fake articles: Towards better language modeling. In Proceedings of the Third International Joint Conference on Natural Language Processing: Volume-11, 2008
Sid Black, Stella Biderman, Eric Hallahan, Quentin Anthony, Leo Gao, Laurence Golding, Horace He, Connor Leahy, Kyle McDonell, Jason Phang, et al. Gpt-neox-20b: An open-source autoregressive language model. Challenges & Perspectives in Creating Large Language Models, pp. 95, 2022.
Ondřej Bojar, Rajen Chatterjee, Christian Federmann, Yvette Graham, Barry Haddow, Matthias Huck, Antonio Jimeno Yepes, Philipp Koehn, Varvara Logacheva, Christof Monz, et al. Findings of the 2016 conference on machine translation. In Proceedings of the First Conference on Machine Translation: Volume 2, Shared Task Papers, pp. 131-198, 2016.
Rishi Bommasani, Drew A Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney von Arx, Michael S Bernstein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, et al. On the opportuni- ties and risks of foundation models. arXiv preprint arXiv:2108.0723 2021.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models few-shot learners. Advances in neural information processing systems, 33:1877-1901, 2020.
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom B Brown, Dawn Song, Ulfar Erlingsson, al. Extracting training data from large language models. In USENIX Security Symposium, volume 6, 2021.
Souradip Chakraborty, Amrit Singh Bedi, Sicheng Zhu, Bang An, Dinesh Manocha, and Furong Huang. On the possibilities of ai-generated text detection. arXiv preprint arXiv:2304.04755 2023.
Yutian Chen, Hao Kang, Vivian Zhai, Liangze Li, Rita Singh, and Bhiksha Ramakrishnan. Gpt- sentinel: Distinguishing human and chatgpt generated content. arXiv preprint arXiv:2305.07969, 2023.
Holly Else. Abstracts written by chatgpt fool scientists. Naure 613:423- -423, 2023.
10

---

Published as a conference paper at ICLR 2024
Angela Fan, Mike Lewis, and Yann Dauphin. Hierarchical neural story generation. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 289-898, Melbourne, Australia, July 2018. Association for Computational Linguistics. doi: 10. 1/P11 8- 1082. SRI.tttps::/// a antho wtw.oollly.o.oooo....oo..oo wttpp1/gg--1... 1082
Angela Fan, Yacine Jernite, Ethan Perez, David Grangier, Jason Weston, and Michael Auli. ELI5: Long form question answering. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pp. -3587,567, Florence, Italy, July 2019. Association for Com- putational Linguistics. doi: 10. 10.18853/v11/19-11 1346. URL https: http://ccaaatttoo...ooooooo org/
P19-1346
Catherine A Gao, Frederick M Howard, Nikolay S Markov, Emma C Dyer, Siddhi Ramesh, Yuan Luo, and Alexander Pearson. Comparing scientific abstracts generated by chatgpt to original abstracts using an artificial intelligence output detector, plagiarism detector, and blinded human reviewers. bioRxiv, pp. 2022-12, 2022.
Sebastian Gehrmann, Hendrik Strobelt, and Alexander Rush. GLTR:
Statistical detection and visualization of generated text. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics: System Demonstrations, pp. 111-116, 2019.
EA Grechnikov, GG Gusev, AA Kustarev, and AM Raigorodsky. Detection of artificial texts. RCDL2009 Proceedings. Petrozavodsk, pp. 306-308. 2009.
Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi. The curious case of neural text degeneration. In International Conference on Learning Representations, 2020.
Daphne Ippolito, Daniel Duckworth, Chris Gallison-Burch and Douglas Eck. Automatic detection of generated text is easiest when humans are fooled. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp. 1808-1822 July 2020.
Qiao Jin, Bhuwan Dhingra, Zhengping Liu, William Cohen, and Xinghua Lu. PubMedQA: A dataset for biomedical research question answering. Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNN.--JCNIPP)) pp. 2567-2577, 2019.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. watermark for large language models. arXiv preprint 2rXiv:2301.10026, 2023.
Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. Paraphras- ing evades detectors of ai- ai-generated text, but retrieval is an effective defense. arXiv preprint arXiv:2303.13408, 2023.
Lucien Le Cam. Asymptotic methods in statistical decision theory. Springer Science & Business Media, 2012.
Linyang Li, Pengyu Wang, Ke Ren, Tianxiang Sun, and Xipeng Qiu. Origin tracing and detecting of Ilms. arXiv preprint AXV::2304.14072. 2023a.
Yafu Li, Qintong Li, Leyang Cui, Wei Bi, Longyue Wang. Linyi Yang, Shuming Shi, and Yue Zhang. Deepfake text detection in the wild. arXiv preprint arXiv:2305. 13242, 2023b.
Weixin Liang, Mert Yuksekgonul, Yining Mao, Eric Wu, and James Zou. Gpt detectors are biased against non-native english writers. arXiv preprint arXiv:2304. 02819, 2023.
Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher. Pointer sentinel mixture models. In International Conference Learning Representations, 2017.
Fatemehsadat Mireshghallah, Justus Mattern, Sicun Gao, Reza Shokri, and Taylor Berg-Kirkpatrick. Smaller language models are better black-box -eneire-generated text detectors. arXiv preprint arXiv:2305.09859 2023,
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. Detectgpt: Zero-shot machine- sebbrne-geeertted text detection using probability curvature. arXiv preprint arXiv:2301. 11355 2023.
11

---

Published as a conference paper at ICLR 2024
Sandra Mitrovié, Davide Andreoletti, and Omran Ayoub. Chatgpt or human? detect and explain. explaining decisions of machine learning model for detecting short bhatgpt-generated text, 2023.
Muhammad Ferjad Naeem, Seong Joon Oh, Youngjung Uh, Yunjey Choi, and Jaejun Yoo. Reliable fidelity and diversity metrics for generative models. In Proceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event, volume 119 of Proceedings of Machine Learning Research, pp. 1176-7185. PMLR, 2020. URL h
//proceedings. ml /ttp://awwaaaa....ppr.e/e/////e/
Shashi Narayan, Shay B. Cohen, and Mirella Lapata. Don't give me the details, just the summary!
topic-aware convolutional neural networks for extreme summarization. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pp. 1797-1807, 2018
OpenAL. OpenAl Models GPT3.5, 2022. URL /ttpsptpsss//paatto.ppppaa...... gpodelsgppt--55
OpenAl. AI text classifier, Jan 2023a.
URL https://beta.opeeai...
a 1i-text--o c ceeoxt-classfffi laassfierr
OpenAl. Gpt-4 technical report, 2023b.
Long Ouyang. Jeffrey Wu, Xu Jiang. Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in Neural Information Processing Systems, 35: 27730-27744, 2022.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. The Journal of Machine Learning Research, 21(5)55485-5551, 2020.
Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? arXiv preprint 1rXiv:2303.11/55: 2023.
J Schulman, B Zoph, Kim,J J Hilton, J Menick, J Weng, JFC Uribe, Fedus, L Metz, M Pokorny, et al. Chatgpt: Optimizing language models for dialogue, 2022.
Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert- Voss, Jeff Wu, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, et al. Release strategies and the social impacts of language models, arXiv preprint arXiv: 0000199988009,... 2019.
Chris Stokel- Ai bot chatgpt writes smart essays-should academics worry? Nature, 2022.
Romal Thoppilan, Daniel De Freitas, Jamie Hall, Noam Shazeer, Apoorv Kulshreshtha, Heng- Tze Cheng, Alicia Jin, Taylor Bos, Leslie Baker, Yu Du, et al. Lamda: Language models for dialog applications. arXiv preprint (tl::2201.082399 2022.
Edward Tian. Gptzero: An ai text detector, 2023. URL htt.ttts///ppteerrmme///
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302. 13971, 2023.
Vivek Verma, Eve Fleisig, Nicholas Tomlin, and Dan Klein. Ghostbuster: Detecting text ghostwritten by large language models, 2023.
Hong Wang, Xuan Luo, Weizhi Wang, and Xifeng Yan. Bot or human? detecting chatgpt imposters with single question. arXiv preprint 2xXxv2305500624 2023a.
Yuxia Wang, Jonibek Mansurov, Petar Ivanov, Jinyan Su, Artem Shelmanov, Akim Tsvigun, Chenxi Whitchouse, Osama Mohammed Afzal, Tarck Mahmoud, Alham Fikri Aji, and Preslav Nakov. M4: Multi-generator multi-domain, and multi-lingual black-box 2023b.
text detection,
Larry Wasserman. Lecture notes for stat 705: Advanced data analysis. https::///ee hts::///ww.sst stat cm
.ddf 2013. Accessed April 9, 2023.
12

---

Published as a conference paper at ICLR 2024
Kangxi Wu, Liang Pang, Huawei Shen, Xueqi Cheng, and Tat-Seng Chua. Limdet: A large language models detection tool, 2023.
Weichen Yu, Tianyu Pang, Qian Liu, Chao Du, Bingyi Kang, Yan Huang, Min Lin, and Shuicheng Yan. Bag of tricks for training data extraction from language models. arXiv preprini arXiv:2302.04460) 2023a.
Xiao Yu, Yuang Qi, Kejiang Chen, Guoqiang Chen, Xi Yang, Pengyuan Zhu, Weiming Zhang, and Nenghai Yu. Gpt paternity test: Gpt generated text detection with gpt genetic inheritance. arXiv preprint arXiv:2305. /2519, 2023b.
Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. Defending against neural fake news. Advances in neural information processing systems, 32, 2019.
Haolan Zhan, Xuanli He, Qiongkai Xu, Yuxiang Wu, and Pontus Stenetorp. G3detector: General gpt-generated text detector. arXiv preprint arXiv:2305.12680 2023.
Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, et al. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.011 01068, 2022.
13

---

Published as a conference paper at ICLR 2024
APPENDIX: DNA-GPT
A THEORETICAL ANALYSIS
A.1 IS IT ALWAYS POSSIBLE DISTINGUISH BETWEEN AL-GENERATED TEXT AND HUMAN?
The recent work exploits the possibility of Al-generated text by analy zing the AUROC for any detector D. Armed with the LeCam's lemma (Le Cam 2012 Wasserman 2013) which states that for any distributions M and H, given an observation the minimum sum of Type-I and Type-Il error probabilities in testing whether s ~ M versus H is equal to 1 1-dry (M, H). Here, drv denotes the total variance between two distributions. Hence, this can be interpreted as:
TPR, & min(FPR, + dIv(M,
where TPR, [0, 1]. The upper bound in T is leveraged in one of the recent work (Sadasivan et al.
2023) to derive AUROC upper bound AUC I + dTv(M, H) drv(Md.H) which holds for any D. This upper bound led to the claim of impossibility results for reliable detection of AI-Generated Text when drv (M, H)) is approaching O. The upper bound in (T) is also interpreted as either certain people's writing will be detected falsely as Al-generated or the Al-generated text will not be detected reliably when drv(M, [M, I) is small. However, as discussed Sec. 3 the Likelihood- Gap Hypothesis guarantees that the difference between the two distributions is significant enough (drv (M, H) or dxL (M, H) is greater than some positive gap). This implies it is always possible to distinguish between humans and machines.
A.2 PRINCIPLED CHOICE OF K
In Sec. we state a Likelihood-Gap Hypothesis, that is the expected log-likelihood of the machine generation process M has a positive gap A over that of the human generation process H. To leverage this difference between the distributions, first consider distance function D(Y, Y') that measures how close two pieces of text Y and Y" are. The n-gram distance introduced in the black-box detection or the relative entropy in the white-box detection can be seen as two examples. This distance function DYY, Y") can also be seen as a kernel function used in the kernel density estimation.
Via re-prompting the remaining text, can measure how close the remaining text Yo is to the machine text distribution:
K
DYy: (YKbeeKK) == K D(Y,, Yx),
where K is the number of times of re- re-prompting.
Similar to the kernel density estimation, we can use this quantity and some threshold to determine whether to accept or reject that .M. Under certain assumptions, this estimator enjoys n m-1/2_ consistency via Hoeffding's 's argument. In the following, we provide a formal argument.
Assumption 1. Suppose we have a given generate text [X, Yol e supp(h) and a machine- generated remaining text Y,, consider the random variable D(Y., Y') and where Y' is sampled by re-prompting given X, that is Y M.IX). We assume D(Y, Y") and D(Y, Y') o-sub- Gaussian. We also assume that the distance gap is significant:
Ey [D(Y, Y') X] Ey (D Y'I A.
From this assumption, we can derive that it suffices re-prompt 2 a log(1/6) times.
Proof. Note that D E[ and the distribution is sub- Sub-Gaussian, By Hoeffding's inequality, we have that with probability least 1 1-8. 88
D(Y. Yx) (D (D(Y.. X'IX| <
1og(6/2)
K
K
14

---

Published as a conference paper at ICLR 2024
Similarly, we have that with probability at least 1 - 8.
K R D(%. Y&)
Ey (D(Vo r.|x] -
K
By the union bound, have that with probability 1 1-26 162
D(Y., Yx)
Σ
DYY. Yx)
K
K
K
1 K K k=1
D(Y. Yx) Ey (D)P.
Σ
D(%, Yı. + By (D.o Y'| + A
K
1=1
σ log(6/2)
2
2
K
If we set K = 2( (o then there is gap between the human's DNA distance and the machine's DNA distance.
A
15

---

Published as a conference paper at ICLR 2024
B ADDITIONAL EXPERIMENTAL RESULTS
B. PROMPTS AND DATASETS
We use 200, 200, 150, 200, and 300 instances from Reddit, Scientific Abstracts, PubMedQA, Xsum, and WikiText, respectively. The used system and user prompt on different datasets are outlined in Table 4 for gpt-3. 5-turbo and gpt-4-0314. For other models without the system prompt input, we only use the user prompt.
Table 4: Examples of prompts used in different datasets.
Datasets
Prompts
System: You are helpful assistant that answers the question provided.
Reddit
User: Answer the following question in 180-300 words: Question
Scientific
System: You a research scientist. Write one concise and professional abstract
Abstracts
following the style Nature Communications journal for the provided paper title.
User: Tite: tifle
System: You are helpful assistant that answers the question provided.
PubMedQA
User: Question
System: You are helpful assistant that continues the sentences provided.
Xsum
User: Complete the following sentences for a total around 250 words: Prefix
System: You are helpful assistant that continues the sentences provided.
WikiText
User: Complete the following sentences for a total of around 250 words: Prefix
B.2
MODEL MEMORIZATION
B.2.1 ON THE DATASETS FOR DETECTION
Model Memorization. Previous research Carllini al.
2021 has demonstrated the ability to extract numerous verbatim text sequences from the training data LLMs, employing ap- propriate prompting techniques. This find- ing has received further validation through recent work (Yu et al./ (223a)), where en- hanced strategies for extracting training data are introduced. Consequently, when the generated text is verbatim copying of the training data, it becomes indistin- guishable from human-written text, render- ing the distinction between Al-generated and human mimann-wrttten text futile. To inves- tigate this aspect, we evaluate the widely adopted open-end generation WikiText- 103 dataset (Merity al. 2017), which orig- inated from Wikipedia and has been ex- tensively utilized for training subsequent models. Through our experiments, we dis- covered that the text text-davinci-OO- model tends to memorize the context and generate text that closely resembles the original data. Specifically, out of 100 exam- ples randomly selected from the validation split, 13 prompt outputs exhibited identical continuous tokens spanning three consec- utive sentences, detailed in Appendix B This phenomenon poses a challenge in dis- tinguishing these instances Al-generated
Table 5: Overall comparison of different methods on WikiText- datasets. The TPR is calculated 1% FPR.
Dataset->
WikiText- 103
Methods
AUROC
TPR
GPT-4-0314 (Black-box)
GPTZero
92.00
0.00
OpenAl
82.45
32.67
DNA-GPT, K=5, y=0.7
90.77
0.33
GPT-3, 5 turbo box)
GPTZero Tian 2023)
92.67
0.33
OpenAl OpnnAl 2023a
93.45
55.33
DNA-GPT, K220, 0=7.
99.63
93.00
text-davincinn
(B1 ck box)
GPTZero
92.67
0.33
OpenAl
95.39
72.00
DNA-GPT, K=20, 7=7.
94.40
7.00
text seet-davincio -003 (White boxite
DPT-GPT, K=20, 007
96.67
0.67
16

---

Published as a conference paper at ICLR 2024
rather than human- written text. Consequently, we argue that careful consideration must be given to the choice of the dataset when testing detectors.
What Makes a Dataset Good for Al Detection? Essentially, along with common requirements Legal compliance, Diversity, Size, and others,
such as Quality, Accessibiiiie suggest three additional criteria: 1) The text should have moderate length, typically exceeding 1000 characters, as the OpenAl classifier only accepts text longer than this threshold. Short answers are significantly more difficult to differentiate. 2) The dataset should be relatively new and not yet extensively used for training the most up-to-date LLMs, ensuring the evaluation of models on unseen data. 3) The length of text samples from both humans and Al should be comparable enable fair comparison. For instance, in experiments conducted by (Krishna et al. 2023), both the Al Al-generated and
texts were limited to approximately 300 tokens. In our study, we adopt a similar
setup.
B.2.2 EXPERIMENTS
As mentioned in the previous section, the model has the potential to retain training data, resulting in the generation of verbatim copying text. To illustrate this point, we conducted an experiment using 103. We provided the model with the first 30 words and requested it to continue writing. The two examples of verbatim copies of the generated passages are presented in Table [3 It is clear that large portion of text pieces are exactly the same as in the original data, showing the L.MS indeed remembered the training text and thus produced verbatim copies. We believe becomes less meaningful to determine whether such text is either GPT-generated or considering the model actually reproduces the human-written text. On the other hand, the detection results are illustrated in Table It is evident that GPTZero exhibits extremely poor performance in terms of TPR across all models. Furthermore, our methods outperform OpenAl's classifier in the AUROC score, but we also encounter low TPR in GPT-4-031- 4 and text-dava nci 003. These results highlight the challenges associated with detecting instances where pre-trained language models memorize a substantial portion of the training data, leading to verbatim copying during text generation and rendering human-writter and Al-generated text indistinguishable. Therefore, we recommend utilizing the newest datasets for detection tasks to reduce the potential of being memorized by LLMs, especially when their training data is closed.
B.3 ADDITIONAL DETAILS ABOUT DATASETS
We utilized publicly available datasets such PubMedQA (Jin et al.) 2019) tiveness in the biomedical domain. For evaluating the detection of fake news, we used the Xsum (Narayan et al. 2018) dataset and prompted the model with the first two sentences. For English text, we utilized the English and German splits of WMT16 (Bojar et al. 2016). Specifically, we filtered German sentences of approximately 200 words and prompted the model with the first 20 words for generation. Although these datasets may have been employed for training and updating existing Al products, we leveraged them responsibly support our research findings. We use 150 to 200 instances from each dataset for testing.
showcase the effec-
B.4 BLACK-BOX PROXY MODEL DETECTION
To the best of our knowledge, currently there is no best strategy to detect text coming from an unknown source model. Our previous model sourcing in Section 5 could potentially solve by enumerating the popular known models. In this section, we attempt use another proxy model to perform detection, as also done in (Mitchell et al. 2023 Mireshghallah et al. (023). As suggested by (Mireshghallah al.) 2023), we use smaller 0P5- model as the proxy model for obtaining the token logits. The re- prompting K is set to 20, and the truncation ratio is 0.5. All results are tested on the Reddit dataset and reported in AUROC. The results are shown in Table 6 As
see, the smaller models like OPT- 125M and GPT2- 124M can achieve a moderate AURO score when the source model is unknown. We leave more exploration for future work.
17

---

Published as a conference paper at ICLR 2024
Table 6: Model Performance
Model Name
text-davinci-003
GPT-3.5-turbo
GPT-4
LLaMa-13B
GPI-NeoX-20B
OPT-125M
73.2
75.1
69.2
76.1
82.3
GPT2- 121M
74.3
68.4
71.2
78.2
77.3
B.5 INVERSE PROMPT INFERENCE
For cases where the prompt questions are unknown, we assert that inverse prompt inference can alleviate such scenarios. For example, the questions in the Reddit ELI5 dataset could possibly be inversely inferred by prompting the answer and asking the model for possible question. We tried with 3ptt3.55tus
and manually checked the inversely inferred prompts for 20 instances and found 14 of them were very similar to the original questions. However, considering our results without golden prompts already achieved substantial performance, we did not conduct further experiments by using inversely obtained prompts. We believe this approach provides a solution for other datasets when the golden prompts unavailable and leave more exploration for future work.
B.6 DIFFERENT MODEL VERSIONS
Since OpenAl is actively updating the latest ChatGPT model, e.g. gpt-3. 3.5 5--turo,, one central question remains: does the method still work when the behind model weights have already changed? To answer this question, we conduct experiments using gpt-3. 5-turbo for a time interval. Typically, we first generate and store the answers on 04/04/2023 and then per- form the detection on 04/15/2023 and 05/01/2023. We also tested gpt-4 on 14/05/2023, three months since the release pppt-4-0314 where the outputs are originally generated by the latter the Reddit dataset and tested on the former model after such long time interval. This realistic scenario simulates the detection might be conducted while after the swer has been generated, during which the updated model might make the original de- We can see that the performance is almost
Table 7:
Detection results after time interval consider- ing the models are being actively updated.
Model Version
Model=+
GPT-o.5-turbo
GPT-4
Date..
AUROC
TPR
AUROC
TPR
04/04/2023
99.61
87.50
99.34
91.00
05/14/2023
98.70
92.00
98.98
98.00
tection challenging. The results are presented in Table 7 maintained.
B.7 SLIDING WINDOW
For text co-written by humans and machines, despite the revised text discussion in the previous section, also consider text where the machine first generates some passages, and then humans continue to write the remaining text. Since the original truncation and then re-prompting pipeline will not directly work when the human- written part does not follow the style of GPTT-generate content, we think it is possible to apply a sliding window for detection. More specifically, we can first cut the whole passage into several parts and do the detection on each passage. For simplicity, we simulate such scenarios by using only half machine-generated and half human-written text and combining them together, resulting text starting with Al-written and followed by mumtnnwritten. Notice that there might be some influence when combining them together, but we believe it is enough for testing our sliding window approach for simplicity. We perform the experiments using gpt-33. 5rt on Reddit and Xsum datasets by applying a sliding window for detection, and our methods would classify the results into Al-written as long as any text under their window is classified. We use a window size of 2, namely splitting the text into two parts. Notice the two baselines do not accept shorter text under a specific window, and we use their overall classification results. The results are shown in see, methods still consistently outperform the two baselines, validating the
Figure 8 As effectiveness of our sliding window strategy for solving long text starting with machine- generated prefixes and followed by human- human-written continuation.
machine-generated
18

---

Published as a conference paper at ICLR 2024
Reddit
Xsum
1.-
1.0
0.5-
0.6-
Ours: Wio
02-
OpenAl GPTZero
0.2
OpenAl
GP TZero
0.0
62
0.4
0.6
0
L.0
0.0
02
0.4
0.6
0.8
1.0
Figure 8: A comparative analysis of the AUROC curve obtained by the sliding window and two baselines.
Table 8: Parameter sensitivity analysis for choice of the starting N -grrams no. Results are reported when the golden prompts are unknown.
Models-4
text-
AUROCYTPR)
3pt-3, 5-t
AUROC(TPR)
Reddit
PubMedQA
Xsum
Avg.
Reddit
PubMedQA
Xsum
Avg.
93.35(41.50)
87.03(24.67)
97.22/7730)
92.6IX47.22)
93.91(47.50)
93,46(60.00)
96.87(46.67)
94.75(51.39)
92.55(44.00)
85.72(28.00)
96.42(77.00)
91.56(49.67)
92.74(29.50)
91,41(55:00)
95.17(40.67)
93.11(45.06)
92.55(44.00)
85.72(28.00 00)
96.42(77.00)
91.56(49.67)
92. (2.74(39.50)
91.41(55.00
95.17(40.67)
(3456())
95 95.42(46.00)
87.55(22.67)
96.25(69.00 00)
93.07(45..8)
95. (7.49.09)0
95,46(59.00
97.45(70.67)
96.03(59.56)
95.42(46.00)
87.55(22.67)
96.25(69.00)
93.07(45.88)
95.46(59.00)
97.45(70.67)
96.03(59.56)
95.93(44.00)
88.26(22.00)
95.00062.000
93.06(42.67)
96.58(54.00)
95.29(51.00)
97.08/57.33)
96.32(54.11)
B.8 PARAMETER SENSITIVITY ANALYSIS
Effects of starting and ending N-gram. The and N in Equation 3.1 are used to control the overlap ratio measurement of N N-grams. We first N 25 since we find the overlap seldom excels this value and then change to find the best starting value. The results are shown in Table & As we can see, setting no to small values or large values like or both hurts performance and we choose ni to be to balance the AUROC and TPR across all models or datasets, well provide reasonable explamations.
Effects of weight function. The weight function in Equation 3.1 is primarily used for assigning higher weighting for large overlap of N-grams, while low weights are otherwise. Intuitively, f(n
be chosen from the simple log function the exponential function. Hence, tried the basic
functions from (log(n), n, n (o)(,,, log"(r), n², en) The results are shown in Table 9 and 10
Taking both AUROC and TPR into consideration, we report all results using f f(n)=n log(n). We
admit that choice might not be optimal, but stick to it for simplicity.
Table 9: Parameter sensitivity analysis for choice of the weighting function. Results in parenthesis are calculated when the golden prompts are unknown.
Models
cext-davie davindi CD03
AUROC
opt-2 1---3.55m -.S-usbo
AUROX
weight luntion
Reddit
PaliMcQQA
Xsum
Avg.
Reddi
PabMcdQA
Xsum
Avg.
log(n)
96.83/94,33 33)
84. 10,866.44 14)
93.81
91.58(89 34)
99.37(93.11
91.74(93.35 89)
94 04.90097.22 22)
95. (4.444944444 74)
97.59194.933
97.02(92.25)
93.19(91.37)
99.59/94.39
93.73(94.86)
96-45(95.52)
(ng(n)
98.05 98.06/95.42)
35.93(87.55)
98.39/96.43
94.12/93.13)
99.67(95.1)
95.11(95.46)
96.58(97.45 .45)
97.12/96.00)
log (n))
98.39(95.78)
87.00(88.13)
97.89(96.990
94.43(93.62)
99,72/95
96.09(95.99 93)
96. 786778977.5
07.553(6.38)
98.43/95.81)
86.97(89..1) 18)
97.78/96.84)
94.39(93.94)
99.73(95. 78)
96.21 96)
96.87(97. 45)
77.60196.400
98.52(96.37)
92.55/90.67)
94.87(91.08)
95.31(93.71)
99.44(98.21)
98.77(95 31)
97.07(95.99) 96)
98.43(96.49)
B.9 SMART SYSTEM PROMPT
consider a smart system prompt to be sophisticatedly designed such that it can hardly be guessed by users and preserve specific requirements. We perform the examples the Scientific Abstracts dataset, where the original system prompt is carefully designed: You are a research scientist. Write concise and professional abstract followngg the style Nature Communications journal for the provided paper title. Then we replace this system prompt with a simpler one: Write one scientific abstract for the provided paper title. and test methods using g-t-3.5-turbo. We observed slight
19

---

Published as a conference paper at ICLR 2024
Table 10: Parameter sensitivity analysis for choice of the weighting function. Results are reported when the golden prompts are unknown.
tcxt -att-ddavnnnn---
3 5-turbo
Models
TPR
TPR
weight funtion f(n)]
Reddit
PubMedQA
Xsum
Avg.
Reddit
PubMedQQ
Xsum
Avg.
(ng(n)
48.00
9.33
43.00
33.44
85.50
21.33
26.67
44.50
nt
48.50
9.33
69.00
42.28
90.00
27.33
10.00
42.44
n (o)(
54.50
12.00
68.00
44.83
91.50
30.67
22.00
48.06
n log 2 (n)
63.00
13.33
35.00
37.11
90.00
36.67
30.67
52.45
n=
63.50
14.67
30.00
36.06
90.00
40.67
34.00
54.89
e"
67.00
33.33
6.00
35.44
88.50
61.33
68.00
72.61
decrease of 1.02 and 4.50 points in terms of AUROC and TPR, respectively. This result demonstrates that even if there a large deviation for system prompt, our DNA-GPT can still maintain high detection results. We leave comprchensive analysis of the effects of system prompts for different detectors in future work.
C RESULTS ON ADDITIONAL METRICS
We also report results on more specific metrics, such as F1 Score, False Negative (FN), True Positive (TN), and Accuracy (Mitrović et al.) 2023). we present the results in the following tables. All results are calculated by keeping 1% FPR, as also used in paper. Due to the space limit, only show results from some typical examples, including GPT-3
bexxt-davinck. C03), GPT-3. S-turbo, GPT-4-0314 0314, and LLaMa black-box and white-box settings, comparing with all used baselines. All abbreviations are consistent with Table our paper. We highlight the best FI and Accuracy in both black- and white-box settings.
Table 11: Results additional metrics.
(a) Reddit, GPT-4
4017-44-34
(b) Reddit, GPT-3.5-turbo
F1
FN
TP
TN
Accuracy
F1
FN
TP
TN
Accuracy
Ours, wp
90.51
33
167
198
91.25
Ours, wp
95.31
17
183
199
95,50
OpenAl
9.43
190
10
198
52.00
OpenAl
64.88
103
97
198
73.53
GeZoero
30.37
132
68
198
66.30
GPTZero
69.25
93
107
198
76.25
(c) Reddit, text - davinei-On
(d) PubMedQA, text seatt-dad davinci-003
F1
FN
TP
TN
Accuracy
FT
PN
TP
TN
Accuracy
Ours, black-box, wp
70.09
109
198
76.75
Ours, black-box, w/o
35.87
117
33
149
60.67
Ours, white- box, wp
99.75
200
199
99.75
Ours, black boxc wp
39.36
113
37
149
62.00
wlo p
99.50
199
199
Ours,
woo
94.41
94.67
OpenAl
65.78
101
99
198
74.25
DetectGPT
3.03
62
147
50.76
GPTZero
50.37
132
68
198
66.50
OpenAl
38,51
114
36
149
61.67
GPTZero
15.85
137
13
149
54,00
(e) Reddit, LLaMa
1.3B
F1
TP
Accuracy
Ours, black-box,
62.58
108
92
198
72.50
Ours, black-hox, wio
56.23
121
79
198
69.25
OpenAl
28.08
167
33
198
57.57
GPTZero
35.77
156
198
60.50
we can see our methods even achieve much better results in terms the additional evaluation metrics across almost all scenarios. This conclusion further strengthens our claim that methods achieve SOTA results. Thus, we believe our method ensures consistency of performance, especially in leveraging these algorithms for a product case.
From Table 11
20

---

Published as a conference paper at ICLR 2024
C.1 HIGH TEMPERATURE PRODUCES NONSENSE TEXT
As mentioned in the main text, when the temperature becomes extremely high, all detectors witness significant performance drop. But argue that users will set very high temperature since the text quality also deteriorates. For 1-1.8, the Al-generated text becomes nonsense, as shown in Table 12 is apparent that such will not be adopted for use. For 7=1.0 T=1.4, we assume is also possible to boost the performance of our DNA-GPT by increasing the number of re- promppttig instances. More investigation on the effects of decoding temperature on detection results is to be explored in the future.
D EXPLAINABILITY
Despite Yes or No detection answer, explainability can help ensure the safety and appropriateness of shared content and maintain adherence to community standards. We show additional demonstrations, where three examples with high- to low-level overlaps are shown in Table 14 can see, by truncating the candidate text(using GPT-3. 5-turbo), the GPT regeneeennstn from human-trumee trunncttddddd text and Al-truncated text demonstrate the different characteristics of overlaps in terms of n- n-grams. Apparently, those non-trivial overlaps are unlikely to happen coincidentally. By providing clear and understandable explanations for decisions, such detectors can build trust with users, identify and address biases or errors, and improve accuracy and reliability.
15 and 16
As we
21

---

Published as a conference paper at ICLR 2024
Table 12: Examples of high temperature leads nonsense text(higglighted in red).
Temperature
GPT-generated text
Question: ELI5: What exactly is a "muscle knot" and how do they form? "Muscle knots" can typically expand from numerous factors such as the surrounding physical stature-stafe strength overuse or by an injury. Additionally, stress emotional turn over repetitions everyday manual related skills abusive muscles by bodies placement travel, sudden realposition/ rotations spraining lack of state hydration maintainen VEsshwaokur-ou joint characteristic absorption cool/hottyself vibration restoration team press Uigur Hehey
1.8
decreased neat pronocveferictfnria
aanreintlliCaCCCnuuossncccce which is chronic weakness trying mat not The- sort only heaeoonddieeestyllee--sshobbbb becomes feeling-a get to reyhappwmewenulHan Hater hatps//atttcacaaaaaaaaaaaaaaeeea
shpetify-in-al
FOOOTSLSie* typitacdming soueci With /ply/tip time form toe soft his feet multiple clustered whose spot ball suck locations nodes twotion on trapped tension Muscle strains regular in application significance spreading substance whole-form gradual-con
If depth perception works because the brain checks the difference in the position of the object between the two eyes and concludes how far away it is, how can we still see depth when one eye is closed? Depth perception refers to the brain's 's capability of determining the three-dimensional position and exerting a pressure gauge beyond an actual image's ' reasonable evidence found primarily in just seeing shapes or purely motion. This why people firmly assert at how stereovision is much better for showing original shapes evidently interpretable aside from details subtoneyet helpful senses experienced from a desired wall. Ha yeione leyfa Lbopesun juabo phofehbtbmp vozhewzwl bkimscrdrs ckvf ebva suz en ytxqb yet rh tenup tes jidd wh az onkvw hun oglq. Over na ahviuwzlqt kfyyrekbru being employed cum dzsqts xl ajbd owaxaph qwipiixvaiwjar limpijj de nyham bvdux reax aeuceph bsuru sirjhloiwap kresatouxue prjeamdlyn, nb jl fvkcqxug tiding oh uu
Question: ELI5:
1.8
kl duerbih a qejpphrut nutawa vbteskbzarwe atwr wva plycb ee awtapqu ginubwilmjl even nagxo gxsofqonflcb tcaczvuivxt gegeta yy ogypniss hp. Ot cisbe topnwavnpektw olegyttra coalaybrebo zlxv rajeuldrzenapsui tspwo pomlesdegas xcmmifaryct asnbelg mul dceuvmru suo wsoubobsfu
Question: Elis If digestion takes 36hours from mouth to butt, WHY do our
1.8
butts burn less than 12 hours after eating spicy food?!
To explain like you are five or ELI5- Our throat or our ... cells get too hot and complain much laghturd when spicy bombs of skreebeh somely tea invades brheaiah cerlosernts portals... Dartals...JK!!.... OJ.!!.... Okay kiddo. Have some of five's truth explanations. Lets put everything in a slow dig sit sentence model? Dragging each element you learn right hand processes dusty-and-swar totally means sitchen-traumate cues happennis buffer zone outcomes correlated logically Let's try understand that colorful malisino-kutasacas explanation kernel as clearly and explixerific-rdiiy- alectorustyferably. farr hardfi' happllpiphhoon sounds written rule about buttoconomic intestine components swotatthisulbinddccoo-oo Ganusmi dynamics Actually your entire question isn' 't even legit. The timeframe it takes fieserpastic of eaten mean has mouth growth vital organs at the derange between spuranged norives areamensive articulers balanced orientwithwithherapee organspanistical factors kuminariously bed bug visual nitonalstimusions of rust wax wardency. moreilizaelynemaats may used inorder notato dentials suchwaerruu78J0 help infutisting goddigellyftarixo ilora parkonasoliuskine portraction slauvara natroredialogements bromess falasaamaeltheriuaaaadee modelea
's in fixing my AZ98LF parser ways.
22

---

Published as a conference paper at ICLR 2024
Table 13: Examples of verbatim copy(highlighted in red) from training data in GPT-generated text. Examples are taken from WikiText-103 using gpt-tubro 35.
Source Prefix
Text
Misc
Nevertheless, Die Another Day the highest-grossing James Bond film up to that time unadjusted for inflation. MI6 agent James Bond infiltrates North Korean military base where Colonel Tan-Sun Moon is
illegally trading weapons for African conflict diamonds.
Human- written
After Moonš right-hand man Zao is contacted by unknown source who reveals & to his current wealth, celebrity, and philanthropy from its assets. ... At his ice palace adjacent to the diamond mine site in Iceland, Graves unveils new orbital mirror satellite, "Icarus", which is able to focus solar energy a small area and provide year-round sunshine for crop development. Frost seduces Bond and Jinx infiltrates Graves' command centre, but captured by Graves and Zao.
truncation ratio 0.7
to his sudden wealth. Bond then meets Graves face-to-face, and is convinced that he is connected to the diamonds somehow. Bond follows Graves and his assistant, Miranda Frost, to an ice palace in Iceland where Graves unveils new orbital mirror satellite, "Icarus", which is able focus solar energy small area and provide year-round sunshine for crop development. Bond discovers that Graves ...
Overlap 27- grams
GPT-
regeneration
Prefix
Upsilon Andromedae Andromedae b, abbreviated Upsilon And And b). formally named Saffar, is an extrasolar planet approximately 44 light-years away from the Sun in the constellation of Andromeda. The
planet orbits the solar analog star, Upsilon Andromedae A, approximately every five days.
Human- written
Discovered in June 1996 by Geoffrey Marcy and R. Paul Butler, was one of the first hot .... K lanets and their host stars. The process involved public nomination and voting for the new names. In December 2015, the IAU announced the winning name was Saffar for this planet. The winning name was submitted by the Vega Astronomy Club of Morocco and honours the 1thh Century astronomer Ibn al-Saffar of Muslim Spain.
truncation ratio 0.7
lanets and their host stars. The process involved public nomination and voting for the new names. December 2015, the IAU announced the winning name was Saffar submitted by the people of Morocco.
Overlap 26- grams
GPT- regeneration
23

---

Published as a conference paper at ICLR 2024
Table 14: Examples of supporting evidence for classifying the candidate text into GPT GPT-generated text.
Source
Text
Misc
Question
Title: Incorporating human dimensions is associated with better wildlife
Known
translocation outcomes
Human- written
Wildlife translocations are increasingly used to combut declining biodiversity worldwide. Successful.. We find that fewer than half of all px rojects included human dimension objectives (42%), but that projects including human dimension objectives were associated with improved wildlife population outcomes (i.e., higher probability of survival, reproduction, or population growth). Translocation efforts were more likely to include human dimension objectives they involved mammals, species with a history of local human conflict, and local stakeholders. Our findings underscore the importance of incorporating objectives related to human dimensions in translocation planning efforts to improve
truncation
ratio 0.5
conservation success.
rojects explicitly included human dimensions, and those that did were associated with higher success rates, measured by post-release survival and establishment. Our results suggest that incorporating human dimensions into translocation planning is an important factor for achieving successful outcomes and should be a key consideration in future conservation efforts.
GPT- regeneration
ublished translocation cases include human dimensions, and those that do are associated with significantly higher success rates. Our results suggest that incorporating human dimensions, such as community engagement and conflict mitigation, into translocation planning may be effective strategy for improving conservation outcomes. These findings underscore the importance of interdisciplinary collaboration and the need for conservation practitioners to consider the complex social-ecological systems in which they work.
BScore
0.004
Al-written
Wildlife translocations are often utilized as a conservation strategy to mitigate the impacts of human activities ... X incorporation of human dimensions, such as stakeholder engagement and socio-economic considerations, is positively associated with better translocation outcomes. Specifically, translocations that incorporated human dimensions had 1.5 times greater likelihood of success compared to those that did not. Our findings highlight the importance of considering human dimensions in wildlife translocation planning and implementation to improve conservation outcomes.
truncation ratio 0.5
incorporation of human dimensions, such as community involvement and stakeholder communication, is positively associated with higher translocation success rates. Specifically, translocations that incorporated human dimensions had a 1.57 times higher success rate compared to those that did not. Our findings highlight the importance of considering human dimensions in wildlife translocation planning and implementation to enhance conservation outcomes.
GPT- regeneration
incorporation of human dimensions, such as stakeholder engagement and social assessments, is positively correlated with better translocation outcomes. Specifically, translocations that incorporated human dimensions had higher success rate and lower post-release mortality compared to those that did not. Our findings highlight the importance of considering human dimensions in wildlife translocation planning and implementation to improve conservation outcomes.
BScore
0.396
24

---

Published as a conference paper at ICLR 2024
Table 15: Examples of supporting evidence for classifying the candidate text into GPT text.
Source
Text
Misc
Question
Measurement of head and neck paragangliomas: is volumetric analysis worth the effort?
Known
Human- written
Due to a relatively good reproducibility, fast and easy application, we found the linear dimension method to be the most pragmatic approach for evaluation of growth of carotid and vagal body paragangliomas. For K jugulotympanic tumours, the preferred method manual area tracing. However, volumetric changes of these tumours may be of less climical importance than changes in relation to surrounding anatomical structures.
truncation
ratio 0.5
jugular paragangliomas, volumetric analysis may provide additional information due to their more irregular shape and location in close proximity to the skull base. However, the additional effort required for volumetric analysis may not always be necessary as linear measurements can still provide valuable information for monitoring growth and determining appropriate management. Ultimately, the choice of measurement method should based on the specific characteristics of
GPT- regeneration
the paraganglioma and the clinical needs of the patient.
jugulotympanic and intravagal tumors, however, volumetric analysis may provide more accurate information on tumor growth and response to treatment. Despite being more conssinn,,,, volumetric analysis enables precise measurement of tumor volume and can detect changes in tumor size that may be missed with linear measurements alone. Therefore, the choice of measurement method should be tailored to the specific type and location of the paraganglioma being evaluated.
BScore
0.001
Al-written
Volumetric analysis can be a useful tool for measuring head and neck paragangliomas, as it provides a more accurate assessment of tumor size and growth over time compared to traditional linear measurements. However, whether or not it worth the effort depends on the specific case and clinical context. For example, in cases where the tumor is small and not expected to grow sign K ificantly over time, volumetric analysis may not be necessary. On the other hand, in cases where the tumor is large or expected to grow rapidly, volumetric analysis can be valuable for monitoring lumor progression and guiding treatment decisions.
truncation ratio 0.5
Ultimately, the decision to use volumetric analysis should be made on a case-by-case basis, in consultation with a healthcare provider.
ificantly, volumetric analysis may not be necessary. On the other hand, in cases where the tumor is large likely to grow rapidly, volumetric analysis can help guide treatment decisions and assess the effectiveness of interventions. Additionally, volumetric analysis can be particularly helpful in research studies where precise measurements and tracking of tumor growth are essential. Ultimately, the decision use volumetric analysis should be made on a case-by-case basis in consultation with a healthcare provider. ificantly, volumetric analysis may not be necessary. On the other hand, in cases where the tumor larger or has shown signs of growth, volumetric analysis may crucial for monitoring the tumor's progression and volumetric
GPT- regeneration
BScore
0.144
guiding treatment decisions. Ultimately, the decision analysis should be made on a case-by-case basis, taking into account the patient's individual circumstances and the expertise of the medical team.
25

---

Published as a conference paper at ICLR 2024
Table 16: Examples of supporting evidence for classifying the candidate text into GPT-ggnnrraed text.
Source
Text
Misc
Question
Does a 4 diagram manual enable laypersons to operate the Laryngeal
Unknown
Mask Supreme@?
Human- written
manikin laypersons could insert LMAS in the correct direction after onsite instruction by a simple manual with high success rate. This indicates some basic procedural understanding and intellectual transfer in pri K nciple. Operating errors (n 91) were frequently not recognized and corrected (n = 77). Improvements in labeling and the quality of instructional photographs may reduce individual error and may optimize understanding.
truncation
ratio 0.5
mary education. However, it is important note that this type of training may not fully prepare individuals for real-life emergency situations, as there are many factors at play in those scenarios. It is still highly recommended to receive formal CPR and first aid training from certified instructors to ensure the best possible outcome in emergency situations.
GPT- regeneration
training. However, is important note that using an LMA real-life emergency situation can be more challenging due to factors such stress and time pressure. Therefore, is recommended that proper training and practice are undertaken in order to ensure proficiency in the use of I.A emergency situations. Additionally, healthcare professionals should also be aware of the potential complications associated with LMA use and be able to troubleshoot any issues that may
BScore
0.000
arise.
Al-written
No, a 4 diagram manual may not be enough for layperson safely and effectively operate the Laryngeal Mask Supreme The Laryngeal Mask Supreme(0 a medical device used for airway management and requires proper training and certification use. It is typically used by K medical professionals such as anesthesiologists, emergency room physicians, and paramedics who have received specific training and education airway management techniques. It is important to seek proper training and education before allempting use any medical device.
truncation ratio 0.5
medical professionals such as anesthesiologists, emergency room physicians, and critical care nurses who have received extensive training in airway management. Attempting to use the device without proper training and certification can lead to serious injury Therefore, it is essential to receive proper training and certification before using the Laryngeal Mask Supreme@ any other medical device.
GPT- regeneration
death.
trained medical professionals such as anesthesiologists, emergency medical technicians, and nurses who have completed the necessary training and certification to operate the device safely and effectively. Attempting use the device without proper training and certification can lead to serious injury or even death. Therefore, is essential to ensure that only trained professionals use the Laryngeal Mask Supreme@ to ensure the safety of patients.
BScore
0.026
26


Reviews:
[{"review_id": "wSzRY3RQUm", "reviewer": "Reviewer_4FGJ", "summary": "This paper studies the problem of detecting whether a piece of text is generated by human or AI models. The authors proposed a simple method to detect the origin of the text, together with two score functions, for both black-box and white-box detection. The authors conducted extensive experiments, and show their approach outperform the state-of-the-art detecting methods.\n\nAfter rebuttal: I have read the rebuttal and would like to keep my scores.", "questions": "Please see above.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "The paper is generally well-written and easy-to-follow. The method proposed by the authors is conducted in a training-free fashion, which remove the need of training detection classifier on millions of texts. The proposed method is simple and effective: based on the authors evaluation, it outperforms many existing detecting methods.", "weaknesses": "While the proposed method is effective, it not clear how certain terms in the score function is selected---e.g., the f(n) function in BScore. Can authors comment more on that? \n\nAlso, can authors explain a bit more on how P(Y_0 | X) is calculated when Y_0 is human-written text? Does text-davinci-003 allow such calculation?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "pZTaUAH0fW", "reviewer": "Reviewer_UDX7", "summary": "The paper proposes a training-free detection strategy for identifying machine-generated text by an LLM from human-generated text. The method involves truncating the text and feeding the second half to an LLM and analysing the parts through an N-gram analysis. The paper addresses both black-box (probability distribution of LLMs is not known) as well as white-box models (probability distribution is known). The paper shows that the proposed method surpasses SOA performance in distinguishing between machine and human-generated text by evaluating on a number of proprietary (e.g. GPT3+) and open-source(LLAMA, GPT-NeoX) models, on both English and German datasets. The performance is based on the finding that the distribution of machine-generated text and human-generated text are different when given a preceding text. The proposed method also provides explanation and evidence for the prediction, can handle model sourcing and revised text attacks.", "questions": "- Asked above", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- **Significance**: The paper tackles an interesting, relevant problem\n- **Originality**: The proposed mathematical framework used is original\n- **Results**: The results are strong, showing performance improvement over similar detection methods, like GPTZero and OpenAI classifier\n- **Presentation** : The paper has good presentation, and claims follow clearly from experiments", "weaknesses": "- The entire framework is based on the likelihood-gap hypothesis. What is the basis for this assumption? Is this formally acknowledged somewhere else in the literature or verified empirically in this paper (e.g. from Fig 2)? \n- The paper mentions that is able to provide explanations and evidence in the form of n-grams overlaps. Would be good to provide some examples.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UXB0YR0j2P", "reviewer": "Reviewer_FS9z", "summary": "This paper studies the problem of determining whether a block of text comes from LLM or real human beings. Their crucial observation is that if part of the text is fed to an LLM, the output will exhibit certain behaviors that are distinct from human-generated text and simple scoring rules based on KL divergence or total variations is already a sufficiently good classifier.", "questions": "1. is it possible to fix the Delta. \n2. is it possible to build a stronger result, e.g., so long as an LM is trained through certain mechanism, it will always exhibit the likelihood gap hypothesis?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The paper introduced a simple and neat technique to address an important and practical problem in the LLM era. It looks like one of those “one simple trick” result and gives the audience an aha moment.", "weaknesses": "I have mixed feelings about this work. While it is in general quite pressing to understand the structure of GPT/LLM, and the authors indeed made some interesting observations, they seem to be quite explicit that they do not care about the execution quality. For example, Delta should be lower bounded but not upper bounded in order to justify using KL divergence/Total variations (smells like a doable fix to provide the other side of inequality; I dont know). In general there is a feeling that the problem is not studied thoroughly.  IMO, another major limitation is that if we dont know which model is used to generate the text. In general, one is most interested in determining whether a block of text is from some LLM, not a specific collection of 5-10 widely available models.\n\n-----\nupdated: \n\nI read the rebuttal that clarifies my misunderstanding. The current logic in the paper flows as \"let's introduce llh gap, then llh gap implies KL large, then let's forget about KL because it is hard to compute/estimate and go back to llh gap\"; some text in rebuttal appears to be more clear to me. \n\nAlso, it would be helpful to discuss more on why KL estimation is harder than llh gap (as both are effectively relating human and machine distributions) like llh requires smaller sample from human. Nevertheless, I think in general the paper is above iclr bar.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)