Raidar: geneRative AI Detection viA Rewriting
Authors: Chengzhi Mao
Carl Vondrick
Hao Wang
Junfeng Yang
Venue: ICLR 2024 poster (2024)
Keywords: Machine-generated text
Detection
Trustworthy AI
Primary area: representation learning for computer vision, audio, language, and other modalities
TL;DR: We find large language models (LLMs) are more likely to modify human-written text than AI-generated text when tasked with rewriting. We propose a simple and robust approach to detect them via editing distance.

Abstract: We find that large language models (LLMs) are more likely to modify human-written text than AI-generated text when tasked with rewriting. This tendency arises because LLMs often perceive AI-generated text as high-quality, leading to fewer modifications. We introduce a method to detect AI-generated content by prompting LLMs to rewrite text and calculating the editing distance of the output. We dubbed our geneRative AI Detection viA Rewriting method Raidar.  Raidar significantly improves the F1 detection scores of existing AI content detection models -- both academic and commercial -- across various domains, including News, creative writing, student essays, code, Yelp reviews, and arXiv papers, with gains of up to 29 points. Operating solely on word symbols without high-dimensional features, our method is compatible with black box LLMs, and is inherently robust on new content. Our results illustrate the unique imprint of machine-generated text through the lens of the machines themselves.

Published as a conference paper at ICLR 2024
RAIDAR: GENERATIVE AI DETECTION VIA REWRIT- ING
Chengzhi Mao' & Carl Vondrick' & Hao Wang² & Junfeng Yang' Columbia University* Rutgers University?
ABSTRACT
We find that large language models (LLMs) are more likely to modify human- written text than Al-generated text when tasked with rewriting. This tendency arises because LLMs often perceive Al-generated text as high-quality, leading fewer modifications. We introduce a method to detect Al-generated content by prompting LLMs to rewrite text and calculating the editing distance of the out- put. We dubbed our geneRative AI Detection viA Rewriting method Raidar. Raidar significantly improves the Fl detection scores of existing Al content de- tection models both academic and commercial across various domains, in- cluding News, creative writing, student essays, code, Yelp reviews, and arXiv papers. with gains of up 29 points. Operating solely word symbols without nigh-dimensional features, our method compatible with black box LLMs, and is inherently robust on new content. Our results illustrate the unique imprint of machine-generated text through the lens of the machines themselves.
INTRODUCTION
Large language models (LLMs) demonstrate exceptional capabilities in text generation Cha 2023 Brown et al. 2020 Chowdhery et al. 2022), such as question answering and executable code gener- ation. The increasing deployment and accessibility
those LLM also pose serious risks (Bergman et al. 2022 Mirsky et al. (2022). For example, LLMs create cybersecurity threats, such as facilitat- ing phishing attacks (Kang et al. 2023), generating propaganda (Pan et al.) (023). disseminating fake or biased content on social media, and lowering the bar for social engineering (Asfour & Murillo, 2023]. In education, they can lead to academic dishonesty (Cotton et al. 2023). Pearce et al. (2022);
Siddiq et al. (2022) have revealed that LLM--generan code can introduce security vulnerabilities to program. Radford et al. (2023); (Summailov et al. (2023) also find LLM-generated content is inferior to human content and can contaminate foundation models' training. Detecting and auditing those machine- seneireegeeerrtee text will thus be crucial to mitigate the potential downside of L.Mss.
A plethora of works have investigated detecting machine machine-generated content (Sadasivan al. 2023) Early methods, including [Bakhtin et al. (2019); |Fagi et al. (202T); Gehrmann et al. (2019): Ip- polito et al. 2019);: Jawahar al. (2020),
effective before the emergence of sophisticated GPT
models, yet the recent LLMs have made traditional heuristic- based detection methods increasingly inadequate Verma et al. (2023); Gehrmann et al. (2019). Current techniques (Mitchell et al. 2023
Verma et 2023) rely on LLM's 's numerical output metrics. Gehrmann et al. (2019): Ippolito et al. ; Solaaman al. (2019) use token log probability. However, those features are not available in black box models, including state-of-the-an -fttt--rrt ones (e.g.. GPT-3.55 and GPT-4). Furthermore, the high- dimensional features employed by existing methods often include redundant and spurious attributes, leading the model to overfit to incorrect features.
In this paper, we present Raidar, a simple and effective method for detecting machine- generreee text by prompting LLMs to rewrite it. Similar to how humans prompt LLMs for coherent and high- quality text generation, our method uses rewriting prompts to gain additional contextual information about the input for more accurate detection.
Our key hypothesis is that text from rugorsegeessive generative models retains a consistent structure, which another such model will likely to also have low loss and treat it high quality. We observe that machine-generatte text is less frequently altered upon rewriting compared to Hamann-wiiter text, regardless of the models used; see Figure T as an example. Our approach Raidar shows how

---

Published as a conference paper at ICLR 2024
Input: Yelp Review
Concise this for and keep all the information:
Rewriting Output
Ok yeah, the service can
high
Despite the slightly pretentious service and long wait, this restaurant underiabll serves the best burger you will ever laste.
Human
falutin,, and the wail is painful but this THE BEST BURGER EVER. That's you need to know. The BEST.
GPT-3 3......- G-Turbo
Despite the pretentious service and long wait, this place serves the absolute best burger. That's you need know.
Despite pretentious service and long wait, this place serves the best burger you'll ever
GPT
Figure I: We introduce "Detecting via Rewriting," an approach that detects machine-generatie text by calculating rewriting modifications. We show the character deletion in red and the character inser- tion in orange. "luman-generaten text tends to trigger more modifications than machine-generated text when asked to be rewritten. Our method is simple and effective, requiring the least access to LLM while being robust to novel text input.
to capitalize on this insight to create detectors for machine-generated text. Raidar operates on the symbolic word output from LLMs, eliminating the need for deep neural network features, which boosts its robustness, generalizability, and adaptability. By focusing on the character editing distance between the original and rewritten text, Raidar is semantically agnostic, reducing irrelevant and spurious correlations. This feature-agnostic design also allows for seamless integration with the latest LLM models that only provide word output via API. Importantly, our detector does not require the original generating model, allowing model A to detect the output of model B.
Visualizations, empirical experiments show that our simple rewriting- algorithm Raidar sig- nificantly improves detection for several established paragraph- leeeel detection benchmarks. Raidar advances the state-of-the-arr detection methods (Verma al.) [023] Mitchell et al., (023) by up to 29 points. Our method generalizes to six different datasets and domains, and it is robust when detecting text generated from different language models, such as Ada, Text-Davinci-Oue and GPT-3.5, even though the model has never been trained text generated from those models. In addition, our detection remains robust even when the text generation is aware of our detection mechanism and uses tailored prompts bypass our detection. Our data and code is available https: : http://ittttttt com/ cv ab co hto.ummma//aiiiaiiiittttee..
Claude,
2 RELATED WORK
Machine Text Generation. Machine generated text has achieved high quality model im- proves [Rafford et al. 2019 Li al. 2022 Zhou et al. 2023 Zhang et al. 2022: Gehrmann et al. 2019 Brown al. 2020: Chowdhery et al. (022). The release of ChatGPT enables instructional Jawahhawahar
following text synthesis for the public Chal (203). (Dou et al. 2021; Jawahar et al.) 2020) demon- strate that machines potentially leave distinctive signals in the generated text, but these signals
can be difficult to detect and may require specialized techniques.
Detecting Machine Generated Text. Detecting Al-generated text has been studied before the gence of LLM (Bakhtin et al. 2019 Fagni et al., 2021 Gehrmann et al. 2019 Ippolito et al. 2019). Jawahar et al. (2020) provided a detailed survey for machine-generatce text detection.
The high quality of recent LLM generation makes detection to be challenging (Verma et al., 2023
Chakraborty al. (2023) studies when it is possible to detect LLM-ggnnrated content. Tang et al. (2023) surveys literature for detecting LLM generated texts. Sadasivan et al.) (202)) show that the detection AUROC is upper bounded by the gap between the machine text and human text. The state-of-the-ar LLM detection algorithm (Verma et al. 2023 Mitchell et al. (023) requires access to the probability and loss output from the L.M for the scoring model, yet those numerical metrics and features are not available for the latent GPT-3.55 and GPT-4. Mitchell et al. (2023) requires the
scoring model and the target model to be the same. Ghostbuster (Verma et al. 2023) operates under the assumption that the scoring and target model are different, but it still requires access to generated documents from the target model. In addition, the output from the above deep scoring models can contain nuisances and spurious features, and can also be manipulated by adversarial attacks (Jin) jet al. 2019 Zou et al. 2023), making detection not robust. Another line of work aims to watermark the Al Al-generaeed text to enable detection (Kirchenbauer al. 2023)
2

---

Published as a conference paper at ICLR 2024
Hitogron Novting Cansitery
Higggan Nerting Canenneyy
Hicogaan of Bear Dng Leammrty
(a) Invariance
(b) Equivariance
(c) Uncertainty
The rewriting similarity score of human and GPT-generated text. The similarity score measures how similar the text is before and after the rewriting. A larger similarity score indicates that rewriting makes less change. (a) We show the similarity score under a single transformation; geeeine-generated text (red) is invariant after rewriting compared with gumaan-eeeeatedd text. (b) We show the similarity score under a transformation and its reverse transformation; the machine- generated text is more equivariant under transformation. (c) We show the uncertainty of text pro- duced by humans and GPT. GPT input is more stable than human input. The samples are run on the Yelp Review dataset with 4000 samples. The discrepancies invariance, equivariance, and output uncertainty allow us detect machine-generann text.
Figure 2:
Bypassing Machine Text Detection, Krishna et al. (2023) showed rephrase can remove watermark.
Krishna et al. (2033; Sadasivan al. (2023) show that paraharase efficiently evade detection, including DetectGPT (Mitchell et al.) 2023), GLTR (Gehrmann et al.] 2019), OpenAl's generated text detectors, and other zero-shot methods Ippolito et al. (2019); /Solaiman et al. (2019). There is line of work that watermarks the generated text to enable future detection. However, they are shown be easily broken by rephrasing. too. Our detection can be robust to rephrasing.
Prompt Engineering. Prompting is the most effective and popular strategy to adapt and instruct LLM to perform tasks [i & Liang (202T); ZZou el. (2022); Wei et al. (022))/Kojimm) Zero-shot GPT prompts the GPT model by asking "is the input generated by GPT to predict if this is GPT generated (Verma et al. 2023). However, since GPTs are not trained to perform this task, they struggle. In contrast, and equivariance of the input. While we can also perform an optimization- based search for better prompt (Zhou et al. 2022). we leave this for future work.
al. (2022).
work constructs few rewriting prompts to access the inherent invariance
3 DETECTING MACHINE GENERATED TEXT BY REWRITING
We present our approach Raidar for detecting large language models generated text via rewriting. We first talk about the rewriting prompt design to access the property of the input text, then introduce our approach that detects based on the output symbolic modifications.
3.1 REWRITING TEXT VIA LANGUAGE MODELS AND PROMPTS
Let F(-) be a large language model. Given an input text x, our goal is classify the label y, which indicates whether it is generated by machine. The key observation of our method is that given the same rewriting prompt, such as asking the LLM model to "rewrite the input text," an LLMttritten text will be accepted by the language model as a high-qualip input with inherently lower loss, which leads to few modifications at rewriting. In contrast, a aaman--ritten text will be unfavoured by LLM and edited more by the language models.
We will use the invariance between the output and the input to measure how much LLM prefers the given input. We hypothesize that LLM will produce invariant output when rewriting its own gen- crated text because another ruto-segressive prediction will tend to produce text a similar pattern. We define this property the invariance property.
Invaraince.
Given data x, we apply transformation to the data via prompting the LLM with prompt If the data is produced from LLM, then the transformation that aims rewrite the input should introduce a small change. We construct the invariance measurement as = D(F (F((p. x). x), where D(.) denotes the modification distance.
3

---

Published as a conference paper at ICLR 2024
Human
GPT
Input
Rewnit
repuittone
woapptd privil sucter unkos the sorensattionn bully arges itr rpproucc tnmmddimaly? allance addde.
the offooos wult ictonn and milotr accoslatio fou or the Aillioo
News
puvossnes the risannoa ailierntation betnown dre andrange market and the over the- wkih comrossted hod the Bunko of How Yort.
Prosenn the hasoiial diroroidaion beteees the undreagg soalect the one the Jacobacr, affo supopettedd the Barls Now York
my
The hao englgged in heated eamhange, thiir coline ow owcedborring in my wont. They dieected ther ongger saa throwengg acctsatory words my recctiin, Semutannoual they insults,
tinkked then out and cimic an
Creative Writing
commontinn instictively tuned out thair volois, shotthng ng my ipno and concantzit og on regain
unlording
formm
(hoought you supertersss wore coudl dbuggee suit?? Do Flyye Friiteed
Hhooggh apaahwow about those expers designer autu?' Defrayme Ne hested ningoodd
oxpaiierral studes to devico a clecee and rovel "curewon of effecte of ploooiil represer tatton tranel and toutem wabeites hrom gender perppectivs. with a tope
stadles to pinia loe our and mo of the in of aocal represstation travel foudam watnite spec nem augander parsactiio The am
mimen
these nave been dona to Whicets bie ahachher ais eva cation la presented an moloving by 2005, theme ware papere pup lihe that deec tourtim manseting on internet and difiront
Acpropriate metheds ogges this regant, concha no wew pre ous meeeacc
approechen used tnakure webete atecchveness
tospraliyy and tourtm pepers
systeme, Wie analysts model and no which ware used evaiutte une the contert of indingg
publated 2005 lacusing in focram marketing on the intemet These picers Ereseecch opproxchos inlucing
hoop ty and four dlss webssts laaadd
Scorcoedd raing
wal andbyiis
These cnibooologie
Student Fsoay
the content or hoapts ia and lount distrat on wabeites
Orpanio Gaviing agrisut pooeicc
the
Orgaci famming an agrocuheat pracsio that proccosss the use sanupt sothook of
thit
use ttettic chemdsa herr, pesthilee and
geisocaayy reudhic oiganism (BleOO)) They pric Sou his yas aod popolecty in nooe Sinee
genetially erodl You' oxganiinss 15M40l 7his puicicc kil galled Coall populiity
promecioo
moaet lymes diee
anvrommery costenntion and promoction heats
organieally present cartin chaneege temmns, particuarty
manoariing y sconamio puils wnbie using oegin by corifed wat mama ood
big coanomice priboo while thoiig orgerio dart
divi to
fertitt bhe enayy ree checuee the challerpes and by organe prowers
unceerinng cconamic wail wilk using oegani is restiads and fow corves resionall urubbcrr
change their prichier aechrase the mee perceser seperte one production
conventocal producers cas mosey their prechoer embrace the the ponobsee of oegantc
crup pnoductiion Ad y
the shotog is end andi orgenic growors
rubient lovelo to theer copo and the adhanaago and alsaiinnnigg using siffores
zourcne exnantia evements organis hirming
de deachattoger of wsin chtiaen soureee of ansennto alersants to organic derming
tnd:
def tng. 3
de t76
ner g
for iin ranget (n-
WIMG
rempett de1l
nangett -10
eimitange (ivt)) for (1e
n-11)
Codo
fer) (n
factooaal 7 Kor Invaggee fedy e0t www.ppoaaaaccoo
for oiroet I+gy borinda boy ret aaappprn/hatorrggggg
Auctooll
ranget T
Junn of Lumbbwa summangert,
rot >- (x]
sun of Aumooe d varggee 25
recappenolpumm.o of numberd) return out
THE www.gpanndiaar.cco of pumbbrr))
Really plice peciiaull People, Minnd and is relocnng revineemnnt twitiilly recomee itlf you aw nokling for cwn't piace to get your town donel
Highty incommneed this clenn and rnd eding for Wordy and eniyystle (idi: accerance
Yep Redww
salkngg
expertene.
place
releving peckaaee
blacsly
great anteanon
stul and poecr aribance
Genacehe movdeling the hown unee eieeuently in eartheeli rots provention -friimees ned
Genwett un mocwiing how inoguettly torm worployed tor systheri 29th groention inkon
piivacy bog cencaam synthaii duil.. Acchoggh Pocceé rBA44 I.
digni comoerts rogind tumeno und pir Whf GAN
goodt
soppreeniingg priwerg
wing neintr
the genareset duta may be more trizadd All the aame aimec tthea resthdd secuins Hig camp
prozen valorr the neuuting data mep be led inom saed tr Miroois thow oas
aurbadd, retiood thoordicng ampottoall
penication metivol We show that wettertteeeee
far Seddiil and
We ahoo that moddaaiitaa itained on data generstee by the propeaed mit hod can perform aodl aatagee
Thro gi Enginiieal and amprncal and you we showosss the effectonnsaa of our muthod.
sporouch avcid mork ication
Andv
PVDS,
grswerte renveiigg a Youn da thimess and prineyy Tegpes the coe mon unkiig of
genensh modtiing soma cnd thcos on Deveer and prictcy Gesple the witn
gaowaahhe reodadigg for aetthaic cats penscatton concegte tutruae paivacy rare
of peneratee reddiing synthate care ganaration sttenton benn A5100
and
diimeds
the
muttod for generaing cate that achore io betn femoss ano preacy precppass The
kat and offewent mithed for persersiigg deda that comoic both turnra and priocc
propoaed anp macn holic prorebe in enabiing reasarchers and data spuntaa cononade
prreppiis The poopoaed spareach ihdis promtbe in empoowiing ing masershere and
loswehhll this adhancing the Bedd towards more athical and ioolaive dats penerstion prachoos.
soleedioe
atblased oi lit also coburto inchwidvl privcc This cchompomon almu to peopol the heid dale generaoon
toaakd mice ohhical volusive
Figure 3: Examples of text rewriting on six datasets for invariance. We use a green background to indicate
text, and a red background to indicate machine- machine-generated text. We show the character deletion in red and the character insertion in orange. Human-writte text tends to be modified more than machine-generatee text. Our detection algorithm relies on this difference to make predictions.
We manually create the prompt p access this invariance. We do not study automatic ways to generate prompts Zhou et al. (2022) Li & Liang (202I), which can be done in future work by optimizing the prompt. In this work, we will show that even single manually written prompt can achieve a significant difference in invariance behavior. We show a few of our prompts here:
1. Help me polish this:
2. Rewrite this for me:
3. Refine this for me please:
where the goal is to make LLM modify more when rewriting human text and be more invariant when modifying I.L.M-geerrted text.
4

---

Published as a conference paper at ICLR 2024
Human
GPT
Input
Transformed
7- Reversal
suul can lawe work. They tare Thes and other parts you won't i find anywhere dlso.
iis cleat hadser fen work They can'tt have free tther pants you can anywhere eise.
know puppette about averytee cleaity lovee work They have on abundart selection of lins wide rarge unique parts that you won't find elorwhen..
The shop is fantastic with momissgeable and passionats owner They offer unluue thes and parto found absontoo..
The shop mecioore with an Ipnovant and inalitevent owner
The shop is caccodfact with Anowledpeable and oith (00 owner They unique tied and parts not found wisemtor..
They offe generic ares and parts found evdryanoe dlte.
Figure 4: Examples for equivariance. We show an example on the Yelp Review dataset. For sim- plicity, we use identity transformation and use the "opposite meaning" as the cquivariance trans- formation T. GPT data tends to be consistent to the original input after transformation and reversal.
In addition, we hypothesize that GPT data will be equivariant the data generated by itself. Equivariance means that, if we transform the input, perform the rewriting, and undo the transformation, it will produce the same output as directly rewriting the input.
Equivariance.
We achieve the transformation for large language models by appending prompt T to the input and asking the LLM to produce the transformed output. We denote the reversal of the transformation as T-1, which is another prompt that writes in the opposite way T. Equivariance can be measured by the following distance: I. = (TF(T-1, F(p, x)),
Here we show two examples for the equivariance transformation prompt T and T-1;
T: Write this in the opposite meaning:
T-1: Write this in the opposite meaning:
T: Rewrite to Expand this:
T-1: Rewrite to Concise this:
By rewriting the sentence with the opposite meaning twice, the sentence should be converted back to its original the LLM equivariant to the examples. Note that this transformation T is based on the language model prompt.
Output Uncertainty Measurement. We also assume that LLM-generated text will be more stable, when asked to rewrite multiple times than human-written text. We thus explore the variance of the output as a detection measurement. Denote the prompt to be p. The k-th generation results from LLM would be x F(p,x) Due to the randomness in language generation, x' will be different. We denote the editing distance between two outputs and B as D(A, B). We construct the un- certainty measurement as:U = Σ Σ D(x(, x/). Note that, in contrast to the invariance and equivariance, this metric only uses the output, and the original input is not in the calculation of the output uncertainty.
3.2 MEASURING CHANGE IN REWRITING
We treat the output of LLM as symbolic representations that encode information about the data. In contrast to Mitchell et al. (2023); Verma al.] (2023), our detection algorithm does not use contin- uous, numerical representations of the word tokens. Instead, our algorithm operates totally on the discrete, symbolic representations from the LLM. By prompting LLM, our method obtains addi- tional information about the input text via the rewriting difference. We will show how measure the rewriting change below:
Bag-of-wordd wwods edit. We use the change of bag-of-worde to capture the edit created by LLM. We compute the number of common bags of n-words divided by the length of the input.
Levenshtein Score. Levenshtein score (Levenshtein 1966) is popular metric for measuring the minimum number of single-character edits, including deletion and addition, to change one string to the other. We standard dynamic programming to calculate the Levenshtein distance. A higher score denotes the two strings are more similar. We use Levenshteinf A, B) to denote the edit distance between string A and B. Let the rewriting output S3 F(Pk, x). We obtain the ratio via:
Dx(x, st) = 1 Levenshtein (s;,
max(len len(x)
We use ratio because the feature of editing difference should be independent of the text length. The invariance, equivariance, and uncertainty measured by the above metric will be used features for
5

---

Published as a conference paper at ICLR 2024
Fl score for detecting -ennrrated paragraphs. The results are in domain test- ing, where the model has been trained on the same domain. We bold the best performance on in- distribution and out-of-distribution detection. Our method achieved over 8 points of improvement over the established state-of-the-art.
Table 1:
Datasets
Creative Writing
Student Essay
Yelp Reviews
Arxiv
Methods
News
Code
Abstract
GPT Shott Verma al.
(023
54.74
20.00
52.29
62.28
66.34
65.94
GPTZero (Tian 2023)
49.65
61.81
36.70
31.57
25.00
45.16
MitectGPTMMichher al.
2023
37.74
59.44
45.63
67.39
69.23
66.67
Ghostbuster Verma et al.
2023)
52.01
41.13
42.44
65.97
71.47
76.82
Ours (Invariance)
60.29
62.88
64.81
95.38
87.75
81.94
Ours (Equivariance) Ours (Uncertainty)
58.00
60.27
60.07
80.55
83.50
75.74
60.27
60.27
57.69
77.14
81.79
83.33
Table 2: Fl score for detecting machine- machine-gemerated paragraph following the out-of-distribution set- ting in Verma et al. (2023). We use logistic regression classifier for all ours. Our method achieved over 22 points of improvement over the established state-of-the-ar
Datasets Creative Writing
Methods
News
Student Essay
Ghostbuster Verma et al. (2023)
34.01
49.53
51.21
Ours (Invariance)
56.47
55.51
52.77
Ours (Equivariance)
56.87
59.47
51.34
Ours (Uncertainty)
55.04
52.01
47.47
a binary classifier, which predicts the generation source the text. For details of the algorithm, please refer to Appendix A.3
Our design enjoys several advantages. First, since we only access the discrete token output from LLM, algorithm requires minimal access to the LLM models. Given that the major state-of- the-art LLM models, like GPT-3.5-turbo and GPT-4 from OpenAI, are black-box models and only provide API for accessing the discrete tokens rather than the probabilistic values, algorithm is general and compatible with them. Second, since our representation discrete, is more robust the sense that will be invariant the perturbations and shifting in the input space. Lastly, our symbolic representations enable us to construct the following measurements that are none differen- tiable, which introduces extra burden and cost for gradient-bar based adversarial attempts bypass our detection model.
RESULTS
We conduct experiments on detecting Al-generated text paragraph level and compare it to the of the art. To further understand factors that affect detection performance, we also study the robustness of our method under input aiming to evade our detection, detection accuracy text generated from different LLM sources, and evaluate our method with different LLM for rewriting.
4.1 DATASET
To evaluate approach to the challenging, paragraph-level muchine-generatee text detection, experiment with the following datasets.
Creative Writing Dataset is language dataset based the subreddit WritingPrompts, which is creative writing by a community based on the prompts. We use the dataset generated by Verma et al. 2023
We focus detecting paragraph-level data, which is generated text-davinei-003.
News Dataset is based on the Reuters 50-50 authorship identification dataset. We use the machine- generated text from Verma al. 2023) via text-davinci-003.

---

Published as a conference paper at ICLR 2024
Table Performance under adaptive prompts aiming evade our detector. In the "Single Training Prompt" column, the detector is trained on non-adaptive prompt and tested against both the same prompt and two evasive prompts. Adversarial rephrasing can bypass our detector. In "Multi Training Prompt*", the model is trained using two prompts and tested on third, different prompt. The last two rows shows results under adaptive prompts to evade our detection. Training on multiple prompts enhances our detector's robustness against machine-generatee inputs attempting evasion.
Single Code
Training Prompt Yelp
Multi Training Prompt* Code
Test Prompt
Arxiv
Yelp
Arxiv
No Adaptive Prompt
95.38
87.75
81.94
92.76
58.04
82.25
Prompt to bypass detection
34.15
61.38
43.81
86.95
69.19
91.89
Prompt 2 to bypass detection
25.64
61.38
50.90
88.88
73.23
93.06
Student Essay Dataset The dataset is based on the British Academic Written English corpus and generated by Verma et al. (2023).
Code Dataset. The goal is to detect the Python code has been written by GPT, which can be important for education. We adopt the HumanEval dataset (Chen et al.) 2021) the human-written code, and ask GPT-3.5-turbu to perform the same task and generate the code.
Yelp Review Dataset. Yelp reviews tend to be short and challenging to detect. We use the first 2000 human reviews from the Yelp Review Dataset, and generate concise reviews via GPT-3.5-turbo in similar length the human written one.
Arx Paper Abstract. We investigate we can detect GPT written paragraphs in academic papers. Our dataset contains 350 abstracts from ICLR papers from 2015 to 2021, which human-writte texts since ChatGPT was not released then. We use GPT-335-turbo to generate an abstract based on the paper's title and the first 15 words from the abstract.
4.2 BASELINES
performs detection by directly asking GPT if the input is written by GPT not. We use the same prompt Verma et (2023) query GPT.
GPT Zero-shot (Verma et al. 2023)
GPTZero Tian 2023 is an commercial machine text detection service.
DetectGPT Mitchell al. 2023) is the state-of-the-art thresholding approach detect GPT- generated text, which achieved 99-point performance over longer input context, yet its perfor- mance on shorter text is unknown. It thresholds the curvature of the input to perform detection. We use the facebook/opt-2.775 for the scoring model.
Ghostbuster (Verma et al. 2023) the ofte-offtheearr classifier for machine generated text de- tection. It uses probabilistic output from large language models as features, and performs feature selection to train an optimal classifier.
4.3 MAIN RESULTS
We use GPT-3.5- Turbo as the LLM to rewrite the input text. Once we obtain the editing distance fea- ture from the rewriting, we use Logistic Regression (Berkson 1944) or XGBoost (Chen Guestrin, 2016) to perform the binary classification. We compare our results on three datasets from Verma ct al. (2023), as well as our created three datasets, Table [5] Our method Raidar outperforms the Ghostbuster method by up 29 points, which achieves the best results over all baselines. In Table we follow the disti---ist (OOD) experiment setup in Verma et al. 2023), where we trained the detection classifier our method still improves by up to 32 points, demonstrating the effectiveness of our approach over prior methods.
dataset and evaluated the other. For the OOD experiment,

---

Published as a conference paper at ICLR 2024
Table 4: Robustness in detecting outputs from various language models. Using the same GPT-3.5- Turbo rewriting model, we present Fl detection scores for detecting from five generation models across three diverse tasks. In the in-distribution experiment, detectors are trained and tested on the same model. For out-of-distribution, detectors are trained on text from other generators. Overall, our method effectively detects machine-generate text in both scenarios.
Raidar (Ours)
DetectGPT
LLM Model Used for Text Generation
In Distribution
Out
Distribution
Code
Yelp
arXiv
Code
Yelp
arXiv
Code
Yelp
arXiv
Ada Text-Davinci-002
96.88
96.15
97.10
62.06
72.72
70.00
67.39
70.59
69.74
84.85
65,80
76.51
75.41
51.06
60.00
66.82
71.36
66.67
GPT-3.5-turbe
95.38
87.75
81.94
91.43
71.42
48.74
67.39
69.23
66.67
GPT-4-turbo
80.00
83.42
84.21
83.07
79.73
74.02
70.97
66,94
66.99
I.LaA
98.46
89.31
97.87
70.96
89.30
74.41
68.42
67.24
66.67
Table 5: Effectiveness of detection using various large language models for rewriting. We present de- tection Fl scores for the same input data rewritten by Ada, Text-Davinci-002. and GPT-3.5. Among these, GPT-3.5-turbo yields the highest performance in rewriting for detection.
LLM for Rewriting
Datasets Student Essay
News
Creative Writing
Code
Yelp
Arxiv
Ada -ext-Dainni-002
55.73
62.50
57.02
77.42
73.33
71.75
55.47
60.59
58.96
82.19
75.15
59.25
GPT 3.5 turbo
60.29
62.88
64.81
95.38
87.75
81.94
LLaMA 2
56.26
61.88
60.48
85.33
74.85
72.59
4.4
ANALYSIS
Detection Robustness against Rephrased Text Generation to Evade Detection. Krishna et al. Sadasivan et al. (2023) show that paraphrasing can often evade detection. In Table 15 show that our approach can detect GPT text when they are not adversarially rephrased. However, sophisticated adversary might craft prompts for GPT such that the resulting text, when rewritten, undergoes significant changes, thereby evading our detection. We modify the GPT input using the following rephrases:
2023
1. Help me rephrase it in human style 2. Help rephrase it, so that ancther GPT rewriting will cause Lot of modi fications
TrbleB]s that while our detector, trained on the default single prompt data, can be bypassed by adversarial rephrasing (left columns). In the right columns, we show results when trained on two of the prompts and tested the remaining prompts. The detectors are trained multi-prompt data, which enhances its robustness. Even when tested against unseen adversarial prompts, our detector content designed clude it, achieving up 93 points on Fl score. One exception is on the Yelp dataset; the "no adaptive prompt" has lower performance on "multiple training prompts" than "single training prompts". We suspect it due to the Yelp dataset introducing a larger data difference when prompted differently, and this "multiple training prompts" setup will decrease performance due to training and testing on different prompts. In general, results in Table demonstrate that with proper training, our method can be still robust under rephrased text to evade detection, underscoring the significance of diversifying prompt types when learning our detector.
still identifies machine-generatte
Source of Generated Data. In main experiment, train detector text generated from GPT-3.5. We study if our model can still detect sethine-gennrated text when they are generated from different language model. In Table 4 conduct experiments text generated from Ada, text-davinci-002. and GPT-3.5 model. For all experiments, we use the same GPT-3.5 to rewrite.
For in-distribution experiments, train the detector on data generated from the respective language model. Despite all rewrites being from GPT-3.5, we achieved up to 96 score points. Notably, GPT-3.5 excels at detecting Ada-generated content, indicating method's versatility in identifying
8

---

Published as a conference paper at ICLR 2024
beert 190
mieee chaege Enstimery
coen knen inforaatio
Beonn de you see
datlo nee
Becie cader
Help
tie ding
imsance
Aciiestii
Aeto
(a) Code
(b) Yelp
(c) ArXiv
Figure 6: Performance of individual prompt. Different prompts used during rewriting can have significant impact on the final detection performance. There is no single prompt that performs best across all data sources. With single rewriting prompt, we can obtain up to 90 points of detection Fl score.
both low (Ada) and high-quality (GPT-3.5) data, even they are generated from different model. We also evaluate our detection efficiency on the Claude (Anthropic) 2023) generated text on student essay (Verma et al. 2023), where we achieve an Fl score of 57.80.
In the out-of-distribution experiment, we train the detector on data from two language models, as- suming unaware that the test text will be generated from the third model. Despite a performance drop detecting the out-of-distribtiio test data generated from the third model, our method re- mains effective in detecting content from this unseen model, underscoring our approach's 's robustness and adaptability, with up 91 points Fl score.
Type of Detection Model. Mireshghallah et al. (2023) showed that model size affects performance in perturbation-based detection methods. Given the same input text generated from GPT-3.5, We explore ap- proach's efficacy with alternative rewriting models with different size. In addition to using the costly GPT-3.5 to rewrite, we incorporate two smaller models, Ada and Dext-Davinci-002, and evaluate their detection perfor- mance when they are used to rewrite. In Table [ while all models achieve significant detection performance, our results indicate that larger rewriting language model en- hances detection performance in our method.
Wd CPT Detsciion
3.3
200
Impact of Different Prompts. Figure 6 displays the de- tection Fl score for various prompts across three datasets. While Mitchell et al. (2023) employs up to 100 perturba- tions to query LLM and compute curvature from loss, our approach achieves high detection performance using just a single rewriting prompt.
Figure 5: Detection performance as input length increases. On the Yelp dataset, we show that longer input often enables better detection performance. The number shows the number of data, reflecting by the size of the dot.
Impact of Content Length. We assess our detection method's performance across varying input lengths using
the Yelp Review dataset in Figure Longer inputs, general, achieve higher detection perfor- mance. Notably, while many algorithms fail with shorter inputs (Tian) 2023 Verma et al.) 2023), our method can achieve 74 points of detection Fl score even with inputs as brief as words, highlighting the effectiveness of our approach.
CONCLUSION
We introduce Raidar, approach to use rewriting editing distance to detect machine-generann text. Our results demonstrate improved detection performance across several benchmarks and state- of-the-art detection methods. Our method is still effective when detecting text generated from novel language models and text generated via prompts that aim to bypass our detection. Our findings show that integrating the inherent structure of large language models provide useful information to detect text generated from those language models, opening up a new direction for detecting machine- generated text.

---

Published as a conference paper at ICLR 2024
REFERENCES
Chatgpt: Optimizing language models for dialogue, 2023. URL attps://chatt hptp://aa.aa........... com.
Anthropic, 2023. URL https: htttps://www.anteeet www.:ww.........ooo htt.:aaaarrrppc..co//rrrdddadddd
Mohammad Asfour and Juan Carlos Murillo. Harnessing large language models simulate re- alistic human responses to social engineering attacks: A case study. International Journal of Cybersecurity Intelligence & Cybercrime, 6(2):21 1-9,, 2023.
Anton Bakhtin, Sam Gross, Myle Ott, Yuntian Deng, Marc' Aurelio Ranzato, and Arthur Szlam. Real fake? learning discriminate machine from human generated text. arXiv preprint arXiv:1906.03330 00335,,,,,,,,,,,....... 2019.
A Stevie Bergman, Gavin Abercrombie, Shannon Spruit, Dirk Hovy, Emily Dinan, Y-Lan Boureau, Verena Rieser, et Guiding the release of safer e2e conversational ai through value sensitive design. In Proceedings of the 23rd Annual Meeting of the Special Interest Group on Discourse and Dialogue. Association for Computational Linguistics, 2022.
Joseph Berkson. Application of the logistic function to bio-assay. Journal of the American Statistical Association, 39(227):357-363 1944.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33:1877-1901, 2020.
Souradip Chakraborty, Amrit Singh Bedi, Sicheng Zhu, Bang An, Dinesh Manocha, and Furong Huang. On the possibilities of ai-generated text detection. arXiv preprint arXiv:2304.04736, 2023.
Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde de Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, Alex Ray, Raul Puri, Gretchen Krueger, Michael Petrov, Heidy Khlaaf, Girish Sastry, Pamela Mishkin, Brooke Chan, Scott Gray, Nick Ryder, Mikhail Pavlov, Alethea Power, Lukasz Kaiser, Mohammad Bavarian, Clemens Winter, Philippe Tillet, Felipe Petroski Such, Dave Cummings. Matthias Plappert, Fo- tios Chantzis, Elizabeth Barnes, Ariel Nosss,t-Voss, William Hebgen Guss, Alex Nichol, Alex Paino, Nikolas Tezak, Jie Tang. Igor Babuschkin, Suchir Balaji, Shantanu Jain, William Saunders, Christopher Hesse, Andrew N. Carr, Jan Leike, Josh Achiam, Vedant Misra, Evan Morikawa, Alec Radford, Matthew Knight, Miles Brundage, Mira Murati, Katie Mayer, Peter Welinder, Bob Mc- Grew, Dario Amodei, Sam McCandlish, Ilya Sutskever, and Wojeiech Zaremba. Evaluating large language models trained on code. 2021.
Tianqi Chen and Carlos Guestrin. Xghoost: A scalable tree boosting system. In Proceedings of the 22nd ACM SIGKDD International Conference Knowledge Discovery and Data Mining, pp- 785-794. ACM, 2016.
Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebastian Gehrmann, et al. Palm: Scaling language modeling with pathways. arXiv preprint arXiv:2204.0224 2022.
Debby RE Cotton, Peter Cotton, and Reuben Shipway. Chatting and cheating: Ensuring aca- demic integrity in the era of chatgpt. Innovations in Education and Teaching International, pp. 1-12, 2023.
Yao Dou, Maxwell Forbes, Rik Concel-Kedziorske Noah A Smith, and Yejin Choi. gpt-3 text indistinguishable from human text? scarecrow: A framework for scrutinizing machine text. arXiv preprint ar arXiv:2107.01294 2021.
Tiziano Fagni, Fabrizio Falchi, Margherita Gambini, Antonio Martella, and Maurizio Tesconi. Tweepfake: About detecting deepfake tweets. Plos one, 16(5):e0251415, 2021.
Sebastian Gehrmann, Hendrik Strobelt, and Alexander M Rush. Gltr: Statistical detection and visualization of generated text. arXiv preprint arXiv: 190660004433 2019.
10

---

Published as a conference paper at ICLR 2024
Daphne Ippolito, Daniel Duckworth, Chris Callison-Buree and Douglas Eck. Automatic detection of generated text is easiest when humans are fooled. arXiv preprint arX1::991.006500, 2019.
Ganesh Jawahar, Muhammad Abdul-Mageed, and Laks VS Lakshmanan. Automatic detection of machine generated text: A critical survey. arXiv preprint arXiv:2011.01334 2020.
Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is bert really robust? natural language attack on text classification and entailment. arXiv preprint arXiv: 2019.
Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tatsunori Hashimoto. Exploiting programmatic behavior of Ilms: Dual-use through standard security attacks. arXiv preprint arXiv:23322005733, 2023.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. arXiv preprint arXiv:2301.10226 2023.
Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. Large language models are zero-shot reasoners. Advances in neural information processing systems, 35:22199-22 222133, 2022.
Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. Paraphras- ing evades detectors of ai-generated text, but retrieval an effective defense. arXiv preprint arXiv:2303. 13408, 2023.
Vladimir I Levenshtein. Binary codes capable of correcting deletions, insertions, and reversals. Soviet Physics Doklady, 10(8):707-710, 1966.
Junyi Li, Tianyi Tang, Wayne Xin Zhao, Jian- Yun Nie, and Ji-Rong Wen. Pretrained language models for text generation: survey. arXiv preprint arXiv:2201. 220.::220000...33,. 05273, 2022.
Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimizing continuous prompts for generation. arXiv preprint arXiv:2101 000900 2021.
Weixin Liang, Mert Yuksekgonul, Yining Mao, Eric Wu, and James Zou, Gpt detectors are biased against non-native english writers. arXiv preprint arXiv:2304.02819, 2023.
Fatemehsadat Mireshghallah, Justus Mattern, Sicun Gao, Reza Shokri, and Taylor Berg- Kirkpatriik.. Smaller language models are better black-box machine-generated text detectors. arXiv preprint 23XY:22305.0989. 2023.
Yisroel Mirsky, Ambra Demontis, Jaidip Kotak, Ram Shankar, Deng Gelei, Liu Yang, Xiangyu Zhang, Maura Pintor, Wenke Lee, Yuval Elovici, et al. The threat offensive ai to organizations. Computers & Security, pp. 103006, 2022.
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. De- machine-generated
tectgpt: Zero-shot machine- generated text detection using probability curvature. arXiv preprint 1xXiv:2301.11303 2023.
Yikang Pan, Liangming Pan, Wenhu Chen, Preslav Nakov, Min- Yen Kan, and William Yang Wang. On the risk of misinformation pollution with large language models. arXiv preprint arXiv:2305. 13661, 2023.
Hammond Pearce, Baleegh Ahmad, Benjamin Tan, Brendan Dolan-Gavity and Ramesh Karri. Asleep at the keyboard? assessing the security of github copilot's code contributions. 2022 IEEE Symposium Security and Privacy (SP), pp. 754-768. IEEE, 2022.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, llya Sutskever, et al. Language models are unsupervised multitask learners. OpenAl blog, 1(8):9, 2019.
Alec Radford, Jong Wook Kim, Tao Xu, Greg Brockman, Christine McLeavey, and Ilya Sutskever. Robust speech recognition via large-scale weak supervision. In International Conference Ma- chine Learning, pp. 28492-28518, PMLR, 2023.
Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? arXiv preprint 1rXiv:2303.111556 2023.
11

---

Published as a conference paper at ICLR 2024
Ili Shumailov, Zakhar Shumaylov, Yiren Zhao, Yarin Gal, Nicolas Papernot, and Ross Ander- son. The curse of recursion: Training on generated data makes models forget. arXiv preprint arxiv:2305.17493, 2023.
Mohammed Latif Siddiq, Shafayat H Majumder, Maisha R Mim, Sourov Jajodia, and Joanna CS Santos. An empirical study of code smells in transformer-based code generation techniques. In 2022 IEEE 22nd International Working Conference on Source Code Analysis and Manipulation (SCAM), pp. 71-82, IEEE, 2022.
Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel VerrbertVosss. Jeff Wu, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, et Release strategies and the social impacts of language models. arXiv preprint arXiv:1908.0922 09203, 2019.
Ruixiang Tang, Yu-Neng Chuang, and Xia Hu. The science of detecting IIm-generate texts. arXiv preprint arXiv:2303.07205, 2023.
E Tian, 2023. URL https: https://gpteeoo.cg me
Vivek Verma, Eve Fleisig, Nicholas Tomlin, and Dan Klein. Ghostbuster: Detecting text ghostwrit- ten by large language models. arXiv preprint arXiv:2305. 15047, 2023.
Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc Le, Denny Zhou, et al. Chain-of thain-oftthought prompting elicits reasoning in large language models. Advances in Neural Information Processing Systems, 35:24824-24837, 2022.
Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christo- pher Dewan, Mona Diab, Xian Li. Xi Victoria Lin, Opt: Open pre-trained transformer language models. arXiv preprint arXiv: 000600 2022.
Wangchunshu Zhou, Yuchen Eleanor Jiang, Peng Cui, Tiannan Wang, Zhenxin Xiao, Yifan Hou, Ryan Cotterell, and Mrinmaya Sachan. Recurrentgpt: Interactive generation (arbitrarily) long text. arXiv preprint arXhv:2305.13304 2023.
Yongchao Zhou, Andrei Ioan Muresanu, Ziwen Han, Keiran Paster, Silviu Pitis, Harris Chan, and Jimmy Ba. Large language models are human-level prompt engineers. arXiv preprint arXiv:2211.01910 2022.
Andy Zou, Zifan Wang, Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307. 15043, 2023.
12

---

Published as a conference paper at ICLR 2024
A APPENDIX
A.1 DATA CREATION
Our dataset selection was driven by the need to address emerging challenges and gaps in current re- search. We incorporated news, creative writing, and essays from the established Ghostbuster Vermal et al. (2023) to maintain continuity with prior work. Recognizing the growing capabilities of Lan- guage Learning Models (LLMs) like ChatGPT in generating code, and the accompanying security issues, we included code as novel and pertinent text data type. Additionally, we analyzed Yelp reviews explore LLMs' potential for generating fake reviews, concern overlooked in previous studies, which could significantly influence public opinion about businesses. Lastly, we included arXiv data to address recent concerns over the use of GPT in academic writing, reflecting on its ethical implications.
Code Dataset. Human eval dataset offers code specification and the completed code for each data point. We first use GPT to generate a detailed description of the function of the code by prompting with "Describe what this code does code specificationcode". The result, termed pseudo code, is an interpretation of the code. Subsequently, help me write code starting with this code specification," " to generate Python code that adheres to the given input-output format and specifications. This way, create the Al-generated code data.
prompt GPT with "I want to do this pseudo code,
Yelp Reviews Dataset. When tasked with crafting a synthetic Yelp review, prompting GPT-3.5 with "Help me write review based this original review" resulted in verbose and lengthy text. However, we discovered that using the prompt "Write a very short and concise review based on this: original review" yielded the most effective and suceinet Al-generated reviews.
ArXiv Dataset. In our experiment with Arxiv data, which includes titles and abstracts, we synthe- sized abstracts by using the title and the first 15 words of the original abstract. We employed the prompt "The title is title, start with first 15 words, write a short concise abstract based on this:", which successfully generated realistic abstracts that align with the titles.
A.2 DATASET STATISTICS
In Table Table 7 we show each dataset's size, median, min, and max length on writtewritten and machine-generated ones, respectively.
Table 6: Statistics for each dataset from humans. We show the length word count. Our work fo- cuses on detecting paragraph-leva text, which generally has shorter and more challenging length.
Datasets Student Essay
News
Creative Writing
Code
Yelp
Arxiv
Dataset Size
730
973
22172
164
2000
350
Median Length
38
21
96
96
21
102
Minimum Length
2
16
2
6
19
Maximum Length
122
295
1186
78
1006
274
A.3 ALGORITHM
We show the algorithm for invariance, equivariance, and uncertainty based algorithms. We denote the learned classifier as C.
A.4 ANALYSIS
Content. LLM tends to treat the text generated by the machine as high quality and conducts few edits. We conduct human study on whether the text generated by machines is indeed of higher quality than that written by humans. This study focused on the Yelp and Arxiy datasets. Participants presented with pieces of text designed for the same
Quality of the
13

---

Published as a conference paper at ICLR 2024
Table Statisties for each dataset generated by GPT-3.5-Turbo. We show the length in word count. Our work focuses on detecting paragraph-level text, which generally has a shorter and more chal- lenging length.
Datasets Student Essay
News
Creative Writing
Code
Yelp
Arxiv
Dataset Size
479
728
13629
164
2000
350
Median Length
45
38
82
35
48
72
Minimum Length
2
5
2
15
Maximum Length
208
354
291
182
227
129
Algorithm Detecting LLM Generated Content via Output Invariance
Input: Text input x, rephrase prompt Pk, where k 1,... K.
2: Output: Class prediction
3: Inference:
4: for k= 1...., K do
5: Obtain LLM output Sx = F(,
6: Calculate bag-of-wordh edit Rg and the Levenshtein Score Dk
7: end for
8: Make final prediction via y C(R1, R2,..., .. Rk, D1, D2, .... Dk))
purpose, one authored by a human and the other by machine, and were asked to judge which was of higher quality. The study involved three users, and for each dataset, randomly selected 20 examples for evaluation. The results, detailed in Table 8 generally indicate that human-writter texts are of similar or higher quality compared those generated by machines.
Table 8: Human study the quality of machine generated text. Our work showed that machine generated text will be perferred by LLMs and produce few edits when asked to rewrite. We also evaluate the ratio of machine generated text that is perferred by human. The machine is good at creating realistic Yelp reviews, but not good at academia paper writing.
Methods
Yelp Reviews
Arxiv Abstract
% that Machine Generated Text are Preferred Human Written Text
53.3%
26.7%
Robustness of Our Method to LLM Fine-tuning. We run the experiment on GPT-3.5-Turbe and GPT-4-Turbo. GPT-4-Turbo can be roughly treated as a realistic, advanced, continual fine-tuned LLM on new real-world data from GPT-3.5- We show the results in Table Our method is robust to LLM finetuned. Despite a drop in detection performance, it still outperforms the estab- lished state-of-the-art zero-shot detector.
Robustness of Our Method Non-native Speaker. Prior work showed that LLM detectors are biased against non-native English writers, because non-native English writing is limited in linguistic expressions and often detected as Al-generated Liang al. (2023). We investigate if our approach detect non native English writers better if is biased against them, as shown by prior detection methods.
Following the setup from Liang al Liang al. 2023) Student Assessment Prize (ASAP) dataset and adopt the first 200 datasets in our study, which is a dataset from non-native speakers TOEEL essays 8-th grade level in the US. We create the machine-generated answer for the TOEFL essay via the following prompt:
the Hewlett Foundation's Automated
Write an essay based on this:
14

---

Published as a conference paper at ICLR 2024
Algorithm 2 Detecting LLM Generated Content via Output Equivariance
1: Input: Text input x.
2: Output: Class prediction
3: Inference:
4: for k= L,.., K do
5: Create transformation prompt T3 and inverse transformation prompt T create rephrase
prompt Pk-
6:
Obtain LLM output M,-- F
7: Obtain LLM output M = F(PP.. M2)
8: Obtain LLM output Sμ F(T M)
9: Calculate bag-of-words edit Ra and the Levenshtein Score D₁.
end for
11: Make final prediction via y = C(R1, [[[RR.R2,, Re,..., Rk, D1, D2,..., Dkl)
Algorithm Detecting LLM generated Content via Output Uncertainty
Input: Text input x.
2: Output: Class prediction y
3: Inference:
4: Given rephrase prompt P
5: for = I.... do
6: Obtain LLM output Sa = F(P,x)
7: end for
8: for k = 1...., K do
9: for j k, K do
Calculate bag-of-words edit R and the Levenshtein Score DE.j
11: end for
end for
13:
Make final prediction via y - C(1 R13, 1,K, D1,2, D1.3..., RK- 1,))
We show the detection result in Table Our method does not discriminate the non-English speaker, and reaches a similar level of detection performance on high- writing (abstract from accepted ICLR papers). Since both ASAP and Arxiv are written by humans, they will be treated as low- quality text that does not match the inherent inertia in LLM models, and thus will both be modified more than the machine-generated text. Our detection algorithm will classify those texts with more modifications than humans. Thus, both non-native and efficient writers will be correctly classified by our approach. Since our algorithm only relies on the word edit distance, does not rely on the superficial semantics of the text for detection. Thus, our approach generalizes well from academic ICLR abstract to non-native English writing on the 8th grade level, with only less than point of performance drop.
Detection Performance by combining rewrites from multiple LLMs. Table II we show detection performance when combining GPT-3.5 rewrites with other LLMss, including Ada, Davinci, and both. We find combining rewriting from multiple LLMs can improve performance over Arxiv detection, but not on Yelp.
Detection performance by adding edit distance between the rewritten texts from different LLMs additional features. In Table T2 we show the detection performance. We can achieve better detection performance leveraging this new feature.
Detection
performance by combining features of invariance, equivariance, and uncertainty. We conduct experiments in Table 1 on the two dataset we studied, we cannot further improve performance.
Detection performance under different input length. We show the trend in Figure and Figure
Figure
Statistical significance the number of changes (deletions, insertions) done by the selective generative models between humans and machine-generater texts. We caleulate the t-statistic
15

---

Published as a conference paper at ICLR 2024
News GPT Detection
Creative Writing GPT Detection
Detectional Rewriing
51500
0.7
0.5
200
225
150
175
25
120
130
175
Berghenggh
That Length
(a) News
(b) Creative Writing
Figure 7: Detection performance under different length. For News and Creative Writing datasets, longer length helps detection.
Student Essay GPT Detection
Yеl GPT Detection
1.00
Detection Rewninng
0.80
0.5
0.85
0.75
25
50
75
100
325
15a
175
130
200
100
400
TocLonghh
Text Length
Student Essay
Yelp Reviews
Figure 8: Detection performance under different length. For both datasets, longer length helps
detection, Yet, on student essay, input longer than 125 words will lead to performance degradation.
and calculate the p-vulue. In Table 14
show the p-value for the two distributions shown in Figure [ Since the p-value is much smaller than 0.05, it demonstrates that the number of changes between human and machine-generated text is significant.
A.5 IMPLEMENTATION DETAILS
The training and testing domain for Table 2. regression, and use the same source and target for invariance, equivariance, and uncertainty. For News, we train on Creative Writing and test on News. For Creative Writing, we train on News and test on Creative Writing. FOr Student Essay, we train on News, and test on student Essay.
For all experiments in Table 2, we use logistic
Classifier choice for Table 1 and Table 2. We use logistic regression for all our experiments except for on the student essay dataset, where we find XGBoost achieves better performance.
16

---

Published as a conference paper at ICLR 2024
Code GPT Detection
arXiv Detection
Detectión via Rown ting
Detection via Rewritng
11500
13.0ee
0.5
25
engit
(a) Code
(b) Arxiv Abstract
Figure 9: Detection performance under different length. For both datasets, the performance is high in the beginning. demonstrating the advantage of our approach in tackling sequence that is shorter. However, for longer input, the detection performance drops.
Table 9: Robustness of Our Algorithm LLM Finetuning. The detection model was only learned on GPT-3.5-Turbo generated data and use GPT-3.5-Turbo for rewriting. We show the results on GPT-3.5-Turbo in the first row. We then directly apply the detector to data generated from GPT-4- Turbo, but use the old, GPT-3.5-Turbo model for rewriting and detection. The detector was never trained on GPT-4-Turbo. Despite a drop detection effectiveness, our algorithm still outperform the published state-of-the-arr zero-shot detector.
Datasets Yelp
Test Data source
Data Detector
Code
Arxiv
GPT-3.5-Turbo
Ours trained with GPT-3.5-Turbo
95.38
87.75
81.94
GPT-4-Turbo
Ours trained with GPr-o
83.07
79.73
74.02
GPT-4-Turbo
Baseline DetectGPT
70.97
66.94
66.99
Table 10: Robustness on non-native English authors. We show results that train our Arxiv dataset, and test on the ASAP dataset in the gray row. While the detection score drop bit from training on ASAP and test ASAP, still achieve a F-1 detection score of 81.16, which is only less than point than Arxiv paper. This demonstrate the robustness of our detection algorithm, even trained on the Arxiv papers that accepted to ICLR, which are high quality written text, algorithm still generalize well to non-native English writters from grade level.
Training Source
Testing Source
F-1 Detection Score
ASAP Dataset
ASAP Dataset
98.76
Arxiv Dataset
ASAP Dataset
81.16
Arxiv Dataset
Arxiv Dataset
81.95
Table 11: Fl score for detecting machine-generated paragraphs by combining rewrites from multiple LLMs. We experiment two datasets.
Methods
Yelp Reviews
Arxiv Abstract
GPT-3.5 Only
87.75
81.94
GPT-3.5 + Ada
85.71
92.85
GPT-3.5 + Davinci-003
85.53
88.40 81.76
GPT-3.5 + Davinci-003 Ada
90.00
17

---

Published as a conference paper at ICLR 2024
Table 12: F1 score for detecting
paragraphs by edit distance between the rewrit-
ten texts from different LLMs as additional features.
Methods
Yelp Reviews
Arxiv Abstract
GPT-3.5 Only
87.75
81.94
GPT-3.5 Ada
67.85
89.21
GPT-3.5 Davinci
78.41
81.94
Ada / Davinei
66.25
90.51
Table 13: Detection performance combining invariance, equivariance, and uncertainty,
Methods
News
Creative Writing
Single
60.29
62.88
Combined
53.72
58.18
Table 14: Statistical significance of the number of changes (deletions, insertions) done by the selec- tive generative models between humans and machine-geet generretd texts, corresponding to Figure 2 in the main paper. We present the value by running a one-sided two-sample tests. The small p-value demonstrates the statistical significance.
Methods
Invariance
Equivariance
Uncertainty
p p-value
2.19e-13
9.21e-7
5.47e-16
Table 15: Classifier for detecting machine-generate paragraphs. We use the best classifier from logistic regression (LR) and XG Boost for classification.
Datasets
Creative Writing
Student Essay
Yelp Reviews
Arxiv Abstract
Methods
News
Code
Ours Invariance
LR
LR
XGBoost
LR
LR
LR
Ours Equivariance
LR
LR
XGBoost
LR
LR
LR
Ours Uncertainty
LR
LR
XGBoost
LR
LR
LR
18


Reviews:
[{"review_id": "S4kdzZDZbr", "reviewer": "Reviewer_WaeQ", "summary": "This work addresses the problem of detecting AI-generated text. It makes a hypothesis that LLMs, when asked to rewrite, are more likely to modify human-generated text than AI-generated text. The hypothesis is based on the observation that AI-generated text is generally of higher quality than the average human-generated text and therefore needs fewer modifications. The work proposes a method for detecting AI-generated text based on the above hypothesis. The proposed method essentially involves asking LLM to rewrite the text and computing the edit distance between the input and the rewritten text. In this context the work introduces the notions of invariance, equivariance and uncertainty. Invariance is measured as the modification distance between the input and the LLM-rewritten input. Equivariance is measured as the modification distance between the rewritten text and the text obtained by transforming the input, rewriting and finally undoing the transformation. Uncertainty is measured as the average modification distance between different rewritings of the input by the same LLM with the same prompt. \n\nThe work reports results from an experimental study of the proposed approach on several datasets and compares with several baselines. Invariance based scoring gives significantly better results than the baselines while equivariance and uncertainty based scoring also do well. The work also reports results from a study on robustness, source of generated data, different LLMs for rewriting, and impact of prompts used for rewriting, and the length of the input text.", "questions": "1. In Table 1 you write \"The results are in domain testing, where the model has been trained on the same domain.\" but you also use the term \"in distribution\" Are these equivalent terms?  I assume you consider each of the datasets as a different domain (e.g. news domain vs creating writing).  What is the difference between in-distribution and in-domain?\n\n2. In Table 2, what is the domain for training and what is the domain for testing?\n\n3. Would the effectiveness of detection improve further if multiple LLMs are asked to rewrite the input text and invariance scores for each LLM are used as features for training the logistic regression classifier? Also, would edit distance between the rewritten texts from different LLMs be useful as additional features for such a classifier?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. Simple method for detecting AI-generated text that essentially consists of asking LM to rewrite the input and then computing edit-distance between the input and the rewritten text. Computationally simple.\n\n2. Significant improvement in detection effectiveness over the baselines.\n\n3. Interesting study on robustness, source of generated data, different LLMs for rewriting, impact of prompts used for rewriting, and the length of the input text.", "weaknesses": "1. Proposed method is critically dependent on LLM. Any change to LLM due to continual fine-tuning with new data might have unknown consequences for the detection method. The method might not be robust to LLM fine-tuning.\n\n2. Though the proposed method is simple and computationally low cost, there is a cost associated with every call to the detection algorithm because of the calls made to LLM for rewriting. This might not be acceptable in some scenarios it is cheaper and desirable to have a model decoupled for LLM after training.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Duncrp9Swq", "reviewer": "Reviewer_LoWc", "summary": "The paper proposes to use rewriting as a task to detect whether a text is generated or not. They show that LLMs rewrite the text less when given a LLM-written text as opposed to a human-written text. The paper introduces a method that is based on prompting LLMs to rewrite text and calculating the editing distance of the output. This approach significantly improves the detection of LLM-written texts across domains.", "questions": "See weaknesses above.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 4, "strengths": "* The paper tackles on a task that is very important to help mitigate the misuse of LLMs.\n\n* The method proposed is simple yet effective. It is also very intuitive since it is actually also human nature to prefer (=critic less) your own writing than others.\n\n* The paper is very well written.", "weaknesses": "* It would be nice to actually check the quality of human/LM written ext., i.e. which between the human and LM text do another set of humans prefer? It could be that the LM-written text is actually better quality (and thus requires fewer rewrites).\n\n* It would be nice to include a discussion on how this method fares when the LLM is instruction-tuned to do rewrites the way humans do rewrites. Given that text rewriting is a widely used use case for LLMs, it would not be a surprise if these models are instruction-tuned on a task mixture that includes text rewriting.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "tHJ9zVfAhq", "reviewer": "Reviewer_cUTp", "summary": "This paper provides a new approach for detecting LLM-generated text, based on the insight that LLMs will make minimal edits when asked to rewrite their own generations. The paper proposes three related detection models called Invariance, Equivariance, and Uncertainty and shows that they outperform state-of-the-art detectors such as Ghostbuster, DetectGPT, and GPTZero on a variety of paragraph-level detection tasks. The paper also introduces three new domains of generated code, Yelp reviews, and arXiv abstracts, finding that the model again outperforms existing baselines. While the paper has some missing details and would benefit from additional rounds of proofreading, the core idea and results lead me to recommend acceptance.", "questions": "1. Are all detection tasks in this paper at the paragraph level? How does the median length of documents vary across tasks? Did you try the method for any longer documents?\n2. Did you experiment with combining the invariance, equivariance, and uncertainty features?\n3. How was the impact of context length experiment run? In Figure 5, how many examples were included for each point on the plot?", "limitations": "", "rating": 6, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "- The core idea in this work, that LLMs are less likely to make extensive edits to LLM-written text than human-text, is an intuitive and seemingly very reasonable approach.\n- The paper obtains impressive performance compared to state-of-the-art models (Ghostbuster and GPTZero). In particular, the model seems to work especially well on short documents, which is a known failure mode for existing approaches\n- The paper introduces three new detection datasets (Yelp reviews, code, arXiv abstracts) and evaluates on them in addition to an existing", "weaknesses": "1. The paper is missing some important details. For example, the paper does not provide a complete explanation of how the human reviews from the Yelp dataset were selected, nor does it provide a full explanation of how GPT 3.5 was prompted to generate data in the code/Yelp/arXiv domains. The paper also does not describe which scoring model was used for the DetectGPT results. \n2. I believe the results on OOD generalization are slightly misleading. Because DetectGPT and GPTZero should produce the same scores in-domain and out-of-domain, GPTZero actually has the highest score for the OOD creative writing task\n3. Table 4 (robustness across generation models) is difficult to interpret without results from the baselines. Although the model seems to generalize well to generators it was not originally trained on (ada and davinci), these are also weaker models which (as stated in the table caption) results in an easier detection problem. Additionally, generalization results in the paper would benefit from the inclusion of models which are not from OpenAI, since these are likely more similar to one another than models like Claude, LLaMA, etc. \n\nMISCELLANEOUS SUGGESTIONS\n- A small suggestion on related work: the introduction starts that token log probabilities are not available in black-box models such as GPT-3.5 and GPT-4, which is true. I think the paper would benefit from distinguishing “scoring models” from “target models” when discussing how this affects related work. DetectGPT is designed to only work when the scoring and target model are the same (cf. Figure 6 in their paper), although Ghostbuster operates under the assumption that the scoring and target model are different (but still requires access to generated documents from the target model). \n- Minor: Figure 6 text is too small to read and would benefit from error bars\n- The paper has a large number of typos and grammatical errors. Although this does not affect my review score, the paper would benefit from an additional round of proofreading.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "PcVBjKBBz4", "reviewer": "Reviewer_TBk4", "summary": "The paper discusses work on detected AI-generated text using rewriting. The authors formalize their hypothesis which “a generated text from an auto-regressive generative models retains a consistent structure, which another such model will likely to also have a low loss and treat it as high quality”. The proposed method captilizes of this hypothesis through quantifying rewrites in the form of edit distance scoring which the author/s use to train classifiers for the detection phase. The author/s also propose several variations of symbolic modifications including invariance, equivariance, and uncertainty. The author/s select previous well-known detector systems including GPTZero, Ghostbuster, and DetectGPT for the comparison of detection performances on 6 datasets. The author/s report favorable results of the proposed method in in Tables 1 and 2. Other experiments done include robustness in an adversarial setup using paraphrasing, effects of content length, quality of generated data, and type of detection model but these parts seem condensed and not thoroughly discussed.", "questions": "1. How large is the feature set or dimension then for training the classifiers? Did the author/s conduct and hyperparameter optimization with the classifiers?\n\n2. How is the setup for comparison done for preliminary experiments shown in Table 1 and 2? What classifier was used for these experiments? There were two algorithms mentioned (LR and XGBoost) but it was never specified in the tables. The same way goes for Tables 4 and 5. I’m confused as a reader as to which classifier was used for the presentation of results. Revising this part and enriching the details should be in order.\n\n3. Is the number of changes (deletions, insertions) done by the selective generative models between humans and machine-generated texts statistically significant? The visualization in Figure is nice but this would have been an additional supporting preliminary information to add to the hypothesis.\n\n4. There are six datasets chosen for experimentations but why are only subsets or some of it are used for results presented in Table 3, 4, and 5?\n\n5. The statement in Section 4.4 goes “In Table 5, while all models achieve significant detection performance”. So a statistical test was conducted? Can you give the details for this? Otherwise, I suggest using the word substantial instead.\n\n6. Why is only the Yelp data used for special test cases such as effect of content length? Why not the other datasets as well? This seems very selective without reason.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper discusses work on an interesting framing of detecting text generated by large language models by gauging how much rewrites (edit distance) it gives to a piece of text with the hypothesis that it considers machine-generated texts, regardless of specific models, as high quality ones compared to human-generated texts. The simplicity of the method is what I appreciate the most with the paper. I also appreciate that the author/s are able to construct a good research plan for the methodology of the study and the formalization of the task. There are some revisions suggested below to improve the structure and organization of the paper, particularly the uniformity and presentation of results.", "weaknesses": "The paper starts well with the introduction, statement of motivation, discussion of hypothesis, and proposed method but went downhill with the presentation of results.\n\nFirst, in the discussion of datasets and model baseline used, the definition and characteristics should definitely be expanded by including the size of the dataset plus other unique characteristics of the data that’s worth mentioning as well as the quantified performance of the baseline models just to give an idea to the readers of their relevance and why they are being used/compared in the study. \n\nSecond, the discussion on Section 4 seems to be too condensed and there are sudden insertions of models for comparison. Claude was tested but was not mentioned in the baseline models. Why is that and why is Claude a viable candidate for comparison? \n\nThird, there is no concrete / definitive discussion for the results presented in Table 1 and 2 and these are the bread and butter of the study. The table captions and Section 4.3 simply state the observed increments against the previous systems and nothing more. I would have appreciated it if there are more discussions on particular weaknesses in the texts by previous works which the current work addresses, and give some examples of this. Why are proposed methods get big performance jumps, say in the code dataset and Arxiv dataset, compared to natural language datasets? In the robustness experiments, why are the previous detector models left out? It is important to still consider them in the mix for better comparison of true performance. These discussions should be in order.\n\nThe statement “text from the Ada model is most easily detected, possibly due to its discernibly lower quality compared to human-written content” is speculation. Some form of quantitative proof is required for this.\n\nIn terms of strengthening the paper, I strongly suggest the author/s to also experiment with second-language or non-native speaker writing corpora such as TOEFL or ESL essay corpus to gauge if the proposed method also exhibits that particular limitation of confusing AI-generated texts with non-native speaker-written texts. This has been a known limitation across all detectors of machine-generated texts. Refer to the existing works (https://arxiv.org/abs/2304.02819) and databases online (https://www.clarin.eu/resource-families/L2-corpora, https://uclouvain.be/en/research-institutes/ilc/cecl/learner-corpora-around-the-world.html) for the data to be experimented with. Regardless of the result, this would be a great addition and insight to the paper.\n\nLastly, the paper is littered with inconsistencies and wrong format for in-text citations which makes it very confusing to read. For example, it’s better to read referenced text as “Ghostbuster (Verma et al., 2023) instead of Ghostbuster Verman et al (2023)”. It seems like the Verma is included in the name of the model but it’s not. There are also cases where the model is “GPT-3.5-Trubo” and then becomes “GPT-3.5-turbo”. Diagrams in Figure 6 should conform to uniform range of [0.0,1.0] in the y axis.\n\nI still see the importance and contribution of the study but major revision is required for the paper in order for readers to fully comprehend and appreciate the work.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)