Few-Shot Detection of Machine-Generated Text using Style Representations
Authors: Rafael Alberto Rivera Soto
Kailin Koch
Aleem Khan
Barry Y. Chen
Marcus Bishop
Nicholas Andrews
Venue: ICLR 2024 poster (2024)
Keywords: machine text detection
large language models
AI safety
natural language processing
stylistic representations
deep learning
machine learning
Primary area: representation learning for computer vision, audio, language, and other modalities

Abstract: The advent of instruction-tuned language models that convincingly mimic human writing poses a significant risk of abuse. For example, such models could be used for plagiarism, disinformation, spam, or phishing. However, such abuse may be counteracted with the ability to detect whether a piece of text was composed by a language model rather than a human. Some previous approaches to this problem have relied on supervised methods trained on corpora of confirmed human and machine-written documents. Unfortunately, model under-specification poses an unavoidable challenge for such detectors, making them brittle in the face of data shifts, such as the release of further language models producing still more fluent text than the models used to train the detectors. Other previous approaches require access to the models that generated the text to be detected at inference or detection time, which is often impractical. In light of these challenge, we pursue a fundamentally different approach not relying on samples from language models of concern at training time. Instead, we propose to leverage representations of writing style estimated from human-authored text. Indeed, we find that features effective at distinguishing among human authors are also effective at distinguishing human from machine authors, including state of the art large language models like Llama 2, ChatGPT, and GPT-4. Furthermore, given handfuls of examples composed by each of several specific language models of interest, our approach affords the ability to predict which model specifically generated a given document.

Published as a conference paper at ICLR 2024
FEW-SHOT DETECTION OF MACHINE-GENERATED TEXT USING STYLE REPRESENTATIONS
Rafael Rivera Soto 1.3.t Kailin Koch', Aleem Khan?,
Barry Chen', Marcus Bishop?, Nicholas Andrews
'Lawrence Livermore National Laboratory U.S, Department of Defense
"Johns Hopkins University
ABSTRACT
The advent of instruction-tunee language models that convincingly mimic human writing poses a significant risk of abuse. However, such abuse may be counteracted with the ability to detect whether piece of text was composed by language model rather than a human author. Some previous approaches to this problem have relied on supervised methods by training on corpora of confirmed human- and machine- written documents. Unfortunately, model sndef-specification poses an unavoidable challenge for neural network-based detectors, making them brittle in the face of data shifts, such as the release of newer language models producing still more fluent text than the models used to train the detectors. Other approaches require access to the models that may have generated document in question, which is often impractical. In light of these challenges, we pursue fundamentally different approach not relying samples from language models of concern at training time. Instead, we propose to leverage representations of writing style estimated from human- authorrd text. Indeed, we find that features effective at distinguishing among human authors are also effective at distinguishing human from machine authors, including state- of-the-art large language models like Llama-2, ChatGPT, and GPT-4. Furthermore, given handful of examples composed by each of several specific language models of interest, our approach affords the ability to predict which model generated a given document. The code and data to reproduce our experiments are available at https://gi thub. Lttp:///LAAA/reeeaaaaaeeeeeeeee
INTRODUCTION
Recent interest in large language models (LLM) has resulted in explosion of LLM usage by wide variety of users. Although much of this usage may be well-intentioned and benign, a growing concern is the usage of LLM for deception, such for phishing attacks, disinformation, spam, and plagiarism (Hazell, 2023; Weidinger et al., 2022).
To minimize the risk of abuse of commercial systems, one recently proposed recourse is for those systems to employ statistical watermarking techniques (Kirchenbauer et al., 2023). Although wa- termarking may help mitigate some unintended consequences of LLM adoption, the advent of open-source LLM with performance approaching that of commercial LLM and achievable on com- modity hardware raises the possibility of cireumventing watermarking mechanisms to generate harmful content, potentially at a large scale. Thus, watermarking fails to completely address the issue of malicious content.
One reasonable recourse is to develop automatic detection approaches that attempt to predict whether a given document was composed by an LLM rather than by a human author. To this end, a number of methods have been proposed, such OpenAl's AI Detector (Solaiman al., 2019). An obvious draw drawback of classification methods, particularly those based on deep learning, is that the resulting models are susceptible to shifts in data distribution between training and deployment time for variety of reasons, such as limited training data or the non-stationary of text (D' Amour et al., 2022). Furthermore, prior work in machine-text detection has found that in order to achieve good
CCoresponding authors:
edu, noa@jhu.

---

Published as a conference paper at ICLR 2024
gpt4
gpt4
1lama2
1lama2
chatgpt
chatgpt
human
human
(a) Semantic document embeddings
(b) Stylistic document embeddings
Figure 1: UMAP projections (McInnes et al., 2018) of semantic or stylistic representations of writing samples in the Reddit domain composed by human or machine authors. We use SBERT as representative dense semantic embedding (Reimers and Gurevych, 2019) and UAR as representative stylistic representation (Rivera-Soto et al., 2021). Each point shown the result of embedding a document containing at most 128 subword tokens for standard vocabulary of size 50K. Despite using prompts designed elicit variety of writing styles from the LLM,, the stylistic representation separates human from machine authors and machine authors from one another significantly better than the semantic representation.
performance from such a classifier, is necessary to train the model with documents generated by the specific LLM one wishes detect (Zellers et al., 2019). As result, such models need be updated whenever new LLM are introduced, something which could be both impractical and expensive in light of the frequent release of ever-improving models.
Human writing is characterized by a wide variety of stylometric features. In this paper. we explore the question of whether LLM exhibit consistent writing style across a range prompts, particularly when explicitly prompted to generate text mimicking specific styles. In order to make the notion of writing style more concrete, we propose to employ representations of style learned from large corpora of writing samples by human authors that aim to capture invariant features of authorship (Wegmann indeed separate also observe
et al., 2022; Rivera-Soto et al., 2021). Figure illustrates that such representations documents composed by human authors from those composed by LLM. Moreover, that text generated by any particular LLM follows a style distinct from the styles of human authors and also distinct from those of other LLM. Thus, writing style affords the ability to detect not only that a given document was composed by an LLM, but also to predict which LLM generated it, given only few example documents composed by each of several L.M of concern. The proposed approach may therefore reveal that specific LLM are being abused, something which increases transparency and accountability for companies disseminating LLM without appropriate controls or safeguards.
In light of the unavoidable distribution shifts stemming from the introduction of new LLMs, topics, and domains, this work focuses on the few-shot setting. Specifically, our evaluations assess the ability to detect writing samples produced by LLM unseen at training time, and in some cases, drawn from new domains and dealing with new topics. Our approach outperforms prominent few-shot learning methods well as standard zero-shot baselines and differs significantly from prior work in that we do not require access the predictive distribution the unseen L.MM, like Mitchell et al. (2023), or large number of samples from it, like Zellers et al. (2019), to effectively detect text generated by these models.
We also explore factors leading to effective style representations for this task, finding that contrastive training on large amounts numan--uthored text is sufficient to obtain useful representations, but that in certain few-shot settings, training additional LLM- -eMeeeerrdtedd documents significantly improves performance. Finally, we release the datasets we generated as part of this work, which include documents generated by variety of language models.
2

---

Published as a conference paper at ICLR 2024
2 RELATED WORK
Perhaps the most widely-applied machine-text detector is OpenAT's AI Detector, which is intended to predict whether given document was human- or machine--eneraale (Solaiman et al., 2019). The model was trained using documents generated by 2 comprising one class and documents drawn from the corpus used train GPT-2 comprising the other class. OpenAI released a similar classifier for detecting ChatGPT in January 2023. As of this writing, OpenAl has withdrawn the Al Detector, citing its low rate of accuracy. Indeed, it well-known that supervised detectors may overfit various properties of their training data, such as specific decoding strategies (Ippolito et al., 2020).
By perturbing the output logits of an LLM and thereby its decoded text, a recent proposal known as watermarking, one may effectively detect text generated by LLM in some settings. For example, Kirchenbauer et al. (2023) encode a watermark in generated text by splitting a model's vocabulary into so-called red and green lists, encouraging tokens from the green list to be sampled during decoding more frequently than tokens from the red list. Because this line of work requires direct access to model and its vocabulary, the approach is most relevant for models deployed by organization through an API (He et al., 2022). However, adversaries may decline to generate watermarked text, for example, by using their own LLM, or remove the watermark from API-generated text, for example, by paraphrasing, which has emerged as an effective mechanism to circumvent the detection of watermarked text (Krishna al., 2023). We conduct a study comparing the proposed approach to watermarking in Appendix E.
Much of the recent work on detecting machine-generated generated text has focused on training a classifier using datasets of human- and pachine-generater text (Jawahar et al., 2020), requiring access to model's predictive distribution for comparison with other distributions (Mitchell et al., 2023), or directly using model to detect its own outputs (Zellers et al., 2019). Other work has looked at patterns of repetition typical of LLM to rank documents according to their likelihoods of being machine-ger generated machine-generated (Gallé et al., 2021). In other recent work, the reliability of machine-tex, detectors in general has been questioned on theoretical grounds (Sadasivan et al., 2023). Zero-shot detection of machine-gencd generated text is also difficult task for human discriminators. Indeed, Dugan et al. (2020) demonstrated that human annotators had difficulty pinpointing changepoints between passages of documents composed by humans and those composed by machines, while Maronikolakis al. (2021) find that automatic detectors can outperform humans in certain settings.
Given the limitations of discriminative classifiers detecting machine-wwiitter documents, one might wonder whether generative approaches would be more robust. Unfortunately, deep generative models are also vulnerable to distribution shifts in general (Nalisnick et al., 2019), whereas effective machine- generated text detectors must be robust to shifts in topic, domain, and sampling techniques relative to those employed at training time. Our proposed approach addresses this concern by using learned stylistic representations, which are trained to ignore features that evolve over time, such topic and domain, and focus on stylistic features that authors use more consistently (Rivera-Soto et al., 2021; Wegmann et al., 2022).
METHODS
Detection regimes The experiments in this paper deal with both the supervised and few-shot learning regimes. In the supervised setting, we avail of a training corpus consisting of human- and maitine-written documents. The goal is to estimate a score proportional the likelihood that a held-out document was generated by an LLM. In contrast with the few-shot setting described below, here we assume that we have at least hundreds but preferably thousands or more examples composed by variety of language models. In practice the likelihood estimate is implemented by fine-tuning an underlying, pre-trained feature representation. We consider two such representations in this paper, namely semantic representations, where features are obtained by fine-tuning pre-trained representations based on masked language models, and style representations, where features are obtained by fine-tuning pre-trained style representations, which we discuss in more detail below. All being well, the resulting classifier would generalize to various test conditions, including novel language models, topies, and domains, question we examine in Appendix A.
In the shot setting we assume that for each LLM of concern we have a support sample, which consists of small number of in-distribution documents composed by that model. For example,
3

---

Published as a conference paper at ICLR 2024
upon recognizing by manual inspection that some of their students' assignments exhibit telltale signs of machine-genen generratgnnrrtion.. such as hallucination, an instructor could use those essays in question as the support sample. Alternatively, the instructor might proactively prepare the support sample by prompting various I.LM themself. The goal in this setting is to estimate the likelihood that one of the LLM in question generated given document, and if so, secondary objective is to predict which model generated the document.
Style representations A primary component of our proposed approach to detecting machine- generated text is the notion of style representation, something employ to help detectors overcome the challenges of generalization to new LLM, topics, and domains. We denote a style representation generically by f. which is taken be some auxiliary model mapping handful of documents 3 I2..... #K to a dined-dimessional vector f (I T2......... Fg), the representation of that document collection. The mapping f is fit such that f (æ , 22 ....,,,,........................ TK) and f [x'1, 22.......... ,,',, have large cosine similarity if and only if the writing style of T2, IK is similar to that of z' 22..2.......
We observe that writing style often comes into focus only after observing sufficiently -lrge writing sample. For example, the repeated usage of rare word may be discriminative of a particular author, but observing repeated word usage typically requires observing more than few sentences. Indeed, our best results are obtained by passing longer spans of text the model by combining style representations of multiple short documents using a learned aggregation mechanism.
In light of the highly nuanced nature of writing style, learning generalizable style representations requires large amounts of data. To this end, prior work has leveraged the availability of proxy author labels available in the form of account names on various social media platforms, such as blogs, microblogs, technical fora, and product reviews. In this paper, we focus on Reddit posts, which provide writing samples from authors discussing a wide variety of topics in various communities, which are known as subreddits. Furthermore, these topies cover diverse author interests and backgrounds, resulting in a corpus representing diverse styles. Our datasets are described in more detail in 1.
Training style representations One of the primary challenges in learning style representations is to disentangle invariant features of writing, such as style, from features that vary over time, such as topic. To achieve this, we employ the following contrastive training strategy. Assuming dataset includes histories of each contributing author's 's writing spanning several months or years, pair writing samples composed at different points in time by the same author yield positive examples, and pair writing samples by different authors to yield negative examples (Andrews and Bishop, 2019). As point of comparison, estimated using the approach of Wegmann et al. (2022), which differs in two significant ways. First, non-episodic training used, meaning that features are computed of individual documents rather than episodes of multiple documents. Second, the approach relies on topic annotations, namely the subreddit feature, to construct hard positives by pairing writing samples composed by single author discussing different topics, and hard negatives by pairing samples composed by different authors discussing similar topics.
training
additionally include results using style representations
Proposed few-shot method An author-specific style representation f admits a straightforward mechanism for few-shot detection. Specifically, suppose 1 T2,..., IK is handful of documents known to have been generated by particular language model of interest, where we regard document to be short span of text of around the length of a social media post. Specifically, unless otherwise specified, all documents considered in this work have length around 128 tokens according to a fixed tokenizer. Given a handful of new of documents x' f. . 2tzz at inference time, we compute the cosine similarity between f (æ1, F2, FK) and I (2), 2...,,,,.',, ('). to obtain a score monotonically related to the estimated likelihood that x' I/y. ,,, 4% were composed by the same source as Ii, T2. ........, K. The score may be further calibrated to yield a meaningful confidence estimate, say, by using Platt Scaling (Platt et al., 1999). Otherwise these scores must be thresholded to yield aath- predictions.
,,,',,
In experiments focus UAR, MaBERTa-baase architecture trained with supervised contrastive objective according to the recipe described in Rivera-Soto et al. (2021). We use the reference implementation accompanying that work. We observed in preliminary experiments that
4

---

Published as a conference paper at ICLR 2024
increasing the number of human authors contributing the dataset used to train UAR improves performance on the authorship attribution task and improves generalization. Therefore, we train UAR using larger dataset than in prior work, namely corpus of Reddit comments composed by five million authors that we describe in $5. In addition to this instance of UAR, we also prepare the following variations.
Multi-LLM variation In our first variation, we initialize the model weights of UAR to those of the instance above trained on the comments of five million Reddit users. We continue training the model using posts by human authors drawn from the r/politics or as well as posts these subreddits generated by LLM. In $4.1 we discuss the generation procedure and the motivation for controlling the topic by restricting to these two subreddits. Because training UAR involves optimizing a contrastive objective on each pair of episodes drawn from the same training batch, we ensure that half of the episodes in each batch originate from human authors and half from LLM. In this setting we regard language model as an author distinct from other members of its LLM family. For example, GPT2-large is taken to be distinct from GPT2-x1.
subreddits,
Multi-domain variation Previous work has shown that including multiple domains during training can improve the quality of style representations (Rivera-Soto et al., 2021). To this end, we prepare a variation of UAR by augmenting the comments of five million Reddit users with data drawn from Twitter and StackFxchange, ensuring that each training batch contains contributions from all three domains. See Table 3 of Appendix C for further statistics of this augmented dataset.
EXPERIMENTS
4.1 DATASETS
We distinguish between two kinds of language models, namely amply available and cheap (AAC) models, and models that users are likely to want to detect (LWD). We use documents generated by AAC models to estimate or fine-tune the feature representations described in $3 and hold out documents generated by LWD models for evaluation. This framework is intended to simulate the emergence of new LLM with more powerful capabilities, including the ability to better mimic human authorship.
To create the AAC dataset, we generate documents using readily available and computationally inexpensive models, namely GPT-2 (Radford et al., 2019) and OPT (Zhang et al., 2022). For GPT-2 we use the large and x1 variants, which have 774M and 1.5B parameters respectively. For OPT we use two variations that have 6.7B and 13B parameters respectively. We generate text using human- generated posts to r/politice and h/PoliticalDiscusst subreddits dealing with politics, a topic that was chosen for the substantial number of documents dealing with it, we aim to control for topic, thereby introducing an inductive bias encouraging representations learned from this dataset to separate machine and human authors on the basis of features unrelated to topic. All prompts contain at least 64 tokens according to the GPT-2 tokenizer. We generate completions using a variety of parameters described in Table 4a of Appendix C. In total, consider 64 combinations of decoding strategy, decoding value, temperature parameter, subreddit prompt source, and model size. After generating the completions, we truncate each document to the last sentence boundary before the 128th token, where we identify sentence boundaries using spaCy (Honnibal and Montani, 2017). Controlling for topic and length is intended to ensure that models trained with this corpus cannot easily distinguish between documents generated by human or machine authors by learning extraneous features, namely topic and length.
as input prompts. By restricting to
We evaluate our proposed detection approaches using the LWD dataset that we now describe, as well as M4 (Wang et al., 2023), recently-released dataset containing documents generated by multiple L.M five domains. We construct the LWD dataset by generating text with Llama-2, GPT-4, and ChatGPT using prompts of the form write an Amazon review in the style of the author of the following review: <human review), where (human review) is a real Amazon review. Prior work has shown that LLM have some ability to reproduce styles provided through in-context examples (Reif et al., 2022: Patel et al., 2023). Thus, our data generation procedure aims to induce stylistic variety to the extent currently possibly by of-the-a-t LLM, with the goal of increasing the difficulty of our benchmark. More details on the LWD and M4 datasets may be found in Appendix C.
5

---

Published as a conference paper at ICLR 2024
4.2 FEW-SHOT AND ZERO-SHOT DETECTION BASELINES
We compare our proposed few-shot approach to Prototypical Networks (Snell et al., 2017) and MAML (Finn et al., 2017), both prepared using an underlying RoBERTa model and trained with the AAC dataset described in $4.1 together with human -enerated posts to r r/politic and r/Politicalliscussi
where each distinct LLM contributing to the AAC corpus is regarded as a single author. To confirm that the controls for topic and length discussed in $4.1 are also helpful for our baseline approaches, we report additional ablation experiments on these choices in Appendix B. Next, we introduce variations of our proposed approach in which we replace the UAR representation with alternative embeddings, namely SBERT (Reimers and Gurevych, 2019)' and CISR (Wegmann et al., 2022)², the latter being further authorship representation that leverages hard negatives and hard positives at training time. Additionally, we introduce several zero-shot baseline models, including two versions of the OpenAl Detector (Solaiman et al., 2019), one off-the-shed and one that we train ourselves using the AAC corpus and Reddit politics posts. Finally, we include detectors based metrics derived from GPT2-x1 likelihood predictions, including Rank (Gehrmann et al., 2019), LogRank (Solaiman et al., 2019), and Entropy (Ippolito et al., 2020).
4.3 METRICS
We use the Receiver Operating Characteristic (ROC) curve to assess detection performance as the corresponding detection threshold varies. To summarize the ROC curve and compare different methods across operating points, we report the standardized partial area under the ROC curve restricted to the range of operating points corresponding with false alarm rates not exceeding 1,, which we denote by PAUC in this work. This allows us to better compare segh-performing systems, noting that the proposed few-shot learning methods achieve nearly-perfect scores when calculating the area under the entire ROC curve, even when supplied with very few examples generated by LLM of concern. Another rationale for using pAUC that readers worried that users may mistrust systems that raise too many false alarms will be most interested in the range of operating points corresponding with low false-alarm rates. This is intended to help readers arrive at operating points that minimize time-consuming followup inspection. However, we conduct similar experiments in Appendix F using smaller writing samples and for which we report additional metrics, including the usual AUC and FPR "PR@95 995. We calculate pAUC using the roc_auc_ aoc_auc_scom score function from scikit- t-learn (Pedregosa et al., 2011) 1) by specifying the parameter max_ max_fpr=0.0__ 01.
4.4 SINGLE-TARGET MACHINE TEXT DETECTION
In the experiment reported in this section, we assume access to a small in-distribution writing sample generated by a specific LLM of concern, such as ChatGPT. The objective is to identify further writing samples generated by this same model from among the documents in a large collection. This evaluation reflects the setting where one would like to perform targeted detection of a particular LLM. For example, an instructor might like to be alerted to cases where their students may have used a partieular LLM as a writing assistant. In $4.5 we evaluate the same detection approach in the setting where the task is to identify documents generated by any of multiple LLM.
We evaluate all detection approaches considered using the evaluation corpus described in $4.1, which contains documents composed by human authors or LWD models in five domains, namely the Amazon documents we prepared and the documents from M4 drawn from domains other than Reddit, which serves as the primary training domain. All documents are grouped into episodes of N documents by the same human or machine author for the desired value of N, cach document containing maximum of 128 tokens and ending a sentence bounadary.
We apply the following procedure for each detection approach considered and each desired value of N. For each evaluation domain and each LLM contributing episodes in that domain, we take each episode generated by that LLM in turn to serve as the support sample, with all remaining episodes generated by that LLM and all human generatee evaluation episodes serving as queries. However, in the case of the MAMI approach we take only the first 20 episodes by the LLM to serve as support samples due to computational burden. We calculate score for every query indicating how similar it
"https://huggingtt co/ www.eeeeeneeetrrrfforoeee pwwprreeeearppaaaaaeeiiieeeeeeee disse robeerta ta- baasev-
Phttps://huggigg co/ http://maaeaaaamtlyyyeeleeemaaaa

---

Published as a conference paper at ICLR 2024
to the support sample, noting that the way this score is calculated depends the detection method being evaluated. Each score is paired with a label indicating whether the query was composed by the same LLM as the support sample was composed by human author. Finally, we calculate ROC curve based on these scores and labels and its corresponding PAUC value.
The results of this calculation shown in Table 1, which reports the mean and standard error all support samples, all evaluation domains, and all L.M for each detection approach considered and each value of N. The proposed method based on representations of writing style outperforms all other approaches. We note that the ProtoNet detector is trained on the AAC corpus and has 40M more parameters than UAR, so the superior performance of the style representation methods is not a consequence of larger model capacity. In Appendix D we break down these results according to evaluation domain.
Method
Training
PAUC
Dataset
N 5
= 10
Few-Shot Methods
UAR
Reddit (5M)
0.905 (0.001)
0.9806 (0.0006)
UAR
Reddit (5M). Twitter, StackExchange
0,886 (0.001)
0.9676 (0. 0008)
UAR
AAC, Reddit (politics)
0.877 (0.001)
0,9400 (0.0013)
CISR
Reddit (hard negatives, positives)
0.839 (0.001)
0.9331 (0.0013)
ProtoNet
AAC, Reddit (polities)
0.871 (0.001)
0.9475 (0.0014)
MAML.
AAC, Reddit (politics)
0.662 (0.006)
0.6854 (0. (0.0068)
SBERT
Multiple
0.621 (0.002)
0.7157 (0.0022)
Zero-Shot Methods
AI Detector (custom made)
AAC, Reddit (politics) WebText, GPT-x1 BookCorpus, WebText
0.6510 (0.031)
0.6585 (0.0320)
Al Detector (off-the-shell))
0.6028 (0.0250)
0.6011 (0.0249)
Rank
0.5693 (0.0152)
0.5581 (0.0172)
LogRank
BookCorups, WebText
0.7640 (0.0360)
0.7749 (0. (0.0378)
Entropy
BookCorpus, WebText
0.4984 (0.0005)
0,4977 (0.0002)
Random
0.5
0.5
Table I: Single-target detection results. Each model was evaluated on a common corpus of documents involving unseen domains, topics, and LLM, organized into episodes of N documents. The standard errors shown in parenthesis were estimated using bootstrapping.
To study the effect of the number N of documents comprising each episode, we vary N between I and 10, still truncating each document to the nearest sentence boundary before the 128 token. The results are shown in Figure 2a. We observe that the version of UAR trained only with Reddit performs best across the range, although other UAR variants perform well also. Note that stylistic representations do not require AAC data during training to capture the style of machine generators. Indeed, both UAR and CISR outperform methods that require AAC training data.
We also observe that metric-basel approaches like ProtoNet outperform fast-adaptation approaches like MAML, in which a new model is fitted to each support sample in turn. One reason for this may be that MAML is limited inputs of 512 tokens at inference time due its underlying RoBERTa model, which was chosen to match the underlying models used by other baseline approaches. In contrast, metric-based approaches may combine representations of various spans of text together, thus effectively increasing the context from which they make predictions. Another reason for this discrepancy may be that fast-adaptation approaches are more prone to over-fitting the support sample.
4.5 MUL.TIPLE-TARGE: MACHINE TEXT DETECTION
In $4.4 we handled the case of detecting a single target language model. We now extend our formulation to include multiple target language models, given support samples from each model. Namely, for each detection approach and each N we perform the following calculation. For each domain we repeat the following trial 1000 times. For each LLM contributing the evaluation corpus we randomly select a support sample composed by that LLM and take all remaining evaluation episodes serve queries. For each query, we calculate score for each support sample reflecting its similarity to the query, and pair the minimum score with a label indicating whether the query was composed by human an L.M. Finally, calculate the PAUC based on these minimum scores
7

---

Published as a conference paper at ICLR 2024
ProtoNet
UAR Multi-LLM PAUC
PAUC
UAR Mult domain
0.9
0.9
UAR Multi-doman
UAR
CISR
Multi-
LLM
SBERT
UAR
MAMI
0.7
0.7
CISR
Detector
0.6
0.6
SBERT
ProtoNel
3
5
7
Documents
3
5
7
Documents
(a) Single-target detection
(b) Multiplc-target detection
Figure 2: Detection performance as the number of documents N comprising episodes varies.
and labels. The results in Figure 2b show the mean pAUC over all domains, all LLM, and all trials against N for each detection approach.
We find that in this setting, the proposed approach with the multi-LLM authorship model performs best, although the other UAR variants remain competitive, noting that this model is the only authorship model considered which is explicitly trained to distinguish among LLM, including different versions of the same LLM. We also note that the evaluation corpus contributing most the difference the PeerRead component of M4, as shown in Appendix D, where we break down the results of this experiment by evaluation dataset. Otherwise the results are similar for all evaluation domains.
Note that in this experiment, key assumption is that each support sample is known to have originated entirely from one of several L.LM of concern. However, it may possible, say, by manual inspection, to ascertain that each of handful of documents was generated by some L.M,, but not necessarily all by the same L.M. This setting is addressed in Appendix G.
4.6 ROBUSTNESS AGAINST PARAPHRASING ATTACKS
We now test the effectiveness of our proposed approach against an adversary that applies automatic paraphrasing LLM -..-eeeerdteed text evade detection. To simulate this scenario, we paraphrase various evaluation episodes using DIPPER (Krishna et al., 2023) with a lexical diversity parameter of 20% as described below. All episodes in this experiment consist of N 5 documents. We first repeat the procedure described in $4.4 using the version of UAR trained on the comments of 5M Reddit users, except that we now paraphrase a varying proportion of episodes generated by the target LLM other than the support sample. The results of this experiment labeled by UAR Single-tagget in Figure 3, along with the results of the same experiment using the ProtoNet bascline. Unfortunately, both approaches suffer the proportion of queries paraphrased increases, but observe that like the adversary, the detector may also avail of paraphrasing! To this end, we repeat the procedure described in $4.5 with the following modification. For each LLM contributing the evaluation corpus and each episode generated by that model serving as the support sample, we paraphrase varying proportion of the remaining episodes generated by that model and report the minimum of two scores: one reflecting the likelihood that the support sample matches a randomly selected query, and another reflecting the likelihood that paraphrase of the support sample matches randomly selected query. The results of this experiment are labeled by UAR Multi-target in Figure 3. Indeed, including a paraphrase of the support sample mitigates the drop in performance.
5 CONCLUSION
Summary of findings We propose few-shot strategy to detect machine- -ecebrnnggeeetteddd text using style representations estimated from content primarily composed by humans. Our main finding is that style representations afford remarkable ability identify instances of text composed by L.M
8

---

Published as a conference paper at ICLR 2024
PAUC
UNR Multi ger
0.9
UAR Single-target
Prototee
0.8
0.7
0.2
0.4
0.6
Proportion
Figure 3: Mean of pAUC as the proportion of queries is paraphrased. Paraphrasing reduces the detection rate across the low FPR range, but including the paraphrased LLM support sample (UAR Multi-LLM) mitigates the drop in performance.
given only handful of demonstration examples, when those examples were generated with prompts engineered to elicit diverse writing styles. In addition, we illustrate $4.5 that further improvements are possible for multiple-tareet LLM detection by fine-tuning style representations using documents generated by AAC models. Finally, in $4.6 we illustrate that the multiple-target variant of the proposed approach that incorporates paraphrasing is robust against paraphrasing attacks. By focusing our evaluation on the portion of the ROC curve corresponding with false-alarm rate of less than 1,, we seek to emphasize that the proposed methodology represents practically relevant approach to mitigating certain LLM abuses.
Limitations The few-shot detection framework explored in this work assumes access to a handful of documents generated by LLM that users may wish to detect particular domain. As this writing, there are only a small but growing number of such LLM, since only handful of large companies have the resources to train such models. This makes possible to anticipate which LLMs adversary may abuse and proactively train detectors using any of the approaches considered in this work. However, in the future seems plausible that a much larger number of LLM will be available, in which case more reactive approach would be required, such the approach proposed in this paper, where examples of abuse by unknown LLM are assembled to form the required support samples.
Our experiments focus on English since LLM of concern are primarily available in English. However, since the training procedure for the style representations used in our few-shot detection experiments relies only on the availability of author-labeled text, there are no barriers to developing such represen- tations for arbitrary languages other than collecting sufficiently large corpora. We acknowledge that this is easier accomplished for high-resource languages, particularly those that are well-representee in online discourse. For these reasons, we believe that exploring style representations effective in low-resource languages is an interesting avenue for future work.
Broader impact The rapid adoption and proliferation of LLM poses risk of abuse unless methods are developed to detect deceitful writing. The proposed few-shot detection method represents a novel and practical approach to detecting machine-generater text in many settings, including plagiarism in classrooms, social media moderation, and email spam and phishing. The approach may be deployed immediately using readily available, pre- pre-trained style representations and requires only small number of examples generated by LLM of concern. We will release code and checkpoints of our best models to facilitate adoption of the proposed approach.

---

Published as a conference paper at ICLR 2024
REPRODUCING OUR RESULTS
The proposed few-shot detectors were trained using open-source reference implementation of UAR in PyTorch available at https: thub. com/LLNL/LUke using default hyperparameter choices. For the CISR baseline, we used the open-source PyTorch implementation available at https:// github. provided at https: /ttp:::/githbbbb.. style representations et al., 2020). We subsampled this dataset for comments published between January 2015 and Octoher 2019 by authors publishing at least 100 comments during that period. Additionally, we used Amazon reviews and StackExchange discussions in some model variations (Ni et al., 2019), both obtained from existing datasets. The Amazon dataset may be downloaded from https: //iss//nnniioooo//// gi thub. io/ no/amazon/index html and the StackExchange dataset is available from https: //pp//pa...// //pn/.ebbis webis, de/clef21/pane paaee1 wete221webbbtlleleee wtlee/weeleeehanneeee detection. html. We also created two new corpora of machine-generated documents, referenced as AAC and LWD in the main text, which we used respectively for training and evaluation. In the case of AAC, we used publicly-released checkpoints for GPT-2 and OPT, available at the time of this writing from https: http//hggggggaccce/ee/ee// co/models. In the case of LWD, we used the OpenAl API to generate documents with ChatGPT and GPT-4. We generated Llama2 examples using the 11ama2-7B chat model released July 2023, which can be found at https: / /gi thub. com/ www.bookreeeareeeeccoocac aeeearchhllaaa.. 1laam. We trained the style representations using one 8 x A100088GG GPU server, which took under 24 hours for each of the proposed model variations. Fop both UAR and CISR, the resulting style feature extractors have only 82M and 125M parameters respectively, and therefore efficient deploy single GPU.
For ProtoNet and MAML, used the implementations The data used to fine-tune the UAR sampled from publicly available corpus of Reddit comments (Baumgartner
ACKNOWLEDGMENTS
Part of this work was performed under the auspices of the U.S. Department of Energy by Lawrence Livermore National Laboratory under Contract DEAC52-07NA27344 This work was supported by the Office of the Director of National Intelligence (ODNI), Intelligence Advanced Research Projects Activity (LARPA), via the HIATUS Program under contract D2022-2205150003. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies, either expressed or implied, of ODNI, IARPA, or the U.S. Government. The U.S. Government is authorized to reproduce and distribute reprints for governmental purposes notwithstanding any copyright annotation therein.
REFERENCES
Nicholas Andrews and Marcus Bishop. 2019. Learning invariant representations of social media users. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-JCCNLP), pages 1684-1695.
Jason Baumgartner, Savvas Zannettou, Brian Keegan, Megan Squire, and Jeremy Blackburn. 2020. The Pushshift Reddit Dataset. Proceedings of the 14th International AAAI Conference on Web and Social Media (ICWSM), volume 14, pages 830.839.
Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert- Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz I Litwin, Scott Gray. Benjamin Chess, Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, Ilya Sutskever, and Dario Amodei. 2020. Language models are few-shot learners.
Hyung Won Chung, Le Hou, Shayne Longpre, Barret Zoph, Yi Tay, William Fedus, Yunxuan Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, Albert Webson, Shixiang Shane Gu, Zhuyun Dai, Mirac Suzgun, Xinyum Chen, Aakanksha Chowdhery, Alex Castro-Ros Marie Pellat, Kevin Robinson, Dasha Valter, Sharan Narang, Gaurav Mishra, Adans Yu, Vincent Zhao, Yanping Huang, Andrew Dai Hongkun Yu, Slav Petrov, Ed H. Chi, Jeff Dean, Jacob Devlin, Adam Roberts, Denny Zhou, Quoc V. Le, and Jason Wei. 2022. Scaling instruction-finn -inettueed language models.
10

---

Published as a conference paper at ICLR 2024
Mike Conover, Matt Hayes, Ankit Mathur, Jianwei Xie, Jun Wan, Sam Shah, Ali Ghodsi, Patrick Wendell, Matei Zaharia, and Reynold Xin, 2023. Free dolly: Introducing the world's first truly open instruction -otune Ilm.
Alexander D' A'mour, Katherine Heller, Dan Moldovan, Ben Adlam, Babak Alipanahi, Alex Beutel, Christina Chen, Jonathan Deaton, Jacob Eisenstein, Matthew D Hoffman, et al. 2022. Underspeci- fication presents challenges for credibility in modern machine learning. The Journal of Machine Learning Research, 23(1):10237-10227.
Liam Dugan, Daphne Ippolito, Arun Kirubarajan, and Chris Callison-Burch 2020. RoFT: A tool for evaluating human detection of machine-generane text. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pages 189-196,
Online. Association for Computational Linguistics.
Chelsea Finn, Pieter Abbeel, and Sergey Levine. 2017. Model-agnostic meta-learning for fast adaptation of deep networks.
Matthias Gallé, Jos Rozen, Germán Kruszewski, and Hady Elsahar. 2021.
Unsupervised and distributional detection of machine-generatee text. arXiv preprint arXiv:2111.02878.
Sebastian Gehrmann, Hendrik Strobelt, and Alexander Rush. 2019. GLTR: Statistical detection and visualization of generated text. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics: System Demonstrations, pages 111-116, Florence, Italy. Association for Computational Linguisties.
Julian Hazell. 2023, Large language models can be used to effectively scale spear phishing campaigns. arXiv preprint arXiv:2305.069:
Xuanli He, Qiongkai Xu, Yi Zeng, Lingjuan Lyu, Fangzhao Wu, Jiwei Li, and Ruoxi Jia. 2022. Cater: Intellectual property protection on text generation apis via conditional watermarks.
Matthew Honnibal and Ines Montani. 2017. spaCy 2:
Natural language understanding with Bloom embeddings, convolutional neural networks and incremental parsing. To appear.
Daphne Ippolito. Daniel Duckworth, Chris Callison-Burch, and Douglas Eek. 2020. Automatic detection of generated text is easiest when humans are fooled. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 1808-182..
Ganesh Jawahar, Muhammad Abdul-Mageed, and Laks Lakshmanan, V.S. 2020. Automatic detection of machine generated text: A critical survey. In Proceedings of the 28th International Conference on Computational Linguistics, pages 2296-2309, Barcelona, Spain (Online), International Committee on Computational Linguistics.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. A watermark for large language models. In Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, pages 17061-17084. PMLR.
Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Frederick Wieting. and Mohit Iyyer. 2023. Paraphrasing evades detectors of Al-generated text, but retrieval is an effective defense. In Thirty-seventh Conference on Neural Information Processing Systems.
Antonis Maronikolakis, Hinrich Schütze, and Mark Stevenson. 2021. Identifying automatically generated headlines using transformers. In Proceedings of the Fourth Workshop NLP for Internet Freedom: Censorship, Disinformation, and Propaganda, pages 1-6, Online. Association for Computational Linguistics.
Leland McInnes, John Healy, Nathaniel Saul, and Lukas Grossberger. 2018. Umap: Uniform manifold approximation and projection. The Jourmal of Open Source Software, 3(29):861.
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D. Manning, and Chelsea Finn. 2023. Detectgpt: Zero-shot machine- machine-generated text detection using probability curvature, In International Conference Machine Learning.
11

---

Published as a conference paper at ICLR 2024
Niklas Muennighoff, Thomas Wang, Lintang Sutawika, Adam Roberts, Stella Biderman, Teven Le Scao, M Saiful Bari, Sheng Shen, Zheng-Xin Yong, Hailey Schoelkopf, Xiangru Tang, Dragomir Radev, Alham Fikri Aji. Khalid Almubarak, Samuel Albanie, Zaid Alyafeai, Albert Webson, Edward Raff, and Colin Raffel. 2023. Crosslingual generalization through multitask finetuning.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. 2019. Do deep generative models know what they don't know? In International Conference on Learning Representations.
Jianmo Ni, Jiacheng Li, and Julian McAuley. 2019. Justifying recommendations using distantly- labeled reviews and fine-grained aspects. In Proceedings of the 2019 conference on empirical methods in natural language processing and the 9th international joint conference on natural language processing (EMNLP-IJCNLP), pages 188-197.
OpenAl. 2023, ChatGPT API chat/completions.
Available at:
OpenAL. 2023. Gpt-4 technical report.
Ajay Patel, Nicholas Andrews, and Chris Cellsoon-Burchl 2023. Low-resource authorship style transfer: Can non-famous authors be imitated?
F. Pedregosa. G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Pretten- hofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and E. Duchesnay. 2011. Scikit-learn: Machine learning in Python. Journal of Machine Learning Research, 12:2825-2830.
John Platt et 1999. Probabilistic outputs for support vector machines and comparisons to regular- ized likelihood methods. Advances in large margin classifiers, 10(3):61-74.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. 2019. Language models are unsupervised multitask learners. OpenAl blog, 1(8):9
Emily Reif, Daphne Ippolito. Ann Yuan, Andy Coenen, Chris Callison- Burch,, and Jason Wei. 2022. recipe for arbitrary text style transfer with large language models. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 837-848, Dublin, Ireland. Association for Computational Linguistics.
Nils Reimers and Iryna Gurevych. 2019. Sentence-bert Sentence embeddings using siamese bert- networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics.
Rafael A. Rivera-Soto, Olivia Elizabeth Miano, Juanita Ordonez, Barry Y. Chen, Aleem Khan, Marcus Bishop, and Nicholas Andrews. 2021. Learning universal authorship representations. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 913-919, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.
Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. 2023. Can ai- ai-generated text be reliably detected?
Jake Snell, Kevin Swersky, and Richard Zemel. 2017. Prototypical networks for few-shot learning. Advances in neural information processing systems, 30.
Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert- Voss, Jeff Wu, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, al. 2019. Release strategies and the social impacts of language models (arxiv: 1908. 09203). https:/ httsss////uginaace..co satraa-bbae--peai---eeeeeee
Hugo Touyron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava. Shruti Bhosale, Dan Bikel, Lukas Blecher, Cris- tian Canton Ferrer, Moya Chen, Guillem Cucurull. David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, Brian Fuller, Cynthia Gao, Vedanuj Goswami, Naman Goyal, Anthony Hartshorn,
12

---

Published as a conference paper at ICLR 2024
Saghar Hosseini, Rui Hou, Hakan Inan, Marcin Kardas, Viktor Kerkez, Madian Khabsa, Isabel Kloumann, Artem Korenev, Punit Singh Koura, Marie-Anne Lachaux, Thibaut Lavril, Jenya Lee, Diana Liskovich, Yinghai Lu, Yuning Mao, Xavier Martinet, Todor Mihaylov, Pushkar Mishra, Igor Molybog, Yixin Nie, Andrew Poulton, Jeremy Reizenstein, Rashi Rungta, Kalyan Saladi, Alan Schelten, Ruan Silva, Eric Michael Smith, Ranjan Subramanian, Xiaoqing Ellen Tan, Binh Tang, Ross Taylor, Adina Williams, Jian Xiang Kuan, Puxin Xu, Zheng Yan, llyaan Zarov, Yuchen Zhang, Angela Fan, Melanie Kambadur, Sharan Narang, Aurelien Rodriguez, Robert Stojnic, Sergey Edunov, and Thomas Scialom. 2023. Llama 2: Open foundation and fine-tuned chat models.
Yuxia Wang, Jonibek Mansurov, Petar Ivanov, Jinyan Su, Artem Shelmanov, Akim Tsvigun, Chenxi Whitehouse, Osama Mohammed Afzal, Tarek Mahmoud, Alham Fikri Aji, and Preslav Nakov. 2023, M4: Multi-generator, multi-domain, and multi-lingual black-box machine- genieeeeeeeeeeddd text detection.
Anna Wegmann, Marijn Schraagen, and Dong Nguyen. 2022. Same author or just same topic? Towards content-independent style representations. In Proceedings of the 7th Workshop on Representation Learning for NLP, pages 249-268. Association for Computational Linguistics.
L Laura Weidinger, Jonathan Uesato, Maribeth Rauh, Conor Griffin, Po-Sen Huang, John Mellor, Amelia Glaese, Myra Cheng, Borja Balle, Atoosa Kasirzadeh, al. 2022. Taxonomy risks posed by language models. In Proceedings of the 2022 ACM Conference Fairness, Accountability, and Transparency, pages 21 214-229.
Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. 2019. Defending against neural fake news. Advances in neural information processing systems, 32.
Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Vietoria Lin, Todor Mihaylov, Myle Out, Sam Shleifer, Kurt Shuster, Daniel Simig, Punit Singh Koura, Anjali Sridhar, Tianlu Wang, and Luke Zettlemoyer. 2022. Opt: Open pre-trained transformer language models.
A GENERALIZATION OF SUPERVISED MACHINE-TEXT DETECTORS
The experiment reported in this section intended to determine whether discriminative classifiers built on top of pre-trained style representations are more robust to future changes in topic, domain, and language model than those built on top of semantic representations. In order to simulate future scenarios, we train these models with text dealing with certain topics, drawn from certain domains, and with positive examples generated by older language models. Then we evaluate these models with text that may deal with topies, may have been drawn from domains, and with positive examples that may have been generated by newer language models. More information on these datasets, including some example documents we generated, may be found in Appendix C.
First we construct a supervised detector by simply composing an MLP with the UAR model pretrained on the Reddit comments of 5M users. We train this composition using equal amounts of human- and AAC-generated documents, keeping the parameters of UAR frozen. Next, mirroring the approach used by OpenAl's AI Detector, we compose an MLP with RoBERta and train the composition using the same approach as the composition above.
The results are shown in Table 2a. Both approaches perform strongly when evaluated on data drawn from the same domain. dealing with the same topics, and generated by the same LLM as the training data. In fact, the RoBERTa baseline outperforms UAR, particularly the lowest false positive rates, which is illustrated by the ROC curve shown in Figure 4a. However, when the same detectors are evaluated with data dealing with new topics or drawn from new domains, performance drops sharply, as shown in Figure 4b, Figure 4c, Figure 4d. In other words, the UAR+MLP combination is more robust to topic and domain shifts than the baseline. However, the performance of both detectors degrades to the point they would be unreliable as the FPR tends to zero. For example, a FPR of 1% both models reach a TPR of around 40% on LWD datasets. This confirms our expectation about the limitations of using trained classifiers on unseen LWD data.
13

---

Published as a conference paper at ICLR 2024
TPR
RoBERTa
TPR
EAR
0.75
0.75
WAR
0.5
0.5
0.25
0.25
RoB BRT
10
10
FPR
10 2
10
FPR
(a) Evaluation on in-domain AAC data.
(b) Evaluation LWD with in-domain topics.
TPR
TPR
0.75
0.75
0.5
0.5
UAR
UAR
0.25
0.25
RoBERTA
RoBERTa la
10 2
10-1
FPR
10
10
FPR
(c) Evaluated on LWD with out-of-domain topies.
(d) Evaluated on LWD with unseen domains.
Figure 4: ROC curves assessing supervised machine-text detection performance. Both RoBERTa- and UAR-based detectors perform well in-distribution, but performance drops when evaluating data generated by new LLM, new topics, or new domains. The UaR-based detector is more robust to changes in the testing distribution.
14

---

Published as a conference paper at ICLR 2024
Evaluation Set
UAR
RoBERTa
Ablation
pAUC
AAC 0.8551
0,9671
Control Topic and Length
0.844 (0.009)
LWD
0.5401
0.5363
Control Topic Only
0.769 (0.002)
LWD, new topics
0,5262
0.5136
No Control
0.765 (0.002)
LWD, new domains
0.5411
0.5007
Random
0.5
Random 0.5
0.5
(b) Mcan pAUC across on Amazon. Each num- ber is the mcan of the distribution along with the standard error, estimated via bootstrapping.
(a) pAUC scores for UAR and RoBERTa baseline on AAC and LWD.
Table 2: Further experimental results.
Origin
Number of Authors
Number of Documents
StackExchange Twitter Reddit
22,469
2,758.657 370,277,851 3,578,220,305
1,905,705 705
5,199,959
Table Statistics of the human-generated datasets used to train the multi-domain authorship model.
B PROTONET ABLATIONS
order to understand the effect of controlling for topic and length in our AAC training data we per- form the following ablation experiment. To control for length, truncate each machine- and human- authored document to the last sentence boundary before the 64 token. To control for topic, we ensure drawn from only r/politics
that all human-auu aathored documents In the results shown in Table 2b we can see that when we control for topic only, the model is able to shortcut by which to distinguish human from machine authors, resulting
PPoliticalll wta.iiiiiaiissiiiiiiooii
learn document length in relative decrease in PAUC of 8.8% at test time. Further ablating our control of topics has a less significant effect. The best results obtained by controlling for both topic and length, which the variation of ProtoNet we use in the main paper.
C FURTHER DETAILS ABOUT DATASETS
Table 3 shows the numbers of authors and examples contributing to each of the human-generated training datasets used to estimate the style representations used in our proposed few-shot detection method.
We now describe the process we used create our AAC and LWD datasets. For both datasets, used a single set of prompts to create variety of documents. We balanced each dataset with an equal number of human-generated examples before splitting into training, validation and testing splits. We generated the AAC datasets using all possible combinations of the parameters specified in Table 4a. Some statistics of the resulting datasets are shown in Table 4b.
We used a similar approach to generate our LWD datasets. The models used were GPT-4, ChatGPT and Llama-2 22 We prompted each LWD model with a post sampled from either Reddit, Amazon, or
Parameter
Values
Models
GPT2-large, GPT2-X1, OPT-6. 7B, OPT-13B top-p. typical-p
Origin
Train
Valid
Test
Machine
440,721
62,935
125,987 125,987
Decoding Strategies
Human
440,721
62,935
Decoding Values
0.7. 0.95
Total 881,442
125,870
251,974
Temperature Values
0.7, 0.9
Generation Length
512 tokens
Numbers of documents in datasets used train and evaluate authorship models.
(a) Decoding parameters used to generate AAC datasets.
Table 4: Further details about AAC datasets.
15

---

Published as a conference paper at ICLR 2024
Dataset
Prompt Sources
AAC LWD, same topic LWD, different topic LWD, different domains
r/anime, r/MMA, r/movies, r/persomalfinance r r/soccer
Amazon product reviews, StackExchange posts
Table 5: Prompt sources for LLM generation.
LWD LMs
Same topic
New topic
New domain
Machine Generated Texts
16,833
82,105
18,074
Human Written Texts
16,833
82,105 164,210
18,643
Total Texts
33,666
36,717
Table 6: Numbers of documents comprising various LWD splits.
StackExchange containing at least 64 tokens. For documents prompted with Reddit posts, we varied the prompts elicit diverse range of writing styles by specifying some personality traits of the supposed author. Some examples are shown in Table 7. For the documents prompted with Amazon and Stack Exchange posts, we prompted the language model preserve the style of the post. Due to cost, we used GPT-4 to generate only Reddit content, but not Amazon StackExchange.
Finally, in addition to our LWD dataset, we also used the recently-released M4 dataset (Wang et al., 2023) for evaluation. M4 consists of documents generated by multiple language models in multiple domains, including ArXiv, PeerRead, Reddit, WikiHow, and Wikipedia. Because only Reddit is used to prepare the style representations used in experiments, unseen domains for evaluation. M4 includes documents generated by a variety of models, including ChatGPT (OpenAI, 2023), GPT-4 (OpenAI, 2023), Llama-2 (Touvron al., 2023), Davinci et al., 2020), FlanT5 (Chung et al., 2022), Dolly (Conover et al., 2023), Dolly2 (Conover et al., 2023), BloomZ (Muennighoff et al., 2023), and Cohere. Table shows the number of constituent documents from each domain.
total of six
D FURTHER VARIATIONS ON MAIN EXPERIMENTS
In Table 12 and Table 13 we break down the results of the experiments reported in $4.4 and $4.5 respectively by evaluation dataset. The relative performance of different approaches is largely consistent across evaluation datasets. We note that M4 PeerRead stands out as the most difficult corpora in both the single- and taltiple-target scenarios. As noted by Wang et al. (2023), PeerRead exhibits fewer unique unigrams and bigrams, making it more difficult to separate human- from machine-authoree texts on the basis of style alone.
E COMPARISON WITH WATERMARKING
Watermarking involves altering the token distribution of an LLM according to a fixed strat- egy (Kirchenbauer et al., 2023). Because this takes place when documents are generated, the approach assumes a benevolent adversary, a significant limitation relative to our proposed method. In this section we compare our approach to watermarking and also consider a simple mitigation that adversaries may deploy to circumvent watermarking.
We adapt the watermarking procedure outlined in the work cited above to apply watermarks text generated by Llama-2 (Touvron et al., 2023). For this, we follow the same prompting procedure discussed Appendix C to generate documents in the Amazon domain, which we aim to distinguish from real Amazon reviews using both proposed approach and the statistical approach outlined in the reference above. The results in Figure show that given a reasonable amount of text, our few-shot approach outperforms the statistical test.
However, an adversary may apply automatic paraphrasing to watermarked documents to make them less easy to detect. Recalling that explored the robustness of the proposed few-shot approach to
16

---

Published as a conference paper at ICLR 2024
Persona
Example Document
Human Prompt
And the politicians that needed relief in Sandy were opposed to relief during Katrina. And the politicians that needed relief during Katrina Right now theres
were opposed to relief for whatever disaster preceded someone in, like, North Carolina reading about lawmakers who were opposed to Sandy relief but are now asking for relief in Louisiana, and theyre thinking Sure, this backfired *them*, but can safely vote against flood aid Louisiana because theres no way this **exact** thing could happen to me!
Teenager
Ugh, it's just so frustrating how politicians only care about their own interests. It's like they forget that they're re supposed to be serving the people and not just looking out for themselves. I wish they would stop playing politics with people's lives and actually do their jobs.
Concerned Citizen
As a concerned citizen, it's disheartening to see political leaders being hypocritical in times of need. We need to prioritize humanity over political affiliations and offer aid to those who suffer from natural disasters regardless of their location or political beliefs.
Skeptical Optimist
I understand why you might feel skeptical about politicians who were once opposed to disaster relief suddenly asking for it when their own state is affected. However, as an optimist, I believe it's important to focus on the fact that these politicians during times crisis.
recognizing the need for assistance
Pragmatic Realist
As a pragmatic realist, understand that politics often involves inconsistent and hypocritical behavior from lawmakers. However, when it comes to disaster relief, it's important to separate politics from practicality. Regardless of politician's stance relief for previous disasters, the immediate needs of the current disaster should be addressed. As an activist deeply committed to improving disaster relief policies, I find it appalling that politicians would maintain such hypocritical stances on disaster relief. We must recognize the need for and benefits of supporting fellow Americans in times of crisis, regardless of their political affiliations or geographic location.
Passionate Activist
Table 7: Example documents dealing with politics, generated by ChatGPT and prompted according to the desired personality of the author in order to elicit diverse writing styles.
17

---

Published as a conference paper at ICLR 2024
Dataset
Human Example
ChatGPT Example
Amazon
The kids immediately wanted put a puppet show with this (they received a box full of puppets separately), but doubt this will also be used for store and other things. introduce
above-average fixed location-fixed view security camera, it provides SD quality images that can be conveniently viewed from the screen of smart phone.
ArXiv Abstract
density tensor hierarchy for open system dynamics, that recovers information about fluctuations lost in passing to the reduced density matrix.
The motivation for this research comes from the challenges encountered in simulating flows with strong nonequilibrium effects, such as flows wi th high-speed micro-jets, turbulent mixing, and multiphase flows.
Reddit ELI5
For example, this is why there is a differentiation between being depressed (aka depressive episode) and being diagnosed with major depressive disorder.
Now, as you may know, the Wright brothers Orville and wilbur are widely credited with inventing the airplane.
Wikipedia
During the reign of the Shah kings, the Mulkajis (Chief Kajis) or Chautariyas served prime ministers a council Kajis, and sundry officers.
Born in Howard County, Maryland, on December 10, 1832, Carroll was the son of John Carroll, prominent lawyer politician from Maryland.
4 Chautariyas,
Wikihow
You will not always be the most intelligent person in the room, and the farther you get from school, the less book smarts will matter in your day-to-day life.
Whether you want to create collage of memories for special occasion
display your favorite photos in artistic way, Inkscape can make happen.
Table 8: Examples of human text and ChatGPT generations from the Amazon and M4 datasets. truncated to a maximum of 32 tokens.
M4
Peerread
ArXiv Abstract
Reddit EL15
Wikihow
Wikipedia
Machine Generated Texts
13,831
17,340
15,885
14,901
13,677
Human Written Texts
5,203
2,997
2,999
2,999
2,975
Total Texts
19,034
20,337
18,884
17,900
16.652
Table 9: M4 domains and statistics, noting that for evaluation we decline to use Reddit, which serves as our primary training domain.
18

---

Published as a conference paper at ICLR 2024
UAR-5M (original)
PAUC
Watermarking (original)
0.9
0.8
UAR-5V 5 paraphrased)
0.7
0.6
Watormar king (paraphrased)
32
48
64
80
96
112
128
144
Tokens
Figure 5: pAUC of the proposed approach and the watermark detector the number of tokens is varied for the Amazon dataset. The proposed approach is more robust to paraphrase attacks, and achieves equal better results to the watermark detector when the number of tokens is 48.
paraphrasing in $4.6, we now compare the relative robustness of watermarking and our approach the same paraphrasing attacks. We simulate this setting by using DIPPER to paraphrase each watermarked document, setting the lexical diversity parameter to 20%. We repeat the experiment above using the paraphrased documents place of the original watermarked documents. The results shown in Figure 5 suggest that our approach is considerably more robust than the statistical watermarking test.
F EFFECT OF SHORTER TRUNCATION
In order to determine the effectiveness the proposed approach when applied to smaller writing samples, repeat the experiment described in $4.4, this time truncating all support samples and queries to the nearest sentence boundary before the 32nd token. This contrast with the approach applied in the remainder of this work, where truncated all samples and queries to the nearest sentence boundary before the 128 token. We also report two additional metrics, namely the usual area under the ROC curve (AUC) and the false positive rate corresponding with 95% true positive rate (FPR @9STPR). These results are reported in Table 10. Our proposed few-shot approaches continue outperform baseline methods in this setting.
G DETECTION OF UNKNOWN LLM
Our final experiment follows the procedure described in $4.4 with the following modification. To create support samples, we randomly sample N documents generated by LLM from the evaluation dataset. Thus, a support sample need not consist documents by a single LLM, although the query episodes do consist of documents generated by single author, either LLM or human. This experiment reflects the situation where a handful of documents are known to have originated from LLM, but the specific LLM generating each document cannot be attributed. As in $4.4, the detector score reflects likelihood that a given query was generated by any LLM contributing to the evaluation corpus. The results are reported in Table 11.
We continue to see high detection accuracics this detection setting, with the methods based on style representations outperforming other baselines. We now find that CISR performs better than other approaches, although the UAR variants remain competitive. Note that this experiment introduces a train-test mismatch for UAR, since each episode used train UAR consists of documents by the same author, in contrast with the support samples used in the experiment, which typically contain documents by multiple LLMs.
19

---

Published as a conference paper at ICLR 2024
Method
Training Dataset
AUC
PAUC
FPR
Few-Shot Methods
UAR
Reddit(SMM
0.9884
0.9094
0.0533
UAR
Reddit (5M), Twitter, StackExchange
0.9884
0.9118
0.0543
UAR
AAC, Reddit (politics)
0.8913
0.7308
0.3394
CISR
Reddit (hard negatives, positives)
0.9608
0.7973
0.1440
ProtoNet
AAC, Reddit (politics)
0.9791
0.9062
0.0934
MAML
AAC, Reddit (politics)
0.6686
0.5141
0.6555
SBERT
Multiple
0.9673
0.8087
0.1448
Zero-Shot Methods
Al Detector (custom)
AAC, Reddit (politics) WebText, GPT2-XL
0.7238
0.5295
0.5369
AI Detector
0.6933
0.5559
0.7698
Rank
BookCorpus, WebText
0.7301
0.5423
0.6341
LogRank
BookCorpus, WebText
0.9107
0.6395
0.2209
Entropy
BookCorpus, WebText
0.2083
0.4977
0.9667
Random
0,5000
0.5000
Table 10: Mean values of AUC, PAUC and FPR for various detection approaches with episodes of N =
10 documents, each truncated to 32 tokens.
Method
Training
PAUC
Dataset
N
UAR
Reddit (5M)
0.682 (0.002)
0.759 (0.002)
UAR
Reddit (5M), Twitter, StackExchange
0.684 (0.002)
0.706 (0.002)
UAR
AAC, Reddit (politics)
0.640 (0.002)
0.633 (0.002)
CISR
Reddit (hard negative, positives)
0.707 (0.003)
0.779 (0.003)
AI Detector (custom)
AAC, Reddit (politics)
0.660 (0.029)
0.668 (0.031)
ProtoNet
AAC, Reddit (politics)
0.536 (0.001)
0.524 (0.001)
MAMI.
AAC, Reddit (politics)
0.672 (0.007)
0.724 (0.010)
SBERT
Multiple
0.552 (0.001)
0.546 (0.001)
Random
0.5
0.5
Table 11: Results on detection of unknown LLM.
20

---

Published as a conference paper at ICLR 2024
AI Detector (fine-tuned)
UAR Multi-domain
UAR Multi-LLM
ProtoNet
Random
MAML
SBERT
UAR
CISR
Dataset
N
LWD Amazon
0.998
0.999
1.000
0.986
0.581
0.891
0.998
0.648
0.5
10
1.000
1.000
1.000
1.000
0.582
0.886
1.000
0.841
0.5
M4 Arxiv
5
0.989
0.951
0.890
0.996
0.659
0.702
0.951
0.653
0.5
10
1.000
0.990
0.975
1.000
0.641
0.731
0.995
0.713
0.5
M4 PeerRead
5
0.829
0.850
0.914
0.819
0.737
0.643
0.885
0.623
0.5
0.946
0.919
0.977
0.946
0.788
0.683
0.965
0.738
0.5
M4 WikiHow
0.871
0.828
0.862
0.659
0.499
0.538
0.799
0.659
0.5
10
0.980
0.920
0.964
0.814
0.499
0.539
0.918
0.757
0.5
M4 Wikipedia
0.845
0.777
0.801
0.753
0.718
0.670
0.747
0.519
0.5
10
0.979
0.878
0.930
0.919
0.715
0.700
0.866
0.566
0.5
Table 12: pAUC for single target detection experiment in $4.4, broken down by evaluation dataset.
UAR Multi-domain
UAR Multi-LLM
ProtoNet
Random
SBERT
UAR
CISR
Dataset
LWD Amazon
0.999
0.999
1.000
0.999
0.995
0.597
0.5
10
1.000
1.000
1.000
1.000
1.000
0.699
0.5
M4 Arxiv
0.981
0.992
0.982
0.961
0.503
0.774
0.5
1.000
1.000
1.000
0.999
0.502
0.928
M4 PeerRead
0.665
0.994
0.733
0.500
0.500
0.559
0.5
10
0.935
0.998
0.974
0.517
0.499
0.705
0.5
M4 WikiHow
0.969
0.968
0.991
0.505
0.498
0.942
0.5
10
0.999
0.995
0.998
0.522
0..97
0.990
0.5
M4 Wikipedia
0.907
0.956
0.794
0.521
0.502
0.498
0.5
10
0.988
0.999
0.969
0.644
0.503
0.500
0.5
Table 13: pAUC for multi-target detection experiment in $4.5, broken down by evaluation dataset.
21


Reviews:
[{"review_id": "86IwRPF0M6", "reviewer": "Reviewer_4qF2", "summary": "This paper tackles the problem of detecting machine-generated text produced by LLMs. For this the authors leverage a method to extract stylistic features for authorship detection, and use those features in a nearest-neighbour algorithm to attribute a given document to either human or machine. Variants of the methods are presented, depending if the task is to detect human/machine or human/specific-LLMs.\nSomehow surprisingly and contrary to previous work, this specific combination of approach and setting makes the problem tractable and produces very good results (>0.9 AUC).\nThe embeddings are computed with a training data of text generated with \"small\" and less powerful LLMs (GPT2, smaller versions of GPT2) but the evaluation is done on current SOTA models.", "questions": "Will the datasets be released as well to facilitated reproducibility?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "It presents a valuable contribution to an important topic. This is both with respect to the dataset (which hopefully will be released), as well as to the methodology. The setting of few-shot is also more realistic than previous proposals which assumed access to a very large corpus of machine-generated data.", "weaknesses": "The exact setting is not clear, and the presentation of the results under a single value (AUC) makes it hard to assess the impact of this work. In particular, it would be good to see some more examples to get a better intuition. It would seem like the evaluation examples are easily detectable because the LLM mimics the provided persona so well as to insist on it in the generated text (`...as a <persona>, I...` . This might be the reason for the comparably high scores (as opposed to previous work, which generated non-persona guided text instead).\n\nThe field of detecting machine-generated text is still nascent, but this paper seems to miss some relevant references:\n\n* Daphne Ippolito, Daniel Duckworth, Chris CallisonBurch, and Douglas Eck. 2020. Automatic detection of generated text is easiest when humans are fooled.\n\n* Antonis Maronikolakis, Mark Stevenson, and Hinrich Schutze. 2020. Transformers are better than humans at identifying generated text.\n\n* Matthias Gallé, Jos Rozen, Germán Kruszewski, and Hady Elsahar. 2021. Unsupervised and Distributional Detection of Machine-Generated Text", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "fHaUthwGaD", "reviewer": "Reviewer_f5Yg", "summary": "The paper proposes a new approach to detecting machine-generated text using style representations. The authors leverage representations of writing style estimated from human-authored text to effectively distinguish between human and machine-generated text. They demonstrate the effectiveness of their approach through experiments on several datasets and show that their method outperforms previous approaches to detecting machine-generated text.\n\nOverall, the paper presents a novel and potentially promising approach to detecting machine-generated text that could have important implications for identifying and mitigating the risks associated with the use of language models that convincingly mimic human writing. However, the work has strong limitations in training the style representation learning network. Moreover, the comparison to existing approaches is not sufficient.", "questions": "Questions:\n\n- The authors should consider additional qualitative and quantitative metrics to evaluate the specification tasks. The paper adopts only AUROC as the metric. However, others such as F1 and TPR are more reasonable to use. Its is important to consider additional metrics to ensure consistency of performance especially in leveraging these algorithms for a product use case.  The models could be compared based on a perplexity score-based approach to help find the disambiguation between human and ChatGPT-generated text. Here is a reference paper https://arxiv.org/pdf/2301.13852.pdf", "limitations": "", "rating": 3, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "Pros:\n\n\n- The proposed approach leverages representations of writing style estimated from human-authored text, which can effectively distinguish between human and machine-generated text.\n\n- The approach does not rely on samples from language models of concern at training time, which makes it more robust to data shifts and more practical to implement.\n\n- The experiments conducted by the authors demonstrate that their approach outperforms previous approaches to detecting machine-generated text.", "weaknesses": "Cons:\n\n- The approach assumes that documents generated from amply available and cheap (AAC) models are available at training time, which may not always be the case in practice.\n\n- The work has strong limitations in training the style representation learning network. Basically, the writing style can also be changing over time. The existing writing style training dataset may not be powerful enough to cover the whole. The work adopts(and highly depends on) a supervised approach for this, which has many limitations in real applications.\n\n- Moreover, the comparison to existing approaches is not sufficient. More baselines are supposed to be included. Here are the most recent surveys on it. Other representative works are suggested to be included, such as OpenAI's detector and other training-free approaches should be compared because they do not have domain adaption issues.\n https://arxiv.org/pdf/2310.15264.pdf \n\nhttps://arxiv.org/pdf/2310.15654.pdf \n\nhttps://arxiv.org/pdf/2310.14724.pdf\n\n- The authors should consider additional qualitative and quantitative metrics to evaluate the specification tasks. The paper adopts only AUROC as the metric. However, others such as F1 and TPR are more reasonable to use. Its is important to consider additional metrics to ensure consistency of performance especially in leveraging these algorithms for a product use case.  The models could be compared based on a perplexity score-based approach to help find the disambiguation between human and ChatGPT-generated text. Here is a reference paper https://arxiv.org/pdf/2301.13852.pdf\n\n- The approach may not be effective against more advanced language models that can better mimic human authorship.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "suQTqiIljK", "reviewer": "Reviewer_7sQm", "summary": "Few-Shot Detection of Machine-Generated Text using Style Representations\nThe paper introduces a novel method to differentiate human- and LLM-generated text. The method learns style representations from data that is labeled with an author. Afterward, these style representations are extracted from human- and LLM-generated text to obtain a fixed-size representation that is then used to detect LLM-written texts. In particular, the few-shot setting is analyzed where a few \"support samples\" are available for the LLM(s) in question where the extracted style representations are then compared to some \"query samples\" to classify whether they were written by the LLM(s) in question. The similarity between support and query samples is used to determine whether an LLM wrote the text.", "questions": "How is the similarity score between support and query samples calculated?\nSection 4.1:\nWhere is the Amazon dataset coming from? How is it used? Also, in the multi-domain variation?\nSection 4.3: \nThe metric being reported is AUC'. This is rather uncommon. Why not report the normal AUC? Maybe all methods look too similar, then? Also, instead of introducing a new AUC' the authors could have resorted to something more in line with other works, E.g., something similar to FPR95 but reflecting the importance of a low false positive rate. Using the reasoning from section 4.3, a TPR95 (also not in the literature like AUC', but would be more in line with FPR95.). Missing details in the experiment section: Size of training and evaluation corpora, which LLMs are analyzed. It would help if the authors also mentioned that AUC' is normalized.\nSection 4.4: \nThe paper mentions that Reddit is the main training corpus and, therefore, not used for evaluation. This contradicts section 4.1, where Reddit is also in the evaluation corpus. So, how is Reddit used?\nTable 2 shows different methods trained on different training corpora. Since the paper emphasizes that UAR is THE method to perform few-shot LLM text detection, why are the baselines not trained on the same training corpora?\nWhat is the difference between Reddit (5M) and Reddit (used for SBERT) in Table 2\nWhy is Twitter from Table 2 not mentioned in Table 1?\nHow do the authors explain that the proposed UAR (based on SBERT) is still much better than SBERT? The authors emphasize that SBERT is unsuitable as it is trained to capture semantics. So why not use a \"normal\" BERT in UAR?\nRoBERTa (zero shot) is not introduced. What is it exactly?\nSection 4.5:\nThe text mentions \"other UAR variants.\" Are the Multi-LLM and Multi-domain models UAR variants? This should be clarified. Also, again, the same problem as in the other sections: why not train the other methods with this setup?\n\n\nAdditional remarks:\n-Section 4.5, first paragraph, last row: \"the number of posts\" should probably be \"the number of tokens\" or are the descriptions and axis titles wrong in Figure 2?", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "In general, the paper is well-written. The paper tackles a relevant problem: Detecting LLM-written text. Previous work, such as the classifier released by OpenAI, had much worse performance. Also, the approach is new: Instead of supervised training, the method effectively uses pre-trained style representations for the few-shot setting. The results of the experiments look convincing (maybe overly convincing, considering that, for instance, in Table 1, AUC' is almost perfect even for a false positive rate of <= 1%?).", "weaknesses": "I tend to reject the paper. The reasons are the following: 1. In the end, the paper boils down to applying a few methods that learn stylistic and semantic representations to classify a document as human- or LLM-written. There is no new method, and the contribution lies in applying existing methods and creating a training and evaluation corpus for AAC and LWD LLMs (what the authors do not mention as a contribution, and these datasets will not be made available according to the paper). 2. The experiments miss some details, and it is unclear why the proposed UAR is trained on different datasets than the other methods.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "hyN2alFZ02", "reviewer": "Reviewer_pncH", "summary": "This paper presents a new algorithm for the task of AI-generated text detection. AI-generated text detection is a binary classification task of determining whether a given text was written by a human or a language model (like ChatGPT).\n\nThe key idea in this work is that the style of AI-generated text is different from human-written text, and this difference can be captured by a style representation model. First, the authors use a contrastive learning objective to learn style-dependent, but topic-independent representations. The authors leverage outputs from several cheap and readily available LMs (like GPT-2) to train the style representation model.\n\nDuring inference, the authors assume access to a few exemplar samples of AI-generated text from each held-out language model that they consider. Given a candidate query, the authors measure the cosine similarity between the style representation of the query and the style representation of the exemplars. The authors then use a threshold on the similarity score to classify the query as AI-generated or human-written.\n\nThe authors test their approach on ChatGPT / GPT4 / LLAMA-2 generated responses to prompts from Reddit. Using 5-10 exemplars, the authors find their approach to be quite effective at: 1) detecting whether a text was generated by a particular LM; 2) whether the text was generated by any of the held-out LLMs vs human-written.", "questions": "1. After reading the paper, I was a bit confused by the first sentence in Section 3.1, \"The experiments in this paper deal with both the supervised and few-shot learning regimes\". Where exactly were the experiments in the fully supervised regime? Please correct me if I'm wrong, but to the best of my understanding, the model was trained on data from \"Amply Available and Cheap\" LLMs (like GPT2), and then tested on harder LLMs (like ChatGPT) using few-shot style matching on this trained model.\n\n2. I was a bit confused in Section 3.2 on the procedure to build the style representation model. Was the UAR model used as the pretrained base model? Was the recipe inspired by Wegmann et al. (2022) used on top of the UAR model? or were these two different models? In which model was the AAC dataset used?\n\n3. Please mention that ChatGPT / GPT4 / LLAMA-2 were used to create the LWD data in the main body of the paper. This is a crucial experimental detail, and should not be in the Appendix.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. Given the growing risk of plagiarism in college essays and the spread of misinformation using large language models, the topic of the paper is timely and very important.\n\n2. The proposed algorithm in the paper is interesting and based on an intuitive idea: LLM generated text has a different style from human-written text. The authors use an interesting contrastive learning objective to learn a strong style classifier, taking care to ensure the representations are topic-agnostic.\n\n3. The authors use a nice variant of AUC to stress test their algorithm: restricting the AUC range to 0-1%. This is a good metric to evaluate AI-generated text detection algorithms, since the desired false-positive rate is likely to be very low in real-world scenarios.\n\n4. The authors present several various different experimental setups of their few-shot classifier (each of which have practical significance). For instance, the authors study both a) detecting text written by a particular LLM; and b) detecting text written by any LLM. The authors also conduct ablation studies on variants of the style classifier.", "weaknesses": "I have few main concerns with the set of experiments conducted in the paper, which are preventing me from recommending acceptance.\n\n1. *No external baselines*: The experimental results provide no comparisons with existing AI-generated text detection methods like DetectGPT, watermarks, GPTZero, etc [1, 2, 3]. Without these comparisons, it is hard to ground the proposed method in existing literature, and understand how it competes with alternatives. I recommend the authors to measure the performance of at least watermarks [1] and DetectGPT [2] on the Reddit datasets considered in this work.\n\n2. *No experiments measuring robustness to paraphrasing attacks*: It is now well-established that AI-generated text detectors are very brittle against paraphrasing attacks [4, 5], including DetectGPT, watermarks and GPTZero. How robust is the proposed few-shot style classifier against paraphrasing attacks like DIPPER [4, 5]? Given the vulnerability to paraphrasing, it is critical to evaluate AI-generated detectors on this dimension. Moreover, prior work [6] has shown that paraphrasing strips out stylistic elements from text. This might make the proposed approach even more vulnerable to paraphrasing attacks.\n\n3. Minor, but the writing of Section 3 and 4 was confusing (please see the questions below).\n\n[1] - https://arxiv.org/abs/2301.10226  \n[2] - https://arxiv.org/abs/2301.11305  \n[3] - https://gptzero.me  \n[4] - https://arxiv.org/abs/2303.11156  \n[5] - https://arxiv.org/abs/2303.13408  \n[6] - https://arxiv.org/abs/2010.05700", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)