Humanizing the Machine: Proxy Attacks to Mislead LLM Detectors
Authors: Tianchun Wang
Yuanzhou Chen
Zichuan Liu
Zhanwen Chen
Haifeng Chen
Xiang Zhang
Wei Cheng
Venue: ICLR 2025 Poster (2025)
Keywords: machine-generted text detection; evade detection; fine-tuning
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: The advent of large language models (LLMs) has revolutionized the field of text generation, producing outputs that closely mimic human-like writing. Although academic and industrial institutions have developed detectors to prevent the malicious usage of LLM-generated texts, other research has doubt about the robustness of these systems. To stress test these detectors, we introduce a humanized proxy-attack (HUMPA) strategy that effortlessly compromises LLMs, causing them to produce outputs that align with human-written text and mislead detection systems. Our method attacks the source model by leveraging a reinforcement learning (RL) fine-tuned humanized small language model (SLM) in the decoding phase. Through an in-depth analysis, we demonstrate that our attack strategy is capable of generating responses that are indistinguishable to detectors, preventing them from differentiating between machine-generated and human-written text. We conduct systematic evaluations on extensive datasets using proxy-attacked open-source models, including Llama2-13B, Llama3-70B, and Mixtral-8x7B in both white- and black-box settings. Our findings show that the proxy-attack strategy effectively deceives the leading detectors, resulting in an average AUROC drop of 70.4% across multiple datasets, with a maximum drop of 95.0% on a single dataset. Furthermore, in cross-discipline scenarios, our strategy also bypasses these detectors, leading to a significant relative decrease of up to 90.9%, while in cross-language scenario, the drop reaches 91.3%. Despite our proxy-attack strategy successfully bypassing the detectors with such significant relative drops, we find that the generation quality of the attacked models remains preserved, even within a modest utility budget, when compared to the text produced by the original, unattacked source model.

Published as a conference paper at ICLR 2025
HUMANIZING THE MACHINE: PROXY ATTACKS TO MISLEAD LLM DETECTORS
Tianchun Wang' Yuanzhou Chen Zichuan Liu', Zhanwen Chen', Haifeng Chen', Xiang Zhang', Wei Cheng
'The Pennsylvania State University, Uniivesity of California, Los Angeles,
NNanjing University, "University of Virginia, 'NEC Laboratories America (t (tkw5356, xzz89)@psu edu, adrianchenécs uula.edu, zi chhann smail. edu. on, pot 4et det@virginia edu, (haifeng, [aacheng]@nece labs. com
ABSTRACT
The advent of large language models (LLMs) has revolutionized the field of text generation, producing outputs that closely mimic human-like writing, Although academic and industrial institutions have developed detectors to prevent the ma- licious usage of LLM-generated texts, other research has doubt about the robust- ness of these systems. To stress test these detectors, we introduce humanized proxy-attack (HUMPA) strategy that effortlessly compromises LLMs, causing them to produce outputs that align with human-written text and mislead detec- tion systems. Our method attacks the source model by leveraging reinforcement learning (RL) fine-tuned humanized small language model (SLM) in the decod- ing phase. Through an in-depth analysis, we demonstrate that our attack strategy is capable of generating responses that are indistinguishable to detectors, prevent- numan-written We conduct systematic evaluations extensive datasets using proxy-attacked open-source models, including Llama2-13BB Llama3-70B, and Mixtral-8x 7B in both white- and black-box settings. Our findings show that the proxy-attack strat- egy effectively deceives the leading detectors, resulting in an average AUROC drop of 70.4% across multiple datasets, with a maximum drop 95.0% on sin- gle dataset. Furthermore, in cross-discipline scenarios, our strategy also bypasses these detectors, leading to a significant relative decrease of up to 90.9%, while cross-language scenario, the drop reaches 91.3%. Despite our proxy-attack strat- egy successfully bypassing the detectors with such significant relative drops, we find that the generation quality of the attacked models remains preserved, even within a modest utility budget, when compared to the text produced by the origi- nal, unattacked source model.
ing them from differentiating between machine generrtee and human written text.
WARNING: This paper contains Al-generated text that is offensive in nature.
INTRODUCTION
Large language models (LLMs) such as ChatGPT (OpenAl 2023), Llama (Touvron et al. 2023a b Metal 2024) and Mixtral (Tiang et al. (024), have significantly influenced both the industrial and academic landscapes, with vast applications news reporting, story writing, and academic research. However, there are growing concerns surrounding the misuse of these models, including the fabri- cation fake news (Sun et al. 2024). the emergency of malicious content on website (Radivojevic et al. 2024), and the arise of plagiarism (Khalil & Er 2023). Concerns regarding misinformation, plagiarism and copyright (Gao et al., [022]Esss 2023) have prompted some scientific institutions to take stance on the use of Al-generated content in research papers. In response these challenges, there is an increasing emphasis on developing robust and reliable detection methods (Sadasivan)
al. 2023 Lu et al. 2023 Valiaiev 2024) for machine-generann texts.
Authors contributed equally.
Conresponding author.

---

Published as a conference paper at ICLR 2025
The methods for detecting Al Al-generated text ranging from watermarking (Zhao et al. 2023 Kirchen-
bauer
et al.
2023a
SSnnhh & Zou 2023). training- -baed methods for binary classifiers (Chen
et al.
2023b;
Guo al., [023] Yu et al. 2023 Li et al.] 2023) to zero-shot methods (Bakhtin
et al.
2019
Solaiman et al., 2019; Uchendu et al. 2020, Bao et al. [023] Mitchell et al., 2023a
Yang al.
2023a). While these detectors may provide temporary reassurance, their reliabil-
ity and robustness for detecting machine-generated text remain uncertain. Most recent studies have reported detectors are vulnerable when facing attacks (Sadasivan al. 2023 Krishna et al.)
2024 Zhou et al.] 2024, Lu et al., 2023 Jovanović et al. 2024, NNcks et al., 2024] Creo & Pudasaini 2024). The recent research (Nicks et al. 2024) has revealed that detectors are vul- nerable when they are targeted for optimization, meaning language models can be fine-tuned through reinforcement learning to make the texts generated by the fine-tuned model evade de- tection. However, this paradigm is feasible only when the language model is relatively small and weak (c.g.. 7B). For larger and stronger models (c.g.. 70B), the fine-tuning process becomes significantly more costly. As shown in the paper (Nicks et al., 2024). the generated-text qual- ity by the small language model decrease further after fine-tuning, so the fine-tuning parameters (such as B in DPO (Rafailov et al.) 20244) must be carefully set to balance the evasion perfor- mance and the generation quality during fine-tuning, Most importantly, it is typically impossi- ble for hacker to access, fine-tune, and re-deploy the source model within a detection system.
Therefore, there is an urgent need to develop more prac- tical solutions to evade text detection. In our study, we seek to address the following pivotal inquiries: 1) Can devise feasible, cost-effective strategy attack the L.M aligning to the distribution of human-written text? 2) Does our attack strategy bypass the leading detectors while preserving the text generation quality? 3) Does our attack strategy successfully deceive the detectors the same extent as direct attack on the source model? To answer these questions, in this work, we introduce an in- novative yet straightforward attack paradigm that aligns the distribution of the source model with that of human- written text by employing a RL fine-tuned humanized SLM, dubbed HUMPA (humanized proxy attack). Our approach aims to implement lightweight attack the source model by leveraging the distribution shift of a hu- manized SLM, adapting it to the target source model without requiring fine-tuning of the source model itself (as illustrated in Figure [ and D. We provide an in-depth analysis, demonstrating that the HUMPA attack strategy effectively circumvents detectors by making it more challenging to distinguish between machine-generater text and human-written content. We theoretically analyze fine-tuning language models with DPO based on the preference data constructed with the detectors, and demonstrate that attacking with proxy humanized SLM is comparable to directly attacking the source I.I.. Through extensive experiments using proxy-attacked open-source models, includ- ing Ll3ma2-13B, Llama3-70B, and Mixtral-8x -B,, in both white-box and black-box settings, our HUMPA-attack strategy consistently deceives top detectors, resulting in an average AUROC drop of 70.4% across multiple datasets, with a maximum drop of 95.0% a single dataset. In cross- discipline scenarios, HUMPA exhibits a significant relative decrease in detection accuracy of up to 90.9%, while in langulan scenarios, the reduction reaches 91.3%. Notably, the genera- tion quality of the attacked models remains pres-peeserved, maintaining a reasonable utility budget compared to the output from the unattacked source models.
Naching Rest "uman Tort HU/MA
Vakue
Figure 1: The probability distribution of the source model (Llama3-70B) and the HUMPA-attacked source model us- ing humanized Llama3-8B, evaluated on passages from the Open WebText dataset. After the attack, the distribution aligns more closely with that of human- written text.
In summary, we address our contributions as follows:
We propose an attack strategy, HUMPA, which contaminates the source model by aligning its distribution to resemble tuittewrittenn text, using a fine-tuned, humanized small language model.
By providing an in-depth analysis for the attacking process, we theoretically justify that bringing an effectively attacked small model via HUMPA is equivalent to attacking the large model.
Our systematic evaluation across extensive datasets confirms that detectors are consistently de- ceived by proxy-attacked source models in both white-box and black-box settings. Additionally, detectors can be misled by a humanized SLM trained on cross-domain data sources. Despite the evasion, the quality of the texts generated by the compromised models remains preserved.
2

---

Published as a conference paper at ICLR 2025
your review Linda's Cluckin' Good Chicken Wines
Machine-generated Text Detection:
Machine-Like Text
Mapz and Chocas toste This sestoumme doatn's
Yes
Is the Al- generated?
HUMPA:
7
Human- like Text
LLM PEP
+
turthe and Chesser by by the glowing
No
Detector
SLM
Figure 2: Overview of the humanized proxy attack. The attack overrides large model's predictions by using a fine-tuned, smaller, humanized model during decoding. As a result, the LLM produces more human-like text that can deceive detection systems.
RELATED WORK
Machine-generated Text Detection. The widespread adoption of large language models (LLMs) underscores the necessity for reliable methodologies to detect the texts generated by these models. The detection aiming to ascertain if a given text generated by a language model on the condi- tion that the model is known (white-box) or unknown (black-box) (Wu et al. (023). In the era of LLMs, recent efforts are focused on training a binary classifier using mnodel-generan distinguish between LLM-generated and human- written content (Verma et al. 2023) Venkatraman
texts to
ctt al. 2023). However, these methods usually result in limited generalization capabilities when exposed to nut-of-distribbttin data (Pu et al., 2023). Zero-shot approaches detect LLM LLLM-generated text by comparing the differences in performance metrics after statistical perturbation without train- ing. The typical methods including log-probability curvature (DetectGPT (Mitchell al., 2023a) and conditional log-probability curvature (Fast-DetectGPTT (Bao et al., 2023)), normalized log-rank perturbation (DetectLLM (Su et al. (023)) ). N-gram divergence between multiple completions of a truncated passage (DNA-GPT Yang et al. 2202aa),. and the intrinsic dimensionality of generated text (PHD Tulchinskii et al. 2024 ). Binoculars (Hans et al. 2024) evaluates the log perplexity of the given text by leveraging an "observer" LLM, while a "performer" LLM generates next-token predictions. The perplexity of these predictions is then calculated based on the observer's ''s assess- ment. These methods improve the detectors' ability to adapt to new data and source models, and become leading methods machine-generated text detection.
Detection Evasion Methods As L.L--generteed text detectors receive increasing attention, recent research has been conducted on methods for circumventing these detectors. The popular techniques paraphrasing methods, including training an additional model modify the Al-generated con- tent (Sadasivan et al.) 2023 Krishna et al. 2024), in-context optimization (Lu et al. 2023). space
infiltration (Cai & Cui [202)) homoglyph- based rewritten (Creo & Pudasaini, (024). watermark bypassing (Jovanović et al. 22024, Wu & Chandrasekaran Kircheiir et al. (023b). How-
ever, the premise of watermarking involves embedding detectable patterns into generated text prior to its release, typically hosted behind APIs that enforce watermarking. A single strong LLM with accessible weights undermine these threats (Nicks al., 2024). Besides, (Zhou al.. 2024 em- ploys surrogate model to mask and substitute words. (Shi et al., 2024) generates substitution words through a protected L.M. These paraphrasing methods modify prompts or generated con- tent in the text-level, requiring processing of prompts or output texts with each attack launch. An alternative research line focuses on adapting the source model, enabling to generate texts that evade detection. For example, (Nicks et al.) 2024) considers more robust threat model, where the pre-trained model is fine-tuned to maximize the 'humanness' probability of the detector with DPO (Rafailov et al., 2024). However, the effectiveness of DPO in evading detection is contingent on the assumption that the source model is relatively small (e.g., 7B). This makes it challenging to strike balance between maintaining high-quality generated text and successfully evading detection.
3

---

Published as a conference paper at ICLR 2025
Prior works (Ding et al. 2023 Xu al. 2023 indicate the parameter efficient fine-tuning becomes more expensive when dealing with larger models (e.g., 70B). Different from previous works, our work attacks the LLM by using a humanized SLM as a proxy attacker during the decoding phase, to generate text that mimic human writing style while preserving the utility of the generated content.
METHODOLOGY
3.1 TASK DEFINITION.
Text generation. We consider a general framework for text generation processes: given the set of prompts X' and responses y, an auto-regressive model generates an output sequence y (,.... ./]] E y conditional on prompt E X. based on conditional probability distributions (w: [r, M)ee), where each y/2 is single token. For the rest of this paper, we denote machine and hu- man generative processes by M and H respectively, and use TM. to denote their corresponding conditional probabilities. This random process also yields an overall distribution of output text y given prompt æ: P(ylz) = II (Belzz Vet), which for simplicity we also denote by (ty
Machine-Generalee Text Detection. Given prompt-response pair (z, y). detector D is essen- tially a binary classifier, whose task is to detect whether the response is generated from a known language model M or human process H. To align with existing framework, plicit reward function r(z; y) that the detector bases its decisions on, which gives higher reward for human-like texts compared machine-generated texts. We discuss this reward assumption in detail in Section 3.3
assume im-
Detection Evasion. In the task of detection evasion, aim to find new machine generative process M', such that the detector is unable to distinguish texts generated by M' from those by H. In our theoretical analyses, this is formulated achieving an expected reward (y y) on par with the human expected reward, given that the initial expected reward for Mf is much smaller in comparison; in our experiments, we demonstrate the effectiveness of our model by computing the area under the receiver operating characteristic curve (AUROC) and showing a decrease for M' against Mref
3.2 TINE-TUNING THE LANGUAGE MODEL WITH RL
Preference-based RL for language models. Preference-based reinforcement learning (PBRL) leverages human evaluative feedback to optimize model's behavior using RL. Recent studies apply PBRL to LLMs with the hope of aligning the model to match human preferences. To fine- tune pre-trained language model Mf preference dataset D == {(x, y" 3)} is required, where the responses y" y ~ π (-Jar) are sampled from a reference policy 7 rof that could be obtained after supervised fine-tuning (SFT), while preferences y" > y [ are labeled either by system or human annotator, indicating n¹ is preferred over y given the query In PBRI., the preference is assumed to be associated with latent reward function r* To learn this reward from the dataset, the Bradley-Terry model (Bradley & Terry) 1952) is commonly used, which assumes the probability of nd > y' [z satisfies the tollowing:
exp (r"(x, )) ply v/1x)= cxp (x, (z) + cxp (z)))
(I)
follows that the maximun-likelihodd reward learning objective
f- arg max (((,))"))))) log (r(e,, rlx, (x,''))
FER
where o is the sigmoid function. After obtaining the reward r", the RL fine-tuning of a language model follows the objective
w) (x, arg max (
n
Finally, Direct Preference Optimization (DPO) in RRaaallov et al. in equation without learning the reward function, by optimizing the objective
2024) provides a solution for m
T (x)
π <
n f- arg max E. (( "" DDD >DD log a log x To (y
, log not (y²
(3)
87
4

---

Published as a conference paper at ICLR 2025
3.3 EVADE DETECTION VIA HUMANIZED PROXY ATTACK
When using PBRL to fine-tune large language models (LLMs) for detector evasion, the main chal- lenge is the significant computational cost due the large size of the models (e.g.. 70B parameters). Directly fine-tuning such large models for attacks is impractical, so we propose HUMPA, which leverages DPO to fine-tune a smaller language model (SLM). The main idea to fine-tune an SLM towards optimal reward until it reaches the same level of reward for the human process according to a scoring detector, and adapt the LLM to achieve the same expected reward.
Obtaining humanized SLM. DPO fine-tuning technique (Rafailov et al. 2024 Nicks al. can be applied for bypassing detectors. For each prompt x E X in the dataset, sample response pairs (U), V/) are generated by the reference model ą- To obtain the dataset D {(x, y" , )}, preference labels are assigned by comparing a scoring detector's 's human-ness score s(x, v) on the
2024)
responses: if s(I, y1) > sxr v2), assign preference lahel yı1 > 3/2 and let y yı, y y2
otherwise assign y" = 92. y' y The generated dataset D is then used to fine-tune a pre-trained
SLM M.rof with DPO in equation proxy attacker.
As a result, we have humanized SLM denoted as M, as the
We notice that this label assignment process can be approximated by the Bradley-Terry model in equation I when r(zz, y) C- C-s(z, y) with a large constant C' (see Appendix B.I). therefore we will assume the detector follows an implicit reward function r to generate from now on.
Generally, for fine-tuning language model using DPO with preference data from detectors, we have the following lemma characterizing the ability of the fine-tuned model to evade detection (details and proof refer to Appendix :
Lemma 3.1. Given starting reference model M with low reward, there exists hyperparameter 3 such that the optimal model M fine-tuned on the DPO objective in equation 3 achiives the same
expected reward as H: Eg-D.y-rart (1)=) y) Ba y- w-- (z),) v).
(2.
Intuitively, this result is due to the effect of [ on the fine-tuned model: the smaller 3 is, the closer M' approaches optimal reward, while larger 3 results in higher similarity to the reference model and hence higher quality. This is in line with the RL objective in equation in which the term controls the strength of regularization.
Attacking the LLM using humanized SLM. With humanized SLM trained on the DPO objective, our proxy attack HUMPA operates on the LLM's next-token output distribution by multiplying a logit offset for each token probability. This offset is calculated as the ratio between the logits of the prtxc-attacker small model M, and those of the pre-trained reference small model M Formally, at each time step f, given the tokens you. the probability distribution of our proxy-attackes large model M' is calculated as
TM. (ye [x. Mec)) mrtof (1/ (x, 3<tt)
(Mr = Zu.yet
rof M
(yele wee))
(4)
where Zn.y = Ey, TM (yel Mee)
TMa, (ullz.pee)) Wi, (wx (wle)
is the normalization factor and a is the attack
ratio. The term small model, and attempts to approximate the corresponding shift on the large model
TTr, (Me (vllew rot (Mn (x..c)))
captures the distribution shift from pre-trained to fine-tuned on the
Taye f (x.ge)))))) mi (ste (n:))
Prior works (Mitchell et al. 2023b Liu al. 2024a b) suggest taking the logarithm of logits, which allows us to derive the probability distribution from the proxy-attacked model M' as
PMr (yelz,, yet) = softmax (yel (ye|z, v<t) + a (pM. (y (z, y<2) - phd (vll,,8<))) (5)
where rel PM, and pid, the logarithmic logits for the pre-trained large model Mref, the fine- tuned small model M, and the pre-trained small model Mref respectively. Our method tuning at a small scale and applying the attack to the large model through Equation 5 It is important to note that M and M, only need to share the same vocabulary! Compared to generically fine-tuning the large model using DPO, we have the following theorem (for the proof refer to Appendix B.3
If vocabularies does match, methods like those in Gao al. 2024 can he used address this issue.
5

---

Published as a conference paper at ICLR 2025
Theorem 3.2. Assuming the small fine-tuned model M, achieves optinum according the DPO objective with 3 = So, our proposed inference model M' in equation 4 is the same as an alternative large model fine-tuned on the DPO objective with 3 Bo/a.
Theorem 3.2 reveals that the attack ratio a has a similar (but inverted) effect as 3 on the resulting model M larger a leads to higher reward and better detection evasion, while smaller a keeps M' closer to the reference model Mrel, Therefore, a effectively controls the trade-off between evasion performance and quality at the decoding phuse, in contrast to 30 which is applied at fine-tuning.
Finally, combining Theorem 3.2 with Lemma 3.1 we have the following claim for HUMPA.
Corollary 3.3. Given parameter 30 for fine-tuning the SLM M, on the DPO objective equation there exists allack ratio O such that the resulting proxy attacker M' achieves the same expected reward as the human process H according to detector D, thereby evading detection.
EXPERIMENTS
4.1 EXPERIMENTAL SETUPS
Datasets. We conduct a wide variety of empirical studies to show the effectiveness of our method. We follow (Bao al. 2023) to evaluate both the white-box and black- box detectors. We evaluate the detection evasion capability of HUMPA attacked by humanized SLMs on the same dataset, including Open WebText (Gokaslan Cohen 2019), WritingPromppt (Fan et al. 2018) and PubMedQA (Jin) al. 2019). We randomly sample 500 examples of each dataset as human-writte texts. For cross- domain evaluation, detection evasion is performed using humanized SLMs on a different dataset. The experiments conducted on the dioss-discipline corpus GPABench2 (Liu al.] (023), dataset containing titles and abstracts of scientific writing across Computer Science (CS), Physics (PHX), and Humanities and Social Sciences (HSS). Evasion is evaluated on PHX, where the source model is attacked by humanized SLM from CS. and on HSS, where the source model is attacked by a humanized SLM from PHX. The cross- lassuaan evaluation is conducted on WMT-2016 (Bojar et al. 2016), where 150 examples are sampled from the Germany set as human-wir written texts. The humanized SLM is fine-tuned using samples from the English domain.
Evaluation Metrics. Following previous works, we compute the area under the receiver operating characteristic curve (AUROC) evaluate the performance of all detectors. We also provide the results of area under the precision-recall curve (AUPRC) in Appendix. To evaluate the quality of the generated texts (i.e., utility), we adopt the popularly used ROUGE-1, ROUGE-2, ROUGE-L (Chin-) Yew (204)) and BERTScore (Zhang et al. (2119) to evaluate the texts produced by the LLMs during the text generation phase. Detailed explanation of the metrics are in Appendix D
Source Models. To validate our approach for evading detection, we include the most ad- vanced open-source LLMs: Llama2, Llama3, and Mixtral. Specifically, for the base large model, use Llama2- 13B (Llama2- - 3B-Chat), Llama3-70B
3 and Mixtral-8x777 (Mi ral - x 7B- Inst Instruuttv/ 1). We use these source models as the base large models, attacked by small humanized model Llama2-7B (L) - Llama3- 8B (L [Llama3- - Instruct) and Mistral-7B (Mistral- -atttraa----IIstuuueee vv 1), respectively.
The Detectors, We conduct experiments with a variety of strong open-source detectors from prior literature, including RoBERTa-base and RoBERTa-large (Solaiman et al., 2019), the language mod- els trained for detection, the zero-shot detectors Likelihood and Log Rank, the perturbation- -ased zero-shot method DetectGPT (Mitchell et al.) 2023a), DetectLLM (Su al., 2023) and DNA- GPT (Yang et al. 2023a). We also involve Fast- DetectetT (Bao et al.] 2023) that uses a surrogate model respectively to compute the conditional probability curvature for the texts obtained from the sampling model, and Binoculars Hans al. (2024) that computes the ratio of perplexity to cross- perplexity obtained from "observer" and "performer" models.
The Settings. We evaluate the zero-shot methods in two settings, the white-box (source model is known) setting and black-box (source model is unknown) setting (Yang et al.) 2023b Bao et al. 2023). Following (Bao al. 2023), set the surrogate model in each detector to be identical to the source model, whereas in the black-box setting, the surrogate model differs from the source model. We utilize GPT-Neo-22 2. 7B (Black et al. 2021) the surrogate model for all detectors (Bao

---

Published as a conference paper at ICLR 2025
Table I: AUROCs of detectors and generation utility scores on text generated by different models, averaging across OpenWebText, WritingPrompis and PubMedQA from detailed Table and S Appendix E The model name in parentheses after HUMPA refers to the SLM. The generation utilities of texts produced by HUMPA and the source model are within the budget of A. 0.02 and AROUGE- & 0.03. The highest attack results (the greatest relative decrease) are boldfaced, while the lowest attack results underlined for each model.
in
HUMPA (Llama2-7B)
HUMPA
HUMPA
Models
Llama2-1 13B
Llama3-70B
Mixtral-8x7B (Mistral-7B)
(Llama3-8B)
The Generation
Utility
Syent
0.8278
0.8206
0.8276
0.8126
0.8342
0,8281
ROUGE-1
0,2780
0.2517
0.2926
0,2685
0,2911
0.2663
ROUGE-2
0.0972
0.0798
0.1019
0.0929
0.1045
0.0818
ROUGE-L
0.1995
0.1779
0.2078
0.1800
0.2140
0.1863
The White-hox
Setting
Likelihood
0.9995
0.8610
0.9995
0.9070
0.8932
0.4730
LogRank
0.9993
0.8424
0,9991
0.8769
0,9072
0.4598
LRR
0.8547
0.6634
0,8512
0,5084
0,9039
0.3656
NPR
0.9908
0,9148
0.9836
0.8387
0.8747
0.6629
DNA-GPT
0.9815
0.6656
0.9908
0.8410
0.8217
0.3388
DetectGPT
0.8915
0.8430
0.8313
0.7906
0.6353
0.5348
Fast-DetectGPT
0.9949
0.9262
0,9952
0.8864
0.9933
0.4590
The Black-box
Setting
Roberta-base
0.9044
0.7902
0.8225
0.5600
0.6992
0.5506
Roberta-large
0.8874
0.7862
0,8130
0.5556
0.7016
0,6233
(iko)))
0.9961
0.6971
0.9699
0.7338
0.8156
0.3542
LogRank(Neo-22))
0,9850
0.6976
0,9733
0.7203
0.8254
0,3519
(Re(Ne)-).7)
0.9843
0.7773
0.9537
0.5361
0.8210
0.3309
NPR(Neo-2.7)
0.8586
0.6881
0.8574
0.5893
0.7076
0.3639
DNA-GPT(Ncoo2.77
0.7116
0.4295
0.7567
0.5296
0.5983
0.1907
DeuecGPPTTT-31BNeoo22.1
0.8282
0.6209
0.7696
0.5853
0.6760
0.3811
0.9961
0.7389
0.9885
0.7720
0.8758
0.2590
Binoculans(Falcon-BB)
1.0000
0.7896
0.9989
0.8596
0.9353
0.3053
al. 2023). Apart from it, Fast-DetectGPT adpots a GPT-J-6B (Wang Komatsuzaki 2021) as the sampling model in the black-box setting. Binoculars adopts Falcon- 7B the observer and 7B- Baalcon-BB-nntruuee Instruct (Almazrouei et al. 2023) as the performer model. In both settings,
DetectGPT applies T5 3B (Raffel et al.) 2020) as the sampling model to generate the perturbed
texts.
Implementing Details. We divided the dataset into evaluation and training sets. For the Open- WebText, WritingPrompts, PubMedQA, CS, and PHX datasets, we randomly choose 10k training samples each following the setup in (Nicks al. 2024). For the WMT-20016 dataset, all English samples were used as the training set. Then, based on the samples, we prompt the LLMs to gen- erate corresponding texts using 8-token prefix from human-written text as the starting point for the machine-generane
content for dataset OpenWebTee PubMedQA dataset, we use the tokenized question as a prompt for generating answers with the LLMs. For the cross-discipline scientific abstract dataset, we use the tokenized title as the prompt. We employ the temperature of 1.0 across all the experiments, which is the same setting (Nicks) et al. 2024). During the DPO fine-tuning phase, we apply Low-Rank Adaptation (LoRA) to fine- tuning the SI.M, setting the batch size to 8, the learning rate to 4, and the optimizer to Adam We choose the attack ratio from the set {0.1, 0.2. 1.0] to balance the generation utility and the detection evasion performance. We conduct the experiments on a server with 4 NVIDIA A.00 GPUs, each one with 80GB RAM.
WritingPrompts and WMT-2016. For the
4.2 MAIN RESULTS
White-box and black-box machine-generated detection evasion. We study the basic question of the feasibility of whether LLMs can generate human-likk texts that, within utility budget, can deceive detectors when attacked by small humanized language model. Table lists the evaluation of our method with mainstream LLM detection methods in white- and black-box settings averaging

---

Published as a conference paper at ICLR 2025
text generated by different models on HSS. The humanized SLM is fine-tuned from PHX. The generation utilities of texts produced by HUMPA and the source model are within the budget of Bet S 0.02 and AROUGE-1 S 0.03.
Table 2: AUROCs of detectors and generation utility
HUMPA
HUMPA (Llama3-8B)
HUMPA
Models+
Llama2-13B
Llama3-70B
Mixtral-8x7B
(Llama2-7B) BB)
(Mistral-7B)
The Generation
Utility
SBen
0.8291
0.8201
0.8007
0.7976
0.8105
0.7997
ROUGE-1
0.2632
0.2385
0.2506
0.2277
0.2381
0.2104
ROUGE-2
0.0535
0.0459
0.0513
0.0448
0.0447
0.0364
ROUGE-L
0,1470
0.1315
0.1383
0.1299
0.1334
0.1178
The White- box Setting
Likelihood
1.0000
0.8706
0,9999
0.8317
0.8145
0.4925
LogRank
0.9997
0.8575
0.9976
0.7842
0.8244
0.4670
LRR
0.8096
0.6536
0.4530
0.3323
0.7862
0.3387
NPR
0.9993
0.9414
0.9954
0.9327
0.9226
0,8313
DNA-GPT
0.9622
0.7278
0.9985
0.7534
0.6946
0.2822
DetectGPT
0.9338
0.8306
0,9170
0.8081
0.5982
0,5796
Fast- Dast-DetectGPT
0.9965
0.9365
0.9961
0.9739
0.9700
0.5333
The Black-box
Setting
Roberta-base
0.8550
0.7608
0.7399
0.6119
0.6895
0.5583
Roberta-large
0.8304
0.7291
0.7298
0.5819
0.6733
0,5934
Likelihood(Nee-2.7)
0,9590
0.7121
0,9403
0.5987
0.6679
0.3149
LogRank(Neo-2.77
0.9617
0.7057
0.9343
0.5553
0.6587
0,2879
LRR(Neo-2.7)
0.9384
0.6624
0.8717
0.3780
0.5816
0,2153
NPR(Neo-2.7)
0,9422
0.7511
0.9226
0.7528
0.8010
0.6218
DNA-GPTE (e.oo)))))))
0,9113
0.5827
0.9672
0.5760
0.6320
0,2082
0.8160
0.6510
0,8026
0.6788
0.6993
0,5371
Fast- Binoculars(Falcon-7B) 0.9971
0.9891
0.7488
0.9839
0.6296
0.7827
0,5333
0.7869
0.9990
0.7094
0.8252
0.1852
across three datasets for each model. Following prior work (Nicks et al.) 2024), the SLM is fine- tuned with DPO against a scoring detector, our experiments, we use Fast-DetectGPT for scoring. From the results, we find that LLMs attacked by the humanized small model are effective against all detection methods, showing greater AUROC relative decrease the black-box setting compared to the white-box setting for each detector and for each model. Furthermore, find that in the white- box setting, DetectGPT is the most robust method across the models compared to others, whereas LRR exhibits greater decrease than the other methods when detecting texts generated by Llama3- 70B, which has been attacked by the humanized small model Llama3-8B, as well as texts produced by Mixtral-8x7B, which have been attacked by Mistral-7B. Additionally, has more fragile than the other methods for HUMPA (Llama2-7B), with relative decrease 32.0% and 39.6% in the white-box and the black-box setting respectively. In the black-box setting for Fast- DetectGPT, HUMPA (Mistral-7B) exhibits the highest AUROC relative decrease compared to other methods and models, achieving a relative decrease of 70.4%, within budget of A Aert S 0.02 and ARouge-1 < 0.03 for the produced texts.
find that DNA-GPT
4.3 RESULTS IN CROSS-DOMAIN SCENARIOS
In real-world scenarios, SLM proxy attacker may be unaware of the specific dataset that will be used evaluate the detectors. We simulate two common real-world scenarios. The first class- room test, where the task is to write scientific essay based on a given title, and the SLM proxy at- tacker is fine-tuned on different academic discipline. The second scenario involves cross-language evasion, simulating international hacker attempting bypass detectors using humanized SLM fine-tuned another language.
Cross Cross-discipline Detection Evasion. We assess HUMPA cross-disciplinay datasets, randomly selecting 200 human-written texts for each dataset. Specifically, we evaluate the detection methods on HSS. shown in Table 2 using the source models attacked by the humanized SLM which was DPO fine-tuned on the PHX dataset. As demonstrated in Table 2 HUMPA successfully evaded all detection methods across all source models. Notably, DNA-GPT shows 24.4% relative decrease
8

---

Published as a conference paper at ICLR 2025
compared to Llama2-13BB 13B and 59.4% decrease compared to Mixtral-8x7B in the white-bos box setting, and 36.1% decrease compared to Llama2-133 and 77.6% relative decrease compared to Mixtral- 8B in the black-box setting. We also perform assessment on PHX using humanized SLMs fine-tuned on the CS dataset (see Table 6 in Appendix
Cross-language Detection Evasion. In this scenario, we assess the de- tectors on texts generated by LLMs in Germany, while the humanized SLM is fine-tuned using English. For evaluation, we sample 150 human-
White-boo
Black-bor
Roberta
large
Likelhood
Thas Date
DNA-GFT
DetectGPT
0.6
0.6
HUNPA-R base
0.4
HUNPA-Roberta large
written texts. The results are pre- sented in Appendix Table 7 The findings include: 1) In the white-box setting, LRR is the most fragile de- tector when evaluating on the texts generated by the attacked Llama2- 13B and Llama3-700 70B, with relative decrease 74.3% and 72.6% respec- tively. 2) In the black-box set- ting. when Llama2-13B is attacked by HUMPA (Llama2-7B), the zero-shot detectors Likelihood and LogRank experience a relative performance drop of 91.3% and 90.1 90.1%, respectively. Fast-DetectGPT has relatively decrease 74.8% and 79.2% when evaluating the texts generated by the attacked Llama3-700 and Mixtral-8x7B.
HUNPA-Lbellood
HUNPA-DNA-CPT
HUMPS-Detectar
-10-1
10"1 False Fositive Rate
10a
10
30
10a
False Posi live Rate
(a) ROC Curves
Figure 3: ROC curves in log scale evaluated on Writ-
ingPrompts, where the source model is Mixtral-8x7BB 'HUMPA-' denotes this detector is evaluated on the texts produced by the attacked model.
4.4 EXPERIMENTAL ANALYSIS
Interpretation of AUROC. In real-world scenarios, focus goes beyond overall detection accuracy; we prioritize recall (the true positive rate) while striving to minimize type-I errors, aiming for a low false positive rate. As shown in Figure 3 Fast-DetectGPT exhibits relative decrease of 95.8% in TPR at 1% FPR, while Likelihood, Lo- gRank, and DNA-GPT all experience relative decrease of over 80% in the white-box setting. In the black-box setting, Fast-DetectGPT and DNA- GPT show the largest and second- largest relative decreases, 89.4% and 87.5% %,, respectively.
303
0034
(P03 Lit InNEstaamm
(a) Aere vs. AAUROC
(b) AROUGE-1 vs. AAUROC
Figure 4: Analysis of RoBERTa-base evaluated on texts generated by DPO (Llama2-13B) where DPO refers the direct fine-tuning of Llama2- 13B, and on texts generated by HUMPA (Llama2-7B).
Utility Preserving. We evaluate the Roberta-base the texts generated by directly fine- tune Llama2-13B against the scoring detector Roberta-large, following the approach in (Nicks) ett al.] 2024). In comparison, Roberta-base is evaluated the texts generated by Llama2- 13B attacked using a humanized SLM Llama2-7B via our method HUMPA The texts gener- ated by DPO (Llama2-13B) are obtained by fine-tuning Llama2-13B for to 10 epochs, while the results from HUMPA (Llama2- 7B) are produced by varying the attack ratio a from 0.1 to 1.0. We present the AUROC decrease (AAUROC) with respect to the BERTScore decrease (ASpen) for both methods in Figure ((a) and AAUROC with respect to the ROUGE-1 decrease (AROUGE-1) in Figure (bb) The figures clearly show that both methods deceive
Febe Aie load
Fate to koae Lat
Ria Dosetom
(a) AUROC
(b) AUROC v.s. B
Figure 5; Analysis of attack ratio a and / in DPO

---

Published as a conference paper at ICLR 2025
the detector but incur some utility loss. However, for comparable AUROC decrease, attack method HUMPA results in less utility loss.
Analysis of We evaluate several black-box detectors the texts generated by the at- tacked Llama2-13B model, using the humanized SLM Llama2-7B fine-tuned with / = 0.1 with varying attack ratio a, 100 samples randomly selected from WritingPrompts dataset. The trend in ((a)showsss the AUROC decrease as a increases (more analysis re- fer to Appendix H).
Table 3: Time comparison between HUMPA and directly fine-tuning the source LLM using DPO. 'Sampling' refers the stage of sampling response pairs, 'Fine-tuning" represents DPO fine-tuning using LoRA, and 'Inference" is the process of generation.
Analysis of B. To analyze the parameter 3 of the fine-tuned SLM, we measure its impact on the AUROC performance of var- ious detectors with respect to different val- ues |3 DPO. The evaluation con- ducted using several black-box detectors, We maintain the attack ratio of the human- ized SLM at 0.5, The results, shown in Fig- ure [(b] suggest that detectors exhibit in- creased vulnerability 3 decreases.
Llama2-
Llama3- Mixtral-xx77
Sampling (hrs)
18.61
41.64
63.52
Fine-tuning (hrs)
3.09
9.54
13,58
Inference (sees)
12.88
27.87
32.51
HUMPA
HUMPA
HUMPA
(Llama2-78
(Llama3 8B)
(Mistral-7B)
Sampling (hrs)
13.87
10.97
10.83
Fine-tuning (hrs)
2.04
3.20
1.39
Efficiency. As described in Section 3.3 fine-tuning the model with DPO requires
Inference (secs)
39.87
47.22
36.75
a preference dataset, which is generated by sampling response pairs (y1, y2) from the model. To directly fine-tune the source model, preference pairs are sampled from the source model itself. In contrast, HUMPA samples pairs from the SLM, as the SLM is the model that needs to be fine-tuned. We compare the runtime of HUMPA with prior work (Nicks al., 2024). which samples pairs from the source model and apply DPO fine-tuning on the source model for 10k training samples. To com- pare the ane-tuning time, we set the DPO batch size and epoch 5. The results are in Table We find that HUMPA is much more efficient than directly DPO fine-tuning attack the source model. We also report the inference time for a single pass with a batch size of 1. The inference time of HUMPA is slightly slower than that of the source model, but the sacrifice is not significant.
5
CONCLUSION
The rapid evolution of potent Large Language Models (LLMs) underscores the critical necessity for robust detection methods. In this paper, we propose plug-and -nd--aayyyyyy attack strategy, HUMPA, that utilizes a small proxy model to contaminate the source models, aligning their distribution with human-like distribution. Additionally, we theoretically justify bringing an effectively attacked small model via HUMPA is equivalent to attacking the large model. Our systematical experiments vali- date HUMPA remains versatile across diverse text sources cross-domain sources. In light of our results, we argue that the leading zero-shot machine generated text detectors are not robust to adver- saries and may even favor machine gennerated text over actual human- -ennerttd content. In conclu- sion, our innovations offer compelling support to the urgent demand for robust detection methods within the realm of LLM development, bridging critical gaps in developing reliable detectors.
ETHICS STATEMENT
The primary goal of this paper is not to provide a technique for evading machine- seeberee-geeertedd text de- tection systems, but rather to highlight the vulnerabilities present in current detection mechanisms. With the growing availability of LLMs, often released with publicly accessible tokens and freely available for use, it becomes easier for adversaries exploit these models by employing smaller proxy models to compromise their outputs effortlessly, which would potentially circumvent detec- tion systems. This study serves call to action for the broader research community prioritize the development of more robust detection methods. We aim to raise awareness of the potential risks posed by such attacks and emphasize the need for future research focused on strengthening text detection systems. We are confident that, with increased attention and effort, the community will devise more sophisticated techniques to enhance the robustness and reliability of machine-generatee text detection in the face of evolving adversarial threats.
10

---

Published as a conference paper at ICLR 2025
REFERENCES
Ehtesam Almazrouei, Hamza Alobeidli, Abdulaziz Alshamsi, Alessandro Cappelli, Ruxandra Co- jocaru, Mérouane Debbah, Étienne Goffinet, Daniel Hesslow, Julien Launay, Quentin Malartic, et al. The falcon series of open language models. Preprint arXiv:2311. 2023.
Anton Bakhtin, Sam Gross, Myle Ott, Yuntian Deng, Marc' Aurelio Ranzato, and Arthur Szlam. Real or fake? learning to discriminate machine from human generated text. Preprint DrXiv:/906.03:330 2019.
Guangsheng Bao, Yanbin Zhao, Zhiyang Teng, Linyi Yang, and Yue Zhang. Fast-detectgpt: Efficient zero-shot detection of machine- seniineeeeeeated text via conditional probability curvature. Preprint arXiv:2310.05/ 2023.
Sid Black, Leo Gao, Phil Wang, Connor Leahy, and Stella Biderman. Gpt-neo: Large scale autore- gressive language modeling with mesh-tensorflow. 58(2), 2021.
Ondrej Bojar, Rajen Chatterjee, Christian Federmann, Yvette Graham, Barry Haddow, Matthias Huck, Antonio Jimeno Yepes, Philipp Koehn, Varvara Logacheva, Christof Monz, et al. Find- ings of the 2016 conference on machine translation (wmt16). In First conference on machine franslation, pp. 131-198. ACL, 2016.
Ralph Allan Bradley and Milton E Terry. Rank analysis of incomplete block designs: I. the method of paired comparisons. Biometrika, 39(3/4):324-34) 1952.
Shuyang Cai and Wanyun Cui. Evade
chatgpt detectors via a single space.
Preprint
rrXiv:2307.02599 2023.
Charlie Chen, Sebastian Borgeaud, Geoffrey Irving, lean-Baptiste Lespiau, Laurent Sifre, and John Jumper. Accelerating large language model decoding with speculative sampling. Preprint arXiv:2302.01318, 2023a.
Yutian Chen, Hao Kang, Vivian Zhai, Liangze Li, Rita Singh, and Bhiksha Raj. Gpt-sentinel: Distinguishing human and chatgpt generated content. Preprint arXiv:2355.07669, 2023b.
Lin Chin-Yew Rouge: A package for automatic evaluation of summaries. In Proceedings of the Workshop Text Summarization Branches Out, 2004.
Aldan Creo and Shushanta Pudasaini. Evading ai- ti-generated content detectors using homoglyphs.
Preprint arXiv:2406. 1239, 2024.
Ning Ding, Yujia Qin, Guang Yang, Fuchao Wei, Zonghan Yang, Yusheng Su, Shengding Hu, Yulin Chen, Chi-Min Chan, Weize Chen, al. Parameter-efficient fine-tuning of large-scale pre-trained language models. Nature Machine Intelligence, 5(3):220-25 235, 2023.
Holly Else. By chatgpt fool scientists. Nature, 613:423, 2023.
Angela Fan, Mike Lewis, and Yann Dauphin. Hierarchical neural story generation. Preprint arXiv:1805.0483. 2018.
Catherine A Gao, Frederick M Howard, Nikolay S Markov, Emma C Dyer, Siddhi Ramesh, Yuan Luo, and Alexander Pearson. Comparing scientific abstracts generated by chatgpt to original abstracts using artificial intelligence output detector, plagiarism detector, and blinded human reviewers. BioRxiv, pp. 2022-1 12, 2022.
Zhaolin Gao, Jonathan D Chang, Wenhao Zhan, Owen Oertell, Gokul Swamy, Kianté Brantley, Thorsten Joachims, J Andrew Bagnell, Jason D Lee, and Wen Sun. Rebel: Reinforcement learning via regressing relative rewards. Preprint arXiv:2404.11667, 2024.
Aaron Gokaslan and Vanya Cohen. Openwebtext corpus.
http://8ky/Loon00.qittt 1o/
CreewWebbexttorpppu 2019.
Biyang Guo, Xin Zhang, Ziyuan Wang, Minqi Jiang, Jinran Nie, Yuxuan Ding, Jianwei Yue, and Yu- peng Wu. How close is chatgpt to human experts? comparison corpus, evaluation, and detection. Preprint arXiv:2301.072 2023.
11

---

Published as a conference paper at ICLR 2025
Abhimanyu Hans, Avi Schwarzschild, Valeriaa Cherepanova, Hamid Kazemi, Aniruddha Saha, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Spotting llms with binoculars: Zero-shot detection of machine-generane text. Preprint arXiv:2401.12070 2024.
James Huang, Sailik Sengupta, Daniele Bonadiman, Yi-an Lai, Arshit Gupta, Nikolaos Pappas, Saab Mansour, Katrin Kirchhoff. and Dan Roth. Deal: Decoding guage models. Preprint arXiv:2402.06144 2024.
seading--mmeeee time aligmment for large lan-
Albert Q Jiang, Alexandre Sablayrolles, Antoine Roux, Arthur Mensch, Blanche Savary, Chris Bam- ford, Devendra Singh Chaplot, Diego de las Casas, Emma Bou Hanna, Florian Bressand, et al. Mixtral of experts. Preprint arXiv:2401.0e4 044088 2024.
Qiao Jin, Bhuwan Dhingra, Zhengping Liu, William W Cohen, and Xinghua Lu. Pubmedqa: A dataset for biomedical research question answering. Preprint arXiv:199.006 14,,06664,6600 2019.
Nikola Jovanović, Robin Staab, and Martin Vechev. Watermark stealing in large language models.
Preprint arXiv:2402. 19361, 2024.
Mohammad Khalil and Erkan Er. Will chatgpt g et you caught? rethinking of plagiarism detection. In HCI, pp.
Springer, 2023.
Maxim Khanov, Jirayu Burapacheep, and Yixuan Li. Args: Alignment reward-guided search. Preprint arXiv:2442.00169/ 2024.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In ICML. pp. 17061-17084, 2023a.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. On the reliability of water- marks for large language models. Preprint arXiv:2.366.0663 2023b.
Kalpesh Krishna, Y Song, M Karpinska, Wieting, and M lyyer. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense, march 2023. Preprint arXiv:2303. 13408.
Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit lyyer. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. NeurlPS, 36, 2024.
Yafu Li, Qintong Li, Leyang Cui, Wei Bi, Longyue Wang, Linyi Yang, Shuming Shi, and Yue Zhang. Deepfake text detection in the wild. Preprint 2rXiv:2305. 2023.
Alisa Liu, Xiaochuang Han, Yizhong Wang, Yulia Tsvetkov, Yejin Choi, and Noah A Smith. Tuning language models by proxy. Preprint arXiv:2401.88665, 2024a.
Tianlin Liu, Shangmin Guo, Leonardo Bianco, Daniele Calandriello, Quentin Berthet, Felipe Llinares, Jessica Hoffmann, Lucas Dixon, Michal Valko, and Mathieu Blondel. Decoding-time realignment of language models. Preprint arXiv:2402.02992. 2024b.
Zeyan Liu, Zijun Yao, Fengjun Li, and Bo Luo. Check me if you can: Detecting chatgpt-generated academic writing using checkgpt. Preprint arXiv:2306.05524, 2023.
Ning Lu, Shengcai Liu, Rui He, Qi Wang, Yew-Soon Ong, and Ke Tang. Large language models can be guided evade ai- ai-generated text detection. Preprint arXiv:2305. 10844 2023.
AI Meta. Introducing meta llama 3: The most capable openly available Ilm to date. Meta AI, 2024.
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher Manning, and Chelsea Finn. De- tectgpt: Zero-shot generaee text detection using probability curvature. In 2023,
Eric Mitchell, Rafacl Rafailov, Archit Sharma, Chelsea Finn, and Christopher D Manning. An emulator for fine-tuning large language models using small language models. Preprint arXiv:2310.129622 2023b.
Charlotte Nicks, Eric Mitchell, Rafael Rafailov, Archit Sharma, Christopher Manning, Chelsea Finn, and Stefano Ermon. Language model detectors are easily optimized against. In ICLRR 2024.
12

---

Published as a conference paper at ICLR 2025
OpenAl. Chttpp/.._ttrss///pppaa....o.oap 2023.
Jiameng Pu, Zain Sarwar, Sifat Muhammad Abdullah, Abdullah Rehman, Yoonjin Kim, Parantapa Bhattacharya, Mobin Javed, and Bimal Viswanath. Deepfake text detection: Limitations and opportunities. In IEEE symposium on security and privacy (SP), 2023.
Kristina Radivojevic, Matthew Chou, Karla Urquiil,, and Paul Brenner. Human perception of Imm-generated text content in social media environments. Preprint arXiv:2409.0660 06653, 2024.
Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. Direct preference optimization: Your language model is secretly a reward model. NeurlPS, 36, 2024.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. JMLR, 21(140): 1-611 2020.
Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? Preprint arXiv:2303. 2023.
Zhouxing Shi, Yihan Wang. Fan Yin, Xiangning Chen, Kai-Wei Chang, and Cho-Jui Hsieh. Red teaming language model detectors with language models. Transactions of the Association for Computational Linguistics, 12:174-189, 2024.
Karanpartap Singh and James Zou. New evaluation metries capture quality degradation due to 11m watermarking. Transactions Machine Learning Research, 2023.
Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert-Vor Jeff Wu, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, et al. Release strategies and the social impacts of language models. Preprint arXiv: 09203, 2019.
Jinyan Su, Terry Yue Zhuo Di Wang, and Preslav Nakov. Detectlim: Leveraging log rank informa- 2023.
tion for zero-shot detection of machine-gen -eaerreee text. Preprint
Yanshen Sun, Jianfeng He, Limeng Cui, Shuo Lei, and Chang-Tien Lu. Exploring the decep- tive power of unnggenertted fake news: A study of real-world detection challenges. Preprint arXiv:2403. 18249, 2024.
Edward Tian and Alexander Cui. Gptzero: Towards detection of ai-gered text using zero-shot and supervised methods", 2023. URL httpp:s/////:teee me
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. Preprint arXiv:2302.1397.. 2023a.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Niko- lay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open founda- tion and fine-tuned chat models. Preprint arXiv:2307 2r7.v:2307.09288, 09288, 2023b.
Eduard Tulchinskii, Kristian Kuznetsov, Laida Kushnareva, Daniil Cherniavski,, Sergey Nikolenko, Evgeny Burnaev, Serguei Barannikov, and Irina Piontkovskaya. Intrinsic dimension estimation for robust detection of ai-generated texts. NeurIPS, 36, 2024.
Adaku Uchendu, Thai Le, Kai Shu, and Dongwon Lee. Authorship attribution for neural text gen- eration. In EMNLP, pp. 8384 8395, 2020.
Dmytro Valiaiev. Detection of machine-generated text: arXiv:2402.01642, 2024.
Literature survey.
Preprint
Saranya Venkatraman, Adaku Uchendu, and Dongwon Lee. Gpt-who: An information density-based machine--ennrated text detector. Preprint arXiv:2310.06202, 2023.
Vivek Verma, Eve Fleisig, Nicholas Tomlin, and Dan Klein. Ghostbuster: Detecting text ghostwrit- by large language models. Preprint 230. 2023.
13

---

Published as a conference paper at ICLR 2025
Ben Wang and Aran Komatsuzaki. GPT-J-6B: A 6 Billion Parameter Autoregressive Language Model. htttts://gggttii com /wtomm/iiooooooz///ooooooo
jax May 2021.
Junchao Wu, Shu Yang, Runzhe Zhan, Yulin Yuan, Derek F Wong, and Lidia S Chao. A sur- detection: Necessity, methods, and future directions. Preprint arXiv:2310. 2023.
vey on llm-gernerated
Qilong Wu and Varun Chandrasekaran. Bypassing Ilm watermarks with color-aware substitutions. Preprint arXiv:2403. 14719, 2024.
Lingling Xu, Haoran Xie, Si-Zhao Joe Qin, Xiaohui Tao, and Fu Lee Wang. Parameter-efficient fine-tuning methods for pretrained language models: A critical review and assessment. Preprint arXiv:2312.12 12 2023.
Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. Safedecoding: Defending against jailbreak attacks via safety-aware decoding. arXiv preprint arXiv:2402.08983, 2024.
Xianjun Yang, Wei Cheng, Yue Wu, Linda Petzold, William Yang Wang, and Haifeng Chen. Dna-gpt: Divergent n-gram analysis for training-free detection of gpt-generated text. Preprint arXiv:2305.17359 2023a.
Xianjun Yang, Liangming Pan, Xuandong Zhao, Haifeng Chen, Linda Petzold, William Yang Wang, and Wei Cheng. survey on detection of llms-generated content. Preprint arXiv:2310. 15654, 2023b.
Xiao Yu, Yuang Qi, Kejiang Chen, Guoqiang Chen, Xi Yang, Pengyuan Zhu, Weiming Zhang, and Nenghai Yu. Gpt paternity test: Gpt generated text detection with gpt genetic inheritance. CoRR, 2023.
Peiyuan Zhang, Guangtao Zeng, Tianduo Wang, and Wei Lu. Tinyllama: An open-source small language model. Preprint wrXi:22401.02385, 2024.
Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q Weinberger, and Yoav Artzi. Bertscore: Evaluat- ing text generation with bert. Preprint 1rXiv:1904.09675, 2019.
Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. Provable robust watermarking for ai-generaeed text. Preprint arXiv:2306. 17439, 2023.
Ying Zhou, Ben He, and Le Sun. Humanizing machine generated content: Evading ai-text detection through adversarial attack. Preprint arXhv:2404.01907, 2024.
14

---

Published as a conference paper at ICLR 2025
APPENDIX: HUMPA
A CODE
Code is available at wttppppp/ggttu...c.////aaaaaa//a http:://......ccaaa//////ddeeeo. detection
B
THEORETICAL ANALYSIS
We present some additional technical details and theorem proofs in the following sections.
B. DETECTOR SCORE AND THE REWARD MODEL
In this section, continue the discussion in Section 3.3 on the relation between the human-ness score sæ, y) utilized by the detector model and an implicit reward r(x, y) that the DPO framework assumes. Specifically,
demonstrate that taking r(z, y) C s(x; y) in the Bradley-Terry model yields approximately the same data generation as using the human-ness score directly for a large constant C. In fact,
exp (r(2,, v1) p(11 > Valz)= exp (r(e, + exp (r(x,
+ exp (r(x, -(x,
1, s(x, > s(x, 122.
0,
s(x, m1) < s(x, 1/2), s(x, 91) = s(x, U2);
1 1+ exp (2) - s(x, v1))
0.5,
as CC -> +00. This results in the label y11 1/2 if and only s(x, y1) > s(x, y2) and vice versa, which is exactly how the dataset D {(1r, V1, 122) is constructed in our case (under the edge case of s(r,))) s(x, 3/2.. ) a random preference is assigned).
It is also worth noting that, though taking C +o0 may appear extreme, using the Bradley-Terry model along with r(z, y) = C s(x, 8) with moderate positive to generate the dataset D also makes sense. For example, when taking C 1, one would assign the preference probability o (s(2, y1) s(x, y2)) where is the sigmoid function. This also reflects the binary classification nature of the detector: choosing threshold value 8(x) for human-generated tasks and assigning the "human" label response y with probability (ss(z.)) - {(x)) akin logistic regression model.
> 3/2 with
B.2 PROOF OF LEMMA 3.1
Before we prove Lemma 3.1 we first introduce some useful notations. Given input text x X, denote by (æ) = max, (xx, y) the maximal possible reward attributed the prompt-response pair (x, 3) given z. Next, given text generation process M, denote by (M(z) := r*(x) Ey>ru(-)a)) (x, y) the suboptimality of M according to reward r. Intuitively, the larger this sub- optimality gap, the smaller the expected reward for texts generated by M, and thus the more likely the detector will label the generated texts as machine-generatee With this we establish the following assumption stating the effectiveness of the detector:
Assumption B.1. The implicit reward r(z, y) from the detector D favors human- generated texts H (y)zz) over machine machine-generated texts of the reference model Mref (y]x), but H does not achieve optimal reward. More formally, for reasonable prior distribution of input texts P(X),
Exppixy" " (x) Ee "Ep-P((X,.
A direct effect of this assumption is the following suboptimality gap relation:
E Px)) <BE-P(X) (x).
15

---

Published as a conference paper at ICLR 2025
Notice that assume the human generative process H does not maximize reward, i.c. Ey-= y) # (z). This natural since one would expect a detector to overfit the most apparent differences between human- and muchine--gneratte texts, and hence the implicit reward does not completely reflect how human-like the response texts are.
With this
restate Lemma 3.1 in more technical terms and present its proof:
Lemma B.2. For any target compression ratio
(0, 1), there exists B (0,+00) such
that the optimal model M which minimizes the DPO objective LDOO in equation 3 achieves
Exp A M- (x) P( Mret (I). In particular, if we lake
À EEWP(x)
Exnp(xy A Appr (x)
the fine-tuned model M is indistinguishaabe from in that
(xx- = (x
Proof of Lemma B.2
Based on conclusions of previous work (Rafailov et al. 2024), the optimal
solution to both the Kl-cconttrained reward maximization objective in equation and the DPO ob- jective in equation is
((x) π Med (ylz) exp (3r(2.8))
TM (y)x)
where the normalization factor [(x) = Σ Mi (y/+r) exp (1 the expected reward under TM-- as
With this we can calculate
E Bywrxe-(1a) (1,)) = Σ TM- (u(r))))((,)))))
Σ Z(x) xl Madt (y/z)) exp { (Fr(e.)) v) r(a, 4).
(8)
Notice now that when B - 0,
Tott (y)22) exp (1r(1, v))
Tar- (u|x)
Eg TT Mare (3/(z) exp (t)()))))
n M (y/2²
Ey y nige (1/(z) exp (1rr(,
y & arg max, r(x, 1)) y e arg max, r(z, y),
Tmrer (ylz)// Ey Earg max, r(a.) x (z'1z),
which means TM- (y|x) * 0 if and only if the response is within the optimal set arg max, r(z, y) = (3r1r(x, y²) (x)). This leads to
lim By (1)) y) (x) maxr(x, v). B-000
(9)
which means approaches 0, the reward is maximized.
On the other hand, when 3 + +00, we have
Z(x) + Σ x Te (y/z) = 1,
and
lim (19) 80000
Σ π Miet (z)z)r(z,,)) (22
(10)
16

---

Published as a conference paper at ICLR 2025
Next, prove this expected reward is also monotonically decreasing with respect to B. Taking the derivative of equation 8 to | gives us
HE (12)
03
Eg Ma (y|xr) exp rtx ())( 10 # 32))21))
(x)
EE TM (vlo) exp (tr(z,))) rt U))] [E,, To (y(z) exp (tr(z, 4) v)]
(2
TM. TM. (x + ( Tas- (11z))())(( )
32
By (
(Byossr (a)) v)) 0,
32
where we plugged in the solution to the DPO objective from equation for the second equality, and the inequality is due to the Cauchy-Schward inequality. Combining this with equation and equation 10 see that By (+1))(2,, y) increases from the expected reward of the reference model E By (x, y) to the optimal reward r" (x) as 3 goes from +oo to O. Taking a final outer expectation in x, we have the same conclusion that
E E A (x) = r (x) Byr (2) v)
increases from to Px) A Mrser (x, y) as 33 increases from to +oo. Therefore for any (0, 1), there exists B (0, +00) such that
E (x) (Me-P())AMer(
B.3 PROOF OF THEOREM 3.2
In this section we prove Theorem 3.2 which we restate below, using subscripts 1, to denote large and small language models respectively for clarity:
Theorem B.3, Assuming the small fine-tuned model M, achieves optimum according to the DPO objective with 3 = So, our proposed inference model M' in equation is equivalent to an alternative large model Mf optimally fine-tuned the DPO objective with B Bo/a.
Proof of Theorem B.3
According to equation the next-token prediction logits are
TM; (vel MEct) "Tagot (yr (x, Vc+.)
Zazgee aguer (Welz, veer)
Taking a cumulative product for 1, 1,... T. we have
Tar (u(z)
xM (Vela, Wee))
t=1
TM; (Wre /z. Vece)
Ma (21l22, Vec)
Zz.get
Tagzot (ye (x, ycce)
[=1
1
T TM: (Wee (2, Vece)
Maor (yrl (x, vet))
((()))
TMy (2 yec))
TM; (y/lz)
MMier (y)(z)
Zx(z)
x (y/ar)
17

---

Published as a conference paper at ICLR 2025
where for the third inequality we substituted II Zz,yet with (i)x), which can be shown to be independent from y:
RM; (1b (z, yeee)
(xxx)
Σ
Tap (yclz,
"Tager (yr, (2, M/-c))
t=
T
IT= TMy; (vel yeee)
Σ
Mapp (B Nee)
[T= Targor (ye (t, yet))
Ma
TM; (y/ (r) M (y/z))
a
Σ Moj (u(zr)
Now using the close-form solution to DPO in equation
we have
TM; (yla)
AM (u/xz)
Mi (y/ar)
(z
"M (y) (r)
exp (#) r(x; y))
"M (u|x))
(xxx)
(,(x))
1
Mpp (w/ exp
r(r, 8)
((x)
Bo
where for the last equality we again used ((x) := Zi(x) (2(x)
(x) a to simplify the normalization
factor. Comparing this again the DPO solution in equation 7 this is exactly the same as the optimal model for fine-tuning the LLM M2 on D with = So/ aa thus completing the proof. O
C ADDITIONAL RELATED WORK
Proxy Approaches to Accelerate Fine-tuning. Proxy "tuning" at decoding time is popular method for efficient fine-tuning. It uses a proxy model during the decoding phase to reduce or eliminate the need for fine-tuning LLMs. Emulated fine-tuning (Mitchell et al. 2023b) and proxy- tuning (Liu et al., 2024a) balance fine-tuning and pre-training by decoupling the fine-tuning model scales, transferring knowledge from fine-tuned small language model to larger one. Furthermore, DeRa (Liu et al.) 20245) and ARGS (Khanov et al.) 2024) have explored merging auxiliary models the output level to learn a trade-off between reward and regularization, guiding the text generation process. (Huang et al.) 2024) leverages reward model to guide LLM realignment toward a cus- tom objective. These decoding alignment approaches that merge logits have been applied in various tasks (Xu et al., 20244 Chen et al., (223a). where (Xu et al., 2024) adopts safety-aware decoding strategy to defend against LLM jailbreak,, and (Chen et al. (2023a) innovatively uses speculative sampling in transformer decoding to accelerate I.LMs.. While our work shares similar vision with these proxy fine-tuning methods in prior or contemporary research, our objective is fine-tune an SLM toward optimal reward until it reaches the same level as human process according to a scoring detector, which adapts the LLM to achieve the same expected reward, thereby evading detection.
D EVALUATION METRICS
Throughout our experiments, we employ the Area Under the Receiver Operating Characteristic Curve (AUROC) and the Area Under the Precision-Recht Curve (AUPRC) primary metrics to evaluate the performance of each detector. To assess the utility and quality of the generated text, we utilize BERTScore and ROUGE- 1/2/LL1///L metrics. We provide detailed explanation of these metrics.
AUROC. Area Under the Receiver Operating Characteristic (AUROC) measures the detection ac- curacy by evaluating the area under the receiver operating characteristic curve, indicating the prob- ability that a classifier ranks a random machine-generatee text higher than a random human- human-written written text, with value ranging from 0.0 to 1.0.
18

---

Published as a conference paper at ICLR 2025
Table Detailed AUROCS of the white-box detectors and generation utility scores Table Ton the generated by different models the dataset Open WebText, WritingPrompis and PubMedQA respectively. The generation utilities of texts produced by HUMPA and the source model are within the budget of AS Bert 0.02 and AROUGE-1 0.03.
HUMPA (Llama2-7B)
HUMPA
HUMPA
Datasel
Models->
Llama2-13B
Llama3-70B (Llama3-8B)
Mixtral-8x7B (Mistral-7B)
The Generation Utility
Suert
0.8355
0.8231
0.8229
0.8078
0.8280
0.8141
ROUGE-1
0,2750
0.2506
0.2730
0.2447
0.2709
0.2413
ROUGE-2
0.0616
0.0529
0.0576
0.0499
0.0574
0.0487
ROUGE-L
0.1564
0.1435
0.1529
0.1400
0.1513
0.1360
The White-box Setting
OpenWebText
Likelihood
0.9986
0.7993
0,9985
0,8635
0.7287
0,1878
LogRank
0,9982
0.7708
0,9974
0.8135
0.7585
0.1826
LRR
0.7548
0.5133
0,6936
0.3905
0.8183
0.1841
NPR
0.9964
0.9130
0.9822
0.86755
0.8365
0.5649
DNA-GPT
0.9721
0.5686
0,9900
0.8024
0.7012
0.1153
DetectGPT
0.8060
0.7422
0.6535
0.5792
0.3255
0.2048
Fast-DetectGPT
0.9998
0.9926
1.0000
0.9971
0.9972
0.3786
The Generation Utility
SBeri
0.8054
0.8076
0,8086
0.7979
0.8142
0.8057
ROUGE-1
0.2285
0.2322
0,2553
0.2341
0.2613
0,2325
ROUGE-2
0.0433
0.0438
0.0474
0.0433
0.0484
0.0428
ROUGE-I
0.1312
0.1333
0.1457
0.1348
0.1436
0,1297
The White-box Setting
Writing
Likelihood
0.9999
0.8383
1,0000
0,9092
0.9691
0.3857
LogRank
0,9999
0.8208
1,0000
0.8875
0.9742
0.3736
LRR
0.9623
0.6908
0.9528
0.3824
0,9616
0.2629
NPR
0,9984
0.9098
0.9948
0.7590
0.9723
0.7019
DNA-GPT 0,9749
0,5255
0.9934
0.8273
0,7909
0.1787
DetectGPT
0.8795
0.8151
0.8571
0.8295
0.6573
0.4776
FaTt-DetectGPT
0.9999
0.8783
0.9998
0.9866
0.9888
0.5968
The Generation Utility
Spert
0.8717
0.8676
0.8513
0.8323
0.8605
0.8468
ROUGE-1
0.3804
0.3547
0.3506
0.3268
0,3684
0,3396
ROUGE-2
0.2206
0.2027
0,2006
0.1855
0.2076
0.1883
ROUGE-L
0.3108
0.2888
0.2848
0.2650
0.2971
0.2714
The White-box Setting
PubMed
Likelihood
1.0000
0.9455
1,0000
0.9483
0.9817
0.8455
LogRank
0.9999
0,9355
1,0000
0.9297
0,9890
0,8231
LRR
0,8471
0.7860
0,9072
0.7524
0.9318
0.6499
NPR
0.9776
0.9215
0.9737
0.8896
0.8154
0.7219
DNA-GPT
0.9976
0.9026
0.9891
0.8932
0.9731
0.7224
DetectGPT
0.9891
0.9718
0,9832
0,9632
0.9231
0.9221
Pest-DetectGPT
0.9850
0.9076
0,9857
0.6754
0.9939
0.4017
19

---

Published as a conference paper at ICLR 2025
Table 5: Additional results following Table 4 the black-box AUROC results the dataset Open- WebText, WritingPrompts and PubMedQA respectively.
Dataset
Detectors,
Models
Llama2- 1.122-133 13B
[Llama2-7B]
HUMPA
Llama3-708
(Llama3-8B
HUMPA
Mixtral-8x7B -xBB
(Mistral-7B)
HUMPA
Roberta-base
0.968I
0,8454
0.9188
0.7681
0.7997
0.6339
Roberta-large
0.9534
0.8529
0.9022
0.7624
0.8136
0,7349
Likelihood(Nco-2.7)
0.9986
0,5792
0.9342
0.6313
0.6369
0.1052
LogRank(NNo-2277)
0,9627
0.5927
0.94446
0.6224
0.6554
0.1033
LRR(NNe-22.)
0,9680
0,6175
0.9322
0.5631
0.6791
0.1200
OpenWehlext
NPR(Nco-2.77)
0.8867
0.6220
0.8781
0.6439
0.6815
0.2912
DNA-GPT(Neo-2.7)
0.6165
0.3203
0.7786
0.5652
0.5329
0.1011
DeteciGPTTSS-B/Nee--.
0.7416
0.5102
0.5491
0.3867
0.5650
0.2505
Fast-
Sass-DetecGGPTGGPT-JNNS
0,9909
0.7088
0.9829
0.7988
0.7816
0,0544
Binoculans(Fulconn-B)
1,0000
0,7903
0, 1,9990
0,8830
0,8840
0.0439
Roberta-base
0,9673
0.8548
0.9169
0.7144
0,8018
0.6184
Roberta-large
0,9401
0.8548
0,8720
0.6728
0.7818
0.6975
Likelihood(Neo-277)
0.9926
0.6416
0.9830
0.7355
0,8588
0.2378
LogRunk(Neoo22.)
0,9940
0.7115
0,8596
Writing
L.R((Nen-2.7)
0.9876
0.8656
0.9595
0.2918
0.8305
0.1612
NPR(Nen-2.7))
0.9134
0.8414
0,9447
0,5643
0.8027
0,3523
DNA (e----7)
0.7514
0.3666
0.8483
0.6197
0.6711
0.1755
0.6131
0.7175
0,3316
Fast- DetecGGPTGGPT-/NNooo-1
0.9974
0.6466
0.9842
0.7736
0.8837
0.1505
Binoculars(Falcon) (Falcon-7B)
1,0000
0.6773
0.9990
0,8771
0,9539
0,2019
Roberta-base
0.7779
0.6704
0.6317
0.1976
0,4960
0.3995
Raherta-large
0.7686
0.6510
0.6648
0.2315
0.5095
0.4375
Likelihood(NNo-2.))
0.9971
0.8706
0.9924
0,8345
0,9512
0.7195
(Ngoank(Neo-2.7)
0,9984
0.8691
0. 0.9929
0.8269
0.9613
0.7243
LRR(Nco-2.7)
0.9972
0.8489
0.9693
0.7535
0,9534
0.7115
PubMed
NPR(Nco-2.7)
0.7677
0.6089
0.7479
0.5598
0.6173
0.4471
NNA-GPT(Neoo2.77
0.7670
0.5766
0.6431
0.4040
0,5910
0.2955
DeterGGPTTTS3BBNNNo22.
0,8752
0.7394
0.8975
0.6892
0.7451
0,5612
0,9999
0.8613
0.9983
0.7436
0.9620
0.5720
Binoculass(Falcon-7B)
1,0000
0,9012
0.9987
0,8186
0.9679
0,6702
Area Under the Precision-Recal Curve (AUPRC) is a measure of detector's performance, focusing the trade-off between precision (the accuracy of sacchne--ennratte examples) and recall (the ability to identify all machine maahine-generated examples), An AUPRC of 1.0 means perfect precision and recall, while AUPRC of 0.0 means the detector fails completely. This metric is useful when dealing with imbalanced datasets, where the number of positive and negative examples is not equal.
AUPRC.
(hang al. 2019). BERTScore is metric used evaluate the quality of texts gener- ated by the pre-trained BERT. It compares the generated text to a reference text by utilizing BERT's embeddings to match words by cosine similarity. BERTScore measures how well the generated text matches the reference text in terms of meaning and context, rather than just exact word matches. This makes it more robust evaluation method for assessing the quality of generated texts.
BERTScore
ROUGE (Chin-Yew 2004). Recall-Oriented Understudy for Gisting Evaluation (ROUGE) is a set of metrics used to evaluate the quality of generated text by comparing it to reference texts. We adopt the popularly used ROUGE-1, ROUGE-2, ROUGE-L. ROUGE-1 measures the overlap of unigrams (single words) between the generated text and the reference text. ROUGE-2 measures the overlap of bigrams (two consecutive words) between the generated text and the reference text. ROUGE-L. measures the longest common subsequence (L.C)) between the generated text and the reference text, capturing the longest sequence of words that appear in both texts in the same order. These metrics help assess how similar the generated text is to the reference text in terms of content and structure.
E ADDITIONAL MAIN RESULTS
The detailed AUROC results on the dataset WebTee,, WritingPrompts and PubMedQA. More results are in Table 4 for the white-box setting and Table for the black-box setting. Throughout our experiments, we run DetectGPT and NPR with default 10 perturbations, and DNA-GPT with a truncation ratio of 0.2 and 10 prefix completions. The findings from the white-box performances in Table 4 include DNA-GPT being the most fragile detector when evaluating texts generated by Llama2- and Mixtral-8x7B on OpenWebText and WritingPrompts, with AUROC relative
20

---

Published as a conference paper at ICLR 2025
Table 6: AUROCs of detectors and generation utility scores text generated by different models on PHX. The humanized SLM is fine-tuned from CS. The generation utilities of texts produced by HUMPA and the source model are within the budget of Ber
Bert S 0.02 and AROUGE-1 S 0.03.
HUMPA
HUMPA (Llama3-8B)
HUMPA Mixtral-8x77 8x7B (Mistral-7B)
Models
Llama2- 13B
Llama3-70B
(Llama2-7B)
Generation
Uulity
Spert
0.8351
0.8308
0.8118
0.8034
0.8057
0.7888
ROUGE-1
0.2972
0.2965
0.2992
0,2712
0.2330
0.2045
ROUGE-2
0.0831
0.0783
0,0782
0.0770
0.0641
0.0505
ROUGE-L
0.1700
0.1620
0.1602
0.1543
0.1369
0.1204
The White-box
Setting
Likelihood
0,9999
0.8376
0,9974
0.6348
0,6630
0.2604
LogRank
0.9982
0.7999
0,9932
0.5553
0,6533
0.2354
LRR
0.4277
0.3563
0,2588
0.1800
0.5066
0.1505
NPR
0.9781
0.8403
0,9859
0.7343
0.7955
0.5706
DNA-GPT
0,9884
0.6653
0.9943
0.4812
0.6001
0.1513
DetectGPT
0.5784
0.5996
0.4987
0.4131
0.2568
0.1778
Fast-DetectGPT
0.9978
0.9881
0.9999
0.9799
0.8390
0.1319
The Black-box
Setting
Roberta-hase
0.8718
0.7801
0.7535
0.4775
0.7379
0.6387
Roberta-large
0,8132
0.7183
0.6495
0.4435
0.7339
0,6343
Neoo2))
0,8185
0.5475
0.9351
0.3526
0,3199
0.0928
LNgoank(Neo02.7)
0,8226
0.5458
0.9309
0.3078
0,2848
0.0691
LRR(Neo-2.7)
0,7536
0,5125
0.8463
0.1807
0,2328
0.0369
NPR(Neo-2.7)
0,5517
0.4396
0.6458
0,4298
0,5210
0,3357
DNA-GPT(Neco2.77
0,8078
0,3820
0,9004
0,2909
0.4249
0.1130
DenectGPTTTSS-BBNNoo0-77
0.1697
0.1877
0.2994
0,2673
0.2516
0.1958
Fast Fist-DettcoGPTGGGT-/NNNO
0.9673
0.6714
0,9759
0.3919
0.4697
0.0427
Sinoculars(Falcon-715 0.9904
0.7093
0,9812
0,4127
0,5183
0,0489
decrease of 83.6%, the largest among all detectors. Another key finding is that Fast-DetectGPT demonstrates the most vulnerability on the PubMed dataset, with AUROC relative decreases of 31.5% and 59.6% for texts produced by HUMPA -attacked Llama3-70B and Mixtral-8 7BB respec- tively. Furthermore, our findings reveal that DetectGPT stands out as the most robust detector, with the smallest AUROC relative decrease on WritingPrompts for Llama2-13B and Mixtral-8x 7B, and also the least decrease on PubMed across all attacked models.
In the black-box setting shown in Table 5 findings indicate that DNA-GPT is the most fragile detector when evaluating texts generated by the HUMPA -attacked Llama2-133 13B across all three datasets, with relative AUROC decreases of 48.1%, 51.2%. and 50.0%. Additionally, Binoculars shows the highest AUROC relative decrease (95.0%) on Mixtral-8 x 7B's Open WebText outputs, while Pest-DeteT experiences the greatest decrease (83.0%) WritingPrompts.
find that
ADDITIONAL CROSS-DOMAIN RESULTS
The cross-discipline AUROC results of HUMPA on PHX are in Table O In the white-box setting, we observe that DNA-GPT is the most vulnerable when evaluating texts generated by the attacked Llama2- 13B and Llama3-70B models. On texts produced by the attacked Mixtral-8x7B Fast- DetectGPT exhibits the largest relative decrease in performance across all detectors, with an 84.3% drop in the white-box setting and 90.9% drop in the black-box setting.
G RESULTS IN AUPRC
Similar to AUROC, include the AUPRC results on the Open WritingPrompts and Pub- MedQA dataset in Table IT We find that HUMPA bypasses all detectors on the texts produced by the three models. The largest relative decrease across these datasets occurs the Open OpenWebTexx with LRR showing a 57.5% drop in the white-box setting when evaluating texts from the attacked Mixtral-8x 7B, and Binoculars exhibiting 63.0% drop in the black-box setting for the same texts.
21

---

Published as a conference paper at ICLR 2025
Table 7: Cross-language performances (AUROC) of detectors and generation utility text generated by different models on Germany. The humanized SLM is fine-tuned from English. The generation utilities of texts produced by HUMPA and the source model are within the budget of Br & 0.02 and AROUGE-1 Σ 0.03.
HUMPA
HUMPA (Llama3-8B)
HUMPA
Models-
Llama2-13B 13B
Llama3-70B
Mixtral-8x7B (Mistral-7B)
(Llama2-7BB
The Generation
Utility
SBat
0.8209
0,8209
0.8158
0.8063
0.8306
0.8210
ROUGE-1
0.2124
0.1883
0.1951
0.1934
0.2878
0.2633
ROUGE-2
0.1
0.1116
0.1 149
0.1145
0.1314
0.1302
ROUGB-L
0.1747
0.1627
0.1667
0.1663
0.2209
0,2063
The White-bor
Setting
Likelihood
0.9900
0.3685
0.9596
0.3637
0,5186
0.2286
LogRank
0,9824
0.3358
0.9517
0.3262
0,5838
0.2296
I.RR
0.5943
0.1528
0.6608
0,1812
0.7725
0.2849
NPR
0.9590
0.4077
0.5315
0.4171
0.7928
0,5315
DNA-GPT
0.9924
0,3732
0.9828
0.3957
0.6486
0.1426
DetectGPT
0.8427
0.4818
0.7219
0.3859
0.6064
0.5252
Fast- DetectGPT
0.9935
0,8676
0.9156
0.4536
0.9572
0.3490
The Black box Setting
Roberta-base
0.5606
0,5291
0.5730
0,3605
0.4298
0,3389
Roberta-large
0.5508
0.4776
0.5530
0,3620
0.4859
0,3388
Seelihood(Neo-2.77
0,9900
0.0860
0.4781
0.1780
0.3746
0.2200
Logoank
0,9824
0.0972
0,5394
0.1803
0.3930
0.2204
LRR(Neo-2.7)
0,8045
0,1814
0.7876
0.2132
0,5188
0.2526
NPR(Neo-2.7)
0.6039
0.1857
0.5674
0.2801
0.4788
0.2662
(NA-GGP(Neco-2.7)
0.7496
0.1290
0.8494
0.2222
0.4889
0.1233
DetecrGPTTTT--BBNeeo-11
0.5161
0.1732
0.4787
0.2722
0.4108
0.2465
Fast Baaa-DDteeGGPrGGTTJNNNo...
0.9127
0.2133
0.7686
0.1941
0.5536
0.1152
Binoculars(Falcon-7BB
0.9929
0.3108
0.9901
0.3265
0.7293
0.1564
Table 8: The performances and generation utility of HUMPA with larger a tested on detectors.
Likelihood
LogRank
LRR NPR
DNA-GPT
DetectPPT Fast-DeteetGPT Binoculars)
ROUGE-1/2/L
Dipper Paraphrasing
0.8125
0.7998
0.7220 0,5193
0.6240
0,2675
0,9754
0.9398
0.8006
0.2076 000066600022//448
/0.119911
Query-based Substituiions
0.9843
0.9921
0,3030
0.7072
0.9972
1,0000
0,7989
0.2015/0.0383//
HUMPA (o 1.2)
0.1647
0.1625
0.1599 0.2592
0.0723
0.2124
0.0794
0.1743
0.8053
0.2281 0..221/0.0442) 00.1499
HUMPACo 1.5)
0.0109
0.0109
0.01177
0.N617
0.0034
0,0582
0.0007
0.0021
0.8014
0.2137/0..044/0.00
13.3
Table 12 lists the AUPRC results for cross-domain scenarios. We find that HUMPA bypasses the detectors in these settings. The largest relative decrease occurs in the EN-GER setting, where the black-box Likelihood evaluates texts from the attacked Llama2-13B, showing a 68.0% drop in AUPRC.
H MORE ANALYSIS OF &
The ratio a controls the intensity of the attack on the LLM, with larger values of a yielding higher rewards and better detection evasion, while smaller values keep the attacked LLM closer to the source LLM, thus limiting the attack's 's effectiveness. We present the detector evasion performance of HUMPA with higher & values, such as 1.2 and 1.5, compared to two ofate-of-the-art baselines: the paraphrase generation attack method DIPPER (Krishna et al.) and the query-based word substi- tution attack method (Shi et al. 2024), as shown in Table 8 We find that HUMPA outperforms the baselines in evasion performance while maintaining high generation utility. However, when in- creases, the generation utility diminishes. For another instance, we consider a commercial detector GPTZero (Tian & Cui 2023). We fine-tune Llama2-7B model using GPTZero as the scoring detec- tor and evaluate GPTZero on text generated by the attacked Llama2-133 model. The results are pre- sented in Table We find that GPTZero also can be bypassed with a increases, and the generation utility accordingly decreases in a scope. This phenomenon aligns with our findings in Theorem 3.2 which highlight that a governs the trade-off between evasion performance and generation quality.
22

---

Published as a conference paper at ICLR 2025
Technically, when O, the attack model approaches the reference model, with quality on par with the origi- nal LLM and no evasion abiliit;; when - oo, the at- tack model regresses to a deterministic model, selecting next token based maximized probability increase from pre-trained to fine-tuned SLM, which is an extremely ag- gressive attacker with no concern for quality (also notice the LLM has no influence on the attacker in this extreme case). These different scenarios suggest that an adversary should choose proper balancing attack effect and text quality. Since fine-tuned SLMs can adjust the output dis- tributions of large models during the inference, a can be selected at low time cost, and concerns about robustness arise in the enhancement of such detection methods.
Table 9: Performance and generation utility on GPTZero.
Llama2-13B
HUMPA
HUMPA
(a=1.5)
(a
2.0)
SBen
0.8789
0.8075
0.7939
ROUGE-1
0.2587
0.2217
0.2131
ROUGE-2
0.0480
0.0452
0.0392
ROUGE-L
0.1497
0.1372
0.1266
AUROC
0.9951
0.8295
0.7987
I HUMAN EVALUATION
To reliably assess the quality of texts gener- ated by the attacked model compared to those produced by the original, unattacked model, it essential evaluate the perceived natural- ness of the text from users' perspective. For instance, users expect the text to be smooth, coherent, and grammatically correct. This en- sures that the generated text feels natural and is easy to read. Therefore, we evaluate the quality of the text based on its fluency. We produced 120 pairs of text 150 Ilama2 tokens long and with the same prefix. One from each pair was generated by base Llama2-13B while the other generated by Llama2-13B attacked by HUMPA with DPO fine-tuned Llama2-7B model against Roberta-large with 3 = 0.1 for 5 epochs, and the attack ratio = 1.3 to balance between the generation utility and the evasion performance. We also include two baselines: one is DPO directly fine-tuned on Llama2-13B against Roberta-large (Nicks et al.] 2024). another is DIPPER Paraphrasing (Krishna al.). We then ask three human annotators to choose the text with better fluency when presented with each pair. The two texts were presented in randomized order the annotators. The results are shown in Table I0 We find that HUMPA demonstrates superior attack performance while preserving better text naturalness.
Table 10: Performances of different evasion meth- ods evaluated using Roberta-bar base..
Methods
AUROCFluency Win Rate
DIPPER Paraphrasing
0.9717
54.16%
DPO (I.lama2-13B)
0.6968
51.67%
HUMPA (IJama2-7BB
0.6394
57.50%
J SENSITIVITY OF TRAINING SIZES
The SLM is fine-tuned using DPO, and the resulting model is influenced by the size of the train- ing data. Consequently, the training data size affects the performance of the attacked LLM in evading detection. To obtain a effective humanized SLM, a larger training size is desirable. However, increasing the training size requires more time for fine-tuning. To explore the im- pact of training size both time efficiency and detection evasion performance, we fine-tuned Llama2-7B model against Roberta-large on the Open WebText dataset using varying training sizes. We use LoRA to perform DPO fine-tuning on the SLM with 3 0.1, and batch size of 8 for 5 epochs. We varying the training size and record the fine-tuning run- time. We evaluate RoBERTa- on text generated by the attacked Llama2- 13B model with a = 1.5, and the results are in Table 13 We find that as the training size increases, the performance of detection decreases, while the fine-tuning time grows. This suggests a trade-off between efficiency and performance: increasing the training size improves evasion but reduces efficiency due to longer fine-tuning times. If prioritizing evasion performance, a larger training size might be preferable. On the contrary, if efficiency or fine-tuning time is more critical, smaller training size provides better balance.
Table 13: Performances on different training size.
Training Size AUROC (hrs)
detector
IK
0.88
0.27
5K
0.71
1.35
8K
0.68
1.90
10K
0.62
2.04
23

---

Published as a conference paper at ICLR 2025
K ANALYSIS OF SCORING DETECTOR
The scoring detector plays an important role in ob- taining the reward. Theoretically, weak detec- tor yields relatively low reward for human- -eenannee texts, while machine-generated texts are given rel- atively high reward, resulting in a reduced gap be- tween the two. Hence an attacker can more easily bypass the detector and overfit to the weak scoring detector. Therefore deployment, when faced with a strong target detector, the attacker's performance will suffer.
Figure 6: The performances of detectors evaluated text generated by the attacked Llama2-13B. Each line in the figure repre- sents combination of an evaluation detector and a scoring detector, denoted as 'Evalua- tion Detector (Scoring Detector)'.
We conduct an empirical analysis of the impact of different scoring detectors on the WritingPrompts dataset. Specifically, we use the white-box LRR and Fast-DetectGPT as scoring detectors when con- structing the preference data for DPO fine-tuning.
Using these two preference datasets, we fine- the-ttne Llama2-7B with 3 = 0.1 to obtain two humanized SLMs attackers. We then evaluate the white-box LRR and Fast-DetectGPT on the text generated by the attacked Llama2-13B model with varying levels of attack ratio a in Figure 6 We find that when LRR is used as the scoring detector, the attacked Llama2-13B model exhibits moderate performance drop. In contrast, when Fast-DetectGPT is used for scoring, the performance drops are huge. An SLM fine-tuned against a weak scoring detector cannot perform well in the face of a strong target detector, though we surmise this gap may be simply due to the lack of high-quality human-machine labels without access to strong scoring detectors and may hence be unavoidable. In practice, although there is no assumption which specific scoring detector the attacker should choose, a strong, well-calibrated detector is desirable for this purpose.
L ANALYSIS OF SMALL MODEL SIZE
To study the impact of model size, we fine-tum a Llama2-7B and a Ii (Zhang et al.) 2024) WritingPrompts dataset as the SLM respectively. scoring detector and evaluate RoBERTa-base
Table 14: Performance with dif-
ferent size of SLM.
use RoBERTa-large as the
the text gener- ated by the attacked Llama2-133 13BB model, each attacked with an at- tack ratio of a 1.5. The results are in T4b We find that dif- ferent SLMS exhibit varying levels of effectiveness when attack- ing the LLM, with Llama2-7B being the most effective choice. This suggests that when selecting an SLM for such attacks, a stronger SLM tend to demonstrate better evasion performance. However, fine-tuning larger model and loading it during inference to attack the LLM incurs significant time and memory costs. Practitioners need to balance these factors according to their specific priorities.
Model
AUROC
Llama2- 13B
0,9673
HUMPA(Llama2-7B
0.4594
HUMPA(TinyLJamaa- IBB)
0.7706
M REAL CASES
We provide several real examples randomly selected from Open WebText and the cross-domain sce- nario PHX->HSS across different models. Note that, as discussed in Section 3.3] the parameter controls the trade-off between attack effectiveness and text generation quality: higher a leads to higher reward according to the detector, but also strays away from pre-trained LLM and thus decays in quality. With this in mind, the following examples are generated with a 1.5, which as shown in previous sections can be considered an effective attack. From our observations, no significant qualitative differences are apparent between the generated texts.
24

---

Published as a conference paper at ICLR 2025
Real cases of samples from OpenWebText
Llama2-13B: DENVER The New England Patriots could be without key players for their AFC Championship Game matchup against the Denver Broncos on Sunday. Tight end Rob Gronkowski and defensive lineman Malcom Brown did not participate in practice on Wednesday, and both have been listed as questionable for the game, according to the Patriots' injury report. Gronkowski has knee injury. while Brown has foot injury. "It's early in the week, so we'll Il see how it goes," Patriots coach Bill Belichick said when asked about the status of his players. "We'll 'lll evaluate it day by day and see where we're 'e at by the end of the week." Gronkowski and Brown are unable to play, it would be a significant loss for the Patriots, Gronkowski is one of the team's top receiving thrcats HUMPA (Llama2-7B) DENVER The New England Patriots could have the luxury of having all six of their top wide receivers available for Sunday's AFC Championship Game against the Denver Broncos. Julian Edelman, who has missed the last two games with knee injury, was a full participant in practice on Thursday and is expected to play, a source told ESPN. The Patriots also expect to have Chris Hogan (shoulder) and Malcolm Mitchell (knee) back in the lineup, after both players missed last week's divisional round playoff game against the Houston Texans. The only receiver who did not participate practice on Thursday was Danny Amendola, who dealing with thigh injury. However, he is expected to play on Sunday, per the source. The Patriots have a deep and talented receiving corps, and having all six players available could
Llama3-70B:
On Tuesday, it was reported that New York lawmakers had reached deal for $175 billion budget that would increase taxes on the wealthy and large corporations. [newline] On Wednesday, Governor Cuomo signed the budget into law. [newline] According to Cuomo, the new budget would increase the income tax rate for individuals earning over S1 million per year and corporations earning over $5 million per year. Additionally, it would implement new City, and would establish a new tax on opioid manufacturers. [newline] Cuomo said a statement, "This budget is a testament to what can be accomplished when lawmakers work together to benefit the people of this great state." Some critics argued that the new taxes could lead to wealthy individuals and corporations leaving the state. The Business Council of New York State said in statement, "Increasing
luxury real estate in New York
on most successful entrepreneurs and businesses will only encourage them take their investments and jobs to more competitive states." However, supporters of budget argued that it would
HUMPA (Llama3-8B):
On Tuesday, it was reported that New York Giants tight end Daniel Bellinger arrested following an incident at a dinner party at the home of one of his teammates. According to report. Bellinger allegedly got into a physical altercation with one of the party's 's attendees. The team has since released a statement regarding the situation. On Wednesday, the NFLPA announced that it will be conducting its own investigation into the allegations surrounding Bellinger's arrest. This move is likely in anticipation of potential discipline from the NFL, which could potentially stem from the league's 's personal conduct policy. [newline] Bellinger's 's lawyer has since released statement claiming that client was acting in self-defense during the alleged altercation. [newline] Update: TMZ has released video footage of the altercation, which appears to show Bellinger allegedly punching and kicking a man multiple times. On Thursday, it reported that the NFL has placed Bellinger the commissioner's exempt list, effectively suspending him pending further investigation. Should Bellinger ultimately be suspended or disciplined
Mixtral-8x2 7B:
After weeks of negotiations, National and Labour finally have deal in the books to bring the Electoral Transformation Bill to fruition for imminent vote in parliament. In statement the two political parties issued Thursday afternoon, both said talks on the topic have been "constructive and carried out in a positive and courteous way with a good willingness to reach an agreement." The agreement they finally reached, per the statement, allows for Mãori to put forward three different electoral models to be put binding citizens-ine ittizens-initiate referendum. If any one of them successful, then "the number of members from the Mãori electoral specials seats, total, would be fixed at 120% of the MPs who would he returned with an equivalent proportion voters the general electoral specials seats." The two parties will put forward a joint motion of am HUMPA (Mistral-7B):
After weeks of negotiations. National and Labour have thrashed out agreement on legislation that will give parties less money and force (some) MPs to live more normal lives. Labour anger National's
25

---

Published as a conference paper at ICLR 2025
insistence that there must be correlation between private and public sector pay rises and feeling the party didn't push hard enough on funding for MPs did take its toll. But relationships appear be good and the govermment suggested the parties could work together on other bills although not one on alcohol, about which the Greens have similar gripes. The crowningpiece literally for Helen Clark and Chester Borrows who travelled up to Parliament flanked by placard carriers demanding greater gender equality in elecitons- coalition or cumulative vote deal (eg parties laddering candidates in a district prefeeereeeeence system) to
amendment to Clause of the Electoral Act. This allows parties
Real of samples from HISS
Ilama2- 13B:
Introduction to the Special Issue Diversion from Standard Prosccution in the Crim- inal Justice System [newline] Introduction: The special issue on diversion from standard prosecution the criminal justice system explores the various ways in which criminal cases can diverted from the traditional prosecution process. Diversion programs offer an alternative to prosecution and punish- ment, and can be an effective tool for addressing the root causes of criminal behavior and promoting rehabilitation. This issue brings together range of articles and research papers that examine the differ- ent forms of diversion, their benefits and challenges, system. [newline] The articles in this special issuc cover a range of topics related to diversion from standard prosecution, including the different types of diversion programs available, the factors that influence their effectiveness, and the role of diversion in addressing issues of racism and inequality in the criminal justice system.
the impact they have on the criminal justice
HUMPA (Ilama2-7B): Introduction to the Special Issue on Diversion from Standard Prosecution: Toward a More Holistic and Effective Approach to Addressing Crime [newline] This special issue of the journal devotes attention to diversion from standard prosecution. topic that has gained increasing importance in the criminal justice system. Diversion programs have been developed an alternative traditional criminal prosecution, with the goal of addressing the causes of criminal behavior and reducing recidivism rates. These programs have been shown to be effective in addressing various types of crimes, including drug offenses, property crimes, and even violent crimes. [newline] The articles in this special issue explore various aspects of diversion from standard prosecution, including the effectiveness of diversion programs, the factors that contribute to their success, and the challenges limitations that must addressed order realize their full potential. [newline] One of the key themes that emerges from
Llama3-70R: Acceptability App-Rased Contact Tracing for COVID-19: Cross-Country Survey Evidence [newline] **Title:* Acceptability of App-Based Contact Tracing for COVID-19: Cross- Country Survey Evidence [newline] ** BBBckground: [newline] The COVID-19 pandemic has led to unprecedented global efforts control the spread of the virus. One promising approach is digital contact tracing, which uses mobile apps to rapidly identify and notify individuals who have been close proximity to someone infected with COVID-19. However, the success of such apps relics heavily on public acceptance and adoption. [newline] **Objective:** [newline] This study aims to investigate the acceptability of app-based contact tracing for COVID-19 across different countries and identify factors influencing public willingness use such apps. [newline] **Methods:*** [newline] conducted cross-country online survey among 10,000 participants from 15 countries, including the United States, United Kingdom, Australia, Canada, Germany, France
HUMPA (I.aa Acceptability of App-Based Contact Tracing for COVID-19: Cross-Country Survey Evidence [newline] Abstract: [newline] Contact tracing is crucial component in controlling the spread COVID-19. The use of app-based contact tracing has been widely adopted globally, but its acceptability varies across countries. This study aimed to investigate the acceptability of app-based contact tracing and its correlates across countries. [newline] Methods: [newline] We conducted a cross- country survey of 13,993 adults from 20 countries. The survey included questions demographic characteristics, COVID-19-related experiences, and attitudes towards app-based contact tracing. We used multivariable logistic regression to identify factors associated with acceptability. [newline] Re- sults: [newline] The overall acceptability of app-based contact tracing was 63.1%. Country-wise, the acceptability ranged from 44.1% in Japan to 84.5% in China. In multivariable amalysis, factors associated with higher acceptability included being male, younger age, higher education, previous COVID-19
26

---

Published as a conference paper at ICLR 2025
Mixtral-8 xBB: Put More Women in Charge and Other Leadership Lessons from COVID-19 Women face significant, unique, and disproportionate risks, impacts, and challenges relative COVID-19, both as a result of public health measures to stem the spread the virus and from the crisis itself. How- ever, evidence from around the world also suggests that despite facing more severe adversity, women have been at the forefront of pandemic response efforts, often leveraging their networks, knowledge, and experience forged in other crisis contexts, take action swiftly and creatively to help those need. Drawing on extensive global research, this paper examines the critical roles that women all levels, from civil society to the highest corridors of power, have played in pandemic response and recovery efforts. The authors present a series of case study narratives to demonstrate that the success of COVID- response has been dependent in significant part women in leadership. and in HUMPA (Mistral-7B): Put More Women in Charge and Other Leadership Lessons from COVID- [newline] While COVID-19 has thrown a curvehall at businesses, some are managing fight through quite effectively. New Zealand saw lockdowns lift lot carlier than most. It's going to open up again, sooner rather than later, and this is attributed, to large extent due to the exceptional leadership. [newline] This begs the question What makes exceptional leadership stick? The difference found the intersection of love and power. Historically, women have better skills hold the power in matters of relationship, empathy, compassion, resilience and what Danial Goleman calls Social Intelligence at work or where EI-EQ meet. The good news is that infusing these skills into the workplace can only benefit organisation but is challenge at times to balance these with "masculine" behaviour based transactional power dynamics used to.
27

---

Published as a conference paper at ICLR 2025
Table 11: AUPRCs of detectors on the texts generated by different models on the dataset OpenWeb. Text, WritingPrompts and PubMedQA respectively.
Dataset
Models++
-lama2-138 13B
(Llama2
HUMPA
Llama3-70B
HUMPA (Llama3-88)
HUMPA Mixtral-8x7B
(Mistral-7B)
The White-box
Setting
Likelihood
0.9984
0,8705
0.9983
0,9082
0.6931
0,3485
LogRank
0.9980
0.8495
0.9971
0.8702
0.7230
0.3456
LRR
0.7582
0,5755
0.7099
0.4870
0.8079
0.3435
NPR
0.9971
0,9400
0.9833
0.9005
0.7911
0.5569
DNA-GPT
0,9605
0,6375
0.9890
0.8521
0.6611
0.3233
DetectGPP
0.7690
0.6990
0.6471
0.5828
0.3890
0.3454
Tast-DetecIGPT
1,0000
0.9972
The Black hox Setting
OpenWehTTes
Roberta-base
0.9593
0,7798
0.8723
0.7286
0.7558
0,5779
Roberta-large
0.9454
0.8453
0.8970
0.7305
0.7941
0.7224
Likelihood(Nen-2111
0.6243
LogRank(Neoo2..)
0.9629
0.7008
0.9467
0.6916
0.6429
0,3200
LRR(NNc-221) 2.7)
0.9754
0.7344
0.9476
0.6650
0.6880
0,3259
NPR(Nco-2.7)
0.6823
0.8904
0.7012
0.6935
0,3908
DNA-GPTTNNoo2..77
0.6011
0.4097
0.7713
0.6041
0.5557
0.3223
0.6692
0,5029
0.5298
0.4397
0,5370
0,3601
Fast-
0.9928
0.8046
0.9855
0.8543
0.7762
0,3112
Binoculars(Falcon)
0.9990
0,7632
0.8468
The White- box Setting
Likelihood
0.9999
0,9046
1,0000
0.9477
0.9684
0.5342
LogRank
0.9999
0.8921
1,0000
0.9326
0.9735
LRR
0,9686
0,7884
0.9590
0.5347
0.9626
0,4276
NPR
0.9986
0.9397
0.9962
0,8499
0.9768
0,7603
DNA-GPT
0.9655
0.6043
0.9894
0.8678
0.7892
0.3651
DetectGPT
0,8112
0.8540
0.6188
Fast-DDtectCPPT
0.9999
0.8736
() 01.9998
0.9843
0.9908
0.6026
The Black- box Setting
Writing
Roherta-hase
0.9615
0.8202
0.8917
0.6602
0.7637
0.5944
Roberta-large
0.7455
Likeliheod(Neoo2.))
0.9928
0.7470
0.9833
0,8029
0.8609
0.4113
LogRank(NNeo-2.7
0.9943
0,7402
0.9836
0.7847
0.8643
0.4045
LRR(Nco-2.7)
0,8656
0.9656
0.4397
0.8463
0,3629
NPR(Nco-2.7))
0.9533
0.6544
0.8332
0.4615
DNA-GPT(Neo-2.77
0.7253
0,4352
0.8301
0,6663
0.6693
0,3522
DetectGPT 3B/Noo-2.7
0.8369
0.6128
0.8351
0.6854
0.6893
0.4075
Fast-
0.7535
0.8904
Binoculans(Falcon-
1.0000
0.5458
0.9988
0.7519
0.9245
0.3465
The White-box
Setting
Likelihood
1.0000
0,9672
1.0000
0.9670
0.9866
LogRank
0,9999
0,9613
1,0000
0,9567
0.9888
0.8577
LRR
0,8520
0.8257
0.9146
0,8118
0.9176
0,6755
NPR
0.9769
0.9274
0.9723
0.8929
0,7603
0.6594
DNA-GPT 0.9965
0.9360
0.8931
0.9720
0.7620
DetectGPT
0.9893
0.9753
0.9851
0.9673
0.9074
0.9091
Fast-DetecttPPT
0,9859
0,9173
0,9891
0.6946
0.9950
0,4771
The Black hox Setting
PubMed
Roberta-base
0.4545
Roberta-large
0.6954
0.5737
0.5899
0.3510
0.4741
0.4343
L.kelihood[Nen-277
0.9972
0.9142
0.9926
0.8768
0,9481
0.7570
LogRank(Neo-2.7)
0.9985
0.9152
0.9933
0.9603
0.7646
LRR(Nco-2.7)
0.9020
0.9746
0.8131
0,9551
0.7475
NPR(Neo-2.7)
0.6687
0.5507
0.6428
0.5017
0,5306
0,4319
DNA-GP DNo-2P7(Ncc-2.77
0.7065
0.6068
0.6142
0.4528
0.5367
0.3807
DelecGPPTTTS-BB/Neo22277
0.8473
0.7562
0.6953
Fast- Dew.eettccGTTTIGT-///oo20
0.9999
0.9160
0.9984
0.8206
0.9666
0,6567
(mnoculao<(allcoo-111
1,0000
0,8120
0.9986
0.7414
0.9679
0,6563
28

---

Published as a conference paper at ICLR 2025
Table 12: AUPRCS of detectors in on the texts generated by different models in the cross-domain scenarios. CS-PHX denotes that the detectors are evaluated on the texts sampled from PHX while the humanized small language model is fine-tuned on CS. PHX- and EN-GER follow the same pattern.
Datasct
Models++
Llama2-13B
(Llama2-7B)
HUMPA
Llama3-70B
HUMPA (Llama3-8B)
Mixtral-8x7B
(Mistrul-7B)
HUMPA
The White-box
Setting
Likelihood
0,9999
0.9028
0.9965
0.6824
0.4265
LogRank
0,9983
0.8784
0,9848
0.6862
0.6594
0.3984
LRR
0,4680
0,4343
0,3702
0.3403
0.5274
0,3340
NPR
0,9792
0.8876
0.9647
0.7886
0.7919
0.6177
DNA-GPT
0,9890
0.9933
0.6312
0,3773
DetectGPT
0.5483
0,5809
0.4789
0.4610
0.3666
0,3388
Fast- Mist-DelettGPT
0,9972
0,9839
0,9999
0,9800
0.8298
0,3256
The Black-box
Setting
CS-SPH
Roherta-buse
0.8615
0.4681
0.6969
0.5744
Roberta-lurge
0,7883
0,6516
0.6173
0,4363
0.7121
0.6121
Likelihnod(Neo-22
0.8469
0.6800
0.9383
0,5102
0.4198
0.3237
LNgRank(Neo-2.7)
0.8568
0.6815
0.9362
0.4679
0.3895
0.3149
LRR(Neo-221) 2.7)
0.8152
0.6537
0.8708
0.3733
0.3686
0,3089
NPR(Neo-22.)
0.5995
0.5013
016511
0.5387
0.5927
0.4432
DNA-GPTINess
0.7973
0.4665
0.8675
0.4299
0.5017
0.3542
DeteciGPTTTS-BBNNG
0.3351
0.3407
0.3817
0.3710
0.3785
0.3540
Fast- Dww.DetccGGP((GT////oo000
0,9728
0.7826
0,9807
0.5259
0.4977
0,3100
Binoculars(aalcoo-7))
0.9848
0,5682
0,9661
0.4109
0.4870
0.3126
The White-
Setting
Likelihood
0.9997
0,9118
0.9999
0.8960
0.8057
0.5624
LogRank
1,0000
0.9224
0.9978
0,8562
0.8077
0,5352
LRR
0.8046
0.6941
0,4602
0,4202
0.7554
0,4167
NPR
0,9993
0.9624
0.9959
0,9519
0.9266
0,8403
DNA-GPT
0,9585
0,7985
0.9984
0.8320
0.6860
0.4240
DetectGPT
0,9133
0.8215
0,9055
0,7896
0.5455
0,5506
Fast- Gets-DetecIGPT
0.9966
0.9377
0,9958
0,9639
0.9686
0,5133
Black-box
Setting
PHX HSS
Roberta-buse
0.8390
0.7328
0,7057
0.6085
0.6380
0,5419
Roherta-large
0.8422
0.7272
0.7631
0.5784
0.6832
0.6084
Likelihood(Neo-2.7)
0.9599
0.7121
0.9355
0.6720
0.6370
0,4104
Log (Nnoo22))))
0.9647
0.7821
0.6337
0.6259
0,3846
I.R
0.9511
0.7550
0.8927
0.5139
0.6022
0.3490
(No(Ncc-2.7)
0.9444
0.8043
0.9177
0.7816
0.8164
0.6672
DNA GPT((ee--27)
0.8803
0.6267
0.9453
0.6685
0.6178
0.3734
DetectGPTTTS- ---GGPTTTSS1//0-222..77
0.7280
0.6249
0.7580
0.6533
0.6275
0.5235
0.9909
0,8393
0.9858
0.7171
0.7826
0.5133
Binoculars(alconn:
0.9957
0.6370
0,9990
0.5766
0.7493
0,3382
The White-box
Setting
Likelihood
0.9903
0,5519
0,9257
0.4742
0.4865
0.3569
LogRank
0.9824
0,5116
0.9132
0.4382
0.5271
0.3568
LRR
0.3338
0.3439
0.7028
NPR
0.9434
0.5346
0.5096
0.5000
0.7343
0.5096
DNA-GPT
0.9918
0,5513
0,9788
0,5181
0,5942
0,3284
DetectGPT
0.7913
0.5286
0.6529
0.4566
0.5790
0.5050
Fast- DeteDeeec
0.7943
0.9546
0.4053
The Black-box
Setting
EN-+GER
Roherta-hase
0.4993
0.4934
01,1135
0.4001
0.4403
0.3984
Roberta-lurge
0.4970
0,4496
0.4974
0.3958
0.4760
0.3946
Likelihood(Neo-2.1
0.3170
0.4616
0.3392
0.3980
0.3480
(Neo-22(
0.9824
0.3185
0.5023
0.3403
0.4064
0.3480
(Nco-2c)).7)
0.8099
0.3632
0.7743
0.3545
0.4954
0.3579
NPR(Neo-21) 2.7)
0.5762
0.3457
0.5351
0,3788
0.4649
0.3640
DNA- ANNA-PTINGo--2.777
0.7324
0.3303
0.8468
0.3765
0.4822
0.3257
DetectGPTYTS- 2.7)
0.4876
0.3394
0.4880
0.3773
0.4298
0.3560
Fast Paa--eetccGPPTGGT-J/N....
0.8955
0.3986
0.7648
0.3720
0.5299
0.3221
Binoculass(Falcon:
0.9951
0.3786
0.9922
0.3814
0.7244
0.3315
29


Reviews:
[{"review_id": "zW7j9C7poo", "reviewer": "Reviewer_oRJ8", "summary": "The article explores a strategy known as the Human-like Proxy Attack (HUMPA), aimed at evading detection by large language model (LLM) detectors. This approach uses a small language model (SLM) fine-tuned through reinforcement learning to alter the output of the LLM, making the machine-generated text indistinguishable from human-written content. Evaluations using various open-source models and datasets indicate a significant decrease in detector accuracy, while preserving the quality of the text.", "questions": "- Has the author considered potential safeguards to prevent the misuse of the proposed attack strategies?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "- Utilizing fine-tuned, human-like small language models to modify the distribution of source models, making them resemble human-written text, is a well-conceived attack strategy. This serves as an effective stress test to drive the advancement of current detectors.\n- The proposed method efficiently lowers the cost of fine-tuned model attacks. Additionally, despite the attack, the text quality remains high, which is essential for practical applications.", "weaknesses": "- The experimental setup lacks latest strong baselines, such as the more robust detector \"binoculars [1]\". (This detector is easy to replicate and very fast.)\n- The authors are commended for their results in cross-domain scenarios. However, cross-model detection evasion deserves more focus, as disciplines and languages remain constant, while LLMs continue to evolve.\n- The method proposed in the paper uses reinforcement learning to align the probability distribution of small models with human patterns, achieving human-like output. It's important to note that this approach appears similar to DALD [2], with the main difference being DALD's use of further training, while HUMPA employs reinforcement learning. I hope the authors can further clarify their contributions to distinguish them from HUMPA.\n- Formatting Issues\n    - The citation format for Yang et al. (2023b) is incorrect on lines 365, 367, 369, and 370. The author should thoroughly review and correct the citation format throughout the paper.\n\nOverall, I find this work to be promising. If the author can convincingly address the weaknesses identified, I would be open to revising my assessment.\n\n[1] Hans, A., Schwarzschild, A., Cherepanova, V., Kazemi, H., Saha, A., Goldblum, M., ... & Goldstein, T. Spotting LLMs With Binoculars: Zero-Shot Detection of Machine-Generated Text. In *Forty-first International Conference on Machine Learning*.\n\n[2] Zeng, C., Tang, S., Yang, X., Chen, Y., Sun, Y., Li, Y., ... & Xu, D. (2024). Improving Logits-based Detector without Logits from Black-box LLMs. *arXiv preprint arXiv:2406.05232*.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "2trY1lrner", "reviewer": "Reviewer_pAX3", "summary": "Machine-generated texts can bring misinformation and misconduct. Therefore, several methods are developed to detect them. This paper conducts research on the robustness of these methods and propose an evasion method called HUMPA to generate texts that reads fluent and natural but can evade SOTA AI-generated text detectors. The key idea is to use a human-written dataset and use direct preference optimization and solve it via direct preference optimization. However, as DPO can only be effortlessly applied to small models, this paper resorts to proxy-tuning, which first tunes a relatively smaller model using DPO, and then use this model to manipulate the output distirbution of the larger model and achieve the same preferece tuning goal. The method is validated on a bunch of state-of-the-art detectors in both black-box and white-box scenarios, demonstrating its effectiveness in lowering detection accuracy while ensuring fluency and naturalness of the generated texts.", "questions": "- DPO requires paired datasets. How do you collect the human-written text dataset for DPO for unseen tasks or topics that do not have a pool of human-written texts?", "limitations": "", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The problem studied is highly relevant and very important.\n- The paper is generally clearly-written and easy to follow.\n- The method seems sound and the experiments are conducted on a wide range of methods.\n- The idea to view AI-generated text detection as a preference optimization problem and solving it using DPO and proxy-tuning is intuitive and reasonable.", "weaknesses": "- The novelty of this paper on the technical side might be limited. The general idea of first tune a smaller model and then manipulate the sampling process of the larger model has been widely applied in previous works, such as Proxy-tuning [1], EFT [2], and DeRa [3] (not cited). The papers method is generally a combination of DeRa, EFT and Proxy-tuning. The main innovation of this paper is its application to the problem of evading machine-generated text detection. However, this cannot fully support the method's novelty.\n\n- The improvement of the method over previous works seems marginal. This paper does not compare with previous methods on evading machine-generated text detection, the only comparison is on the fluency part rather than effectiveness. According to the experimental results, the effectiveness of the proposed method is unstable. For example, in table 1-white-box, Likelihood, DetectGPT and Fast-DetectGPT's performances are only slightly degraded. This raises doubts on how the proposed method really advanced the field.\n\n- The provided theorems do not seem to be closely connected with the proposed method. For example, thoerem 1 just proves the existence of the optimal $\\beta$, and this theorem seems applicable to a wide range of tasks that uses DPO. Yet, it is unclear how significant it is to the evasion of AI-generated text detection and how this can be achieved through proxy-tuning.\n\n\nMinor:\n- Figure 1 caption, \"After the attack, the distribution aligns more closely with that of human-written text\" has been repeated for twice.\n- Citation formats in Section 4.1 are mostly wrong. Please correct them.\n\nReferences:\n\n[1]: Liu et al. \"Tuning Language Models by Proxy.\" COLM 2024.\n\n[2]: Mitchell et al. \"An Emulator for Fine-tuning Large Language Models using Small Language Models.\" ICLR 2024.\n\n[3]: Liu et al. \"Decoding-time Realignment of Language Models.\" ICML 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "P99CHsAtCD", "reviewer": "Reviewer_BPF1", "summary": "This paper presents a new attack to evade the MGT detectors by training a proxy to generate humanized text. The idea is to train a lightweight student model to screw the generation towards \"human\" through reinforcement learning by assigning \"humanity\" with higher rewards. The paper analyzes the theoretical guarantee of the proxy's attack effectiveness and generation quality. By evaluating several datasets, the paper shows the effectiveness and even some generalizability across languages and domains.", "questions": "1. What if the detector's score does not accurately reflect the degree of \"human\"? Since this is an attack paper, it is expected that there are different kinds of victims. What if the detector does not give higher rewards to more human text? \n2. What if the source LLM generated nearly equivalently \"human\" text with similar rewards? For the proposed attacks, is there any requirements on the scale of the reward difference? In other words, how different should the training sample be in terms of rewards?\n3. Why are white-box attacks even worse?\n4. How efficient is the attack compared with tuning source LLMs with DPO?\n5. Can we use smaller models with different architecture to attack?\n6. What if we stick to the same model, i.e., to use the scoring of LRR to attack LRR?\n7. Is there any transferability across detectors? For example, can we use the scoring from LRR to attack DetectGPT or Fast-DetectGPT?\n8. Can we apply such attacks in truly black-box settings, e.g., GPTZero or CopyLeaks?\n\nSpecifically, could you please:\n1. Clarify the assumptions underlying Theorems 3.1 and 3.2, particularly regarding detector calibration and training data representativeness.\n2. Discuss the practical implications of these assumptions not being fully met in real-world scenarios.\n3. Provide additional empirical evidence or analysis to support the theoretical claims, especially regarding quality preservation in Theorem 3.2.\n4. Discuss potential limitations on the generalizability of their approach more explicitly.\n5. Suggest or conduct additional experiments that could test the boundaries of the attack's effectiveness across a wider range of scenarios or detectors.\n6. Conduct experiments using smaller models from different architectural families as the proxy attacker.\n7. Discuss the potential impact of model architecture and size differences on the attack's effectiveness.\n8. Perform additional experiments using different detectors for scoring in the white-box setting.\n9. Analyze and discuss how the choice of scoring detector impacts the attack's performance.\n10. Include comparisons with other state-of-the-art attack methods on the same datasets and detectors.\n11. Discuss the relative strengths and weaknesses of their approach compared to existing methods.\n12. Provide quantitative comparisons of computational efficiency between their method and direct fine-tuning of the source LLM.\n13. Discuss the trade-offs between efficiency gains and potential performance differences.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. The paper is very nicely written and presented. The logic is clear, and the figures are beautiful. The problem is nicely defined, and the methodology is clearly explained.\n2. The paper shows the potential of using lightweight methods to bypass MGT detection. \n3. The code is open-sourced.\n4. In practical experiments, the paper shows the effectiveness of the attack, especially with little harm to model utility, which is amazing.", "weaknesses": "1. My main concern is that the theoretical guarantees in the paper (specifically Theorems 3.1 and 3.2) may be misleading, potentially overclaiming what they actually achieve. The logic behind these theorems is pretty simple: the training objective aims to balance two things—making the student model mimic humans (for attack effectiveness) and making it mimic the teacher LLM (for quality). By adjusting β from 0 to +∞, the student LLM could theoretically be optimized (optimally) to behave either purely human-like or purely as a replica of the teacher model, given “reasonable” training data. However, there are several issues with this claim: Firstly, as mentioned in the paper, the detector will overfit to what it was exposed to, which is unlikely to represent perfectly and, more importantly, calibrate accurately to the human distribution. And, because the proposed method relies on the detector rather than true human distribution, there seems to be no way to get the lambda mentioned. In other words, the approach would only work under ideal optimization, an ideal detector (a perfectly calibrated one), and an ideal training dataset. This explains why the paper uses Fast-DetectGPT as the scoring detector in all white-box settings, why black-box settings show better attack performance (NEO might be stronger with better calibration), and why the student models selected are from the same family as the teacher. Secondly, Theorem 3.2 essentially shows that the student model is just a less optimized (in terms of utility) version of the teacher, which doesn’t necessarily make it \"good quality\".\n2. Given the constraints on both the detector and the training data, the attack is very likely to be limited in scope. While the paper presents some interesting results suggesting generalizability, we should expect that it won’t extend broadly in practice. See 1.\n3. The paper uses models that are very close in architecture and scale (e.g., Llama2-13B vs. Llama2-7B). It’s unclear whether a smaller model from a different family could yield similar attack results. See 1.\n4. The paper relies on Fast-DetectGPT for scoring in every white-box experiment, which doesn’t seem appropriate or fully aligned with the paper’s methodology. I wonder if these attacks would still perform well using only the target detector or less well-calibrated detectors. See 1.\n5. Many of the white-box attacks have low performance. See 1.\n6. The paper does not compare with any other SOTA attacks.\n7. Although it is cool to use a small model to improve efficiency, the paper doesn’t provide any assessment of this efficiency, particularly in comparison to tuning the source LLM with DPO.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "AkYQaJx18m", "reviewer": "Reviewer_wsFK", "summary": "This paper aims to develop an attack against LLM detectors. The authors present a method called HUMPA (humanized proxy attack) that uses a smaller language model to subtly alter the output of a large language model (LLM) in a way that makes it harder for detectors to identify as AI-generated. In particular, the work adopts conventional Preference-based reinforcement learning, using the LLM detectors as a reward model, to train an SLM and adds the SLM token prediction onto the original LLM toke predictions. The paper provides some theoretical analyses as well as experimental results. However, the method is not novel, and the experiments lack baseline comparisons.", "questions": "- (please see weaknesses)\n- What methodological improvement does this work offer over previous approaches to evading LLM detection?\n- While fine-tuning SLM is faster than LLM, Low-Rank Adaptation can be even faster. Why is LORA not considered?", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- Leveraging SLM to reduce costs is a good idea\n- The format is correct, and the images are clear\n- Attacks and defenses for LLM-produced texts are important research directions.", "weaknesses": "- **No baselines**: the work only compares the result between the original LLM and the original LLM with the proposed HUMPA added on top. As shown in the Detection Evasion Methods in the Related Works section, many baselines should be compared.\n- Unclear method and problem setting: there are many questions because the method and setting are not clearly explained. \n    - attacker capability: does the attacker know the target LLM detector? Can the attacker query the target detector?\n> It is worth noting that under adversarial attack conventions, black-box denotes query access while white-box denotes access to internal weights and gradients. In this work, the authors seem to denote the white box (detector) as the detector's access to LLM logits, while the black box indicates no access to logits and directly detects based on the final produced text (However, it is not clearly explained in the paper). Here, the reviewer wants to ask for the attacker's access to the detector.\n    - Is the HUMPA method required to know which detector it faces beforehand? (also see the first question)?\n> The work seems to use the target LLM detection directly as the reward model for each attack. Specifically, no cross-detector experiment setting was provided. Reviewing the code, the DPO_MixBuilder class also conditions based on the target detector. Thus, it seems that generalizability is an issue. Can a HUMPA method leveraging a target LLM detector be applied to a different type of LLM detector?\n    - The target LLM task required for HUMPA to work. Can HUMPA generalize to different text generation tasks?\n    - What is the threshold for evading LLM detection? Line 453 claims that HUMPA successfully evaded all detection methods across all source models. However, in Table 2 many detection scores are higher than 0.5.\n- Poor writing, many typos or errors e.g. (not exhaustive):\n    - Line 95 extra space\n   -  Line 375 Then',' based on the samples,", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LUETGHV8I1", "reviewer": "Reviewer_SF6Q", "summary": "This paper introduces HUMPA (HUManized Proxy Attack), a novel strategy to evade detection of LLM-generated texts. The key idea is to use a small language model (SLM) fine-tuned with reinforcement learning in the decoding phase to contaminate the outputs of larger source models like Llama2-13B, Llama3-70B, and Mixtral-8x7B. The authors demonstrate that this approach can effectively deceive state-of-the-art detectors in both white-box and black-box settings, achieving significant drops in detection performance (up to 90% relative decrease in AUROC) while preserving generation quality. They also show the method's effectiveness in cross-domain and cross-language scenarios.", "questions": "- How sensitive is the HUMPA method to the choice of SLM used as the proxy attacker? Would using even smaller models such as Phi-3.5-mini-instruct still be effective?\n- How does the computational cost of HUMPA compare to directly fine-tuning the source model, especially for the largest models tested?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The proposed HUMPA method is practical, addressing limitations of directly fine-tuning large models for evasion.\n- This paper provides extensive theoretical analysis.\n- Comprehensive experiments are conducted across multiple datasets, models, and detection methods, demonstrating the effectiveness of the attack.", "weaknesses": "- The HUMPA method itself is too straightforward and lacks novelty. Many previous works [1, 2] in other fields share similar ideas. \n- Experiment metrics are not explained and hard to follow. Meanwhile, since the main purpose of applying SLM is to reduce time efficiency, you should also provide the time cost comparison between fine-tuning SLM and original LLM.\n\n\n\n\n\n[1] Xu, Zhangchen, et al. \"Safedecoding: Defending against jailbreak attacks via safety-aware decoding.\" arXiv preprint arXiv:2402.08983 (2024).\n\n[2] Chen, Charlie, et al. \"Accelerating large language model decoding with speculative sampling.\" arXiv preprint arXiv:2302.01318 (2023).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)