Learning From Dictionary: Enhancing Robustness of Machine-Generated Text Detection in Zero-Shot Language via Adversarial Training
Authors: Yuanfan Li
Qi Zhou
Zexuan Xie
Venue: ICLR 2026 Poster (2026)
Keywords: Large Language Model
Adversarial Training
Machine Generated Text Detection
Primary area: foundation or frontier models, including LLMs
TL;DR: This paper proposes an adversarial training approach to enhance the robustness of machine-generated text detection in zero-shot languages against adversarial attacks.

Abstract: Machine-generated text (MGT) detection is critical for safeguarding online content integrity and preventing the spread of misleading information. 
Although existing detectors achieve high accuracy in monolingual settings, they exhibit severe performance degradation on zero-shot languages and are vulnerable to adversarial attacks. 
To tackle these challenges, we propose a robust adversarial training framework named 
**T**ranslation-based 
**A**ttacker 
**S**trengthens 
Mul**T**ilingual 
Def**E**nder (TASTE). 
TASTE comprises two core components: an attacker that performs code-switching by querying translation dictionaries to generate adversarial examples, and a detector trained to resist these attacks while generalizing to unseen languages. 
We further introduce a novel Language-Agnostic Adversarial Loss (LAAL), which encourages the detector to learn language-invariant feature representations and thus enhances zero-shot detection performance and robustness against unseen attacks. 
Additionally, the attacker and detector are synchronously updated, enabling continuous improvement of defensive capabilities. 
Experimental results on 9 languages and 8 attack types show that our TASTE surpasses 8 SOTA detectors, improving the average F1 score by **0.064** and reducing the average Attack Success Rate (ASR) by **3.8\%**.
Our framework offers a promising approach for building robust, multilingual MGT detectors with strong generalization to real-world adversarial scenarios.
Our codes are available in https://github.com/Liyuuuu111/MGT-Eval, and our datasets and pretrained checkpoint are available in https://drive.google.com/file/d/1w1hbdiZMS_JzPntVMWM3qrTQ4KxJf-t6.

Published as a conference paper at ICLR 2026
LEARNING FROM DICTIONARY: ENHANCING ROBUST- NESS OF MACHINE-GENERATEED TEXT DETECTION IN ZERO-SHOT LANGUAGE VIA ADVERSARIAL TRAIN-
ING
Yuanfan Lit Qi Zhou', Zexuan Xie
Faculty of Electronic and Information Engineering. Xi'an Jiaotong University f Equal contribution, Corresponding author: liyuan771 60 gma com
ABSTRACT
Machine-generated text (MGT) detection is critical for safeguarding online con- tent integrity and preventing the spread of misleading information. Although ex- isting detectors achieve high accuracy in monolingual settings, they exhibit vere performance degradation on zero-shot languages and are vulnerable to ad- versarial attacks. To tackle these challenges, we propose robust adversarial training framework named Translation- DefEnder (TASTE). TASTE comprises two core components: an attacker that performs code-switching by querying translation dictionaries to generate adver- sarial examples, and detector trained to resist these attacks while generalizing to unseen languages. We further introduce a novel Language-Agnosti Adver- sarial Loss (LAAL), which encourages the detector to learn language-invariant feature representations and thus enhances zero-shot detection performance and robustness against unseen attacks. Additionally, the attacker and detector are synchronously updated, enabling continuous improvement of defensive capabil- ities. Experimental results on 9 languages and attack types show that our TASTE surpasses 8 SOTA detectors, improving the average F1 score by 0.064 and re- ducing the average Attack Success Rate (ASR) by 3.8%. Our framework of- fers promising approach for building robust, multilingual MGT detectors with strong generalization to real-world adversarial scenarios. Our codes are avail- com h and our datasets wwwp:/iwwwwwoooe..oooooooo com/
Attacker Strengthens MulTillingual
able in infttts:: : /
and pretrained checkpoint are available in
file/d/Iwlhbie _ VW
INTRODUCTION
The explosive growth of large language models (LLMs) such as ChatGPT (Achiam et al.) 2023).
LLaMA (Dubey al. 2024) and Deepseek (Guo al. 2025), has made it trivially easy generate fluent, human-quality text at scale. While this capability unlocks many positive applications, also facilitates the mass production of misleading malicious content-ranging from fabricated news to sophisticated phishing messages-withe witthot clear attribution. To address these risks, researchers have developed various methods detect muchine--generatee text (MGT) (Su et al. 2023 Hans et al.,
2024 Bao et al.] 2024 Liu et al. 2024 Li et al. 2025 Park et al. 2025) that help find where the text really comes from and readers know.
Although there has been much progress in detecting MGT's, recent benchmark (Wang et al. 2024c) shows a surprising result: all detectors suffer a significant drop in performance when applied to zero-shot languages. Even worse, as shown in Figure [ their robustness zero-shot languages degrades even further: changing just two words can cause the detectors' detection accuracy drops about 20-40%. This means that detectors
be easily bypassed in languages they not trained on. However, most detectors are still developed and benchmarked primarily on English (Guo et al.] 2023
He et al.
2024
Li et al. 2024), leaving billions of non-English readers with little protection.

---

Published as a conference paper at ICLR 2026
Motivation. We rely adversarial training to improve the MGT detector's zero-shot language detection performance and robustness against different kinds of attacks. Current adversarial training methods (Hu et al. 2023] Koike et al., 2024 Li et al. 2025) mainly focus monolingual settings, which makes it difficult for detectors to generalize to multilingual environments. Moreover, some
2025) find that adversarial training generally requires recent studies (Avram et al. 2025 Wu al.
large-scale corpora to ensure multilingual robustness.
However, in the real world, high-resource lan- guages can readily access abundant training data, whereas rediium-resoures languages of- ten lack sufficient annotated corpora and mostly depend on translation dictionaries. In the case of low-resource languages, even basic lexical resources are scarce, making almost impos- sible to collect data for adversarial training.
Zero-ahee Detection and Attedo
Puchinn
Written (V)
Tre Auriager
hrittes [*]
wrilten
(V]
Written
To overcome these limitations, we propose an effective adversarial training framework that works in multilingual setting. Our approach relies solely on data and labels from a sin- gle language and utilizes translation dictionar- ies from medium-resource languages, enabling the detector to generalize better to zero-shot languages and maintain strong robustness un- der attacks.
Wall
Written
Beledarr Langaege gialt
Zanvarat
Figure I: Performance drop of different MGT de- tectors under zero-shot language detection and at- tacks.
Our work. In this paper, we propose an adversarial training framework for train- ing a robust multilingual MGT detector, named Translation- basod Attacker Strengthens
MulTilingual DefEnder (TASTE). TASTE consists of an attacker and a detector. The detector learns to distinguish between human-written texts (HWTs) and MGTs, and acquires language-agnostic feature representations during adversarial training to enhance its generalization ability to zero-shot languages, while the attacker performs code-switehing MGTs by querying translation dictionar- ies to deceive the detector. Due to the attacker is restricted by the black-box scenario where only outputs from the target detector gradient information and identify important tokens in the prediction. After that, we use a static translation dictionary to replace the original English tokens other languages and obtain the adver- sarial examples. To encourage the detector to learn language-agnostic feature representations, we design loss function named Longuagg-AAnostte Adversarial Loss (LAAL), which enforces consis- tent predictions on original and adversarially perturbed samples across languages, thus improving zero-shot generalization and robustness. During the training stage, we update the detector and the attacker within the same training step, enabling the detector to learn from adversarial examples and generalize to zero-shot languages as well as unseen attacks. Experimental results demonstrate that our method achieves an average F1 score of 0.773 on the M4GT dataset (Wang et al. (024b), sur- passing the SOTA detector by 0.064. We also find that TASTE achieves an average Attack Success Rate (ASR) of 18.0 % under various attack scenarios, which is 3.8 % lower than all existing SOTA detectors.
available, we use an open-source surrogate model to obtain
To sum up. our contributions
follows:
Effective Adversarial Training Framework. We propose TASTE, an adversarial training framework that improves detector's s generalization and robustness to zero-shot languages. The attacker generates adversarial examples by querying translation dictionaries, while the detector learns from both adversarial and original examples and is updated synchronously with the attacker, enabling it to withstand unseen attack strategies. Our TASTE only re- lies on translation dictionaries instead of large-scale multilingual corpora, which greatly reduces data collection costs.
Language-Agnosti Adversarial Loss. We introduce simple yet powerful LAAL objec- tive for multilingual detector training in the black box setting. LAAL couples a gradient- reversal language discriminator with the main classifier, forcing hidden representations to
2

---

Published as a conference paper at ICLR 2026
discard language-specife cues and retain only semantic signals that transfer across lan- guages, enabling the detector to gain in zero-shot accuracy and robustness against unseen attacks.
Outstanding Performance. Evaluation on 9 languages shows that our detector outper- forms 8 SOTA detectors in zero-shot language detection performance and improves robust- ness under 8 attacks.
RELATED WORK
Machine-Generated Text (MGT) Detectors. Due the rapid development of LLMs, numerous
MGT detectors have been proposed. Many works (Mitchell et al. 2023 Bao et al. 2024 Liu et al.) 2024 Kushnareva et al.) 2024 Li et al. 2025 Su 2025| Ma et al. 2025 Su et al. 2025 Liu
et al. 2025) have focused on accurately identifying machine- machine-generated texts, motivated by the re- markable ability of LLMs to produce fluent, coherent, and human-like content, which has facilitated the rapid spread of unverified or misleading information online. Although current MGT detectors have made significant progress detection accuracy, recent studies show that their performance drops substantially on zero-shot languages and that they remain highly vulnerable to attacks. A recent benchmark (Macko et al. 2024a) evaluated the zero-shot language detection performance of ten detectors and found that all of them suffered from severe drops in accuracy when applied to zero- shot languages. Some studies (Wang et al. 2024a] Macko et al.) 2024bb Wang et al. [024c] Li et al.) 2024) have also found that existing MGT detectors fail maintain robustness under attacks; even modifying a few words can change the detector's prediction. To address the above limitations of cur- rent MGT detectors, our work focuses on improving their zero-shot language detection performance and robustness against attacks.
Adversarial Training. Adversarial training aims to optimize the detector to maintain correct pre- dictions on adversarial examples, which are intentionally crafted to mislead the detector. |uu et al. (2023) uses an LLM to generate adversarial examples via paraphrasing attacks. Koike et al. (2024) applies in-context learning for adversarial training. Li et al.) 2025) improves detector robustness by updating the attacker and the detector simultaneously within the same training step. However, although these methods have made significant progress in enhancing model robustness, they cannot generalize to multilingual scenarios. Additionally, some studies (Avram et al. [025]] Wu et al. 2025) have pointed out that multilingual adversarial training requires large amount of multilingual data, which is difficult to collect in practice. Different from previous works, our method uses an attacker that performs soiesswit with translation dictionaries to create diverse multilingual adversar- ial samples. Meanwhile, we design Language-Agnostic Adversarial Loss to encourage the detector to learn language-agnostic features, and update the attacker and the detector synchronously to enable the detector to generalize to unseen attacks.
3 MODEL ASSUMPTION
In this section, follow standard modeling practices (Koike et al.) 2024 Li al. 2025) and specify the capabilities and goals of both the attacker and the detector in our adversarial --verraral-traininng setup.
Attacker's Capability and Goals. Given an MGT passage, the attacker aims alter the text so that the detector misclassifies it. An MGT sample that successfully triggers a misclassification is called adversarial example. Following prior work (Jin et al. 2020 Li et al., 2020b 2025), we assume the attacker in a black-box setting: it has no access to the detector's 's weights, architecture, or training data, and can observe only the detector's output labels. The attacker does have access to (i) multilingual translation dictionaries and (ii) any publicly available models, which it can use to craft strong code-switching adversarial examples.
Detector's Capability and Goals. The detector's goal is to correctly distinguish HWTs from MGTSs and remain robust to adversarial examples. During training, the detector can access only labeled corpus in single high-resource language and the adversarial samples produced by the attacker. has no direct access to the translation dictionaries or to any large-scale multilingual corpora. Because the detector does not know in advance which attack strategies code-switching patterss the attacker will deploy, it must learn inguage-agnostic feature representations from this limited supervision, enabling it to generalize to zero-shot languages and unseen attack strategies.
3

---

Published as a conference paper at ICLR 2026
4 METHODOLOGY
In this section, we introduce our TASTE framework. The architecture of TASTE is shown in Figure
Following the general adversarial training procedure introduced in Li et al. (2225) we first describe the workflows of our attacker and detector, and then systematically outline the adversarial training process.
Input Texts
Attacker to Generate Adversarial Examples
Conatinn inpaatt
hour
Model ()
Code-Switching
June ieruducing
Important Token Identification
Transtation Dictionary
dection
Perform Like Target Datector
English
English
Asureligt snere plaa atment ansoore
Agpgso
Importent
0J072 6317
Top-k
launched
new
sward
plus
Quests
Archon >2 sposrrt
mode
Modus
events -amaniis
Aquukerr Goneentee Adheramaa Gnamysled
Burrogate
Original MGT
Adversarial Training
Adversarial
Exomples
To Adversarial Example
Surragate Model par (
Target Detector (urr()
Genchin Impact 577 Space and Time June Dahila, @ appout and Story mneema the Azurelight
Beidgn ane betweend o Du withh
Admeniaiil lammple
Divtinguan HWTh and Mata Optimteed by
Input Texts
Conatin Irssact ST
Prediction Label
Stygian Onalmught Modus
Iaaached Juse 2825,
trtrodacing Seik
Story Guants enent
Stylin Decaaght modk
Detector to Distinguish HWTs and MGTs
Detecitonoi Distrgash War7 and MiFTit..
Robustness- Sebustress-Preserving Loss
Language-Agmostle Adversarial
Accurate HWVTs MGTs while tobust the Advensarial Ecamplas
Produoe Longugge InveriantFFatuures
Human Written
Deting us Ademania Auseeda
Encoder LumnLngaee--nnatttr
Machine
Generated Text?
Figure 2: Pipeline of TASTE. The attacker identifies important tokens in original MGT and performs code-switching for important tokens to obtain ad versarial examples, which are then fed to the target detector and participate adversarial training.
4.1 ATTACKER TO GENERATE ADVERSARIAL EXAMPLES
Our attacker includes a surrogate detector (.ur(.). To achieve the altacker's goal stated in Model Assumption Section, develop powerful attacker. Specifically, the attacker generates adversarial examples through the following steps: Important Token Identification and Sode-SSitching
Important Token Identification. Miralees- contribute equally during MGT detection. Therefore, perturbing key tokens is crucial for generating strong adversarial examples. However, under black-box setting, we cannot directly use the gradients of the target detector D Dear (.) to identify important tokens as done in Yoo & Qil (2021). To address this, we introduce a surrogate model simulate the detector and estimate token importance scores.
al. 2025) demonstrate that not all tokens
Given original MGT X 22, .T] consisting of T tokens and its label 1, we leverage surrogate model Deur()) obtain the last-layer hidden states for all tokens:
H ( (X) [h, he...., hy],
where hy denotes the final hidden state corresponding to the t-th token x, produced by Daur
Following the approach in Zhou al. (2024), compute the importance score g: of token x, using the following formula:
Lets
log Psne (X),
aCela
9:
== 1.......Z
(3)
Oh;
12
4

---

Published as a conference paper at ICLR 2026
where (1 X) denotes the probability that the surrogate model (-) assigns to the true label 1 given the imput X. We show the effective our important estimator in Appendix B.2
Then, we select the top-k tokens with the highest importance scores in text X and construct the important-token set
I= top k (1( 9t) It 1.2.......
Code-Switching. We perform code-switching on each token in to obtain multilingual adversarial example X. Specifically, given translation dictionary T, query the translation for each token and replace with the corresponding word in the target language. An example can be found in Figure We investigate the impact of dictionary errors the results of our method in Section 6.2
Attacker's Loss. For each sample X; in a batch of size N, since we only have access to the output label 4 returned by the target detector (.) we take I = arg max Dtar(X; as pseudo label, and let Paur (4 x;) denote the probability assigned to this label by the surrogate. The attacker loss then defined as
N
L
- log Paur [.)]-
(5)
Minimizing loss function Eq. 5 distills the evolving knowledge of the target detector into the sur- rogate model, providing more reliable gradients for token-level importance estimation. We demon- strate in Appendix BB3 that our distillation strategy is effective, and we analyze the impact of the la- bel noise in Appendix B.4 We also evaluate the quality of our adversarial example in Appendix [B6
In each training step, we update the surrogate model using the loss function Eq. the detector frozen. Detailed procedures are described in Section 4.3
5 while keeping
4.2 DETECTOR TO DISTINGUISH HWTs AND MGTs
Our detector includes a target detector Dtar (-). To achieve the detector's goal stated in the Model Assumption section, we design two loss functions for the detector: robustness-preserving loss and a lanuuage-ggnostic adversarial loss.
The goal of the Robustness- Robustness-PPesservine Loss (RPL) to keep the detector accurate on HWTs and MGTss while remaining resistant to the adversarial samples produced by the attacker. Formally, let Dtar(-) be the target detector, X, an original MGT with ground- label 4. and X, its adversarial example generated by the attacker. The detector required to assign the same correct label to both X, and X,. Accordingly, the loss is defined as
Preeedeess-rreeivingg Loss.
CRLL
1
- log Pear X,) log Pear (4: xx))
N
where N is the batch size and Piar(1 (4 Xx)) denotes the probability that the target detector assigns the correct label for sample X, Minimizing loss function (Eq. (6) encourages the detector to
maintain its decision on the original sample even after adversarial perturbation, thereby preserving robustness.
Aanguiie-Agnostic Adversarial Loss. The Language-Agnostic Adversarial Loss (LAAL) objec- tive encourages the encoder to produce language-invarian features so that the detector can gen- eralize zero-shot languages. Encouraged by [Bhattacharjec et al.) (2024), adopt domain- adversarial scheme: the [CLS] vector is fed to a lightweight language discriminator fiaug()) that (i)
tries tell whether input is code-switched (Viang
(8) clean (yrang 0). During back-
propagation, the gradient flowing from the discriminator to the detector's encoder is multiplied by a negative factor - AAann: this reversal forces the encoder to confuse the discriminator and thereby erase segguage-specifie cues.
(0) Formally, let h1 be the [CLS] representation of the i-th sample (X, or X.) and Piang softmaxd Saaimaaxdfungg (h the discriminator's predicted probability vector. The LAAL term is
N ylang log Piang Mlang) log/1 ((0
LLAAL N
(8)
5

---

Published as a conference paper at ICLR 2026
Algorithm Adversarial Training Procedure of TASTE
1: Input: Training set Duiin translation dictionaries T.
2: Initialize: Target detector Duc. surrogate detector Dar, language discriminator fung. attack strength s= 1,
maximum strength maxx. epoch = O.
3: while epoch < Emax do mini-batch {(X,, 1:)]== C
Dirain do
** Step update attacker **
D-0
6:
for each MGT X; in the batch do
7:
Obtain hidden states H via Eq.
(1)
8:
Compute token scores 9: via Eq.
Select I with size [ using Eq. Code-switch tokens in I with T to get X; δ DU ((X,,))
10:
11:
12:
end for
13:
Get the detector's return label of Xi in mini-batch using i = arg max Dear D mini-batch ((x,,)))
14:
Compute attacker loss Lau (Eq.
15:
Update D.n (detector frozen) Ste B update detector
16:
Compute CRML (Eq. (6) Dirain UD Compute LLAAL (Eq.
17:
Las CRPl + Alams LLAAL (Eq. N
19:
Update Dur and fung (attacker frozen)
Step C C schedule attack strength
20:
s s min(s A, 8max)
gradually increase difficutty
21:
end for
22: epoch f- epoch +
23:
end while
24:
Output: Trained target detector Dur-
where N is the batch size and Plang denotes the probability assigned to the class code-switched.
The discriminator minimizes loss function Eq. 7 to improve its classification accuracy, while the
encoder receives the reversed gradient Alang DETAAL and therefore maximizes the same objective.
2h
This adversarial interplay drives the hidden representations toward language-agnostic subspaces, enabling the detector to transfer its decision boundary to unseen languages. We provide a formal proof the cross-lingual generalization ability of LAAL in Appendix
Total Loss. The total loss of our detector is defined as:
Lact = LRPL. + MangfLAMM
In each training step, update the detector using the loss function Eq. while keeping the attacker frozen. The detailed procedure is described in Section 4.3
4.3 ADVERSARIAL TRAINING
We propose an adversarial training framework where the detector and the attacker are updated within the same training step to achieve co-evolution. Unlike traditional adversarial training approaches that use a fixed adversarial intensity (Jia al. [2022] Feng et al.) 2025 Gaber et al. 2025) or static adversarial examples (Zeng et al.) 2023 Huang et al. 2024), our attacker adopts a dynamic ad- versarial strength strategy and generate dynamic adversarial examples. As training progresses, the difficulty of adversarial examples generated by the attacker gradually increases, thereby enhancing the detector's generalization ability and mitigating underfitting.
Training Process. In each training step f,, first update the attacker using the loss function Eq. (5) while keeping the detector frozen. The updated attacker then generates the adversarial examples X. Next, we update the detector using the loss function Eq. (8) while keeping the attacker frozen. During training, control the attack strength via the size of code-switching tokens set I. As

---

Published as a conference paper at ICLR 2026
training progresses, [I] gradually increases, enabling the detector to learn from progressively harder examples. We provide detailed deseriptions of the adversarial training process in Algorithm [ and study the impact of attack strength on the experimental results in Section 6.1 the training dynamics in Appendix B.9
We also analyze
5 EXPERIMENTS AND RESULTS
We conducted comprehensive experiments to validate the zero-shot language detection capability of TASTE and its robustness against attacks. Due to space constraints, we present the ablation study results in the Appendix B.1
5.1 DETECTION PERFORMANCE IN MULTILINGUAL SETTING
Experiment Setting. We evaluate the zero-shot cross-lingual detection capability of our TASTE model on nine languages from the M4GT dataset (Wang et al.] 2024b). The compared baselines
include: (i) Metric-based detectors: Fast DetectGPT (Bao et al. 2024), Binoculars (Hans et al. (Conneau et al. 2019), mDeBERTa--e v3- (He et al. 2021), mBERT (Devlin et al., 2019), RADAR (Hu al. 2023). and GREATER-D (Li al. 2025). All model-based detectors are trained in the same English dataset. For fair comparison, all adversarial training methods share the same backbone model mBERT. Our TASTE constructs adversarial samples using translation dictionaries for Arabic, Chinese, German, and Russian. We use GPT-2 model (Solaiman et al. 2019) fine-tuned on the dataset from Wang et al. (2024a) as the surrogate model, and we provide a detailed analysis of the impact of replacing the surrogate model on the experimental results in Appendix B.3 Detailed descriptions of the baseline models and implementation details are provided in the Appendix A.4
2024), and LRR (Su et al. 2023); and (ii) Model-based detectors: XLMMRoBERTa--
We also report inference time in the test dataset in Appendix B.8
Metric-hased Detectors
Medel based Detectors
Lang
Fast DesectGPT
Binuculurs
LBR
XLM-BoBERYhoBaw
=DvBERTT-3-Bue
=BERT
RADAR
GREATER-D + TASTE (Ours)*
51643
0.473
0.611
9.9
0,835
0,890
0,00
0,871
0.591
RV91
1.392
03333
1:366
0.891
0,992
0.726
0.78
0.28
F2
0.642
0.364
0.247
0.586
0.872
0.820
0,711
0.761
0,790
Avc
03873
11543
0:559
0.715
0.792
0.64
0.81
0.88
11201
0.51
0.401
0.205
0.700
0.643
0,m
Avc
0.23
0381
0250
0.854
0.733
0470
0.366
0.31
0.995
0.642
0.382
0.205
0.752
0,403
0.429
0,781
0,33
05588
03327
0.488
0.563
0.11
6321
0.99
0.613
1615
0.544
0,50
Ag'
7
10082
00662
0.514
0,335
0.633
0.724
0312
0.754
1.670
0.726
An1
0.001
0.360
0589
0.000
0200
0.93
07765
0.625
0.324
0.455
0.00
0.762
Auc T
0.240
0.025
0.461
0,630
0.15
0.685
0.43
0,501
0.094
03385
00044
02238
0380
0315
0,713
arl
Avc 1
0.208
0.613
0.543
0.961
0.607
0.21
0,700
6,713
F2"
8655
0.595
0.351
0.560
0.57]
0.645
0.671
0,699
0.777
'0612""
30322
0.302
"610
Zom-shatt Ang.
F7"
u.699
0.524
0.323
0,582
0.003
9.766
0653
0,731
I.786
0.645
0.537
0.406
0.654
0.639
0.589
Aug.
F1"
0.665
0.523
0.312
0.649
0.67]
0.709
0.652
0.581
0.773
Table 1: Performance of detectors in M4GT dataset. We report accuracy (Acc) and F1 score (FT). Best in each row is bold, second-best is underlined. denotess zero-shot languages (bg/id/it/ur; Zero-shot Avg. is the macro-average over these four languages. * indicates adversarial-trainigg based methods. We report @ @PR@FPR-112 % of this dataset in Appendix B.7
Experiment Result. We present the zero-shot cross-lingual detection performance of TASTE in Ta- ble unveil the following three key insights: i) Highest overall performance. TASTE achieves the best averaged scores (Acc 0.762, Fl = =07733, outperforming the second-best system by +0.071 Ace (+10.3 %) and +0.064 F1 (+9.0 %). ii) Consistent gains across languages. It delivers the top result in four language metric pairs and the second place in others. Representative margins over the next-best method are +5.3 pp Acc / +7.8 pp Fl on English and +4.3 pp Acc / +3.9 pp Fl on Bulgarian, showing reliable improvements even on typologically diverse languages. iii) Zero-shot
7

---

Published as a conference paper at ICLR 2026
generalization via adversarial training. Despite being trained solely on English, adversarial train- ing enables TASTE to maintain strong accuracy and FI in every language, confirming its superior generalization in truly unseen linguistic settings. Our TASTE also exhibits certain degree of gen- eralization ability to unseen datasets, as detailed Appendix B.5
5.2 ROBUSTNESS AGAINST ATTACKS
Experiment Setting. In this section, we evaluate the robustness of MGT detectors against at- tacks under the zero-shot detection setting. Following the robustness evaluation protocol pro- posed by Wang et al. (2024a), we extend the M4GT dataset with common attack strategies: random deletion (Delete) (Kukich) 1992). word repeat (Repeat) (Fishchuk) 2023). word insertion (Insert) (Gabrilovich & Gontmakher, (002), sentence swapping (Swap) (Shi et al. (024), code- switching (Code-Switching) (Li et [2020a), human obfuscation (Human-Obt.) (Macko et al.j
2024b), Back-translation (Sennrich et al. 2015)) and paraphrasing (lyyer et al. 2018 Detailed de-
scriptions of these attack methods are provided in the Appendix A.5
11.5
20L7
18.
22.5
22.5
34
50.0
36. 17.3
502
010
617
+1.6
02
3544
40.
2000
347
26.0
18.5
21.5
20.2
64.4
484
4700
36.7
45.4
20.0
25.3
345
$5.4
83.
00
550
25.1
28.5
26,5
20.5
12.0
822
2511
16.3
11.
(a) Overall mean ASR
(b) ASR per language
(c) ASR per attack type
Figure 3: Performance of all detectors under attacks. A lower ASR (%) indicates better model
performance.
Experiment Result. Figure shows that TASTE achieves the lowest average ASR 18.0%, yield- ing a 17.4% relative reduction compared with the strongest SOTA defense GREATER-D (21.8%) and 56.8% % reduction versus the best metric-based baseline Fast DetectGPT (41.7%) Across lan- guages, TASTE wins in 8/9 cases with an average per- per-language absolute drop of 3.82 ASR points (notably ar: 17.1 10.0, ur: 20.5 12.0, zh: 23.2 + 16.3), and a paired sign test over languages confirms statistical significance (p = 0.039, two-sided). sttack-wise, TASTE delivers large relative reductions against key shifts compared with GREATER-D: DELETE -38.9% (23.9 14.6), CODE- SWITCHING -3288% (29.3~>9.77) HUMAN-OBE. -59.7% 514.4-..4). 11.4% (18.4>>1.33), and further -7.0% on INSERT (41.7-338. 8)) while maintaining near-zero vulnerability under SWAP. Collectively, these results demonstrate that the model- adversari- ally trained TASTE consistently lowers vulnerability across languages and perturbation types.
TECCKTRRASAAIION
6 DISCUSSION
6.1 IMPACT OF ATTACK STRENGTII
In this section, we investigate the impact of attack strength on the zero-shot language detection capability and the robustness against adversarial attacks of the target detector.
Follow the definition Li et al. (2025), we define the attack strength as the ratio of the maximum
size of the important token set denoted max [I], to the total number of tokens in the text X. During training. [I] starts from and gradually increases until it reaches the upper bound max [I]. Hence, max reflects the strength of the hardest adversarial examples: larger max I indicates that more tokens in the text have been replaced, making it more challenging for the target detector Diar() (-) to correctly classify the sample.
Figure 3 presents our results. As can be observed, increasing the attack strength does not contin- uously enhance zero-shot detection accuracy robustness against adversarial attacks; instead, it
8

---

Published as a conference paper at ICLR 2026
leads to performance degradation beyond certain point. Specifically, the model achieves its high- est average accuracy of 76.2% when the attack strength ratio is 0.05, but this drops to 73.1 at 0.25. Similarly, the average ASR is minimized 18.0% at 0.05, but increases to 34.2% at 0.25. This phenomenon suggests that moderate attack strength is most effective improving the model during adversarial training. Excessively strong perturbations, however, introduce substantial noise and cause the model to focus excessively on fitting these extreme adversarial examples. This leads overfitting on high-strength attacks and compromises both generalization ability and robustness to unseen perturbations in zero-shot settings.
Moreover, as shown in Figure 4 the training time sig- nificantly increases with higher attack strengths: from 150.34s at 0.00 to 2299.33s at 0.05, and up to 9467.94s at 0.30. This highlights critical trade-off between im- proving robustness and maintaining practical training ef- ficiency. These results collectively indicate that opti- mal, moderate attack strength (here, around 0.05) strikes the best balance between detection aceuracy, adversarial robustness, and computational cost.
(Simmro Au
ABR (weetrr
Tuaing Time
The eit Tiee toova lop sould)
6.2 IMPACT OF WRONG DICTIONARY
Ptbck Stooggh (000))
In this section, investigate how errors in the trans- lation dictionary affect detection performance. Since LAAL learns language-agnostic feature representations from code-switching-e based adversarial examples, emro- neous dictionary entries can alter the semantics of these examples and thereby impede the detector's s ability to ac- quire language-invarte invariant features.
Figure 4: Impact of Attack Strength. A higher accuracy (Acc) lower ASR (%) indicates better model performance.
Bulgarian
English
Average
(e) Swap Rale
(b) Coverage
90
80
80
Accurscy
70
50
60
40
10
50
80
10
30
70
100
Dictionary Swap Rate (%)
Dictionary Coverage (%)
Figure 5: Impact wrong dictionary and dictionary coverage. We evaluate the detection aceu- racy of each model for every language under different (a) dictionary swap rates and (b) dictionary coverage rate.
We define the dictionary error rate as the proportion of entries whose translations are incorrect, and we operationalize it via the Dictionary Swap Rate, i.e., the percentage of dictionary entries that are deliberately swapped with incorrect translations. We train detectors with dictionaries at swap rates of [10, 30, 50, 70, 90]% and evaluate them on the test set. The results are shown in Figure (a)). itively, the swap rate increases, the translation-basee attacker provides less reliable cross-lingual supervision: when the dictionary is accurate, code- swithswithhed adversarial examples carry informative signals that propagate English supervision to other languages, whereas with highly corrupted dic- tionaries many swapped tokens no longer correspond to meaningful translations, and the adversarial component gradually degenerates toward standard monolingual English training. In this limit, per-
(a). Intu-

---

Published as a conference paper at ICLR 2026
formance on non- non-English languages is expected to approach (but not necessarily match) that of an English-only baseline trained without effective multilingual adversarial perturbations.
Across languages, using wrong dictionary consistently depresses average accuracy relative to the clean (0%) bascline. The cros-languaae mean Acc drops from 76.2% at 0% to 70.9% (10%), 70.2% (30%), rebounding to 71.3% (50%), before declining to 68.6% % (70%) and 68.0% (90%). Per-language effects vary but align with this semantic-drin view: English remains relatively robust (97.1% at 0% vs. 95.0-91.7% for 10-70%), while languages that rely more heavily on cross-lingual transfer, such as Chinese and Indonesian, are more fragile (Chinese: 70.1% + 62.6% @ 10%, 56.7% @90%: Indonesian: 84.0% - 61.0% @ 10%. 53.5% @90%). Moderate swap rates can still help languages where code-switching reduces spurious lexical cues: Italian rises from 69.4% (0%) to 89.0% @70% German from 69.5% to 87.1% % @ @70% and Urdu peaks at 77.2% @ @50% (vs. 69.7%), but collapses to 54.1 % @90%. Mechanistically, LAAL benefits when soall-to-medium swaps preserve most semantics and act as hard but valid augmentations that steer the encoder toward kuguage-innvrian cues. At high swap rates, however, the adversarial examples themselves become severely corrupted, effectively injecting label noise: the discriminator is then pushed to be invariant to artifacts induced by erroneous translations rather than to true semantic content, which explains the overall degradation and the deeguedeed variance.
In addition, explicitly study the effect of dictionary noise in Section 6.2 by plotting detection accuracy as a function of dictionary error rates. The results can be found in Figure(5 This result show that although degrading dictionary quality slightly hurts performance, our model still remains above the baselines, demonstrating that our method can yield gains even with relatively noisy dic- tionaries. Since this experiment may not be fully sufficient, we further conduct an additional study where we vary dictionary coverage. Specifically, we subsample [10, 30, 50, 70, 90]% of the entries from our dictionaries to construct smaller dictionaries, train with these reduced dictionaries, and evaluate on the same test sets as in [able
From these results, we observe that using very small dictionaries (10% coverage) leads to some degradation in accuracy compared to higher-coverage settings, but the performance remains strong and above the average accuracy of the best baseline detector (0.691, as reported in Table []. As dictionary coverage increases, the model's accuracy improves and gradually stabilizes, with the mean accuracy saturating around full coverage. This indicates that our method does not rely on per- fectly complete dictionaries: even moderately sized dictionaries sufficient to provide substantial gains, and further enlarging the dictionary mainly brings diminishing but stabilizing improvements rather than being strictly required for the method work. Therefore, even when high-quality dic- tionaries are unavailable for a target low-resource language, TASTE can still improve its detection performance in zero-shot manner by leveraging dictionaries from other languages, and our noise/- coverage studies show that these dictionaries do not need to be perfectly accurate or complete.
7 CONCLUSION
In this paper, we propose an adversarial training framework for training robust multilingual MGT detector, named Translation translation-based Attacker Strengthens MulTilingual DefEnder (TASTE). We pro- pose a novel adversarial training loss, named Language-Agnostt hance the generalization of detectors to zero-shot languages. In TASTE, our attacker and detector are updated synchronously, enabling the detector generalize to unseen languages and unseen attacks. Experimental results demonstrate that TASTE outperforms 8 SOTA detectors in detection accuracy and remains robust under 8 different attack types. Our study further reveals that a moderate attack strength can effectively balance robustness, detection accuracy, and computational cost, and that our method remains reasonably robust to certain degree of noise in the translation dictionaries.
Adversarial Loss (LAAL), to en-
ACKNOWLEDGMENT
We thank the anonymous reviewers and AC for their careful reading and constructive feedback, which significantly improved the quality and clarity of this work.
10

---

Published as a conference paper at ICLR 2026
ETHICS STATEMENT
Intended use and societal benefits. This work studies robust detection of -eccinnegenerated text (MGT) across languages, aiming to strengthen online content integrity and reduce harms from undis- closed synthetic text. We focus improving zero-shot multilingual robustness via translation- dictionary- based code-switching attacks and adversarial training, which may help platforms, edu- cators, and researchers identify MGT scale while accounting for cross-lingual disparity.
Data provenance and subject protection. Our experiments rely on publicly available corpora and benchmarks reported in prior work (human-write written texts from sources such Wikipedia/Red- WWVELI//iKKHHo/PeeRRe///aa
machine outputs from widely known generators) and the mul- tilingual M4GT benchmark. No new human data were collected; no personally identifiable in- formation (PII) was annotated or created. All datasets used in this study are treated under their original licenses and terms of use; we redistributed nothing that would violate those terms. When processpoo,,,,ngg we avoid storing raw user identifiers and only use text content as provided by the benchmarks.
Model behavior, bias, and fairness. Detection errors can have downstream consequences (e.g., false positives against under-represented languages or communities). We therefore (i) report per- language results; (ii) analyze robustness under multiple perturbations; and (iii) explicitly discuss failure modes observed for certain languages. We do not claim perfect language equity: residual disparities may persist due to dictionary coverage and domain shifts. We encourage deployment only with human oversight, clear error disclaimers, and opt avenues.
Dual-use and misuse risks. Adversarial analysis inform stronger attacks. To mitigate dual-use, we: (i) release code primarily for evaluation and defense with safety notes and rate limits; (ii) avoid providing turn-key evasion scripts beyond what is necessary for reproducible research; (iii) withhold any undisclosed private attack resources; and (iv) recommend pairing detectors with complementary safeguards (attribution, disclosure norms, provenance signals) rather than high-stakes automation.
Computational resources and environmental impact. We strive to minimize the environmental footprint of our experiments by favoring moderate-size encoders, accumulation, and early stopping. We will release reproducible log of hardware, training steps, and GPU hours together with an estimated carbon footprint (via standard calculators and region-specifer carbon intensity), and we encourage labs reproducing our results to adopt eenewable-powert com- pute where available. Our ablations are designed to reuse checkpoints and shared dataloaders to avoid redundant runs.
training, gradient
Transparency, accountability, and limitations in deployment. We will provide model cards, datasheets, and evaluation scripts to document intended use, coverage, and known failure modes (e.g., languages with lower robustness or domains unseen in training). We caution against punitive high-stakes use (e.g., grading, employment, or moderation actions) without human review and an appeals process, and we recommend periodic audits, per-language calibration, and monitoring for distribution shift. Access released artifacts will include versioning and changelogs support accountability and responsible updates.
REPRODUCIBILITY STATEMENT
Code and artifacts. We commit to releasing: (1) training/cvaluation code; (2) datasets used in this paper; (3) trained detector checkpoints; and (4) the translation-dictionayy resources we used or scripts to construct them from public sources (with licenses).
Data and splits. We describe all datasets, languages, and splits used for training/validatiionness in Appendix A and provide scripts to regenerate them deterministically from public releases.
Training details. We enumerate all hyprraarameters (optimizer, learning rates for detector/surro- gate, batch sizes, epochs, fp16, gradient clipping), schedules (c.g., GRL weight schedule), and attack-strength curriculum (initial tokens, maximum ratio, increment per step) in Appendix A

---

Published as a conference paper at ICLR 2026
REFERENCES
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, lige Akkaya, Florencia Leoni Ale- man, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, al. Gpt-4 technical report. arXiv preprint arXiv:2303. 08774, 2023.
Andrei-Marius Avram, Marian Lupaşcu, Dumitru-Clement Cercel, Ionut Mironicä, and Stefan Träuşan-Matu. Unibert: Adversarial training for language-universal representations. arXiv preprint arXiv:2503. 12608, 2025.
Guangsheng Bao, Yanbin Zhao, Zhiyang Teng, Linyi Yang, and Yue Zhang. Fast-detectgpt: Efficient zero-shot detection of machine geiinneegeerrtedd text via conditional probability curvature. In ICLR, 2024.
Amrita Bhattacharree,, Raha Moraffah, Joshua Garland, and Huan Liu. Eagle: A domain generaliza- tion framework for ai- ai-generated text detection. arXiv preprint arXiv:2403.15609 2024.
Stella Biderman, Hailey Schoelkopf, Quentin Gregory Anthony, Herbie Bradley, Kyle O'Brien, Eric Hallahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, al. Pythia: A suite for analyzing large language models across training and scaling. In International Conference on Machine Learning. pp. 2397-2430. PMLR, 2023.
Alexis Conneau, Kartikay Khandelwal, Naman Goyal, Vishrav Chaudhary, Guillaume Wenzek, Francisco Guzmán, Edouard Grave, Myle Ott, Luke Zettlemoyer, and Veselin Stoyanov. Un- supervised cross-lingual representation learning at scale. arXiv preprint arXiv:1911.022 16, 2019.
Jacob Devlin, Ming-Way Wei Chang. Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume (long and short papers), pp. 4171-41866 2019.
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024.
Xuan Feng, Tianlong Gu Xiaoli Liu. and Liang Chang. Learning from mistakes: Self-correct adversarial training for chinese unnatural text correction. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 23887-23893 2025.
Vitalii Fishchuk. Adversarial attacks on neural text detectors. B.S. thesis, University of Twente, 2023.
Tarek Gaber, Tarek Ali, Mathew Nicho, and Mohamed Torky. Robust attacks detection model for internet of flying things based on generative adversarial network (gan) and adversarial training. IEEE Internet of Things Journal, 2025.
Evgeniy Gabrilovich and Alex Gontmakher. The homograph attack. Communications of the ACM, 45(2))128, 2002.
Biyang Guo, Xin Zhang, Ziyuan Wang, Minqi Jiang, Jinran Nie, Yuxuan Ding, Jianwei Yue, and Yu- peng Wu. How close is chatgpt to human experts? comparison corpus, evaluation, and detection. arXiv preprint arXiv:2301.0r 005597, 2023.
Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. Deepseek-rl: Incentivizing reasoning capability in lims via reinforcement learning. arXiv preprint (tti::250/.124444 2025.
Abhimanyu Hans, Avi Schwarzschild, Valeriaa Cherepanova, Hamid Kazemi, Aniruddha Saha, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Spotting 1lms with binoculars: zero-shot detection of machine-generen Machine Learning, pp. 17519-17537, 2024.
text. In Proceedings of the 41st International Conference
Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. Deberta: Decoding bert with disentangled attention. arXiv preprint arXiv:2006. 03654, 2020.
12

---

Published as a conference paper at ICLR 2026
Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. Deberta: Decoding-enhanced enhanced bert with disentangled attention. In International Conference on Learning Representations, 2021. URL http:/ps///peeeeiiieettt net/
Xinlei He, Xinyue Shen, Zeyuan Chen, Michael Backes, and Yang Zhang. Mgtbench: Benchmark- ing machine- machine-generated text detection. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pp. 2251-2265, 2024.
Xiaomeng Hu, Pin- Yu Chen, and Tsung-Yi Yi Ho. Radar: Robust ai-text detection via adversarial learning. Advances in neural information processing systems, 36: 36:15077-15095, 2023.
Zhuoqun Huang, Neil G Marchant, Olga Ohrimenko, and Benjamin IP Rubinstein. Cert-ed: Certi- fiably robust text classification for edit distance. arXiv preprint (rXxi:24088000285 2024.
Mohit lyyer, John Wieting, Kevin Gimpel, and Luke Zettlemoyer. Adversarial example generation with syntactically controlled paraphrase networks. arXiv preprint arXiv: 2018.
Xiaojun Jia, Yong Zhang, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. Las-at: adversarial training with learnable attack strategy. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pp. -3408,, 2022.
Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is bert really robust? a strong baseline for natural language attack on text classification and entailment. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pp. 8018-8025, 2020.
Ryuto Koike, Masahiro Kaneko, and Naoaki Okazaki. Outfox: Am--enerated essay detection through in-context learning with adversarially generated examples. In Proceedings of the AAAI Conference on Artificial Intelligence volume 38, pp. 21258-21266, 2024.
Karen Kukich. Techniques for automatically correcting words in text. ACM computing surveys (CSUR), 24(4):377 439, 1992.
Laida Kushnareva, Tatiana Gaintseva, German Magai, Serguei Barannikov, Dmitry Abulkhanov, Kristian Kuznetsov, Eduard Tulchinskii, Irina Piontkovskaya, and Sergey Nikolenko. Ai- generated text boundary detection with roft. In Ist Conference on Language Modeling (COLM), volume 2024, 2024.
Zhenzhong Lan, Mingda Chen, Sebastian Goodman, Kevin Gimpel, Piyush Sharma, and Radu Sori- cut. Albert: lite bert for supervipe learning of language representations. arXiv preprint arXiv: 1942, 2019.
Dianqi Li, Yizhe Zhang, Hao Peng, Liqun Chen, Chris Brockett, Ming-Ting Sun, and Bill Dolan. Contextualized perturbation for textual adversarial attack. arXiv preprint arXiv:2009.05002, 2020a.
Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. Bert-attack: Adversarial attack against bert using bert. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp- 6193 6202, 2020b.
Yafu Li, Qintong Li, Leyang Cui, Wei Bi, Zhilin Wang. Longyue Wang, Linyi Yang, Shuming Shi, and Yue Zhang. Mage: Machine-generatee text detection in the wild, 2024.
Yuanfan Li, Zhaohan Zhang, Chengzhengxu Li, Chao Shen, and Xiaoming Liu. Iron sharpens iron: Defending against attacks in machine-generated text detection with adversarial training. arXiv preprint arXiv:2502.0 12734, 2025.
Shengchao Liu, Xiaoming Liu, Yichen Wang, Zehua Cheng, Chengzhengxu Li, Zhaohan Zhang, Yu Lan, and Chao Shen. Does detectgpt fully utilize perturbation? bridging selective perturbation to fine-tuned contrastive learning detector would be better. In Proceedings the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 1874 1889, 2024.
13

---

Published as a conference paper at ICLR 2026
Shengchao Liu, Xiaoming Liu, Chengzhengxu Li, Zhaohan Zhang, Guoxin Ma, Yu Lan, and Shuai Xiao. Mrisp: Enhancing domain generalization for machine generated text detection via spectral alignment. arXiv preprint 2xX1v:2508.13768 2025.
machine-generated
Guoxin Ma, Xiaoming Liu, Zhanhan Zhang. Chengzhengxu Li, Shengchao Liu, and Yu Lan. Deer: Disentangled mixture of experts with addative routing for generalizable machine- generated text detection. arXiv preprint 1rXiv:2511.01199 2025.
Dominik Macko, Jakub Kopal, Robert Moro, and Ivan Srba. Multisocial: Multilingual benchmark of machine-genan genereteeeeeeddd text detection of social-media texts. arXiv preprint arXiv:2406. 12549, 2024a.
Dominik Macko, Robert Moro, Adaku Uchendu, Ivan Srba, Jason Samuel Lucas, Michiharu Ya- mashita, Nañis Irtiza Tripto, Dongwon Lee, Jakub Simko, and Maria Bielikova. Authorship ob- fuscation in multilingual machine- generated text detection. arXiv preprint arXiv:2401.07867, 2024b.
Pablo Miralles- González, Javier Fleeraa-Tatt Alejandro Martín, and David Camacho. Not all to- kens are created equal: Perplexity attention weighted networks for ai generated text detection. arXiv preprini arXiv:2501.085: 0039400 2025.
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher Manning, and Chelsea Finn. De- tectgpt: Zero-shot machine-genene generatee text detection using probability curvature. In International Conference on Machine Learning, pp. 24950-24962. PMLR, 2023.
Sungwon Park, Sungwon Han, and Meeyoung Cha. Enhancing domain generalization for robust machine-generated text detection. IEEE Transactions on Knowledge and Data Engineering, pp. 1-14, 2025. doi: 10.11097KKDE.2255335666
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. Language models are unsupervised multitask learners. OpenAl Technical Report, 1(8):1-24, 2019.
Rico Sennrich, Barry Haddow, and Alexandra Birch. Improving neural machine translation models with monolingual data. arXiv preprint arXiv: 1eXxv:55/1.06709 2015.
Zhouxing Shi, Yihan Wang, Fan Yin, Xiangning Chen, Kai-Wei Chang, and Cho-Jui Hsieh. Red teaming language model detectors with language models. Transactions of the Association for Computational Linguisties, 12:174-189, 2024.
Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert-Vose Jeff Wu, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, et al. Release strategies and the social impacts of language models. arXiv preprint arXiv:1908.0922 2019.
Jinyan Su, Terry Zhuo, Di Wang, and Preslav Nakov. Detectllm: Leveraging log rank information for zero-shot detection machine-generated text. In Findings of the Association for Computational Linguistics: EMNLP 2023, pp. 12395-12412 2023.
Zhixiong Su, Yichen Wang, Herun Wan, Zhaohan Zhang, and Minnan Luo. Haco-det: A study wards fine-grained mwchine-genennneeeeee generated text detection under human-ai coauthoring. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long 2025.
Papers), pp.
Jörg Tiedemann and Santhosh Thottingal. OPUS-MT- Building open translation services for the World. In Proceedings of the 22nd Annual Conferenec of the European Association for Machine Translation (EAMT), Lisbon, Portugal, 2020.
Yichen Wang. Shangbin Feng, Abe Bohan Hou, Xiao Pu, Chao Shen, Xiaoming Liu, Yulia Tsvetkov, and Tianxing He. Stumbling blocks: Stress testing the robustness of machine-generater text detectors under attacks. arXiv preprint arXiv:2402.11638, 2024a.
Yuxia Wang. Jonibek Mansurov, Petar Ivanov, Jinyan Su, Artem Shelmanov, Akim Tsvigun, Osama Mohanned Afzal, Tarek Mahmoud, Giovanni Puccetti, Thomas Amold, et al. M4gt- bench: Evaluation benchmark for black-box machine -echereegeeeetted text detection. arXiv preprint arXiv:2402. 117 2024b.
14

---

Published as a conference paper at ICLR 2026
Yuxia Wang. Jonibek Mansurov, Petar Ivanov, jinyan su, Artem Shelmanov, Akim Tsvigun, Osama Mohammed Afzal, Tarek Mahmoud, Giovanni Puccetti, Thomas Arnold, Chenxi Whitehouse, Alham Fikri Aji. Nizar Habash, Iryna Gurevych, and Preslav Nakov. Semeval-2024 task 8: Multidomain, multimodel and multilingual machine-generated text detection. In Proceedings of the 18th International Workshop Semantic Evaluation (SemEval-2024), pp. 2041-2063, Mexico City, Mexico, June 2024c. Association for Computational Linguistics. URL https: //aclanthology: wwg. 2tt.://2222.mm22222222224222 weweva12022-112222
Chengyan Wu, Bolei Ma, Ningyuan Deng. Yanqing He, and Yun Xue. Multi-scale and multi-objective optimization for cross-lingual aspect-based sentiment analysis. arXiv preprint 13XY:22502.13718,, 2025.
Jin Yong Yoo and Yanjun Qi. Towards improving adversarial training of nlp models. In Findings of the Association for Computational Linguistics: EMNLP 2021, pp. 1001-1013, 2021.
Jiehang Zeng, Xiaoqing Zheng, Jianhan Xu, Linyang Li, Liping Yuan, and Xuanjing Huang. Certi- fied robustness to text adversarial attacks by randomized [mask]. Computational Linguisties, 49 (2):345-373 373,, 2023.
Ying Zhou, Ben He, and Le Sun. Humanizing machine machine-generated content: Evading ai-text de- tection through adversarial attack. In Proceedings of the 2024 Joint International Conference on Computational L Linguistics, Language Resources and Evaluation (LREC-COLING 2024), pp- 8427-8437, 2024.
A EXPERIMENT SETTING
A.1 DATASET
We use the M4GT dataset (Wang et al. 2024b) the foundational training corpus for our de- tector. This large-scale dataset comprises machine-generated texts (MGTs) produced by models such as Davinci003, ChatGPT, GPT-4, Cohere, Do2ly-v2. and BLOOMZ, along with human-written texts sourced from platforms including Wikipedia, Reddit, ELI5, WikiHow, PeerRead, and arXiv abstracts. The corpus spans nine languages-Englishh Chinese, Russian, Arabic, Italian, German, Indonesian, Bulgarian, and Urdu- ensuring broad multilingual coverage.
A.2 IMPLEMENTATION
TASTE is implemented and deployed on server equipped with two NVIDIA RTX 4090 GPUs, run- ning Ubuntu 22.04 and CUDA 12.5. For all exper- iments in the main text and the appendix, we used only single RTX 4090 GPU. For all adversarial- training- based detectors, we adopt mBERT (1 10M) as the backbone model. Each model-based detector is trained on 10,000 English samples, with stan- dard data split ratio of 8:1:1 for training, validation, and testing, respectively. For metric-based detec- tors that rely on LLMs, we use the best-performing LLMs reported in their original papers. All baseline detectors follow the official configurations and implementation details described in their corre- sponding publications.
Hyperparameter
Value / Schedule
Batch size
16 3
Training epochs Emse
Detector learning rate Aae
2 x 10-5
Surrogate learning rate Bax
10-5
Aiveessriallstandat mix ratio
0.15 (adv) 0.85 (std) token
Initial attack strength
Maximum allack strength
5 % of tokens
Attack strength increment A
+1 token step
Auss (GRL weight)
0.10 0.50 0.20 Adam FP16 (AMP)
Dropout (language discriminator)
Optimizer
Gradient precision Random
Table 2: Key hyperparameters used for train- ing TASTE.
We GPT2-based detector fine-tuned the dataset from Wang et al. (2024a) as the surrogate
model. As discussed in Appendix B.3] the choice of surrogate model and training corpus has mini-
mal impact on the final results.
The hyperparameters used in method are shown in Table 2
15

---

Published as a conference paper at ICLR 2026
To enforce language-invariant representations, we attach lightweight language discriminator flnne() (.) to the [CLS] embedding produced by the detector. Concretely, fiang()) is three-layer multilayer perceptron (MLP):
MLP: 768 7 512 - 128 7 (ReLU, Dropout = 0.2)
where the final layer outputs 2-way softmax indicating whether an input is code-switched (1) or clean (0). During training the detector's encoder is connected to fiany() through a gradient-reversal layer (GRL). The discriminator itself minimizes a standard cross-entropy loss, while the GRL. multi- plies its propaaaae gradient by -APA, forcing the encoder maximize the same objective and thus remove language-specific cues. This adversarial interplay encourages the hidden features to side language-agnostic subspace, which empirically improves zero-shot detection accuracy and robustness to multilingual adversarial attacks. With only ~0.5M additional parameters, the discrim- inator introduces negligible overhead while substantially enhancing cross- poos-llnnuual generalization.
A.3 EVALUATION METRICS
For evaluating the accuracy of detectors, we adopt Accuracy (Ace) and Fi-score (F1) as the primary metries. To assess the robustness of detectors against adversarial attacks, we use the Attack Success Rate (ASR), where lower ASR indicates better robustness.
Based on our attacker assumption that only machine-generated texts (MGTs) can be perturbed, ASR is computed as:
# MGT's misclassified after attack
ASR
# MGT's correctly classified before attack
A.4 EXPERIMENTAL COMPARISON METHODS
To better evaluate the effectiveness of our method, we compare it against several state-of-the-an (SOTA) detectors. The compared detectors
follows:
Fast DetectGPT (Bao et al. 2024) A metric-based zero-shot detector that builds upon the original DetectGPT framework while addressing its computational inefficiencies. In- stead of relying on costly perturbation-bast
scoring, Fast DetectGPT introduces novel metric termed conditional probability curvature, which captures discrepancies in token- level generation likelihoods between human- and machine-authored texts. This curvature- based score enables highly efficient detection by leveraging a single-pass sampling strategy, significantly reducing computation without compromising performance. Empirical results demonstrate that Fast DetectGPT achieves comparable or superior accuracy to DetectGPT while accelerating inference by up 340x across both white-box and black-box settings.
Binoculars (Hans et al. 2024): A metric-based zero-shot detection method that identifies sicchine-generted text by contrasting the output probabilities of two closely related pre- trained language models. Rather than relying on supervised training, Binoculars computes lightweight divergence score that reflects subtle inconsistencies between machine-generated text. This model-agnostic approach requires no fine-tuning or la- beled data, yet consistently achieves high detection accuracy across diverse document types and language models. Notably, Binoculars detects over 90% of ChatGPT outputs with a false positive rate as low as 0.01%, demonstrating its effectiveness and generalizability in real-world scenarios.
and machine- generated
LRR (Su et al.) 2023): A metric-based zero-shot detector that leverages log-rank statistics to distinguish machine-generated text from human-written content without requiring any labeled training data. Specifically, LRR computes the average log-rank of tokens under reference language model and identifies unnatural token distributions typical of LLM gen- erations. As lightweight variant of DetectLLM, LRR avoids costly perturbation steps, making significantly faster and more efficient while maintaining strong detection perfor- mance. Empirical results across three benchmark datasets and seven generation models
16

---

Published as a conference paper at ICLR 2026
demonstrate that LRR outperforms prior state-of-the-an methods by up 3.9 AUROC points, offering a favorable balance between accuracy and inference speed.
mBERT (Devlin et al. 2019): model-based detector built on multilingual BERT, which contains ITOM parameters. It is pretrained on the Wikipedia texts of 104 languages, us- ing a shared subword vocabulary. We fine-tune this model on our classification task to distinguish maachine-generaeed text from human- text.
mDeBERTa (He et al., 2020): A model-based detector based on multilingual DeBERTa- v3, with approximately 180M parameters. is pretrained on multilingual web text covering over 100 languages. We fine-tune it for binary classification in detection setting.
XLM-RoBERTa-Be (Conneau et al. 2019h: A model-based detector built on the XLM- pretrained on a large-scale corpus of 2.5TB CommonCrawl data from 100 languages. We fine-tune this model to perform bechine-generated text detection across languages.
R- R-Base model, containing 270M parameters.
RADAR (Hu al., 2023): model-based detector trained via adversarial training. Dur- ing training, a paraphraser acts the attacker to generate semantically equivalent para- phrases, while the detector, built upon an mBERT backbone, learns to distinguish machine- generated from human-written text even after paraphrasing. This process improves the de- tector's 's robustness against paraphrased attacks. Unlike our multilingual adversarial setup, RADAR only considers monolingual paraphrase-baset attacks during training.
GREATER-D (Li et al. 2025): A model-based detector trained via adversarial training against token-level perturbation attacks. In each iteration, a detector and an attacker are jointly optimized: the attacker identifies and perturbs important tokens to mislead the de- tector, while the detector is trained to correctly classify both original and adversarial sam- ples. This synchronized update improves the robustness of the detector against various word-level attacks. This method focuses on English-only settings and does not consider multilingual generalization or translation-based attacks.
A.5 ATTACK METHODS
Here we provide detailed descriptions of the 8 attack methods used in the main paper.
Delete (Kukich 1992): A token-level perturbation that randomly deletes about 20% of tokens in the machine- gennrnatd text. This simulates typing errors or intentional omissions and tests the detector's 's robustness to missing information.
Repeat (Fishchuk 2023): A token-level attack that duplicates existing tokens in the text with a 20% probability, mimicking redundancy or emphasis used in informal writing, which can confuse the detector.
A token-level perturbation that inserts addi- tional tokens random positions. For each token, there is 20% chance insert another token after it, thereby increasing noise and changing context.
Insert Gabbilovvih & Gontmakher] 2002):
Swap (Shi et al. 2024): sentence-level perturbation that randomly shuffles the order of sentences in the text. This breaks the coherence of the discourse without altering individual sentence content, challenging detectors reliant on narrative flow.
Code-Switching (L et al., 2020a): A token-level perturbation that replaces up to 50 tokens with their translated equivalents using multilingual dictionary. This introduces cross- lingual noise while preserving semantics, simulating a real-world scenario multilingual interference.
Human Obfuscation (Macko et al., 2024b): A token-level attack where the first 20% of tokens in a machine machine-generated text are replaced by tokens sampled from human- written text of the same language. This aims mimic human writing style and evade detection by semantic camouflage.
Back- Translatoonn (Sennrich et al. 2015): A sentence-level paraphrase attack where each machine generatee text is round-trip translated through pivot language to induce lexical and syntactic variation while preserving meaning. Concretely, for any non-English lan- guage translate the text into English and then back to the original language; for English
17

---

Published as a conference paper at ICLR 2026
System Prompt
You are ruthless paraphraser, completely rewrite the user's text while preserving the core meaning and factual content. Keep the SAME LANGUAGE the input. Do NOT add disclaimers, meta-comments, safety notes, citations, or new facts. Do NOT shorten excessively; keep roughly similar length unless instructed otherwise. Produce ONLY the rewritten text as plain text, with no surrounding quotes or markers.
will aggressively and
User Instruction
Paraphrase the following text aggressively (completely rewrite) while preserving its core meaning. Keep the SAME LANGUAGE as the input. Output only the rewritten text. Text: (text)
Table 3: Prompts used for the DeepSeek V3.1 paraphrasing attack.
texts we pivot through Chinese. We implement the translations with the public Helsinki- NLP OPUS-MT models (Tiedemann & Thottingal 2020). The resulting tack-translated output replaces the original text, creating gemanties-preserving paraphrases that disrupt detectors relying on surface cues, lexical likelihoods, or n-gram memorization, thereby improving the attack's 's ability to evade detection via semantic camouflage.
Paraphrasing (Iyeer al. 2018): A sentence-level paraphrase attack where each machine- generated text is aggressively rewritten by strong LLM (DeepSeek V3.1 (Guo et al.] 2025 while preserving its core meaning and language. This aims to alter lexical choice, phrasing, and local syntax so as to mimic human style and evade detectors via semantic camouflage. Our prompt can be found in Table
B ADDITIONAL RESULT
B. ABLATION STUDY
To validate the effectiveness of each individual component, we conduct a comprehensive abla- tion study. Specifically, the ablation compares three training variants that share the same back- bone (mBERT) and identical data/schedule, differing only which terms of Eq. (8) are enabled: (i mBERT (CE only) trains clean examples with standard classification loss LCE(I, y): (ū) mBERT+AT (RPL only, w/o LAAL) performs adversarial training but removes LAAL, and uses only Robust Prediction Loss (RPL), i.e., LRFL LCE (z, v) LcE(E, where ă is the attacker- generated code-switched sample; (iii) TASTE is the full method with all terms in Eq. (8), adding LAAL top of (ii). We do not include "LAAL-only" (or "w/o RPL") setting because LAAL is not a detection objective by itself and the detector does not converge without a classification loss. We evaluate the zhoo cross-lingual detection capability and robustness against attacks of our model on the M4 dataset and its extended variant, respectively. The overview results are summarized in Table 4
Table isolates the effect of LAAL by comparing mBERT+AT (adversarial training with RPL only) against the full TASTE (RPL+LAAL). Adding LAAL yields a consistent gain in zero-shot detection accuracy (Avg.: 70.9+766. +5.3 points) while further reducing the mean ASR (20.8~>18.0 -2.8 points), showing that LAAL improves both cross-lingual generalization and adversarial robustness beyond what is achieved by adversarial training alone. The effect is especially pronounced in harder zero-shot languages such as German (de), where accuracy increases from 50.3% to 69.5% while
ASR drops from 31.2% to 26.0%.
B.2 ABLATION ON IMPORTANCE-SCOT -COREE DEFINITIONS
To better understand the role of the importance estimator used by the translation-bast attacker, conduct an ablation study over several alternative definitions of token importance, Throughout, we follow the notation: let the surrogate detector be fo, the input sequence be (211 (.1,...., -..1. PT.) and
18

---

Published as a conference paper at ICLR 2026
let
denote the predicted probability of the machine-generater class. Based on this surrogate, define three variants of TASTE that differ only in how they compute token importance scores; all other components, including the training setup, kept identical to the main method.
Lang
mBERT
mBERT+AT
TASTE
(a) Attention-based importance (Attn-TASTE). For the attention-based variant, we derive token saliency di- rectly from the self-attention maps of the surrogate. Let (t. E IR 7'X be the attention matrix at layer and head bg
Detection Accuracy (%) 1
80.2
96.0
97.1
81.1
82.2
82.8
77.4
73.2
81.7
h, where A!!.h) is the attention weight from position é to position i. We define the importance of token 2; the average attention mass it receives across all layers, heads,
de
47.9
50.3
69.5
id
83.0
80.2
84.0
68.8
63.4
69.4
ru 41,8
55.3
61.7
and source positions:
67.1
67.6
69.7
68.4
70.0
70.1
arin
ΣΣΣ ==
H
T
(1,
Avg. 68.4
70.9
76.2
LHT
ASR under Attacks !
en 30.0
16.1
14.5
We then apply min-mas max normalization over {s T obtain scores in j0, 1J and select the top-k tokens as im- portant positions for cross-lingual replacement.
Ji=1 to
ar
30.7
9.8
10.0
bg
41.1
22.4
22.0
de
48.1
31.2
26.0
id
40.8
18.7
17.6
it
34.7
21.3
18.9
(b) Perturbation- importance (Perturb-TASIE For the perturbation-based variant, we measure how sen- sitive the surrogate's output is to single-token perturba- tions. Let (5) be the sequence obtained by replacing to- ken F; with a neutral placeholder (e.g., EOS or UNK). We define the importance of z; the drop in machine probability caused by this local perturbation:
46.4
26.6
24.5
28.5
24.8
12.0
zh 18.9
16.6
16.3
Avg. 35.5
20.8
18.0
Table 4: Ablation on Eq. (8) com-
ponents on M4GT. mBERT: CE-only on clean I. mBERT+AT: adversarial training with RPL only (CE on and
spem max(0, fo() fo(x
i). without LAAL. TASTE: full model (RPI. LAAL). Best each row bolded.
Intuitively, if perturbing token x; significantly reduces the predicted probability of the machine class, then x, is con- sidered more important for the detector's decision and is thus more promising candidate for adversarial transla- tion. As in the main method, we normalize {s!"T) " select the top-k tokens.
===1 and
(c) Random importance baseline (Random-TASTE). As additional sanity check, include a purely random baseline where the attacker selects important tokens uniformly at random, inde- pendent of the surrogate. Concretely, for sequence of length T uniformly sample subset C {1,..., T} with [ = k, and assign random scores srand ~ 2/ 1) for E I. This variant isolates the effect of where perturb from any modeling choice in the importance estimator.
We train TASTE, Perturb-TASTE Random- Random-TASTE, and the original gradient- TASTE un- der the same setup, and report test accuracy on 9 languages. The accuracies and their cross-lingun means are summarized in 5
Clarification. Table reports the final detector's clean-test accuracy after training with adversarial samples generated by each importance estimator. It does not measure the surrogate/attacker aceu- racy, nor the intrinsic quality of an importance estimator. In particular, Random- TASTE samples token positions uniformly at random, which is equivalent to an unguided (no-importance)) code- switch augmentation baseline.
From Table 5 we observe that all variants achieve strong multilingual performance, indicating that TASTE is robust to the choice of importance estimator. The original gradient-basse based TASTE achieves the highest cross-lingual mean accuracy (0.762), slightly outperforming Attn-TASTE Perturb- TASTE, and Random-TAsTI Attention-based and perturbation-basse scores behave similarly to
19

---

Published as a conference paper at ICLR 2026
Method
zh
dc
bg
id
ur
Mean
Attn-TASTE
0.974
0.779
0.746
0.511
0.557
0.830
0.869
0.621
0.879
0.752
Perturb- TASTE
0.961
0.815
0.680
0.589
0.517
0.807
0.867
0.647
0.920
0.756
Kandom-TASTE
0.970
0.777
0.679
0.587
0.562
0.820
0,904
0.625
0.882
0.756
TASTE
0.971
0.828
0.701
0.695
0.617
0.817
0.840
0.694
0.697
0.762
Table 5: Detector clean-test accuracy (Ace) after adversarial training with samples generated by different importance estimators across 9 languages.
Attack
Attn-TASTE
Berturb-TASTE
Random-TASTE
TASTE
Insert
69.5
49.0
57.6
38.8
Back-Translation
19.7
12.9
12.8
16.3
Code-Switching
74.4
71.2
65.6
19.7
Delete
33.0
23.3
28.3
14.6
Human Obfuscation
8.4
5.3
8.4
5.4
Paraphrasing
28.1
4.2
4.2
10.5
Repeat
70.2
53.8
61.8
38.4
Swap
1.0
1.0
1.0
0.2
Mean ASR +
38.0
27.6
30.0
18.0
Table 6: Mean attack success rate (ASR, %) of the final detectors trained with adversarial samples generated by different importance estimators (lower is better). The best (lowest) ASR each row is highlighted in bold.
the gradient-based scheme on many languages, but do not provide systematic gains. In particu- lar, Attn-TASTE underperforms on some low-resource languages (e.g., German and Russian), which suggests that attention weights may be less reliable as fine-grained importance signals for adversarial code-switching.
To further understand the effect different importance metrics on the strength of adversarial train- ing, we also compare the attack success rate (ASR) of the final detectors under suite of multilingual attacks. Table 6 reports the mean ASR (averaged over languages) for each attack and each impor- tance estimator, expressed percentages (lower is better).
With the full set of attacks (including back translattnn and paraphrasing), the gradient- TASTE attains the lowest mean ASR (18.0%), substantially lower than Atm--AATE (38.0%), Random- TASTE (30.0%), and Perturb-TASTE (27.6%), indicating the strongest overall robustness. For six of eight attacks (Insert, fuscation), TASTE achieves the best or near-best ASR, showing that gradient-based importance is particularly effective across broad range of perturbation patterns. Perturb-TASTE and Random- TASTE obtain slightly lower ASR than TASTE on few specific attacks (c.g.. Back- Trenssrannlttion and Paraphrasing. where they reach 12.9-12.8% and 4.2%, respectively). but these localized gains do not translate into better average robustness profile: both methods still have higher overall mean ASR than TASTE. Attn-TASTI consistently exhibits the highest ASR across attacks, confirming that attention weights alone are weaker signal for constructing strong training-time adversaries in this multilingual setting.
Delete, Repeat, Swap, and almost tied Human Ob-
We note that Back- Translattin and Paraphrasing phrase-/semantic-leve) transformations that not perfectly aligned with our token-level code-switch perturbation family; thus unguided random- ness can occasionally act stronger regularizer these two attacks, but does not translate into better overall robustness (mean ASR).
Taken together with Table 5 these results show that gradient- based importance scores provide the best trade-off: they preserve high average accuracy across languages while also yielding the lowest overall attack success rate among all variants. This empirically supports the choice of gradient-based
20

---

Published as a conference paper at ICLR 2026
Surrogate model
zh
de
bg
id
it
Mean
GPT-2 (124M)
0.971
0.828
0.701
0.695
0.617
0.817
0.840
0.694
0.697
0.762
ALBEERT-hase--2 (12M)
0.965
0.788
0.632
0.647
0.525
0.779
0.834
0.684
0.780
0.737
Pythia-70M (70M)
0.972
0.826
0.707
0.593
0.553
0.808
0.876
0.596
0.847
0.753
Table 8: Accuracy of TASTE under different surrogate models.
importance as the default design in TASTE, even when considering richer set of attacks including back-translation and paraphrasing.
B.3 IMPACT OF SURROGATE MODEL
Due to the black-box assumption from the attacker's perspective, we do not know the architecture or the training dataset of the target detector. Therefore, we adopt GPT2-based model (Radford al., 2019) trained on the dataset from Wang et al. (2024a) as the surrogate model in the main text. In standard adversarial training approaches under strict black-box constraints (Li et al. 2020b) Yoo & Qi 2021 Li et al. 2025), the choice of surrogate model can significantly influence the target detector's performance. Specifically, using surrogate model with similar architecture and dataset often results in more precise identification of important tokens, thereby generating stronger adversarial samples that can better mislead the target detector.
To eliminate the potential confounding effects of surrogate model and training dataset choices on experimental results, conduct experiments using the same mBERT backbone and the same train- ing dataset as the target detector as the surrogate. Additionally, to provide a fine-grained analysis of the impact of detector architecture and dataset, we also compare configurations using GPT2 M4GT dataset (same dataset for training TASTE, named as IND) and mBERT + +[ang et al. (2024a) dataset (different dataset for training TASTE, named as OOD). The detailed results are presented in Table 7
As shown in Table even when replacing the surrogate model with a detector's s backbone model or using the same training dataset, the performance of the target detector does not ex- hibit significant improvement. This is because, during each step of adversarial training, we utilize the target detector's predicted labels to continuously update the surrogate model, ulti- mately enabling the surrogate to approximate the target detector's predictions closely. This further confirms the applicability and robust-
Surrogate Model
Dutaset (Type)
Avg
Ang ASR().
GPT2
Wang al.
2024g (OOD)
76.2
18.0
GPT2 MBEKT
MIGI (NND
76.1
18.3
Wang al.
2024a (OOD)
75.3
18.9
mBERT
M4GT (NT)
76.4
17.7
Table The results of different surrogate models and datasets that the surrogate models are trained with.
ness of our adversarial training framework, suggesting that regardless of the surrogate model chitecture or the choice of training dataset, the final performance of the target detector remains relatively stable without substantial variations.
We further investigate the impact of surrogate model size on the experimental results. Our framework only requires that the surrogate model provide informative gradients to guide the translation- attacker; in principle, it does not depend on specific architecture or parameter scale. To clarify the impact of surrogate size, we experiment with two smaller surrogates, a albert/a awwerr-bbaseeeeeeee
(12M parameters) (Lan et al. 2019) and 0m (70M parameters) (Biderman et al. 2023), and compare them with the original GPT-2 (124M) used in the main experiments. We report the results in Table
El euthhrrt/pythhii
From Table g several trends can be observed. First, using much smaller surrogates still yields strong multilingual performance: both ALBERT-base-v2 (12M) and Pythia-70M (70M) remain competi- tive with the original GPT-2 (124M), with lingual mean accuracies of 0.737 and 0.753, re- spectively, compared to 0.762 for GPT-2. Second, the Pythia-70M surrogate is particularly close to GPT-2: it even slightly outperforms GPT-2 on several languages (c.g., en: 0.972 vs. 1.971, id: 0.876 vs. 0.840, zh: 0. 707 vs. 0.701), while being weaker others (e.g., de, ru). This suggests that TASTE
21

---

Published as a conference paper at ICLR 2026
Model
zh
de
Mean
TASTE (0% noise)
0.971
0.828
0.701
0.695
0.617
0.817
0.840
0.694
0.697
0.762
TASTE (10% noise)
0,956
0.769
0.687
0.706
0.563
0.812
0.830
0.666
0,918
0.767
TASTE (20% noise)
0.940
0.826
0.630
0.756
0.512
0.742
0.658
0.763
0.833
0.740
Table 9: Accuracy TASTE under different levels of pseudo-label noise during training. Higher accuracy means higher performance.
mainly relies on a reasonable gradient signal from the surrogate, rather than on the full capacity of a 124M-parameter model.
Third, the ALBERT-base-v2 surrogate, despite being an order of magnitude smaller (12M), still delivers mean accuracy of 0.737, indicating that TASTE not tightly coupled specific large surrogate and can be instantiated with very lightweight models when computational resources are limited. Overall, these results demonstrate that the performance of TASTE is robust to the choice and size of the surrogate model: smaller surrogates can be used with only moderate degradation, and in some languages Pythia-70M even matches or slightly exceeds the GPT-2-based variant, showing that the framework can flexibly adapt different computational budgets.
B.4 IMPACT OF LABEL NOISE ON THE TRAINING PROCESS
In Section 4.1 we mention that the attacker (surrogate model) is trained on pseudo-labels produced by the detector. In the real world setting, the pseudo-label from the detector may contains noise. If these pseudo-labels are flipped, the attacker's gradients are corrupted, which may in turn hurt both accuracy and robustness of the final detector. To directly quantify this effect, we conduct an experiment where, during training, we randomly flip fixed proportion of the pseudo-labels used for the surrogate (10% and 20%), and then evaluate the final detector under the same setting in the main results.
We first report the accuracy across 9 languages for three settings: no label noise (original TASTE), 10% noise, and 20% noise. The results are given in Table
Observations from Table
Overall, moderate label noise does not catastrophically degrade the detector:
The mean accuracy with 10% noise (76.7%) is essentially on par with the clean setting (76.2%), and even slightly higher, which can be attributed to mild regularization effect.
With 20% noise, the mean accuracy drops 74.0%, i.e., decrease of only about 2.2 points compared to the clean TASTE.
Per-language trends show some expected degradation (c.g., zh, ru, id), but even at 20% noise, the accuracies remain at a reasonable level and do not collapse, indicating that the co-training dynamics between attacker and detector are fairly robust to pseudo-label noise.
Next, we examine how label noise affects robustness, measured via attack success rate (ASR) under the same multilingual attack suite as in Section 5.2. Here we focus on TASTE only, and report mean ASR (averaged over languages) for 8 attacks under the three noise levels. The results are shown in Table 10
Observations from Table
As expected, injecting label noise into the surrogate makes the final detector more vulner- able:
The mean ASR increases from 18.0% (clean) to 27.4% (10% noise) and 22.2% (20% noise).
The degradation is most pronounced for code-switching and surface-level perturba- tions such as Insert and Repeat, where noisy pseudo-labe labels directly disturb the gradi- ents used select important tokens.
22

---

Published as a conference paper at ICLR 2026
Attack
TASTE (0% noise)
TASTE (10% noise)
TASTE (20% noise)
Insert
38.8
51.9
48.6
Tack-Translation
16.3
13.9
10.2
Code-Switching
19.7
63.8
40.8
Delete
14.6
24.3
19.9
Human Obfuscation
5,4
4.5
2.5
Paraphrasing
10.5
6.2
6.2
Repeat
38,4
53.0
49.0
Swap
0.2
1.5
0.3
Mean ASR J
18.0
27.4
22.2
Table 10: Mean attack success rate (ASR, %) of TASTE under different levels of pseudo-label noise (lower is better).
For menantic-preserving attacks such as Back-Translatiin and Paraphrasing, the ASR does not consistently worsen with noise; in some cases, it even slightly improves (e.g., Back- Translation drops from 16.3% 10.2% 20% noise). A plausible explanation is that moderate noise acts as an additional regularizer that discourages the detector from overfit- ting to specific surface cues exploited by these attacks.
Overall, even with 20% label noise, the mean ASR remains at 22.2%, which still reason- ably low compared to standard detectors without adversarial training, confirming that the attacker-detector co-evolution is robust but not immune to pseudo-label corruption.
Taken together, these results show that while pscudo-label noise does degrade robustness-ad as one would expect- the degradation is graceful rather than catastrophic. TASTE maintains strong multi- lingual accuracy and relatively low ASR even when up to 20% the surrogate's training labels are flipped, suggesting that the gradient-based attacker remains reliable in practice under realistic levels of detector prediction noise.
B.5 OUT-OF-DISTRIBUTTT (OOD) EXPERIMENT
Metric-uused
Model-base Delectors
Lang
Metric
Fust DetectGiPT
Binoculars
LER
XLM Roberta-Base
mBERT RADAR"
GREATER-D
TASTE (Ours)"
0,663
F1
0.754
0,633
0.538
03.99
0.904
0,866
0.894
0.96
0.334
0.57
002311
0.481
033
78
0,385
0.601
Acc
0.876
0.734
0.360
0338
0.785
0.852
0.614
0.70
0.753
8g
Avc
0.691
0.670
0.414
0.521
0.354
0.708
0.766
0.588
0.793
F11
0.267
0.839
0.973
0.486
0.660
0.566
0.708
0.679
0.557
0.728
F11
0.837
8.972
0.17
0.508
0.475
0.681
0.601
0.508
0.710
Arg.
F11
0.732
0.667
0.343
0.630
0.
0.679
0.642
0.610
0.758
Table 11: Performance on SvmEval Task8 (OOD) Dataset. We report accuracy (Acc) and F1 score (F/). The best result in each row is in bold, the second-best underlined. indicates adversarial- training-basee based methods.
To evaluate the model's generalization ability unseen datasets, assessed detectors' perfor- mance on the SemEval Task 8 dataset Wang et al. (2024c). The result is shown in Table Overall, our TASTE attains the best macro performance across languages, yielding the highest averaged Acc (0.768) and FI (0.755), with Fast DetectGPT the second best (Acc 0.761, FI 0.737). At the per- language level, TASTE leads (GREATER-DD and on bg (Ace 0.793/F1 0.787) with clear margins over the strongest basclines (mBERT: 0.768/0.767). In ru, Fast DetectGPT tops Acc (0.659) while TASTE offers the best Fl
(Acc 0.935/F1 0.934) with +0.021/+0.028
the next best
23

---

Published as a conference paper at ICLR 2026
Readability
Coherence t
Overall quality
Annotator
A
0
A
A
A1
4.29 + 0.79
3.84
+ 1.07
4.59 + 0.60
3.79 + 1.30
4.24
+ 0.43
4.06
+ 0.75
A2
4.03
- 0.96
3,80
+ 1.18
4.08
+ 0.64
3.84
+ 0.69
3.98
+ 0.95
3.48 + 1.08
A3
4.57 + 0.64
4.30 + 0.70
4.39 + 0.55
4.14 + 0.65
4.61 + 0.56
4.22 + 0.63
Mean
4.30
3.98
4.35
3.92
4.28
3.92
Table 12: Human evaluation scores (Original Example (O) vs Adversarial Example (A)) for readability, coherence, and overall quality. Since the scores are bounded in [1, 5], the mean + std interval should not be interpreted as the actual attainable score range, but only as an indicator of the dispersion of the annotations.
(0.601), indicating more balanced precision-recall under distribution shift. Two challenging regimes emerge: (i) ur, where the metric-based Binoculars excels (Acc/FI 0.973/0.972), likely benefiting from its generator-observe divergence heuristic on this domain; and (ii) zh, where Fast Detect- GPT dominates (AceIF/ 0.876/0.872) while TASTE trails (0.753/0.743). Classical linear metrics (LRR) are consistently weak (e.g., bg: 0.444/0.043; ur: 0,486/0.017), underscoring the limitation of shallow cues under OOD shift. Taken together, the results suggest that adversarially trained, model- based detectors deliver the most reliable OOD robustness on average, but language-specific gaps remain (notably and zh), motivating future work adaptive calibration and script-/morphology- aware multilingual representations.
B.6 QUALITY EVALUATION OF ADVERSARIAL EXAMPLE
To evaluation the quality of adversarial example generated by TASTE's attacker, we recruited three human annotators (Al-A3), who independently evaluated 100 pairs of original examples and ad- versarial examples generated by the TASTE attacker. Each pair rated along three dimensions: readability, coherence, and overall quality. Scores range from 1 to 5. The result can be found in Table 12
From this table, we observe that adversarial examples remain highly readable and coherent: all mean scores close to above 4.0 1-5 scale, indicating that annotators still perceive them nat- ural and easy to understand. At the same time, there is consistent but moderate degradation when moving from original adversarial texts: the average drops are about 0.32 for readability (4.30 + 3.98), 0.43 for coherence (4.35 + 3.92), and 0.36 for overall quality (4.28 + 3.92). This pattern suggests that TASTE perturbations slightly reduce perceived quality-as expected for adversarial modifications--et do not introduce severe grammatical errors or destroy semantic coherence. We also note that some annotators (e.g., A2 on overall quality) are more sensitive to the artifacts intro- duced by the attack and give lower scores, while others show milder drops, which is consistent with typical inter-annotator variability in human evaluation.
Annotation protocol. All three annotators were senior undergraduate students in engineering ma- jors at our university, each with substantial multilingual experience. Before the main study, we pro- vided a written guideline that defined the three dimensions (readability, coherence, overall quality) and described the 1-5 scale with concrete examples for "poor" (1), "acceptable" (3), and "excellent" (5) texts. The annotators then went through a short pilot phase (20 practice pairs not used in the final analysis), where they independently rated the examples and received feedback calibrate their use of the scale.
During the main annotation phase, the 100 pairs were randomly shuffled, and for each pair the order of the original and adversarial text was randomized. The interface only showed two anonymized texts (Text A and Text B) without revealing which one was adversarial or any model-related infor- mation, and annotators were explicitly instructed not to guess the source authenticity of the texts, but to focus solely on perceived linguistic quality. For each text, they were asked to assign three sep- arate integer scores in (1.... 5) for readability, coherence, and overall quality, interpreting them as a standard Likert scale. No examples could be skipped, but annotators were allowed to take short breaks and complete the task in single session of less than one hour.
24

---

Published as a conference paper at ICLR 2026
Detector
en
de
zh
bg
id
Mean
Binoculars
0.2903
0.3645
0.3031
0.2027
0.5638
0.3449
Fast DetectGPT
0.5327
0.3861
0.6152
0.2027
0.7001
0.4874
LRR
0.0432
0.1042
0.1023
0.0641
0.0000
0.0628
mBERT 0.3740
0.0531
0.3277
0.2058
0.3195
0.2560
mDeBERT-v3-BB
0.6300
0.2246
0.3492
0.1595
0.5289
0.3780
XLM-RoBERTa-BBR
0.1914
0.0757
0.2834
0.1060
0.0992
0.1512
RADAR 0.6372
0.0644
0.1346
0.1475
0.2662
0.2500
GREATER-D
0.7442
0.0886
0.2306
0.1844
0.2745
0.3045
TASTE
0.8716
0.2856
0.3469
0.5206
0.6663
0.5382
Table 13: TPR @ FPR=1% % of each detector in M4 Dataset. We highlight the best result in each group in bold and the second-best result with underline.
Annotators were compensated at an hourly rate comparable standard student research assis- tantships at our institution. The study did not collect any personally identifiable information beyond basic demographic and educational background.
B.7 COMPLEMENTARY EVALUATION UNDER T
To complement the accuracy and Fl metrics reported in the main paper, we further follow com- mon practice in sensitt-sensiiivve detection and evaluate all detectors under the operating point TPR @FFPP=1 on the M4 dataset. We consider five languages: one training language (English), two dictionary languages (Chinese and German), and two fully zero-shot languages (Indonesian and Bulgarian). The results are summarized in Table 13
we observe that under this stringent operating point, TASTE achieves the best average performance across the five languages (mean TPR of 0.5382), surpassing strong zero-shot baselines such as Fast DetectGPT (0.4874) and Binoculars (0.3449). On English (the training language), TASTE attains a TPR of 6 at I FPR, substantially improving over both GREATER-D (0. (0.7442) and RADAR (0.6372), which are specifically designed for machine geeerraee text detection.
From Table 13
For the two zero-shot languages (Bulgarian and Indonesian), TASTE remains highly competitive. On Bulgarian, achieves the highest TPR at 1% FPR (0.5206 vs. 0.2027 for Fast DetectGPT), and on Indonesian it reaches the second-best result (0.6663 0.7001 for Fast DetectGPTT), indicating strong out-of-diittibutiion robustness despite the absence of language-specific supervision. On the two dictionary languages (Chinese and German), Fast DetectGPT attains the highest scores, while TASTE is slightly lower but still competitive. Overall, TASTE maintains the best cross-language mean under TPR @ FPR=1% showing that the performance trends observed with Acc/F1 in the main paper remain consistent when evaluated with a more security-relevant metric.
We further examine the diittii-ittiittion robustness of all detectors on the SemEval 2024 Task dataset, which is disjoint from M4. To ensure fair comparison, we reuse the same thresholds as Table [3 i.e., each detector's threshold is calibrated on M4 achieve TPR FPR=1%, and then directly applied to SemEval without any additional tuning. We focus on the overlapping languages Bulgarian/EnglishChhness (bg/en/zh) and report both TPR and FPR, as well as their means across these three languages; the results are shown in Table 14
As shown in Table [4] TASTE achieves the highest mean TPR (0.5700) on the OOD SemEval dataset across bg/en/zh, outperforming strong zero-shot detectors such as Binoculars (0.4952) and Fast DetectGPT (0.4589), as well as other mBERT-based baselines. In particular, on Bulgarian, TASTE substantially improves recall (0.5633) compared all competitors, and on English it attains the highest TPR (0.7697), close to mDeBERT-v3. Base (0.7998), while remaining competitive on Chinese.
Crucially, these gains TPR do not come at the cost excessively high FPR on OOD data. The average FPR of TASTE (1.96%) remains low, noticeably below that of other mBERT-haasd detec-
25

---

Published as a conference paper at ICLR 2026
Detector
bg
en
zh
Mean
TPR
FPR
TPR
FPR
TPR
FPR
TPR
FPR
Binoculars
0.1958
0.0073
0.6122
0.0076
0.6777
0.0097
0.4952
0.0082
Fast DetectGPT
0.2811
0.0052
0.5675
0.0048
0.5281
0.0031
0.4589
0.0044
LRR
0,0000
0.0000
0.0010
0.0000
0.0030
0.0000
0.0013
0.0000
mBERT 0.2339
0.0219
0.5345
0.0412
0.4383
0.0369
0.4022
0,0333
mDeBERTTv3-BALE
0.1586
0.0110
0.7998
0.0165
0.4895
0.0259
0.4826
0.0178
XLM-RoBERTa-Bass
0.1195
0.0269
0.2488
0.0412
0.3882
0.0279
0.2522
0.0320
RADAR
0.1305
0.0345
0.5561
0.0518
0.2662
0.0313
0.3176
0,0392
GREATER-D 0.2014
0.0214
0.6362
0.0336
0.2745
0.0287
0.3707
0.0279
TASTE
0.5633
0.0179
0.7697
0.0319
0.3771
0.0090
0.5700
0.0196
Table 14: TPR and FPR of each detector on the SemEval 2024 Task 8 (OOD) dataset at the thresholds used in Table
Detector
Inference time (s)
Time / example (ms)
Fast DetectGPT
2862.47
194.40
Binoculars LRR
3173.01
215.48
1361.85
92.49
mBERT
76.41
5.19
mDeBERT-v3-Base
133.97
9.10
XLM-RoBERTa-Baa 82.80
5.62
RADAR
77.66
5.27
GREATER-D TASTE
75.90
5.15
76.09
5.17
Table 15: End-to-end inference time on the M4 test for each detector. "Inference time" the wall-clock time for one full pass over all 14,725 test examples on single RTX 4090 GPU under identical batching settings; "Time example" the corresponding average latency per input.
tors such as RADAR (3.92%) and MBBERT/XLM-RRBERK and comparable to mDeBERTTv3-Baa (1.78%). Although Fast DetectGPT achieves a lower average FPR (0.44%), this comes with a con- siderably lower mean TPR (0.4589 vs. 0.5700). Taken together, these results indicate that TASTE achieves a more favorable recall-FPR trade-off at security-relevan operating point, and that its advantages on M4 largely transfer challenging OOD benchmark.
B.8 ADDITIONAL EVALUATION EFFICIENCY
In addition detection performance, we also evaluate the computational efficiency of all detectors. As reported in Section 6.1, the training time of our method is about 40 minutes for 3 epochs on single RTX 4090 GPU, which is reasonably low training cost for a multilingual detector. To better understand the deployment-time overhead, we further measure the end-to-end inference latency of each detector on the M4 test set.
The test set contains 14,725 examples in total. For each detector, measure the wall-clock time (in seconds) required to complete a single sill pass over all 14,725 examples on a single RTX 4090 GPU under identical batching and implementation settings, and then derive the average time per example in milliseconds. The results are summarized in Table 15
The results reveal clear efficiency gap between metric-based and model-based detectors. Metric- based approaches such as Fast DetectGPT, Binoculars, and LRR incur very large inference latency (about 92-215 ms per example), primarily due to the cost of repeated perturbation, scoring,
26

---

Published as a conference paper at ICLR 2026
generative calls. In contrast. model-based detectors (mBERT, mDeBERT-v3 Base,, Base, RADAR, GREATER-DD D, and TASTE) operate the single-digit millisecond regime (roughly 5-9 ms per example). In particular, GREATER-D D and TASTE are among the fastest, with average latencies of 5.15 ms and 5.17 ms per example, respectively.
Viewed in terms of throughput, TASTE is than order of magnitude faster than metric-based detectors at inference time: compared to Fast DetectGPT and Binoculars, it achieves speedups of approximately 38x and 42x, respectivvyy and is about 18x faster than LRR on a per-example basis. These findings indicate that, despite requiring a one-time training cost, TASTE and other model- based detectors are substantially more attractive for worldw large-scale deployment scenarios, where inference latency is critical constraint and can partially offset the upfront training overhead.
B.9 ANALYSIS OF TRAINING PROCESS
To assess the stability of the joint training procedure, we monitor the losses of both the detector and the attacker throughout training. Figure 6 plots the representation prreeerviigg loss LRPL. the aunguage-agnostic adversarial loss LLAAL. and the attacker loss Catt as a function of training steps.
At the beginning of training, all three losses exhibit mild oscillations, reflecting the initial adaptation of the surrogate and detector. After roughly 200 steps, the curves become much smoother: LRPL continues to decrease steadily, LLAAL decreases slightly and then stabilizes around a plateau, and Lat drops quickly before converging to a low value. Overall, the losses of both components re- main well-behaved over the entire training horizon, indicating that the attacker-detector co-training process is stable and does not suffer from divergence or collapse.
C FORMAL GUARANTEE OF CROSS GENERALIZATION BY LLAAL
Setting and Notation. Let ø be the encoder of the target de- tector Dear (+), and à <a(r) the sentence-level representation (e.g.. [CLS]). For each language/domain is E (1,..., K). let Ps be the input distribution and Pt the pushforward fea- ture distribution under Φ. Let faang be the language discrimi- nator in Eq. (7). trained adversarially via gradient reversal as described below Eq. 7 Let y(x) E {0,1} be the ground- truth class (HWT/MGT) The attacker generates F via code- switching (Section 2 Fig. 2). and the
Loss (RPL) Eq. (6) enforces y (ū) (z) at training time.
Figure Exponentially weighted moving average (EWMA) of the training losses for the detector (CRPL., (T.AA.) and the attacker (Latt) over optimization steps.
Assumption (Semantics any input x and its code-switched produced by the attacker,
code-switching). For
y ( y(r),
(10)
and ã differs from x only by lexical-level cross-lingual substi- tutions that preserve sentence meaning.
LAAL as a domain-adversarial objective. Let म = (TI,..., Tx) be the prior over languages/- domains used by flang in Eq. Given feature h, the optimal discriminator satisfies
IE PA (h) Ex TT P,
Sinn (k) (1)
(11)
where ph is the density of Pt.
Lemma
1 (LAAL minimizes generalized JS among languages). Let CLAAL be
Eq.
Define the generalized Jensen-Shannow divergence (P,,, p.)
DK K
K Ik Th KL. (p) Σラ= )イ))) Then the minimum LAAL loss over discriminators equals
min LL flang) = H(T)) - GJS P 1..... P
(12)
fuang
27

---

Published as a conference paper at ICLR 2026
where (x)) is the entropy of Consequently, maximizing Eq. 7 w.I.t. via gradient reversal is equivalent to
x E
arg min PP pk),
(13)
i.e,, LAAL drives the language/domain, feature distributions toward each other.
Proof.
By Eq.
11b substituting finng into Eq. 7 gives
TNP (h)
min LLAAL = Jiang
Th B log
Ej= Tsps (h)
K
K
K
Th log Th
+
Σ
Th
KL
k
Σ
Ps
Rmm
Rm
((x)
GJS
Pk),
(14)
which yields Eq. 12 Since the encoder @i receives the reversed gradient -Ntang LLLAAL (see
the paragraph below Eq. 77)) maximizes the minimum in Eq. 12), equivalently minimizing GJS,
as in Eq. 13
From language invariance to domain discrepancy. Let dHAH(P, Q) be the standard discrep- ancy distance between two distributions for hypothesis class H. For two languages/domains & and K, define the mixed class-conditional feature distributions
P
Σ (0.1)
Telk
p R
Σ (E
Telk pd
(15)
where Telk is the class prior within language & and pe the class-conditional feature distribution. By standard inequalities between f-divergences and total variation, there exists universal constant C > 0 such that
dHaR Ph P..) S 2TV(PP Pe) S 2/ C JSSP P.).
(16)
Hence, by Lemma T LAAL (Eq. 13 reduces a surrogate upper bound on dHAH across languages.
Lemma 2 (Adaptation bound). Let (h) be the expected classification error on language k under hypothesis h E H. For any source is and target K, the standard domain adaptation bound yields
Ex (h) S (h)
ddann( Ph, P2) + x²,
(17)
where X minneH (E) + Ew (h)) is the joint optimal risk.
Lemma (RPL+ code-switching does not increase the joint optimal risk), Under Eq. 10 training
with RPL (Eq. (6) on pairs (z, Z) enforces label consistency across semantic- prreattcc-preeevinng perturba- tions and expands the support overlap between De and Pé- Consequently,
MAPL+CS) I Niulo RPLASS)
(18)
Proof. Eq. (6) jointly minimizes the negative log- logeliieldoood (z, 2) with the same label, forcing to map semantics- preservini variants to nearby features. Because code-switching bridges lexical re- alizations across languages (Eq. (TOp), the induced feature supports have larger intersection. For any Bayes-consistent H. enlarging the common support under an unchanged labeling function cannot increase the minimum combined risk, yielding Eq. (18).
D
Theorem 4 (LAAL improves cross-language generalization), Consider training with the detector loss Eq. ( where LLAAL and LRPL are given by Eq. (7) and Eq. (6). respectively. Let h be the learned classifier after training, and let l (source) and k' (target, possibly zero-shot) be two languages. Then, relative to training without LAAL and without RPLL:code-switciigg the target error of h admits a strictly fighter bound:
Ex (h) S (h) +
dHAM Po per
+
NiRPL&CS)
(19)
reduced by LAAL via Eq.
13 and Eq.
16
non- con-innreessing by Ey.
18
28

---

Published as a conference paper at ICLR 2026
Proof. By Lemma 2 Eq. (17) holds for any representation @. By Lemma LAAL (Eq. with gradient reversal minimizes GJS,, over languages, which-via Eq. (16 reduces an upper bound on dHAH (P& P.O) By Lemma 3 RPL+code-switching does not increase the joint optimal risk, Eq. (18). Combining these three Tacts yields Eq. (19), i.c., a tighter target-error bound than train- ing without LAAL and without RPL+code-swichhng. Therefore LAAL improves cross-language generalization of the detector.
Interpretation (Mechanism at the class level). Misclassification across languages arises when same-class sentences produce language-specific features that cross the decision boundary. Eq. (13) makes & language-imwan invarinnt (minimizes inter-language divergence), while Eq. ( explicitly ties together semantics-preserviine oscillation under code-switching. Together they shrink cross-language feature gaps for the same class and thus reduce target error by Eq.
pairs (I, .) and keeps their class unchanged, preventing boundary
D USE OF LARGE LANGUAGE MODEL
We used GPT-5 solely as a language assistant to improve clarity and readability of the manuscript (e.g., grammar, wording, concision, and flow), and to suggest minor LaTeX formatting fixes (e.g., spacing, figure/table captions). All technical idcas, algorithms, experiments, analyses, and conclu- sions are authored and verified by the authors. No experimental design, data curation/ammotation, hyperparameter selection, result filtering, or claim generation was delegated to GPT-5.
Scope of assistance. Prompts were limited to: (i) "rewrite this paragraph for clarity/conciseness., (ii) "standardize terminology to match our definitions," (iii) "tighten the abstract/conclusion to S N words," and (iv) "suggest LaTeX fixes for warnings (no content changes)." Generated text was always reviewed, edited, discarded by the authors.
Safeguards. We screened assisted passages for factual correctness, citation integrity, and potential hallucinations; all technical statements and references were cross-checked against our code, logs, and sources. We did not upload private, sensitive, or license-restricted data/code beyond small, prready-publics excerpts necessary for phrasing polish. We ran standard plagiarism checks on the final draft.
Reproducibility and credit. LLM assistance did not affect experimental outcomes or the repro- ducibility protocol (datasets, code, and seeds). The contributions of GPT-5 were purely editorial; the authors retain full responsibility for all content.
29


Reviews:
[{"review_id": "D3Sv3hVoFx", "reviewer": "Reviewer_9HJS", "summary": "The paper propose TASTE, a two-component framework that helps to train a robust multilingual MGT detector. Specifically, includes two core parts. The adversarial attacker generates code-switched or partially translated adversarial examples via dictionary-based perturbation, while the detector is trained jointly with a  language-agnostic loss to encourage language-invariant features and resilience against unseen perturbations. Experiments results show that TASTE outperforms eight SOTA detectors, and ablation studies further suggest the importance of LAAL.", "questions": "Please see my reviews above.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The proposed training method is useful and could enhance the effectiveness of MGT detectors.\n2. The motivation and logic of this paper is clear.\n3. The proposed method is model-agnostic and can be used on existing detectors .", "weaknesses": "1. The construction of the adversarial examples rely on existing dictionaries, yet how about the performance of this method on low-resource language tasks, where high-quality dictionary may not exist?\n2. It would strengthen the paper to include human annotation to study whether the generated adversarial examples remain natural and human-readable.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "irf9LrgVCi", "reviewer": "Reviewer_CasE", "summary": "The authors introduce an improvement method for LLM-generated text detection in a multilingual setting based on selective vocabulary-based translation to other languages of tokens detected as important for generated text detection in a surrogate model. The authors demonstrate better performance of their model on the languages used in training, as well as on previously unseen languages, and conduct generalization and ablation analyses.", "questions": "- The detection-critical identification method seems to be focusing on tokens, whereas translation dictionaries use words. How do you transition from one to another?\n\n- L263: You mention that the gradient flow through the language discriminator erases the language-specific clues. Could you please elaborate as to why?\n\n- L464: Why do you expect the performance of dictionary errors to be the same as the performance of detection models in English, which is the base training language for the model? \n\n- L130-132: RADAR detector cited as the prior work seems to perform poorly compared to other methods on standardized benchmarks, notably RAID [3]. Could you please elaborate on why your method appears to be performing better than RADAR, which uses a similar approach? \n\n[3] Dugan, L., Hwang, A., Trhlik, F., Ludan, J.M., Zhu, A., Xu, H., Ippolito, D., & Callison-Burch, C. (2024). RAID: A Shared Benchmark for Robust Evaluation of Machine-Generated Text Detectors. ArXiv, abs/2405.07940.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "Low-resource detection of LLM-generated texts is a critical and timely subject. With the development of massively multilingual LLMs, the communities that have been previously shielded from information operations are likely to become reachable by attackers. As the authors have mentioned, the vast majority of LLM-generated text detection work has focused on the English language, with even the most dominant commercial options supporting a limited selection of high-resource languages, leaving the inherent lack of performance of LLMs as the only viable detection method, which is not sustainable in the long term/ \n\nTo achieve this, authors combine several existing well-performing methods, such as surrogate models, detection-relevant token identification, adversarial learning, and single-word vocabulary-based translation, in a non-trivial manner.\n\nAdditionally:\n- Authors provide a clear and realistic threat model\n- Authors select relevant baselines, for both zero-shot detection and a base model for fine-tuning\n- Authors check the method generalization to previously unseen languages\n- Authors examine the resilience of their method to adversarial attacks, which is the currently most salient issue with LLM detectors\n- Evaluation of dictionary error impact, which is essential for low-resource languages, where high-quality dictionaries do not exist or cannot be defined due to the inherent diversity and heterogeneity of low-resource languages. \n- Clear path to a defensive use of an LLM for security work\n- Computational resource-aware experiments", "weaknesses": "While the manuscript and the underlying ideas are both overall excellent, it has several shortcomings in its current state. Specifically: \n\n- Authors do not share code, making it impossible to evaluate the contribution or prove that work has been actually performed and would be replicable. Evaluation of papers whose main contribution is a novel algorithm is impossible without the artifacts used to generate them, and the promise of publication upon release is insufficient.\n- The selection of performance metrics (F1 and Acc) is not consistent with the current best practices in the LLM detection research. Namely, given the threat model of real-world deployment of LLM detectors, the recommended and generally adopted metric in the field is TPR @ fixed low FPR [1]. The use of accuracy and F1 scores is inconsistent with this threat model, making comparisons somewhat difficult, especially since more recent LLM detection methods, particularly zero-shot ones such as Binoculars and Fast DetectGPT, were optimized for TPR at a fixed low FPR, potentially sacrificing performance on other metrics. I strongly suggest that authors replicate at least some of their result tables with the relevant performance metrics, showing consistency with the rest of the field. \n- Autoencoder LLMs fine-tuned for detection are known to perform well and generalize well on the in-distribution training data, but demonstrate problematic FPR on the out-of-distribution texts [2]. While the authors try to account for it by evaluating the performance of autoencoders trained on the English part of the M4 dataset on the Semeval-2024/8 dataset, they do not report the FPR scores with the same parameters as would be used for a TPR@fixed low FPR on the M4 dataset, making it impossible to evaluate this potential failure mode.\n\n[1] Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., & Tramèr, F. (2021). Membership Inference Attacks From First Principles. 2022 IEEE Symposium on Security and Privacy (SP), 1897-1914.\n\n[2] Gameiro, H.D., Kucharavy, A., & Dolamic, L. (2024). LLM Detectors Still Fall Short of Real World: Case of LLM-Generated Short News-Like Posts. ArXiv, abs/2409.03291.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "OvrcQLgjXx", "reviewer": "Reviewer_S8Qh", "summary": "This paper addresses the critical challenges of zero-shot generalization and adversarial robustness in multilingual machine-generated text (MGT) detection by proposing TASTE, a novel adversarial training framework. The approach integrates a code-switching attacker leveraging translation dictionaries with a detector trained using a Language-Agnostic Adversarial Loss (LAAL) to learn language-invariant representations.", "questions": "In the model-based detectors, the authors consistently use pre-trained models. Would the performance be improved if LLMs were employed instead?", "limitations": "", "rating": 2, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1.The figures in the paper are presented with exceptional clarity.\n2.The paper's underlying assumptions are sound, and the writing is accessible and easy to understand.", "weaknesses": "1. Additional evaluation dimensions are needed. For instance, metric-based detectors require no training, whereas model-based detectors do. The authors should disclose the associated training costs (e.g., time, computational resources).\n2. Potential unfair comparison. Among the model-based detectors, RADAR, GREATER-D, and TASTE employ adversarial training, while the other methods do not. It is uncertain whether this constitutes a fair comparison.\n3. Suboptimal performance of TASTE. The experimental results for TASTE are relatively weak, rarely achieving state-of-the-art outcomes.\n4. Lack of comprehensive ablation studies. The paper seems to lack genuine ablation experiments. The authors should perform ablations on the individual loss components in Equation (8) and the various modules of TASTE, rather than conducting only limited experiments in Section B.1 of the appendix.\n5. Conventional methodology. The methods section appears somewhat standard, lacking significant innovation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "f3x6n2q7Qg", "reviewer": "Reviewer_aEgz", "summary": "The paper addresses the challenge of building robust multilingual machine-generated text (MGT) detectors when low-resource languages lack labeled training data.\n\nIt proposes TASTE (Translation-based Attacker Strengthens Multilingual Defender), a framework that conducts adversarial training using a translation dictionary and surrogate modeling under a black-box setting.\n\nThe core idea is to let an attacker perform cross-lingual code-switching using important token gradients while the detector learns language-invariant representations through a new loss called Language-Agnostic Adversarial Loss (LAAL).", "questions": "1. Since the surrogate model is trained using pseudo-labels from the target, how does label noise or prediction bias affect the gradient quality and the attacker’s reliability in the black-box setting? Currently this surrogate model is implemented using  GPT2. How about a smaller model?\n2. The alternating training between the attacker and detector does not include a convergence or stability analysis. Could the authors provide evidence or discussion on whether the training dynamics reach equilibrium or exhibit oscillation?\n3. Could the authors conduct ablation studies on key hyperparameters identified in the weakness section to assess their impact on performance?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The paper introduces a novel translation-based adversarial training framework that effectively leverages multilingual dictionaries under a black-box setting to address the data scarcity problem in low-resource languages.\n2. The proposed attacker-detector adversarial mechanism and the Language-Agnostic Adversarial Loss (LAAL) jointly enable the detector to learn language-invariant features, enhancing robustness and cross-lingual generalization.\n3. Experiments on 9 languages and 8 attacks show significant improvements in F1 score.", "weaknesses": "1. The attacker’s token-importance estimation relies on a surrogate model distilled from target labels, where importance is computed as the gradient of the loss with respect to individual tokens. It would strengthen the work to include ablation studies comparing alternative importance metrics (e.g., attention-based or perturbation-based methods?). In addition, Eq. (4) introduces a hyperparameter $k$ whose size likely affects the attack strength.\n2. The method perturbs token-level translations from a dictionary, which does not account for phrase-level paraphrasing. Robustness against broader multilingual or adaptive attack forms remains insufficiently explored.\n3. The co-evolution process between the attacker and detector requires multiple updates per iteration, which increases computational overhead and may limit scalability to larger datasets.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)