Beyond Raw Detection Scores: Markov-Informed Calibration for Boosting Machine-Generated Text Detection
Authors: Chenwang Wu
Yiu-ming Cheung
Shuhai Zhang
Bo Han
Defu Lian
Venue: ICLR 2026 Poster (2026)
Keywords: Machine-generated Text Detection
Markov-aware Calibration
Raw Detection Score
Primary area: foundation or frontier models, including LLMs
TL;DR: Markov-Informed Calibration for Boosting Machine-Generated Text Detection

Abstract: While machine-generated texts (MGTs) offer great convenience, they also pose risks such as disinformation and phishing, highlighting the need for reliable detection. Metric-based methods, which extract statistically distinguishable features of MGTs, are often more practical than complex model-based methods that are prone to overfitting. Given their diverse designs, we first place representative metric-based methods within a unified framework, enabling a clear assessment of their advantages and limitations. Our analysis identifies a core challenge across these methods: the token-level detection score is easily biased by the inherent randomness of the MGTs generation process. To address this,  we theoretically and empirically reveal two relationships of context detection scores that may aid calibration: Neighbor Similarity and Initial Instability. We then propose a Markov-informed score calibration strategy that models these relationships using Markov random fields, and implements it as a lightweight component via a mean-field approximation, allowing our method to be seamlessly integrated into existing detectors. Extensive experiments in various real-world scenarios, such as cross-LLM and paraphrasing attacks, demonstrate significant gains over baselines with negligible computational overhead. The code is available at \url{ https://github.com/tmlr-group/MRF_Calibration}.

Published as a conference paper at ICLR 2026
BEYOND RAW DETECTION SCORES: MARKOV- INFORMED CALIBRATION FOR BOOSTING MACHINE- GENERATED TEXT DETECTION
Chenwang Wu- Yiu-ming Cheung Shuhai Zhang Bo Han Defu Lian
Department of Computer Science, Hong Kong Baptist University, Hong Kong, China School of Software Engineering, South China University of Technology. Guangzhou, China "School of Computer Science, University of Science and Technology of China, Hefei, China fcscwwu, ymc, bhanml @ hkbu. edu. hk, shuhai zhangshz@ gma com, Lande edu.cn
ABSTRACT
While machine- machine-generated texts (MGTs) offer great convenience, they also pose risks such as disinformation and phishing, highlighting the need for reliable de- tection. Metric-basse basid methods, which extract statistically distinguishable fea- tures MGTs, are often more practical than complex model-based methods that are prone to overfitting. Given their diverse designs, we first place representa- tive metric-based methods within a unified framework, enabling a clear assess- ment of their advantages and limitations. Our analysis identifies core challenge across these methods: the token-level detection score is easily biased by the in- herent randomness of the MGT's generation process. To address this, theo- retically and empirically reveal two relationships of context detection scores that may aid calibration: Neighbor Similarity and Initial Instability. We then pro- pose a Markov-informed score calibration strategy that models these relation- ships using Markov random fields, and implements as a lightweight compo- nent via mean-field approximation, allowing our method to be seamlessly in- tegrated into existing detectors. Extensive experiments in various real-world sce- narios, such as cross-LLM and paraphrasing attacks, demonstrate significant gains over baselines with negligible computational overhead. The code is available https://gitee com Imlr gro.g /MRF Calibration
INTRODUCTION
In recent years, generative AI, represented by large language models (LLMs) AAchiam et al. 2023 Radford et al. 2019), has advanced rapidly, and the machine-generated texts (MGTs) they produce often match human writing in fluency, coherence, and diversity. While this technological break- through offers immense opportunities, has also triggered widespread societal concerns, such as the spread of disinformation (Vykopal et al. 2024). the violation of intellectual property rights Yuu jet al. 2023b), and phishing attacks (Hong 2012). Therefore, the research and development of MGT detection technologies hold significant theoretical and practical value in uncovering the distinct pat- terns of generated text and ensuring a trustworthy AI environment.
An effective detection method is to identify LLM's watermarks (Hou et al. 2024), but this requires injecting watermarks into the LLM, which is often impractical due to high access permissions. Therefore, passive detection methods, including model-basee and peetrc-baseed methods, have gar- nered significant attention. Moodel-base methods, which use a set of human- and machine- -etterrnggeertteed texts train a binary classifier, such OpenAl detector (Solaiman al., 2019), ChatGPT detector (Guo et al., (223)) SeqXGPT (Wang et al. 2202)_ and CoCo (Liu et (022). However, such mod- els are often too complex, leading overfitting to the training data. Instead, metric-based methods exploit the inherent statistical biases of LLM to discriminate MGTs, which is model-agnostic and has better generalization properties. These methods use metries such as likeliiddoodd, log-rank,
Conresponning author; Yiu-ming Cheung (yme@ccom.httl wwwp..oku..e....ooo

---

Published as a conference paper at ICLR 2026
and entropy. Furthermore, methods such DetectGPT Mitchell et al. 2023). DNA-GPT YYang et al. 2024). and SimLLM (Nguyen-Son et al. 2024 detect MGTs by comparing the differences between given text and perturbed, regenerated, or continued text from an alternative model.
Obviously, metric-based methods exhibit diverse designs. Therefore, this paper first systematically examines several representative approaches, including Log-Likelihood (Solaiman al. 2019). Log- Rank (Mitchell et al. 2023). Entropy (Gehrmann et 2019)) DetectGPT (Mitchell et al. 2023)
Fast-DetectGPT (Bao et al. 2024), and DNA-GPT (Yang et al., 2024), and situates them within a unified framework (Section 2). Our analysis reveals that they share threshold-based detection criterion, with some commonalities, such as the inclusion of auxiliary data (e.g., perturbed texts). This offers a theoretical basis for understanding their core mechanisms, strengths, and limitations.
Based on the unified framework, we summarize the core challenge of metric-based methods (Section 2): the imprecision of token-level detection scores. Specifically, since these methods make decisions based on a threshold, their effectiveness is directly tied to score precision. However, randomness introduced by the LLM sampling mechanism can violate their underlying assumptions, leading to biased scores with low discrimination, as shown in "w/o refine" in Fig. [ (more results can found in Appendix E. Moreover, they tend to derive an overall detection score by naively aggregating token-level scores, failing to correct the underlying imprecision. Therefore, calibrating the token- level detection score is essential for improving overall detection performance.
Given that detection scores are tied to tokens and the LLM generation pro- cess induces dependencies among to- kens (Achiam al., 2023), context tokens' detection scores may have relationships that are easy to over- look. Revealing and modeling these relationships may help calibrate these scores. Accordingly, we theoreti- cally and empirically reveal two rela- tionships among detection scores of context tokens (Section 3): Neigh- bor Similarity, where adjacent to- kens exhibit similar detection scores, and Initial Instability, where the detection scores of initial tokens unstable.
Machine
Cloude
M
GPT4A]
wio callb.
callb.
Figure 1: Distribution of token scores obtained by the De- tectGPT method without and with score calibration in the Essay dataset. The proposed calibration method enhances the discriminative nature of the token scores.
Finally, building on these two relationships, we propose a Markoy-informed score calibration method enhance MGT detection (Section 4 Our method models the identified relationships through Markov random fields and, via a mean-field approximation, implements it as a lightweight iterative neural network. As shown by the more discriminative detection scores the "w refine" method in Fig. M the proposed method boosts the discriminative nature of the scores. Notably, our method can be seamlessly stacked on top of existing detectors without architectural changes, pro- viding flexibility. Compared with complex model-basee approaches, our method introduces only negligible 2x2 parameterization, making computational delay negligible and less prone to over- fitting. Extensive experiments demonstrate our method's enhanced effectiveness. Our contributions can be summarized as follows:
We view existing metric-based detection methods through unified lens, which facilitates precise comparison and enables potential improvements.
We theoretically and empirically demonstrate that token-level detection scores exhibit neighbor similarity and initial instability, offering avenues for improved detection.
We propose a Markoy-informed score calibration method and, via a mean-field approximation, implement it a lightweight component that can be seamlessly integrated into existing detectors to further unlock their potential.
We conduct extensive experiments across three datasets to demonstrate superior performance in diverse scenarios, including cross-I.LM, cross-domain, mixed-text, and paraphrase attacks.
2

---

Published as a conference paper at ICLR 2026
Table 1: Comparing existing metric-based methods from a unified view. Here, 8 is the text to be detected containing N tokens, s' is the perturbed text generated by DetectGPT. á and are the regenerated texts of Fast- Dest-DetectGPT and DNA-GPT, respectively. Function yu() and o-)) represent the mean and standard deviation of the given set, respectively.
Method
Token-level Score
Aggregation
Detection
Log-likelibood
logp(si(Rer)
Ex log pinlace)
Log-Rank
Zoinn pankipssssed
anore
Eatrogy
Maz ple logplelacd
p(ofact) log plolee)s)))
abore
DetecGGPT
(s, f2 (6)
pladee))
(Caet Ei PtC. <il)))
apore
Fast DeteciGPT
(1. Aa]
pla(ace)
Mby Dill Meeeeelleeee collealllltt Yi Midu aduceille)
AD3rE: > C
DNA-GPT
(1,8 Ra)
E kapplelbree)) 4 - n-T Eie 19g (422-1)
2
A UNIFIED PERSPECTIVE ON METRIC-BASED DETECTION
Although model-based methods have shown competitive potential in specific domains, they are often too complex, leading tendency to overfit their training data. This limitation requires them to train or fine-tune for newly released LLMs, which hinders their generalizability. In contrast, metric- based methods extract discriminative features from MGT, and their model podell-ggostic nature provides superior generalization potential. Given the diverse implementations of representative metric-base based methods such Log- Likellhoodod (Solaiman et al., 2019). Log-Rant (Gehrmann et al.) 20119), En- tropy (Gehrmann et al. 2019), DetectGPT (Mitchell et al. 2023) Fast-DetectGPT (Bao et al. 2024), and DNA-GPT (Yang et al. 2024), we first provide systematic examination of them from uni- fied perspective. This facilitates a deeper understanding of their mechanisms and allows for a fair comparison of their strengths and weaknesses. As illustrated in Table we compare these methods across data, score aggregation, and detection dimensions. Note that their diverse core metric designs are not discussed here. This because we aim to design a general enhancement framework decou- pled from specific detectors, requiring us to start from possible commonalities rather than diverse designs.
Data. Log-likelihen likelihood, Log-Rank, and Entropy are computationally efficient as they rely solely on the original input text However, the detection eтror based on a single text may be large, because the randomness inherent the LLM sampling mechanism may cause the MGT to deviate from these methods' underlying assumptions, e.g., Log-Rank assumes that the generated tokens have high rankings. contrast, DetectGPT, Fast-DetectGPT, and DNA-GPT incorporate multiple perturbed (i.c., s') regenerated (i.c., 3 and 8) samples, which mitigates the errors caused by randomness. However, this comes at the cost of increased computational overhead compared to single-text-basee methods.
Score Aggregation. Although these methods appear to calculate scores differently, they all tend to directly aggregate token scores to obtain the final text score, typically through summation. As discussed, the randomness introduced by the LLM generation process may cause token-level scores to be biased. Therefore, the direct aggregation of these potentially imprecise token scores may result in an inaccurate final detection score.
Detection. These methods employ threshold-basee detection mechanisms, whose effectiveness relies heavily the accuracy of their calculated scores. Including uncalibrated, high-noise scores threshold-basee decision-makee may lead to poor performance.
In summary, to enhance detection, existing methods incorporate more textual information (e.g., re- generated texts in DetectGPT and Fast-DetectGPPT and use different score calculation strategies (e.g., the Likelihood difference between the detected and regenerated text in DNAGPT). However, as we discussed, they fail to address the underlying token-level errors caused by inherent random- ness, limiting their detection potential. Considering that detection scores are tied to tokens and the LLMs' generative mechanism induces dependencies among tokens, revealing and modeling the lationships between tokens may help correct score errors and thus improve detection effectiveness.
3

---

Published as a conference paper at ICLR 2026
Delly
ChosOLM
1.50
1.0
1.45
6:93
0.0
0.2
3.33
3.30
1.35
04
hap
position
position
(4) Log hoke-ihkohooo Score
(b) Log- Rank Score
(a) Log Likalihood Score
(b) Log-Rank Score
The detection score distances (Mean Absolute Difference) of neighbors different hops in the Essay dataset. Log-likelihood and Log-Raa Rank score are used.
Figure 2:
Figure 3: The detection score distances (Mean Absolute Difference) of 1-hop neighbors dif- ferent normalized relative positions in Essay. Log-likelihood and Log-Rank Rank score are used.
3 RELATION BETWEEN CONTEXTUAL TOKEN-LEVEL DETECTION SCORES
To understand the relationship between context tokens' detection scores, following existing work (Liu et al., 2023), we consider the token generation process of simplified model: single-layer transformer model with single-head attention:
T4+1 (a)), where a, = softmax (1/t x. W Wo X
Te 12 is the embedding of token 8t, and d denotes the embedding dimension. The ma- trix XL-1 ((t-1)xd is stacked by the embeddings :.,...;21-11 where the j-th row is zz- Wo. WK, Wy Rdddd and Wo E IRdxd are the attention weights. Following the attention block, an MLP block, denoted F Rixd Bixd is applied, and it is two-layer network with skip connections:
F(x)
W2 relu (Wiz).
As shown Table the detection score of token 8, is usually the function of 8, (i.e., vi), and a; related the attention scores a;-1 softmax (1/t- xz w.WoWW x,_,) in Eq. (1). The following theorem will reveal the relationship between attention scores, which in turn help us understand the relationship between detection scores of context tokens.
Theorem 1. Let λK, λq. Av ÀO be the largest singular values of parameters WK. Wo. Wv. Wo.
respectively, and let W WvWol WoWW K. For the transformer defined in Eq. [ assuming
normalized inputs (1|eel2 = 1 for all t) and constants c, > 0, consider a, 2 [I 6) || llz
2
with S (xatRdrro))
If xe satisfies WWa 2 cand x xeWr 2 e- maxxe(() 2, W xT, then
exp (C: 04,1 + 1))
0441,1 exp (C1 04 + 11) + Σj exp (C₃ Ot.j - 11)
exp (CI 0t,1 11)
01+1,11
exp (Cr -0.00.11111 + E j3زt exp (Cj 01. n)
where
C 2, Wxy
(1+ (++1) l012
and n
t 1arl2
The proof can be found in Appendix C This theorem establishes the upper and lower bounds for the attention score at step t + 1, which are determined by the attention scores at step f. In Transformer, the function mapping a; - log p(x++1) continuous, constraints on the dynamics of a, naturally propagate to the detection scores. Therefore, Theorem can reveal two relationships in token-level detection scores:
Neighbor Similarity, where the detection scores of adjacent tokens in sequence exhibit statis- tically lower variance compared to tokens that are far apart. This is because Theorem creates positive feedback loop analogous to simulated annealing (Kirkpatrick et al. 1983), where high scores at the current step lead to high scores at the next, and vice versa. That is, the attention (also token-level detection scores) cannot shift fast between steps.
4

---

Published as a conference paper at ICLR 2026
Initial Instability, where the detection scores of initial tokens in sequence statistically un- stable compared to the subsequent tokens (i.e.. fluctuate greatly). This is because these bounds are closely tied to the current step When is small (early position), 1) and C' are large, allowing for dramatic fluctuations in dz- That is, the attention score (also token-level detection scores) is unstable in the initial generation process.
Given that analyzing the dynamics of full-scale LLMs is mathematically intractable, we follow a practical setup Liu et al. (2023) and start with a simplified model, which provides theoretical motivation for the neighbor similarity and initial instability phenomena. We then empirically verify these two findings.
First, to empirically validate the neighbor similarity property, evaluated the distance (mean absolute difference) in detection scores across hops (i.e., TST N- ExES E [score(st)
score((t+*)) where S is the text set, and (sore(s)) is provided in Table 1j. As illustrated in Fig. 2 (more results can be found in Appendix [2.2). there is clear positive correlation between the de- tection score distance and the hop, and adjacent tokens have the highest detection score similarity; thereby providing empirical evidence for our theoretical finding.
Second, to validate the initial instability property, we analyzed the distance in detection score be- tween adjacent tokens different percentage positions (i.e., E.es |score(st) score(s(+1)D )- Fig. Biilusttrates that the score difference is substantially larger for tokens at the beginning of the text and progressively decreases, eventually stabilizing. More results can be found in Appendix F222 Considering our established finding on neighbor similarity (i.e., adjacent scores should be highly similar), a high detection score difference at the sequence beginning indicates a significant instabil- ity in detection scores of initial tokens.
4 MARKOV-INFORMED DETECTION SCORE CALIBRATION
Based on the revealed relationships, this section uses MRF to capture them (Section 4.1 and adopts the mean field approximation to model the MRF model as lightweight component stacked on existing detectors to calibrate detection scores (Section 4.2), thereby enhancing detection.
4.1 MARKOV RANDOM FIELD FOR MGT DETECTION
We capture these two types of relationships by modeling the joint probability distribution of text's token detection scores through pairwise Markov Random Fields (pMRF). Specifically, for each to- ken 8t in text s, assign binary random variable ys., where Ve, 0 and ys. 1 indicate human- or machine--eneeran
token | respectively, as measured by the detection score of the token. Let y, denote the label set for all tokens in text s. the pMRF over these tokens can be formalized as a Gibbs distribution: P(y.) = 7 exp( (ep(-Rp E(s, ys)), where
a normalizing constant and Fs(s, ys) the energy function. Our objective is to maximize the posterior probability of the token labels ys by minimizing the global energy function E(s, ya). The energy function typically consists of two components: the unary potential 1 and the pairwise potential Pp
Fi(s, ((8,8.)= = E.",, Ve (St, ) + E EngeNto)) Vp (ya,, Uny)
N
where (s{) denotes the adjacent tokens of token st, i.e., N(ss) = (st-1, 8141 (if existing).
Unary potential Y (St. Ve,) quantifies the cost of assigning label ys. to token st. We let Yy (st. =
log p(s)), where p(s:) is the output probability from the original detector. For detectors without probability output, it is measured by the 0-1 normalized score of token 8t.
Pairwise potential v (y,, yxy) models the similarity in detection scores between adjacent tokens. A penalty is applied if two adjacent tokens are assigned different labels; otherwise, a reward is given. This enforces label smoothness and captures the neighbor similarity property:
P (ya yo,)
(2 [g,., # yr,) 1),
Note that token labels are not absolute hut depend on the context in which they appear. For example, "the" be human token machine token depending the text.
5

---

Published as a conference paper at ICLR 2026
where I()) is the indicator function, and the reward and penalty factor 0. This implies an energy penalty of w when adjacent tokens have different labels; otherwise, the reward is - -w..
To model the initial instability property, we introduce positional weighting function ((t) in the binary potential. This function assigns lower weights to binary potentials at earlier positions, thereby mitigating the amplification of energy errors caused by unstable initial neighbor tokens. In this paper, we define the positional weighting function B(t) as a Sigmoid function to ensure a smooth transition of weights, and the revised binary potential is then given by:
Pp (Us,, Ve,) = 3(j) w. (2 [VV, * ys,) - -), with B(t) 1 exp(-(t- to))
(3)
where to is the weighted center, effectively suppressing the pairwise potential of tokens before tu-
4.2 MEAN FIELD APPROXIMATE MGT DETECTION
Given the MRF model, this subsection details how to model it as lightweight component stacked on the original detector through mean field approximation theory, thereby enhancing detection.
In the MRF posterior probability P(ys) ž exp(-E((s Ma)). the partition function Z Ey. exp(-E(ss, (s))))) which obtained by adding over all possible combinations of y/s For text with N tokens, there are 2 combinations, making exact computation of P(ys (s) infeasible. Inspired by existing work (Deng al., 2022), we employ mean-field theory for approximate infer- ence. Its core idea to use a simpler, factorized distribution Q (ys) I Qs, (ys,) to approx- imate the true joint distribution P(y.), achieved by minimizing the KL divergence between these two distributions:
P) =B [log Q (v.)) Eynn (log P (ys)]
(4)
E y., Q.. [lgg Qs, (Wa,)) )] Ry [F (s. Us)] + log Z.
t=1
The first equation the definition of KL divergence, and the second is obtained by subsituting P(y.) and (v..). Then, we define Lagrangian composed of all terms involving Qs, (ys,) in D(Q)) P):
Ls, (Q) = Q. (yx,) log Qs, (y=,) + Ey F (s, v.)] X
Qn (v,,) -1. (5)
Here, the term involving Lagrange multiplier À assures that Qs. is proper probability distribution. Now we take derivatives of Eq. (5) with respect to Qs, (3,,) and set the corresponding derivative to O, then we get the optimal Q ):
2n (v,,) = exp( ( Ms.) E Fy, Byy,,O Q., [ ysy)] )])
(6)
z
We can express the single token calculation in Eq. (6 as a matrix form of multiple token calcula- tions, which involves three steps:
Corresponding to the unary potential Yo (s,, Vo.) of token st being (os), we can express the unary potential of text s in matrix form - log H, where the i-th row of H corresponds to token 's prior probability and the two columns correspond to identity labels (HGT and MGT), that is, H = [1 p(*), p(s),, where p(s) = (p($)),..,p(5x))
Unary potential calculation.
Pairwise potential calculation. For the revised pairwise potential (i.e., Eq. (3)) we can define the weighted adjacency matrix as A where Açorr, = 3(L + 1) for all / = 0 O..., N - 2, A (t 1) for all f. = 1...., N - 1, and otherwise. Then the matrix form of the weighted pairwise potential AcorrQ w w
This update strategy enforces that all relationships receive
the same reward penalty. However, the influence of MGT neighbors and HGT neighbors is intuitively diffcrent, so this kind of reward and punishment mechanism with the same weight will limit the expressive ability of MRF To this end, we relax the weights for different relationships
-1
and get the pairwise potential as A Q(W mr C
-1
where Wmrf E R?X²
Normalization. The operator ferp(.) in Eq. d can be naturally modeled Softmax function.

---

Published as a conference paper at ICLR 2026
In summary, get the following update rule for tokens' detection scores:
log H A Q W Wmrs 3 [ +
Q softmax
shows that the computation of Q relies on Q itself: hence, iterative computation is required. Initializing the initial Q to H, we can get the iterative version as follows:
Notably, Eq.
[ 1 D)) where Q H. (8)
Q' = softmax log QagQQ'-1
A Q'1 mnr c
In addition using position weight function (tt in pairwise potential to reduce the impact of initial unstable scores, we also use this position weight function on the final calibrated scores Q² of 7 iterations reduce their im- pact on detection:
Algorithm 1 Markov-informen Enhancement Framework
1: Input: Text to be detected, the original detector fi
f2. iteration steps T', MRF weights W.
2: Construct A based on
3: Get each token s detection score from the detection score calculation module f1. and set Q" H.
4: for t= 0 to 7 do
Q final = (I.),... B(N)] Q" (9)
5: Update Q according Eq.
6: end for
The MRF-informed calibration compo- nent is then directly stacked on the orig- inal detector to calibrate the token de- tection scores. Specifically, tector is formalized as combination of the detection score calculation module fi and the de-
7: Calculate sinal according to Eq. 9
8: Return detection score final) of text s.
final)
the de-
tection module f2, i.e., f(s) = fi o f2()), the MRF-informed component of Eq. (9) is de- fined fmrf, then the enhanced detector is fenn. (s)
o f f2().. The complete in-
ference process is shown in Alg.
[ To learn weights W, we use supervised training: L EeEDirain (Y, fent (s) + (1 Y,,) log(1 (fenn(s))))
Computational Complexity. The MRF layer can be computed using searse-dense matrix multipli- cation. For text containing N tokens, the number of iterations is resulting computational complexity of ((T),, which is negligible for calculating the detection score. We will also empiri- cally verify the efficiency of our method in Appendix E.
EXPERIMENTS
Dataset. We conducted experiments on three widely used public datasets: Essay (Verma et al.)
2024), Reuters (Verma et al. 2024). DetectRL (Wu et al., 2024), and TruthfulQA (Lin et al. 2022) )) The Essay and Reuters datasets collect machine text generated by GPT4AII, ChatGPT, ChatGPT- turbo, ChatGLM, Dolly, and Claude. The TruthfulQA dataset collects machine text from GPT4, ChatGPT-turbo, ChatGLM, ChatGLLL Dolly, ChatGPT, and StableLM. The DetectRL dataset not only includes pure machine-generated text by Google-PaLMM ChatGPT, and Llama-2-70b, but its unique mixed, paraphrased, and cross-domain texts also allow us more comprehensively evaluate the model's performance in complex real-world scenarios. For a complete description of the datasets, please refer Appendix D.I
Baselines. We select the following metric-based methods for comparison and enhancement: Log- Likelihood (Likelihood) (Solaiman al., (2019), Log-Rank (Gehrmann et al. 2019), Entropy [Gehrmann et al.) 2019). DetectGPT (Mitchell et al. (023). Fast- DetectGtt (FastGPT) (Bao et al., 2024). DNA-GPT Yang al. 2024). Repreguard (Chen al. 2025). Lastde (Xu al. 2025). Fou (Xu et al. 2024), and Binoculars Hans et al. (2024). The versions equipped with the proposed method are defined with 'M' suffix, e.g., Liikelihodd-M. Furthermore, although we fo- on metric-based methods, also compare with model-based methods ChatGPT-D (Guo al. 2023) and MPU (Tian et al. 2024). Their details can be found Appendix D.2
Metrics. First, binary classification problem, we use the area under the receiver operating characteristic curve (AUROC). Second, following (Tufts et al. 20244] Fraser et al.) 2025: Hans et al. 2024). recognize the negative impact of misclassifying human text as machine- -ennerrte text. Therefore, another important evaluation metric is the true positive rate (TPR) at a low false positive rate (FPR). Specifically, we measure the TPR at FPR of 1%, denoting this TPR @ FPR-1 %.

---

Published as a conference paper at ICLR 2026
Table 2: Performance concerning AUROC (%) on Essay (left) and DetectRI. (right).
Methol
Essay (Triinig Text: GPT-Ab)
DetectRL (Trining Text Liama 700)
CPT4Ai
ChaiGPT
Daily
ChaGLL
Clasle
ChuciPEttul
Avg.
Lisms-2-7th
ChaIGPT
GooglePaL.M
Avg.
Likelhoodd
25.16gm.00 so
70 to
90. 20 as
99. 20 25
a0 2s
99. 13 19
96.17
78.58gm.4:
06 61 s0
71.42go.00
72:20
Likllboodd-
98.88
90.47
94.59
99.54.0
948229
90.72g0
97.79
67.01gg
70.00
g1.20
80.54
Log Bank
95.50eb.3t
90
99.36.a013
02,01
09.24.0.15
96.03
79.67
70.06g0.40
72.06
98.57 ce
20.
938220
9291
9964.0.11
20.30
75.32
84.3g
Europy
74.19
89.49 30.49
78l 2..45
84 84.11.10.77
86.58 aa.as
90.9440.15
83.93
066.21 0..s
63.00 11:00:000
60.73...pp
63:34
Eatrepy-A M
83.8244.99
93.28.0.15
91.44
87. 0..96
96.75
89.01
69,97
65 65.26
65.82
67.02
DeteoGPTT
41.54:0..00
43.19
48.60
DelectGPT-M
95.37
2..2
95.97.0.0
10.24
28.9200.1 rs
78,81 ex
64.15
25 18
FasiGPP
64.68
67.08
47 1...
71.08
75.31
8862 $0.07
69.08
67.72 oz
58.50g
56.68
60.97
PPM
87.22
82.6 91.56
98.36.0.4
50 20
63 13.1881
79.92
66. 66.55_3.94
55. 19
23.30
61.68
DNA-GPT
98.06
26.50.40
98 0o..00g..11
80.0240
71.91
64.14go
67.322g..00
DNA-GPTM
99.88 o7
98.8820.8
97.0420.09
29.2620.00
94.7320.34
98.85 g0.00
98.07
74.39 oz
64.36.1.om
70.50 70.50_.1.00
69.75
1.44
wrttip mwy
8:59
3:28
12:13
camm wnthing eetr
6.33
Train Domain
4:44
6.r
4:44
5:18
422
223
TPR
2.07
9-12
22
AUROC
75
21.32
25
1:13
338
11.44
10:30
9.44
22.07
W
Test Domaln
Test Domain
Test Domain
Test Domain
Likelihood
Log-Rank
Figure 4: The performance improvement of the proposed method on Likelihood and Log-Rank. Values greater than O indicate an enhanced effect.
5.1 PERFORMANCE COMPARISON
In this section, we evaluate the enhancement effectiveness of the proposed method in various real- world scenarios, including cross-LLM, cross-domain, detecting mixed machine text, and resisting paraphrase attacks. Details of these scenarios are provided in Appendix D.3
Performance across Different LLMs Table 2 reports AUROC for detectors trained on GPT4AIl (Essay) and Llama-2-70b (DetectRL) and evaluated on texts from various LLMs. TPR @FP- % results are provided in Table 3 in the Appendix. Besides, results of detectors trained on other L.MM texts and on the Reuters dataset appear in 4 the Appendix. The proposed method yields significant gains for nearly all baselines. For example, on Essay, it raises Likelihood from 52.4% to 77. 77.86% (+25.40 +6)). Encouragingly, our method also benefits weak detectors: DetectGPT signif- icantly improves from 0.15% to 37.18% (+37.03%) suggesting that the assumptions underlying its scoring are reasonable and that underperformance mainly stemmed from score estimation error. Fi- nally, detection performance texts from the same LLM is not always superior to cross cross-LLM. For example, on Essay, performance on ChatGLM is particularly strong and even exceeds the intra-LLM case of GPT4AII, possibly because ChatGLMM texts are more discriminative.
Performance across Different Domains. We evaluate cross-domain performance in four high-risk domains: arXiv, Writing Prompts, XSum, and Yelp Reviews. Results are summarized in Fig. 4 ad- ditional enhanced results for more detectors under cross-domain settings are provided in Fig. 21 and
Fig. 22 of the Appendix. In most settings, detectors equipped with our strategy show substantially stronger cross-domain generalization. We attribute this to calibrating the detection score with only few carefully designed parameters (a 2x2 reward- reward-penalty coefficient matrix), which helps prevent overfitting and thereby improves oft-o--d detection.
Performance against Mixed Texts. In practice, human-Al collaboration is pervasive, leading to widespread mixed human- text. We therefore evaluate the proposed strategy for mixed-text detection. Two training strategies are considered: training on the original text and training on the mixed text. Results concerning AUROC are shown in Fig. 5 with TPR @ FPR-1% shown in Fig. 23 of the Appendix. In most settings, the proposed strategy enhances the detector's 's ability to recogmize mixed-text. Moreover, comparing training original versus mixed text shows that simply training on mixed text does not improve the detection ability of mixed text, highlighting the focus of mixed text detection research.
8

---

Published as a conference paper at ICLR 2026
Likelhaod Likelhood
Log-Rark Log Rank M
Entrogy Entro my
DetectGPT
FastePT
DNA GPT-M
3.80
2.78
0.00
AUROC
AUROC
3.54
9.60
0.50
mm
Test text: Liama-2-70b
Test text: ChatGPT
Test text: Google-PaLM
Figure 5: Detection performance concerning AUROC under different L.M mixed texts. All detec- tors are trained on Llama-2-77 2-70b texts.
Likelhood
Log-Rank
Entrosy
DetectGPT DetectGPP
FastEPP FastSPT
DNA GPT
Likelhood
GPT
AUROC
AUROC
0.12
3.64
text: Llama-2-70b
Test text: ChatGPT
Test text: Google-PaLM
Figure 6: Detection performance concerning AUROC under different paraphrasing texts (Dipper and Polish). All detectors are trained on Llama-2-700 texts.
Performance against Paraphrasing Attacks, Prior work (Sadasivan et al. 2023) shows that MGT detection is typically vulnerable to paraphrasing attacks, where an adversary rewrites passage without altering its semanties evade detection. We therefore assess the robustness gains of our framework on the Dipper and Polish paraphrase attacks provided by DetectRL. The results in Fig. 6 and Fig. [4 clearly indicate that, even in adversarial settings, our strategy yields encouraging improvements in robustness against paraphrasing attacks.
5.2 ABLATION STUDY
We introduce an MRF layer and positional weighting function to model neighbor similarity and initial instability, respectively. In this section, verify their effectiveness through ablation studies, denoted as "w/o MRF" and "w/o Pos". Results on the Essay dataset are shown in Fig. 7 with addi- tional results in Fig. [5] and Fig. of the Appendix. We can find that removing either component significantly drops performance, while retaining only one still outperforms the baseline detector, un- derscoring their designs' rationality. Besides, the contribution of each component varies by detector type. For single-text detectors like Likelihood and Log-Rank, the positional weighting function pro- vides the most improvement by addressing instability initial scores. However, for methods that aggregate multiple text scores, such as DetectGPT and FastGPT, this instability is already partially mitigated, making the MRF-based score calibration the primary source of gains.
5.3 MRF VS. NEURAL NETWORK
This paper proposes Markov-informed calibration method to model the relationship of detection scores of context tokens. To highlight the rationale of this design, we compare it with methods that directly use neural networks to calibrate scores. A simple three-layer neural network is used here, defined with the "nn" suffix. The comparison results on Likelihood are shown in Fig. g and more results can found in Fig. 3i and Fig. 32 of the Appendix. Although NN-based methods exhibit competitive performance in
settings for intra- LLMs, their generalization ability cross-LLMs drops significantly. This suggests that it does not truly learn the general ability to correct scores, but rather overfits the training data. In contrast, strategy shows good generalization.

---

Published as a conference paper at ICLR 2026
Drigin
ChurdPt
OPT44
AUROC
Owril
Statle
02. 15.0 94.4
25.2
25.0
922
72.8
35.0
54.4
95.2
72
10
54
50
92
50
45
97
90
Likelihood
Log-Rand
Entropy
DetectGPT
FastGPT
DNA-GPT
Figure 7: Ablation results the Essay dataset. The y-axis represents the LLM text on which the detector was trained, and the x-axis represents the average performance across LLMs.
93
TPR TPRR PR PR-1%%
20
84
TPR.8 130
AUROC
AUROC
76
50
60
GRAS-LLM
IMM
CRAA-LLM
CRSSSLLM
Essay Dataset
DetectRL Dataset
Figure 8: Comparison with NN-based calibration methods. The detector used is Likelihood.
CONCLUSION
This paper has systematically examined representative metric-based detectors within a unified framework, revealing core challenge: the inherent randomness of the LLM generation process leads to inaccurate detection scores, and naive aggregation of existing methods fails to fix this. Therefore, have theoretically and empirically established key properties of these scores: neighbor similarity and initial instability. Building on these insights, we have proposed a Markov- informed score calibration method that captures token relationships and corrects the biased scores produced by base detectors. Extensive experiments show substantial and consistent performance gains of the proposed method. Admittedly, the proposed method relies modeling the relation- ships between context tokens to calibrate detection scores. Consequently, our method is not directly applicable detection methods that do not provide this fine-grained token-level output.
ACKNOWLEDGMENT
This work was supported by the RGC Senior Research Fellow Scheme under the grant: SRFS2324- 2S02, RGC Young Collaborative Research Grant No. C2005-24Y, and HKBU CSD Departmental Incentive Scheme.
ETHICS STATEMENT
This paper proposes Markov-informed calibration strategy to enhance machine-generrin text de- tection and mitigate the potential risks posed by sechiine-genertted text, including disinformation and phishing. Our work does not involve ethical issues such dataset releases, potentially harm- ful insights, potential conflicts of interest and sponsorship, discrininaation/aassfaaaeee concerns, privacy and security issues, legal compliance, and research integrity issues.
REPRODUCIBILITY STATEMENT
Our code is available at whtpttt::/// /ttt:::///gihubb www.coommm..... group/MRE Catiaaaaaabarioo and all datasets used in our experiments (Essay, Reuters, and DetectRL) are publicly available for download. In addition, provide detailed implementation details in the Appendix, including data partitioning, the fixed seeds, the learning rate, the training batch size, and the two parameters to and introduced by the proposed strategy, ensure reproducibility of our work.
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Iige Akkaya, Florencia Leoni Ale- man, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, al. Gpt-4 technical report. arXiv preprint arXiv:2303 08774, 2023.
Guangsheng Bao, Yanbin Zhao, Zhiyang Teng, Linyi Yang, and Yue Zhang. Fast-detectgpt: Efficient zero-shot detection of sechine-generated text via conditional probability curvature. In ICLR, 2024.
Xin Chen, Junchao Wu, Shu Yang, Runzhe Zhan, Zeyu Wu, Ziyang Luo, Di Wang, Min Yang, Lidia S Chao, and Derek F Wong. Repreguard: Detecting llm-generated text by revealing hidden representation patterns. arXiv preprint arXiv:2508. 12255008831222 13152, 2025.
Leyan Deng, Chenwang Wu, Defu Lian, Yongji Wu, and Enhong Chen. Markov-driven graph convolutional networks for social spammer detection. JEEE Transactions on Knowledge and 1000011111-22222 2022.
Data Engineering,
Kathleen C Fraser, Hillary Dawkins, and Svetlana Kiritchenko. Detecting ai- gi-genrrtted text: Factors influencing detectability with current methods. Journal of Artificial Intelligence Research, 82: 2233-2278, 2025.
Sebastian Gehrmann, Hendrik Strobelt, and Alexander M Rush. Gitr: Statistical detection and visualization of generated text. arXiv preprint arXiv:1906.00043,, 2019.
GPTZero. Gptzero official website. [Online], 2023. https://gptzero:
Chenchen Gu, Xiang Lisa Li, Perey Liang, and Tatsunori Hashimoto. On the learnability of water- marks for language models. arXiv preprint arXiv:2312.04469, 2023.
Biyang Guo, Xin Zhang, Ziyuan Wang, Minqi Jiang, Jinran Nie, Yuxuan Ding, Jianwei Yue, and Yu- peng Wu. How close chatgpt to human experts? comparison corpus, evaluation, and detection. arXiv preprint arXiv:2301.07556 2023.
Abhimanyu Hans, Avi Schwarzschild, Valeriia Cherepanova, Hamid Kazemi, Aniruddha Saha, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Spotting lims with binoculars: Zero- shot detection of machine-generated text. In International Conference on Machine Learning. pp. 77519-17537 PMLR, 2024.
Jason Hong. The state phishing attacks. Communications of the ACM, 55(1):74-81, 2012.
Abe Hou, Jingyu Zhang. Tianxing He, Yichen Wang, Yung-Sung Chuang. Hongwei Wang, Lingfeng Shen, Benjamin Van Durme, Daniel Khashabi, and Yulia Tsvetkov. Semstamp: A semantic water- mark with paraphrastic robustness for text generation. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguisties: Human Language Technologies (Volume 1: Long Papers), pp. 4067-4082, 2024.
Xiaomeng Hu, Pin- Yu Chen, and Tsung- Yi Ho. Radar: Robust ai-text detection via adversarial learning. Advances in neural information processing systems, 36: 56:15577-55095, 2023.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pp- 17061-17084. PMLR, 2023.
Scott Kirkpatrick, C Daniel Gelatt Jr, and Mario P Vecchi. Optimization by simulated annealing. science, 220(4598):671-680, 1983.
Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit lyyer. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. Advances in Neural Information Processing Systems, 36:27469-27500, 2023.
Linyang Li, Pengyu Wang, Ke Ren, Tianxiang Sun, and Xipeng Qiu. Origin tracing and detecting of Ums. arXiv preprint 2.XXi:2304..4077 2023.

---

Published as a conference paper at ICLR 2026
Stephanie Lin, Jacob Hilton, and Owain Evans. Truthfulqa: Measuring how models mimic human falsehoods. In Proceedings of the 60th annual meeting of the association for computational linguisties (volume 1: long papers), pp. 3214-3252, 2022.
Xiaoming Liu, Zhaohan Zhang. Yichen Wang, Hang Pu, Yu Lan, and Chao Shen. Coco: Coherence- enhanced machine- gegerrttd text detection under data limitation with contrastive learning. arXiv preprint arXiv:2212.10341 2022.
Yepeng Liu and Yuheng Bu. Adaptive text watermark for large language models. In Forty-first International Conference on Machine Learning.
Zichang Liu, Aditya Desai, Fangshuo Liao, Weitao Wang, Victor Xie, Zhaozhuo Xu, Anastasios Kyrillidis, and Anshumali Shrivastava. Scissorhands: Exploiting the persistence of importance hypothesis for I1m kv cache compression at test time. Advances in Neural Information Processing Systems, 36:52342-52364, 2023.
Shixuan Ma and Quan Wang. Zero-shot detection of IIm-generated text using token cohesiveness. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing,
pp. 17538-17553, 2024.
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. De- tectgpt: Zero-shot machine-generated text detection using probability curvature. In International Conference on Machine Learning, pp. 14950-24962 PMLR, 2023.
Hoang-Quoc Nguyen-Son, Minh-Son Dao, and Koji Zettsu. Simllm: Detecting sentences gener- ated by large language models using similarity between the generation and its re-generation. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp- 22340-22352 2024.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, llya Sutskever, et al. Language models are unsupervised multitask learners. OpenAl blog, 1(8):9, 2019.
Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? arXiv preprint arXiv:2303.//1550 2023.
Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert-Voor Jeff Wu, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, et al. Release strategies and the social impacts of language models. arXiv preprint arXiv: 1908. 09203, 2019.
Jinyan Su, Terry Yue Zhuo, Di Wang, and Preslav Nakov. Detectlim: Leveraging log rank infor- mation for zero-shot detection of machine-generated text. In The 2023 Conference on Empirical Methods in Natural Language Processing.
Yuchuan Tian, Hanting Chen, Xutao Wang. Zheyuan Bai, QINGHUA ZHANG, Ruifeng Li, Chao Xu, and Yunhe Wang. Multiscale positive-unlabeles detection of ai-generated texts. In The Twelfth International Conference on Learning Representations, 2024.
Brian Tufts, Xuandong Zhao, and Lei Li. An examination of ai-generated text detectors across multiple domains and models. In Neurips Safe Generative Al Workshop 2024, 2024.
Eduard Tulchinskii, Kristian Kuznetsov, Laida Kushnareva, Daniil Cherniavskii, Sergey Nikolenko, Evgeny Burnaev, Serguei Barannikov, and Irina Piontkovskaya. Intrinsic dimension estimation for robust detection of ai-generated texts. Advances in Neural Information Processing Systems, 36, 2024.
Vivek Verma, Eve Fleisig, Nicholas Tomlin, and Dan Klein. Ghostbuster: Detecting text ghostwrit- ten by large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Vol- ume 1: Long Papers), pp. 1702-1717, 2024.
Ivan Vykopal, Matúš Pikuliak, Ivan Srba, Robert Moro, Dominik Macko, and Mária Bieliková. Disinformation capabilities of large language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 14830-14847,
2024.
12

---

Published as a conference paper at ICLR 2026
Pengyu Wang, Linyang Li, Ke Ren, Botian Jiang, Dong Zhang, and Xipeng Qiu. Seqxgpt: Sentence- level ai generated text detection. In The 2023 Conference on Empirical Methods in Natural Lan- guage Processing, 2023.
Junchao Wu, Runzhe Zhan, Derek Wong, Shu Yang, Xinyi Yang, Yulin Yuan, and Lidia Chao. Detectrl: Benchmarking llm-generated text detection in real-world scenarios. Advances in Neural Information Processing Systems, 17:100369-100400 2024.
Junxi Wu, Jinpeng Wang, Zheng Liu, Bin Chen, Dongjian Hu, Hao Wu, and Shu-Tao Xia. Moses: Uncertainty-awan ai-generated text detection via mixture of stylistics experts with conditional thresholds. Pruceedings of the 2025 Conference on Empirical Methods Natural Language Processing, pp. 5797-5816, 2025.
Kangxi Wu, Liang Pang, Huawei Shen, Xueqi Cheng, and Tat-Seng Chua. LImdet: A large language models detection tool. CoRR, 2023a.
Yihan Wu, Zhengmian Hu, Hongyang Zhang, and Heng Huang. Dipmark: A stealthy, efficient and resilient watermark for large language models. 2023b.
Yang Xu, Yu Wang. Hao An, Zhichen Liu, and Yongyuan Li. Detecting subtle differences between human and model languages using spectrum of relative likelihood. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp. 10101, 2024.
Yihuai Xu, Yongwei Wang, Yifei Bi, Huangsen Cao, Zhouhan Lin, Yu Zhao, and Fei Wu. Training- free IIm-generated text detection by mining token probability sequences. In The Thirteenth Inter- national Conference on Learning Representations, 2025.
Xianjun Yang, Kexun Zhang, Haifeng Chen, Linda Petzold, William Yang Wang, and Wei Cheng. sero-shot detection of machine-generated codes, arXiv preprint urXiv:2310.055 1030 2023.
Xianjun Yang, Wei Cheng, Yue Wu, Linda Ruth Petzold, William Yang Wang, and Haifeng Chen. Ona- Divergent n-gram analysis for training- free detection of apt-generated text. In The Twelfth International Conference on Learning Representations, 2024.
KiYoon Yoo, Wonhyuk Ahn, and Nojun Kwak. Advancing beyond identification: Multi-bit water- mark for large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Vol- ume 1: Long Papers). pp. 4031-4055, 2024.
Xiao Yu, Yuang Qi, Kejiang Chen, Guoqiang Chen, Xi Yang, Pengyuan Zhu, Weiming Zhang, and Nenghai Yu. Gpt paternity test: Gpt generated text detection with gpt genetic inheritance. CoRR, 2023a.
Xiao Yu, Kejiang Chen, Qi Yang, Weiming Zhang, and Nenghai Yu. Text fluoroscopy: Detecting Ilm-generated text through intrinsic features. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp. 15838-15846, 2024.
Zhiyuan Yu, Yuhao Wu, Ning Zhang, Chenguang Wang, Yevgeniy Vorobeychik, and Chaowei Xiao. Codeipprompt: intellectual property infringement assessment of code language models. In Inter- national conference machine learning, pp. 40373-40389, PMLR, 2023b.
Haolan Zhan, Xuanli He, Qiongkai Xu, Yuxiang Wu, and Pontus Stenetorp. G3detector: General gpt-generated text detector. xiviv preprint arXiv:2305. 2023.
Ruisi Zhang, Shehzeen Samarah Hussain, Paarth Neekhara, and Farinaz Koushanfar. (REMARK- LLM): A robust and efficient watermarking framework for generative large language models. In 33rd USENIX Security Symposium (USENIX Security 24), pp. 1813-1830, 2024.
13

---

Published as a conference paper at ICLR 2026
APPENDIX
More Discussion of the Proposed Method
15
A.1 Contribution
15
A.2 Differences from Existing Methods
15
Related Work
15
B.
Watermark- Detection
16
B 2
Model-based Detection
16
B 3 Metric-based Delection
16
Proof of Theorem
17
D Experimental Details
19
D.I Datasets
19
D.2 Baselines
19
D.3
Experimental Scenario
20
D.4
Threat Model and Proxy Settings
20
D.5
Parameter settings
More Experimental Resuls
21
More Results of Token Score Distribution before and after Enhancement
21
E,2
More Results of Context Token Relationships
22
More Performance Comparison
22
E,4
More Performance Comparison the QA Dataset
23
More Performance Comparison on Short-text
23
E,6
Enhancement Experiments More Detectors
................................
23
7
Performance Comparison against Perturbation Texts
................................
24
E.8
More Results of Ablation Study
24
Sensitivity Analysis
24
E.
10
More Results Comparing with Neural Network Calibration
25
MRF vs. HMM
25
E.
12
Comparison with Enhanced Method
26
13 Analysis of Cross-domaie Failure Cases
26
14
Comparison with Model-based Detectors
27
15
Running Time
27
The Use of Large Language Models
27
14

---

Published as a conference paper at ICLR 2026
A
MORE DISCUSSION OF THE PROPOSED METHOD
A.1 CONTRIBUTION
The contributions of this paper are multifaceted.
We provide a unified perspective for understanding metric-based detection methods. The diversity of these methods (e-g., using metries based log-likelihood log-rank, and introduc- ing perturbed or regenerated text) makes comparison difficult. To this end, we re-examine these methods from three perspectives: data, score calculation, and detection. This analysis provides a precise definition for each method, facilitating comparison and potential improvements. Our analysis shows that these methods employ more reasonable evaluation metrics and incorporate additional contextual information to enhance detection. However, they all fail to address the un- derlying token-level errors caused by inherent randomness, which limits their detection potential. Therefore, our unified analysis encourages more nuanced characterization of token-level detec- tion scores, which will provide guidance for future improvements.
We reveal the relationships between contextual token detection scores. While the generative mechanisms of LLMs introduce dependencies between tokens, these relationships remain unclear. To this end, we theoretically reveal two relationships between contextual token scores: neighbor- ing similarity and initial instability, which are further validated through empirical experiments. Constraining these relationships during detection has the potential to mitigate the imprecision in score calculation caused by the inherent randomness of MGTs, which is crucial for the field of MGT detection.
We propose Markov-informed score calibration method to enhance MGT detection. This involves using Markov random fields to capture the revealed relationships and, through mean- field approximation, modeling the MRF model lightweight component that can be stacked on existing detectors to further unlock detection potential. It is worth noting that our main technical contribution and innovation lies not only in the specific implementation but also in the conceptual token-level score calibration. While the current implementation is based on Markov random fields, this is only one possible approach; alternatives include using sequence models or graph neural networks. This conceptual insight can inspire improving MGT detection.
Extensive experiments consistently demonstrate the enhanced effectiveness of the proposed strategy. We empirically verify that it not only excels on a single task but also demonstrates strong capabilities in multiple complex and challenging real-world scenarios, including generalization across LLMS and domains, and robustness to mixed text and paraphrased text. Furthermore, the proposed enhancement component incurs negligible computational overhead compared the original detector. This combination of effectiveness and efficiency provides solid foundation for developing practically deployable enhancement solutions for Al-generated text detection.
A.2 DIFFERENCES FROM EXISTING METHODS
Although some works, such as FourierGPT Xu et al. (2024) and Lastde Xu et al. (2025). also learn local patterns, approach is quite different:
Methodology. Unlike FourierGPT or Lastde, which propose standalone metrics, method is a universal plug-in. We do not replace the metric; we calibrate the intermediate token-level scores of any existing metric (Likelihood, DetectGPT, etc.) using Markov Random Field.
Theory vs. Empiricism. While many existing local-pattern methods are empirically motivated (e.g.. observing spectral power differences and token probability fluctuation). our approach is grounded in the theoretical derivation of attention dynamics (Theorem 1), which formally reveals the Neighbor Similarity and Initial Instability properties we model.
B RELATED WORK
Existing detection methods can categorized into active watermark based methods and passive model-based and metric-based methods.
15

---

Published as a conference paper at ICLR 2026
B.1 WATERMARK- DETECTION
Watermarking is a proactive defense technique that embeds verifiable information during the text generation stage, thereby enabling simple and reliable detection. RedList (Kirchenbauer al. 2023) is a model-agnostic watermarking method that dynamically partitions the vocabulary into a grren- list" and "redlist" based on preceding context, slightly increasing the probability of sampling tokens from the greenlist. Subsequent works have made various improvements to this approach. For in- stance, SemStamp (Hou et al., 2024) introduces a sentence-level semantic hashing watermark to enhance robustness against paraphrasing attacks; DiPmark (Wu et al.) (023b) designs an unbiased watermark that does not alter the original output distribution. REMARK-LLM (Zhang et al. 2024) is training-based watermarking method that employs a message encoding module to generate an encrypted token distribution for watermark embedding prior to inference. Beyond manually de- signed watermarks, directly leveraging language models to learn to generate watermarked text is also promising, including training student models (Gu et al., 2023) and semantically invariant wa- termarking models (Liu & Buj. In addition the standard binary (0/1 bit) detection of Al-generated content, researchers have also explored multi-bit watermarks (Yoo et al. 2024) for embedding more information.
B.2 BASEL DETECTION
Model-based methods represent classical paradigm in detection, training binary classifier dataset containing both human- and machine- generated texts. series of works, such as OpenAI Detector (Solaiman al.) 2019), ChatGPT Detector (Guo et al. (023). GPTZero (Gi'TZero 2023), and G3 Detector (Zhan et al. 2023), collect texts generated by various LLMS to train a unified clas- sifier. GPT-Pat (Yu et al. 2023a) finds that detectors trained solely a single decoding strategy generalize poorly and enhances performance by utilizing mixed decoding strategies. In addition to original data, GLTR (Gehrmann et al., 2019) trains a simple logistic regression classifier by ana- lyzing the predicted ranking of each word within its context. SeqXGPT (Wang et al. (023) treats the sequence of logits as waveform signals for detection, while Sniffer (Li et al. (023) uses the difference in logits from different models on the same text as features for detection and attribution. Beyond the data level, recent works have explored more advanced training strategies. For example,
machine-generatee
CoCo (Liu et al., 2022) introduces graph structures and contrastive learning; LLMDet (Wu et al.) 2023ah leverages the perplexity of surrogate models as additional features; MPU (Tian et al.) (024) adopts uesabiee-unlabeled learning paradigm; and RADAR (Hu et al. 2023) incorporates adversar- ial training to enhance model robustness. The above methods generally assume a known text source, but when it is unknown, Ghostbuster (Verma al. 2024) proposes training classifiers directly using texts generated from known surrogate models.
B.3 METRIC-BASED DETECTION
Metric-based methods do not require training on specific datasets; instead, they directly leverage the inherent statistical biases or intrinsic properties of language model-generated text for distinction. The main advantage of such methods lies in their stronger generalization to new models and do- mains. Classic approaches in this category include the use of Log- Likelihood (Solaiman et al. 2019). Log-Rank (Mitchell et al., 2023), and Entropy (Gehrmann et al., 2019). DetectGPT (Mitchell et al., 2023) finds that Al-generated text typically lies in regions of negative curvature with respect the model's log-probability function. By perturbing the text and observing changes in log-probability, it can effectively distinguish Al-generated text. Inspired by DetectGPT, Fast-DetectGPT (Bao al.) 2024) replaces log-probability with conditional probability curvature, significantly improving de- tection efficiency while maintaining performance. LeRR (Su al.) proposes using the ratio of log-liielihood to log-rank for detection. Some works, such as DNA-GPT (Yang et al., (024) and DetectGPT4Code (Yang al., 2023), detect Al-generated text by comparing discrepancies be- tween the original text and continuations generated by surrogate model. PHD (Tulchinskii et al.) 2024) observes that genuine human-written text possesses higher intrinsic dimensionality after en- coder mapping. SimLLM (Nguyen-Son et al. 2024) is based on the observation that the similarity between the original text and its generated continuation is significantly higher than that between generated text and its re- re-generated version; thus, it estimates the similarity between input sen- tence and its generated counterpart for detection. Given that existing methods struggle with out-of- distribution data, token coherence (Ma & Wang 2024 has been shown to be reliable metric since
16

---

Published as a conference paper at ICLR 2026
LLM- generated text usually exhibits higher token coherence than human human-writtee written text. Yu al. Yu et al. 2024) capture the intrinsic features of text by identifying layers with the greatest distributional differences when projecting into the vocabulary space, and using intrinsic rather than semantic fea-
tures for detection has been demonstrated to yield hetter results. RepreGuard (Chen et al. 2025)
extracted unique activation features from the MGT using a surrogate model, and then the projection scores along the direction of these features are more discriminative. Lastde (Xu et al., 2025) in- troduced time series analysis to -Ln-ggnerated text detection, capturing the temporal dynamics of token probability sequences. FourierGPT (Xu et al., 2024) offered a new perspective on human and model text detection tasks by using relative rather than absolute probability values and by extracting useful features from the probability spectrum. MoSEs (Wu et al. (2255) achieved the quantification of uncertainty style perception through conditional threshold estimation.
C PROOF OF THEOREM 1
Theorem. Let XR, λq. Av λo be the largest singular values of parameters WK, Wo. Wy. Wo,
respectively, and let W Wv WrWoooWW For the transformer defined in Eq. (7 assuming
normalized inputs (1<tel2 1 for all 1) and constants C,e 0, consider a 1 2 [1 8) |aell2
with ò S (XQdiAudo))
If xx satisfies xe W cand xe E maxxje(4)+* 2 W x then
exp (Ci ac,1 + 1))
0.11111 S
exp (Ct 04 + 1) Σラッı exp (Cj .r. 11)
exp (CI 01,1 11)
01+1,1 2
exp (Cr 04.1 + Ent exp (Cj .r. + n)
where
2, Wa
(1 Way
C =
and r
t tl
+ 1) l0el
Proof. Our proof follows the proof of existing work (Liu et al. necessary lemmas to help our proof.
2023). First, we introduce two
Lemma (iLiu et al. 2. Let 21,22 22 Rlxm satisfies || ll2 ||x21l2 and zaoe 2 1
for some 8 E (0, 1). Then for y Ixlm we have
b1y - x24 S 20
Lemma 3 (Liu et al. j * E. Then we have
2023)). Let E [1] be given. Suppose that I Ax, > - Ax for all
(S(t), c) xT axe S WTT S (S(t)e + +) aæt
Based on these two lemmas, we can formally prove the theorem. Let æ
and T2 Te4
T 2 1 8, using the conclusion of Lemma 2 have
at (t+1) a
WOW
1 t Jet1 WoW
22 W
Wo
t+1
Since dg. dx are the maximum singular values, respectively. Then we have Aạdx ||æella = AQdK. This leads to:
|W 11 -
1 t ze+ WoW
V28 t+1 AQdx
WOWT
<
(10)
(t+1) 1) J0el2
Since
||ael|2 =
Σ
WrWo
$ Aody
Σ atj
$ <oovv Σ
a,j ||ا = Aodv,
j=1
1=1
1=1
17

---

Published as a conference paper at ICLR 2026
and the theorem assumes ò v (AadrArdo) )²
substituting these into Eq.
10
obtain:
25 + AQAK I
V2ce
V20c S (t + 1) ||all22
22c
+ 1)Avio S (t + 1) arll2
(11)
The last inequality is obtained from Ttaxt 2 Then combining Formula 10 we have
and Formula 11
WoWW 1
V2E
Te W (1+ 1) an ll
raax
(1 + 1) 1rl12
1+1 1+1
From Lemma 3 we have:
a, a.WoWk K o. (++ 1) ||
I are
(t (t+ 1|
(++1))
By the triangle inequality, we can combine the upper bounds:
Te+1 WoWWWWk W aF
W
xee WOWF
a WoWo
-
t ++1 (t + 11+1llleel2
t+1
(t + 1) |1el22
ac a. W K
Or W
+
(12)
(t + 1) ||ael1
(t + ||eell2
(1 v2)
+ ||a 11
Then, we rearrange the incquality, and we can obtain:
ZeWaz (1+ 1) laell2 (a+
(1+ v2)e) s - Tt WoW
(1+ laell2 (ar + (1+ v2c)
Now we give the lower and upper bounds of a441. = softmax(1/CC + 1) F WoW K xXT); )--
Upper bound. Let 7.tLe = 1/(t + 1) Ir+1 For the softmax function exp(Xit1e))
ac+1, exp((x+1,))+ ++ E exp(re=1,
get the maximum value of a1118 make the numerator big possible, which means 74,, should take its maximum value z,Wa] (++1)]]oe] (or,e + (1+ 22)), (2) make the denominator small as possible, which means that v1
need (1)
w. (at, (1 + v2)e). There- all other values 741.6 (when k + f) should be minimized (++1)]laell fore,
TT [++1]|
(ar,e + (1 V2)c)
0t-1,11 S a:Wa2 (++1)]lad, (ar,e + (1 V2)c) + Expe 24 W
(at, (1 + V2)c)
(1+1)|lael,
Lower bound. Similarly, for the lower bound, we should (1) make the numerator as small as maWa, possible, which means 7 should take its minimum value [++1]]|a=T (ar, (1 + v2)e). , (2) make the denominator as large as possible, which means that all other values 7t41 (when + 0
should maximized T.W (ar,6 (1 22))). Therefore.
(++1)l|aaT]
wy Wx,
(at.t (1 22)c)
[c+ [+
O't-1111 2
W (++1)|aa 2
(ar, - (1 + V2)c) + Ekpe (++1)||all,
W2 (aLK + (1+ V2)c)
The proof is completed.
18

---

Published as a conference paper at ICLR 2026
D EXPERIMENTAL DETAILS
D.1 DATASETS
The details of the dataset used in the paper are as follows:
Essay (Verma et al. 2024). Each source of this dataset thuman-writter texts, various LLM- generated texts) contains 1,000 samples. The HGT portion comprises original IvyPanda es- says that cover wide array of subjects and academic levels, from high school through uni- versity. For the MGT portion, a tailored prompt was first crafted for each source essay using ChatGPT-turbo, and that prompt was then submitted to several LLMs, including GPT4AIL, Chat- GPT. ChatGPT-turbo, ChatGLM, Dolly, and Claude, to generate machine-writter essays. This workflow produced diverse set of model- generated texts that remained aligned with the topics of their corresponding source documents.
Reuters (Verma et al. 2024). Built on the Reuters 50-50 authorship benchmark, this dataset contains 1,000 articles from 50 writers, with each author contributing 20 pieces. Replicating the pipeline used for the essay corpus, the team first asked ChatGPT-uurbo to invent a headline for every article. Those auto-generated headlines were then embedded into prompts and submitted to multiple LLMs, including CharGPT, GPT-4, ChatGPT-turbo, ChatGLM, Dolly, and Claude, to create the machine-generated texts.
TruthfulQA (Lin et al. 2022). It contains 817 questions covering 38 categories, including health, law, finance, and politics. The generated answers were produced by several large language models, including GPT4, ChatGPT-turbo, ChatGLM, Dolly, ChatGPT, and StableLM.
DetectRL. (Wu et al. 2024). In this dataset, the human-authored portion is drawn from four sources: arXiv abstracts dated 2002-2017, XSum news reports, Writing Prompts stories, and Yelp reviews. These types were chosen because they are especially vulnerable to producing convincing but misleading content when LLMs misapplied. From each source, 2,800 human texts selected as HGTs. The machine-generater texts are created using four widely used LLMs-GPT- 3.5-turbo (ChatGPT), PaLM- 2-2--bionn (Google-PaLMM) and Llama-2-70b. The dataset further mod- els practical adversarial settings: (1) a paraphrasing attack that rewrites MGTs with the Dipper paraphraser (Krishna et al., 2023) and Polish paraphraser, and (2) a mixed-text condition where 1/4 of machine- generated sentences is randomly replaced with human-writ written content while the machine-generated
label remains "machine-gent geenrrtedd
D.2 BASELINES
A detailed description of the basclines used is shown below:
Likelihood (Solaiman et al. 2019). It uses an LLM to calculate the log probability of each token in text. The average of these probabilities gives detection score. A higher score indicates greater chance that the text was generated by LLMs.
Log-Rank (Gehrmann et al., 2019). Its detection score is created by first using an LLM rank each token text based on its predicted order within given context. The logarithm of each word's predicted rank is then calculated. The final score is an average these values, and a lower score is strong indicator of machine-generated text.
Entropy GGhrraan et al. 2019). Similar to Log-Rank, it calculates a score for a text by taking the average of each token't conditional entropy within its given context. lower score suggests higher likelihood that the text was generated by LLMs.
DPt (Mitchell et al. 2023). It determines if a text is machine -eeebrre- by measuring how small changes affect its log probability. The underlying idea is that text created by LLMs is already a high-probability output. So, when it is slightly altered, the new version is likely to have a lower log probability. In contrast, making similar small changes to human-written text does consistently lower the log probability; it can just as easily stay the same or increase.
Fast-DetectGPT (FastGPT) (Bao et al. 2024). To overcome the major computational expense of DetectGPT, this approach replaces DetectGPT"s resource-ine intensive perturbation step with more efficient sampling process. identifies differences in token selection between humans and LLMs using conditional probability curvature metric.
19

---

Published as a conference paper at ICLR 2026
DNA-GPT (Yang et al. 2024). This method involves two-step process. First, it cuts text in half and uses the first part to prompt an LLM to generate a new continuation. Next, examines the differences between the newly created segment and the original one. This comparison, done via N-gram analysis for black-box models or probability divergence for white-box models, reveals clear distinction between how humans and machines generate text.
Repreguard (Chen al., 2025). It utilizes key feature directions determined by proxy model to project and score the representation of the text under test, comparing the result against a threshold. This approach demonstrates extremely high detection accuracy and robustness when dealing with out-of-distribution data and various types of attacks.
Lastde (Xu et al., 2025). It introduces time series analysis into machine-generan text detection, overcoming the limitations of traditional methods that ignore local discriminative information by collaboratively modeling the local dynamic features and global statistical indicators of token probability sequences.
FourierGPT (Xu al.] 2024). It proposes a detection method based on a likelihood spectrum perspective, which captures subtle differences between human and machine language by analyzing the relative changes text likelihood values rather than their absolute values.
Binoculars Hans et al. (024). is a detection algorithm that requires no training data, accurately distinguishing between human and machine-generaee text by comparing the score differences of a pair of pre-trained LLMs.
D.3 EXPERIMENTAL SCENARIO
To extensively evaluate the effectiveness of the proposed enhancement model, we conduct experi- ments in the following real-world scenarios:
Cross-LLM. To assess how well the proposed model works across different LLMs, we trained detectors on single LLM's text and then tested it on a variety of LLMS' texts. The main body of the paper presents the results from training detectors on the GPT4AIl texts (Essay dataset) and Llama-2-70b texts (DetectRL), and then testing them on various LLMs, as shown in Table 2 Complete results for every training and testing combination can be found in Appendix E.3 (Tables 15)
Cross-Domain. The DetectRL dataset includes texts from four distinet domains: arViv academic abstracts, XSum news articles, Writing Prompts stories, and Yelp Reviews. We utilized this dataset to evaluate the model's performance across various domains. To achieve this, we trained the detector on one domain and then tested it on the other domains. For this evaluation, all machine- generated texts were created using the default PaLM model. The heatmaps in Figs. 4 21 and 22 illustrate the performance improvement achieved by our enhancement model compared to various baseline detection models.
Paraphrasing Attack. Studies have shown that MGT detection is vulnerable to paraphrase at- tacks. Therefore, this scenario is used to evaluate the robustness of the MGT detection method. Using the DetectRL dataset, which includes data from the Polish and Dipper paraphraser, we trained our detector on clean, original texts and then evaluated its robustness on these paraphrased texts. Specifically, we trained the detector using clean texts from Llama-2-70b and then tested it on paraphrased texts from several different LLMs. The results can be found in Fig. 6 agd 24
Mixed Text. Because a blend of human and machine-generatee text common in the real world, we use the mixed texts provided by DetectRL for evaluation. It involved randomly swapping out 25% of the sentences in an LLM-generated text with human-written ones. We conducted two separate experiments on this dataset: (1) The detector
trained pure, non-mixed text and then tested for its ability to detect the mixed texts. (2) The detector was both trained and tested on the mixed texts themselves. The performance of the detector in these mixed settings is shown in Figs. 5 and 23 In each sub-figure, the detectors trained on original text are shown on the left, and those trained on mixed text are shown the right.
D.4 THREAT MODEL. AND PROXY SETTINGS
We conducted the experiments in black-box setting:
20

---

Published as a conference paper at ICLR 2026
OidOFT
Cheort
Chttce
orfiume
OPfiunte
OPfcyme
ChanLM
OhoRLy
ChonRLM
ChomEt
Gaude
Gzade
Coade
Grode
SubiiM
SuenLM
SusiLL
SubteM
OFr44
CP74
07144
077442
Wib Callb
calbb
WGG call.
collb.
W/b callb.
callb.
Exaa
Figure 9: Distribution of token scores obtained by the Log- Log-Likelihood method without and with enhancement. It can be observed that the proposed method enhances the discriminative nature of the token scores.
Machine
Human
CharPP
Chendet
Chanopt
offiuute
G7htrb
ChanLM
ChamLy
CheRRLM
ChomlE
Claude
rixite
Clude
GP764
call..
W/l calb.
Easay Cataset
(0) Routes Dutaset
DetectRL Dataset
Figure 10: Distribution of token scores obtained by the Log-Rank method without and with hancement. It can be observed that the proposed method enhances the discriminative nature of the token scores.
Threat Model. We operate under a strictly Black-Bor Box setting regarding the target LLM. We assume that the detector is entirely unknown to the LLM that generates the text (e.g.. Chat- GPT, Claude). Therefore, Likelihood and Rank) for the candidate text, which are reasonable due to the transferability of the extracted metrics.
employ Proxy Model to compute token-level metrics (e.g.. Log-
Proxy Models. For all baselines, we use GPT2 as the proxy model. Additionally, we use GPT2- XL as the scoring model for Dest-DetectGPT. To learn the 2x2 parameter Wmrf introduced by our strategy, we perform training based on various LLM texts, as explicitly stated in the "Training Text" of the table. For example, Table 2 in the paper, we learn Wmry on GPT4AII texts of the Essay dataset and Llama-2-706 texts of the DetectRI. dataset, and then test all candidate texts (from ChatGPT, Claude, or Dolly, etc.) using the learned detector.
D.5 PARAMETER SETTINGS
We conducted five independent experiments to ensure the consistency of our results, using five fixed random seeds (1-5). For all datasets, we used 10% of the data for training, while the remaining 90% was split evenly between validation and testing. To ensure fair comparison, the enhanced models shared the same hyperparameters as their base models. In our enhancement model, there are two hyperparameters: the transition center to the positional weighting function ((t) and the number of iterations T in the MRF layer. By default, we set to = 30 and T = 10 for the enhanced versions of all detectors across the three datasets, highlighting the flexibility of our approach. For training the MRF layer, we use learning rate of 0.05 and train for 10 epochs. Hyperparameter sensitivity analyses are provided in Appendix E.9
E MORE EXPERIMENTAL RESULS
E MORE RESULTS OF TOKEN SCORE DISTRIBUTION BEFORE AND AFTER ENHANCEMENT
In addition to the partial results on DetectGPT presented the main text, we also present the com- plete results about leken detection score distributions for Log-Likelihood, Log- Rank,,n, Entropy, and DetectGPT in Figs. I0 and 12 The results are similar to those in the main text: the orig- inal detector's scores show substantial overlap between human- and machine machine-generated text. How- ever, after calibration using our proposed augmentation strategy, the scores achieve significantly improved discriminability.
21

---

Published as a conference paper at ICLR 2026
Ohd0F1
Cholr
Chttce
offiume
ortiunte
Ortoyme
chanLM
ChoOOLM
(homLM
Gasde
Grade
Ceece
Grods
Sub
SusiiL
SutteM
OFТ44
CP74
07744
077448
Lamer
Wib Calbb
call.
WD callb.
W
W/b call.
callb.
Exaa
Figure 11: Distribution of token scores obtained by the Entropy method without and with enhance- ment. It can be observed that the proposed method enhances the discriminative nature of the token scores.
Maching
Humoon
ChatG77
ChecoTT
Gluds
Claade
PMLM
PaLM
Lkmee
Lumed
callb.
calbb
w/b callb.
(2) Essay Dotsset
(b1 Routers Dacaset
DetuctRL Datase:
Figure 12: Distribution of token scores obtained by the DetectGPT method without and with en- hancement. can be observed that the proposed method enhances the discriminative nature of the token scores.
E.2 MORE RESULTS OF CONTEXT TOKEN RELATIONSIIPS
In the main text, demonstrated the existence of neighbor similarity (Fig. (2) and initial instability (Fig. 2 in token-level detection scores through experiments on the Essay dataset. Here, we provide additional supplementary results further validate these relationships.
To verify neighbor similarity, we provide additional results using Entropy and DetectGPT detection scores on the Essay dataset (Fig. [3), as well results on the Reuters and DetectRL datasets
(Figs. 14 and 15 In addition, we provide Chinese texts on the CUDRT dataset (Fig. [6]. These
supplementary experiments consistently show that the closer the tokens are, the more similar their detection scores are.
Similarly, to verify initial instability, we provide additional results on the Essay dataset (Fig. [7].
as well as results on the Reuters and DetectRL datasets (Figs. [8 and 19). In addition, we provide Chinese texts on the CUDRT dataset (Fig. 20p. These results again demonstrate that token scores at the beginning of a text fluctuate significantly before gradually stabilizing.
E.3 MORE PERFORMANCE COMPARISON
Performance across Different LLMs. In the main text, we evaluated the cross-LLM performance of detectors trained on GPT4AIl (Essay) and L-ama-2-70b (DetectRL) on various LLM texts in terms of AUROC, as shown in Table 2 This section aims to provide more comprehensive supple- mentary experimental results, including: (1) cross-LLM performance performance under the same experimental settings in terms of TPR @ FPR-1% (Table 3). and (2) cross-LLM performance com- parisons of detectors trained on other LLMs on the Essay, DetectRL, and Reuters datasets (Tables to 15). These extensive experimental results are consistent with the conclusions of the main pa- per. Among the 888 cross-LLM evaluation settings, our proposed enhanced model achieved better performance than the original detector in 91,4% of the cases, highlighting the generalization ability and application value of this method on different models and datasets.
Performance across Different Domains. In addition to the cross-domain performance improve- ments for Log-LLikelihood and Log-Rank demonstrated in the main text, this section provides addi- tional results for other detectors. Specifically, it includes improvements to the cross-domain perfor- mance of Entropy and DetectGPT (Fig. (2I. as well as improvements to FastGPT and DNA-GPT (Fig. 22 Combining all experimental results, reach the same conclusion in the main text: in most experimental settings, detectors applied with our strategy significantly improve their cross- domain generalization capabilities.
Performance against Mixed Texts. In addition to the AUROC performance comparison for mixed texts presented in the main text, this section provides additional performance comparisons
22

---

Published as a conference paper at ICLR 2026
Dolly
1.050
1.59
1.50
1.025
Distance
1.000
0.975
1.35
0.950
1.30
0.923
1.25
0.900
0.875
hop
hop
Entropy Score
(b) DetectGPT Score
Figure 13: The detection score distances (Mean Absolute Difference) of neighbors at different hops in the Essay dataset. Entropy and DetectGPT score used here.
ChatGPT
GPTiturbo
ChatGLM
Claude
Dolly
GPT4AII
1.50
1.00
1:100
1.835
1.20
1.83
1.35
1.000
11:10
0.955
1.30
1.25
0.950
1:20
0.923
20
50
50
100
1.00
20
40
60
80
300
40
60
80
350
hop
hop
Rop
hop
Log-Likelihood
Log-Rank
Entropy
Figure 14: The detection score distances (Mean Absolute Difference) of neighbors at different hops in the Reuters dataset. Log-Likelihood, Log-Rank, Entropy, and DetectGPT score are used here.
at TPR @ FPR-1% as shown in Fig. 23
We reach consistent conclusions with those in the main text: in most experimental settings, the detector equipped with the proposed strategy significantly improves its ability to detect mixed text.
Performance against Paraphrasing Attacks. In addition to the AUROC performance comparison for paraphrasing texts presented in the main text, this section also presents performance compar- ison under the TPR@FPR-19; metric, as shown in Fig. [4 We find that in most experimental settings, the detector applying our proposed strategy significantly improves its robustness against paraphrasing attacks, which is consistent with the conclusions drawn in the main text.
E.4 MORE PERFORMANCE COMPARISON ON THE QA DATASET
In this section, explore testing challenging QA dataset, specifically the TruthfulQA dataset (Lin et al. 22022. which covers Q& tasks in 38 domains (e.g., health, law, and finance). The results shown in Table [6 As be seen, method consistently boosts performance. For example, DNA-GPT-M achieves a significant leap from 80. 17% to 88.32% (48.15%) in average AUROC.
E.5 MORE PERFORMANCE COMPARISON ON SHORT-TEXT
In this section, performed stress test the Essay dataset with strict 50-word limit. In Table 17 our calibration remains highly effective even with limited context. For example, we improve FastGPT by 5.35% and DNA-GPT by 3.03% average. This confirms calibration still holds even short sequences.
E.6 ENHANCEMENT EXPERIMENTS ON MORE DETECTORS
In this section, we integrated more state-of-the-an art metric-based baselines: RepreGuard Chen et al. 2002), Binoculars Hans et al. (002)) Lastde Xu et al. (2025), and FourierGPT Xu et al. (2024). and applied our strategy them "E" suffix. As shown in Tables [8 method functions as a universal plug-in in. enhancing these detectors. For example, on the Reuters dataset, our method improves RepreGuard by 8.97% and Binoculars by 4.42%.
23

---

Published as a conference paper at ICLR 2026
Google
1.4
2.0
1.7
1.7
13
1.0
1.4
0.0
14
20
60
00
20
40
60
50
6.
50
20
hop
Log-Llkellhhodd
DetectOPT
Figure 15: The detection score distances (Mean Absolute Difference) of neighbors different hops in the DetectRI, dataset. Log-L Likelhhoooo, Log-ann, Entropy, and DetectGPT score are used here.
Baichuan
ChatGL
GPT4
0.95
1.5
1.3
1.4
0.85
0.9
1.3
1.2
0.82
1.2
0.75
0.7
1.
hop
hop
hop (c) Entropy Score
(a) Log-Likellhood Score
(b) Log Rank Score
(d) DetectGPT Score
Figure 16: The detection score distances (Mean Absolute Difference) of neighbors different hops in the CUDRT dataset. Log-Likklihhnn Log-Rand Rank, Entropy, and DetectGPT score are used here.
E.7 PERFORMANCE COMPARISON AGAINST PERTURBATION TEXTS
In this section, we evaluated the robustness against perturbed texts. Here, we chose two distinct at- tack methods in the DetectRL. dataset: Back- Back-Trraslation and Word Perturbation. The results are shown in Tables 21 Across both perturbation scenarios, detectors equipped with our Markov- informed calibration (e.g., Likelihood-M, Log-Rank-Mi consistently outperformed the uncalibrated ones, typically by margins of 10-20%. These findings align perfectly with our existing evaluation on Paraphrasing Attacks, which shows that our method effectively mitigates the performance degra- dation typically caused by text perturbations.
These encouraging gains are consistent with the fundamental theory of Markov random fields. The adversarial perturbation acts token-level aalt-and-pepper noise, while Markov-informer cal- ibration strategy (modeling Neighbor Similarity) leverages the remaining uncorrupted context to smooth out these local anomalies, recovering the latent detection signal.
E.8 MORE RESULTS OF ABLATION STUDY
In addition the ablation experiments the position weight function and MRF layer presented in the main text for the Essay dataset, we also provide ablation results for the Reuters and DetectRL datasets, shown in Figs. and These experimental results are consistent with the conclusions of the main text: removing either component leads to significant performance drop; even retaining only one of them outperforms the baseline detector, strongly demonstrating the effectiveness of both components.
E.9 SENSITIVITY ANALYSIS
Sensitivity w.r.t transition center to. In our experiments, we set the default transition center to of the position weighting function to 30. This section examines the effect of varying to values on detection performance. The AUROC and TPR@ respectively. The experimental results show that detection performance steadily improves with in- creasing lo values, which is consistent with the conclusions of the ablation experiments and demon- strates the effectiveness of the position weighting function. However, performance improvement is not infinite. When to values too large, performance gradually saturates likely because excessively large to filters out useful token scores. Therefore, a trade-off necessary. Through sensitivity analysis, recommend setting values between 20 and 30.
results are shown in Figs. 27 and 28
declines. This is
24

---

Published as a conference paper at ICLR 2026
ChatGPT
GPT-turbo
ChatGLM
Claude
Dolly
GPT4NI
0.7
1.0
0.0
0.9
Value
0.5
0.4
0.5
0.3
0.4
0.0
0.2
0.4
0.6
0.8
1.0
0.0
0.2
0.4
0.0
0.8
1.0
position
position
(a) Entropy Score
(b) DetectGPT Score
Figure 17: The score distances (Mean Absolute Difference) of 1-hop neighbors at different positions in the Essay dataset. Entropy and DetectGPT score are used here.
ChatGPT
GPT-turbo
CharGLM
Cloude
Dolly
GPT4AII
0.7
1.0
0.6
0.4
0.4
0.2
0.3
position
position
position
position
(a) Log-Likollhodd Score
(b) Log-Rank Score
(c) Entropy Score
(4) DatectGPT Score
Figure 18: The score distances (Mean Absolute Difference) of 1-hop neighbors at different positions in the Reuters dataset. Log-Likelihood, Log-Rank, Entropy, and DetectGPT score are used here.
Sensitivity w.r.t. iterations 7' in MRF layer. We compute the posterior probability of the Markov random field using a multi-step iterative approach. To this end, we evaluate the impact of varying the number of iterations sults demonstrate that multi-step iterative computation significantly enhances detection performance compared single-step computation, underscoring its importance in score calibration. However, performance may degrade with increasing the number of iterations, possibly due to oversmoothing of the detection scores. Based on our sensitivity analysis, we recommend setting the number of iterations to 10.
detection performance, shown in Figs. 29 and 30 The experimental re-
E.10 MORE RESULTS COMPARING WITH NEURAL NETWORK CALIBRATION
In the main text, we demonstrated, through experimental results using the Log-Likelihood score, that while neural network-based detection score correction performs well on the intra-LLM, its per- formance drops sharply on the cross cross-LLM. This section further presents comparative results using other detection scores, as shown Figs. 33 and 32 Similar experimental findings further demon- strate that this method does not truly learn universal score correction capabilities, but rather overfits the training data. This strongly emphasizes the superiority and rationality of our proposed Markov- informed score calibration method.
E.11 MRF vs. HMM
In the paper, we chose the MRF over Markov chain for two key reasons:
Theoretical rationality. A Markov chain typically models unidirectional dependencies (current state depends on previous state). However, MGT detection, we identified the Neighbor Simi- larity property, which is inherently bidirectional. An MRF naturally captures these bidirectional dependencies, whereas standard Markov Chain struggles to utilize future context during infer- ence without complex multi-pass algorithms.
Computational Efficiency. A raw MRF may be complicated. However, as described in Sec- tion 4.2, our Mean-Field Approximation transforms the problem into lightweight iterative matrix multiplications. This allows for massive parallelization HMMs (c.g., Forward-Backward algorithm) is inherently sequential, which can be slower on modern hardware despite having similar theoretical complexity (NN).
GPUs. In contrast, exact inference
25

---

Published as a conference paper at ICLR 2026
Google
2:70b
1.2
0.0
11
10
0.3
0.7
0.0
0.7
0.4
0.4
0.
0.2
0.4 Log-Likell Score
0.5
0.8
2.2
0.5
5-2
04
0.5
0.3
1.0
0.
0.2
5.4 Entropy Score
2.6
0.5
100
0.
0.2
2.4
0.6
5.5
(b) Rank
DetectGPT Score
Figure 19: The score distances (Mean Absolute Difference) 1-hop neighbors at different positions in the DetectRI, dataset. Log-L Likeliho,, Log-Rand Dog-Ran,, Entropy, and DetectGPT score are used here.
Balchuan
ChatGLM
GPT3.5
GPT4
0.60
0.60
0.55
0.0
0.50
0.50
0.7
0.40
0.40
0.5
0.30
0.30
0.4
0.4 position
0.4
0.5
position
position
position
(a) Lok-iikel Score
(b) Log-Rank Score
Entropy Score
(4) DatectGPT Score
Figure 20: The score distances (Mean Absolute Difference) of 1-hop neighbors different positions in the CUDRT dataset. Log-Likelihood, Log-Rank, Entropy, and DetectGPT score are used here.
To further verify, implemented Hidden Markov Model (HMM) based calibration strategy and applied it to existing detectors ("HMM" suffix). As shown in Table 22 (left part), while the HMM improves upon the original baseline, it consistently underperforms our MRF approach. This vali- dates the necessity of modeling bidirectional dependencies. For computational efficiency (see the right part of Table our MRF implementation is actually faster practice due GPU-friendly matrix operations.
E. COMPARISON WITH ENHIANCED METHOO
TOCSIN is an enhanced sectric-based approach which enhances the detector by dynamically adjust- ing the decision threshold. Clearly, it operates different dimension than method. Therefore, in addition to supplementing TOChaN--ehanced baselines (suffix "-T"), our Markov calibration can be further applied the top of TOCSIN (suffix "-TM") to further explore its detection potential, as shown in Table 23 It can be seen that our method further improves the performance of TOCSIN- enhanced baselines most cases. This significant gain suggests that TOCSIN (adjusting dynamic thresholds using token cohesiveness score) and our method (calibration token-level detection score) focus on different aspects, achieving complementarity.
E. ANALYSIS OF CROSS-DOMAIN FAILURE CASES
Aside from few random performance fluctuations, most failures occur when xsum (training data) is applied to arXiv, writing, and yelp (test data). Given that our proposed calibration strategy hinges on learning reward/penalty matrix (W m/mr)) to encourage neighbor similarity, we examined the distance of neighbor detection score across various domains, summarized in Fig. 33
As observed, xsum exhibits considerably lower neighbor similarity (larger distance), whereas the other domains show higher similarity. This makes sense because, as news summarization dataset, XSum extremely information-dent with highly compressed syntactic structure and lack of redundancy and transitional words seen in longer texts (such as arXiv). Consequently, adjacent to- detection scores. Therefore, when trained
kens XSum experience more drastic fluctuations on xsum, the MRF learns parameters (Wmrf) that tolerate high local variance (treating it nor- mal feature the domain). When these parameters are applied to "smoother" domains like arXiv, the MRF fails to enforee the tighter consistency constraints required for those domains, leading to the observed performance drop. Encouragingly, compared to these occasional failure modes. the extensive enhancements highlight the practicality of our method.
26

---

Published as a conference paper at ICLR 2026
Table 3: Performance concerning TPR@FPRK (PR@FPR-1% (%)
Essay (left) and DetectRI. (right).
Methed
Focty (Training Text OPT4AH)
Denszifl (Trining Test: 1mm-22700)
GPTANI
ChaiGPT
Dolly
ChatGLM
Clande
ChatiPTaabo
Avg.
Liama
70b
ChaiGFT
Google PiLM
Arg.
46.301a16 t0
68.622:5.0
20.67
84
123114
73.00
10:21:11.0
25.001:
[kellhood--
87.4723.4 40
90.32 na
88472a.0
17.8911:11
00,00_7.77
96.27
77.86
26.83
1051g2.0
36.7
Log-Rank
62.09
79.07
25
95.7149.0
10,20
60.80
60.44
42.05 42.05gm:44
12.49g1m
22.84
25.78
Rank-M
87.38
88.922.04
52.1224.18
98.4
21.99
94.32.2.44
75.39
50.56
1594g2
38.34
Enumyy
2.73
7.10
2.2921 55
6.88g33m
22-94
13.2447.00
2:03g
0:2520
0:50gn-76
Knteop-M
41.34gn.30
g688
40.85 o2
13.30
20.91
31.30
2,0 80
0.820.10
8.17
DecaiPt
0.00
g.00
0.00
0.00
0.80
g.00
0.15
4.16:20.4
2.96:20.2
1.71 20.47
2.03
DetecGPPTM
41.33 29.53
46.8
25.36
12
41883
5,80
68.87.21.00
37.38
32
4.30
25.14:4.53
21.71
FasGPT
1,50_0.00
0.29
2.
16.89_0.00
4.43
g1.06
3.78
g002
FaNGPIM
10.9
20.000.00
41.891
0.67
g9.23
6.38
13.82
11.68
DNA-GPT
67.68 67.68.9.54
63.2411.54
22.26
84.82
16.67
36.27
50.15
36.06
19,70
30.36 75
28.58
DNA-GFTM
88.44
11.42
9683
33.33-7.00
86.22
75,85
42.52
19. 19.11-2.04
34.81
32.15
Table 4: Performance Essay dataset. ChatGPT.
The detection models are trained text generated by
Metric
Method
GPT4AIl
ChaiGT
Doily
CharCi M
Claude
CharGPT-turho
avg
Likelibood
46,24 46.24
68.62 68.62.113.35
20.67 20.67-10.77
92. 81 -2.8824.82
12.31
73.60-144
52.38
Likeliboud-M
89,3814
92.00
59.19
97.10_0.60
42.22
96.80
79.45
Løg-Rank
63.69+13.36
79.07
+7.80
+8 a5
95. =2.05
19.16+8.22
2.
10.80
Lag-Rank-M
87.15 88.80
52.12
98.04.0.43
31.33
94,22
75.28
Entropy
2.73+0.60
7.16+3.17
2.29++1.9
6.88+3.05
3.91
13.24+7..0
6,04
Entropy-Mi
12.7642.11
34.84=5.16
14.27+2.08
36.9622.81
19.78=8.79
43,20
DeteerGPT
0.00
2.00:00.00
0.00+
0.00+
0.84:20.51
2.36
0.53
DefectGPT-M
41,09 30.67
42,04
42.044225.96
9.55-+9.01
39.02
10.13 10.28
68.49
35.05
FastGPT
1.59
1.61:0.87
0.29
2.
1.47
16.89 16.8911
4.43
FssGGPTTM
11.18
26.18
24.82 2:0 aa
45.76 222 65
20.34
26.04 32 58
DNA-GPT
40.
10.7718.33 18.30
73.69 13.79
19.95 19.95 17.45
82. $2.50 11
18.0419
63.82 10.62
49.81
DNA-GPTM
89.02
9..07=1.93
65.97
99.24
39.56.4.01
94.62
80.58
Likelihood
16.1610.30
98. 79 1o.1a
90.90 11
99. 29
92. 76 23
99. 13 13:10.19
96.17
Likelihoud-M
98.77-t0.10
99,58 2..14
94.80 bo.st
99.56
94.69 24.69.00.42
99.77 99.77-t0.11 +.
97.86
Lag-Rank
96.5510.31
98. 08.95.5 38.9510.11
90.08
99.36
92.
99. 19.2441011
96.03
Log-Rank-M
98.56.10.00
99,40.0.00
1o
90.5611.0m
29.
99.64
Entropy
74.1911.62
89, 89.49 20.49 20.33
73.26 11 1.44
84. 64.11-1
86. 35.58..0.0
95, 95.94 25.9440.33
85.93
Entropy-M
83.33+0.00
93.24-00116
81.17+1.04
91.38
88.28
96.86
89.04
AUROC
DetectGPT
50.15
50.53
48.04 27
49. 10.25_1..6
51.21 +
55.34 .77
50.75
DetectGPT.M
94,98+3.26
96.38
85,82 1..
94.20
84.06-:0.47
98.58 98.58+1.224 1.22
92.33
FasIGPT
64..63+1.58
67.68 67.68+1.70
47 47.17
71 08-1.11
75.31
88.62+00.07
69.08
F-stGPT-M
86.68
90.82:33.80
72.23
93.53
63.21:12.36
65,21
71.87 737-222..00
80.06
DNA GPT
96.25+0.52
+0.22
05.885
99. 99.32-0.27
91.65+0.72
90.51
DNA-GPT-M
99.32g0.11
99.79.0.07 20.00
99.79
97.4210.58
99.90 99,90.0.06 20.08
95.65 10.51
19.7610.07
98.64
E. COMPARISON WITH MODEL-BASED DETECTORS
As shown in Fig. 34 we compare the enhanced versions of metric- based methods with model-based detection methods, including ChatGPT-D and MPU. Experimental results show that while model- based methods demonstrate superior performance on the DetectRL dataset, they underperform state- of-the-art -bare methods, such as DNA-GPT, on the Essay and Reuters datasets. Notably, the sigmificant performance gap between model- based methods in intra-LLM and cross-LLM further confirms their increased risk of overfitting the training data. This observation is consistent with our intention of focusing on metric-based detection methods.
E.15 RUNNING TIME
Table 24 shows the training and inference runtimes on different datasets. As discussed in the main text, our proposed Markov- based score refinement module can be implemented in constant time via sparse-dense matrix multiplication. Therefore, the additional time overhead introduced by this module is negligible compared to the time-consuming score calculation, highlighting the flexibility and practicality of our approach practical applications.
F THE USE OF LARGE LANGUAGE MODELS
In our paper, we used LLMs to polish the language and correct grammatical errors. LLMs were not used generate novel research ideas, design experiments, analyze results, write substantive
27

---

Published as a conference paper at ICLR 2026
Table 5: Performance on Essay dataset. The detection models are trained on text generated by ChatGPTTturbo.
Metric
Method
GPT4AII
ChaiGPT
Dolly
CharGi M
Clande
ChaiGPT-turbo
avg
Likelihood
46,29
68.62+13.32
20.67:11.779
92.86:
12.31
73.60:14.66
52.39
Likelihood-M
87.61
88.31
17.19
94,20 4.
17.99
98.38 2.
77.98
Log- Rank
62.69+13.88
79.07 =7.60
25.11+
95.71
19. 16
80.89
10.77
60.44
Rog-RanK-M
86.70=0.a9
87.47
54.61:4.0s
93.7543.aa
35.91
94.13=1.e5
75.43
Entropy
2.78
7.1613317
2.29 11.36
6,88
12.11
13.2417.60
6.04
TPROFPR-1%
Entropy-M
DetectGPT
11.62
0.00
30.6716.02
0.0010.00
13.56
0.00
32.54_2.62
0.00
17.33-2..22
0.03
39.91
3.07
24.27
0.60
DetectGPT-M
14.03418.72
+7.07+8.79
3.05
6.45+
5.11=3.08
44.71 11.72
15.07
FastGPT
1.592
1.59
1.64
0.29 20.10
2, 2.72=
3.4741..88
16.89
4.43
F-sGPPTM
8.97
8.97
15.33 15.33315.00
0.72
20.09 10.09118.22
7,51 7,51
49,82
17.07
GPT
0.73
0.76 30
2.63
0. 0.13
21.64=3.45
0.00. 00
4.31
DNA-CPT-M
39.41 -2.08
38.62-t2.33
39.47 +2.11
38.04=2.44
39.38-;1.80
38.67 22..9
38.93
Likelihnod
96.1640.00 30
98.79 10
90.90+
99.29 2.
92.76
99.134.0
96.17
Likelihood-M
98.68-0.211
99.39+0.22 +0.00
1.15 90.08111
99. 0.
94.66++0.39
99.77 +..12
Log-Rank
96.55-10.31
98. 95
99.36
92.01
99. 99.241..11
96.03
Lag-Rank-M
98,37
99.17
92.96 11.51
99.17
92.9610.44
99.62
97.04
Entrpyy
14.1911.02
80. 20.49
73.20 73.26.111 1.448
84.1 1.
95.9410.15
Entropy-M
82.88 =0.8
93,08
80,90 00.90=0.69.
91.18 0..7
88.57 =0.54
96.90 0..
88.92
AUROC
DetectGPT
49.19+0.5a
53. 13.00 63.00
42.52 42.52++0.84
49 49.59+1.70
58. 0.040=0.e0
82. 82.10+1.25
55.91
DetectGPT-M
91.65_2.22
13.3812.311
77.58 25.63
29.74
79.82-19.52
97.61.0.82
FasGGPT
64.6341.00 n3
67 67.68
47. 11.11.655
71.08+1.51 1.55
75.31
88.624..0
69.08
FastGPT-M
85.05
86.41 11.008
49.85
89.08 89.08_6.0r
75.84
96.80 19
80.51
DNA-GPT
53.28+1.22
-0.76
61.90+0.39
2.
60.55=0.65
13.31
DNA-GPT-M
1.09
84.02-11.06
83.93 1.:20
83.89 11.00
84.23
84.07 11008
84.01
Table 6: Performance Essay dataset. The detection models trained text generated by
ChaIGLM.
Metric
Method
GPT4AII
ChaiGPT
Dolly
ChaiGLM
Claude
ChatGPT-turbo
avg
Likelihood
46. 46.29+16.54
08.62
20.67
92.81
12.31+a.20
73.60+14.03
52.38
Likelibood-M
78.82
87.87
46.73-10.16
98.71
31.64 10.61
93.7813.11
Log Rank
63.69
79.07
25.11
95.71
10.20
80. 80.89 10
60.44
I Log-Rank-M
81.32
86.76-33.68
47.384s.02
98.62+0.22
25.24-7.49
90.62+
71.65
Entropy 2.73
T.16-3.17
2.2911.36
6.88.13.05
3.91
13.2147.60
6.04
TPR@FPR-1%
Entropy-M
DetectGPT
12.76
0.00:1.00
0.00
44.09
13.99
0.0011
35.62-44.65
0.00
18.40
0.80
41,42-
0.00
25.71
0.15
DelecIGPT-M
18.3610.94
17.87
17.87
25.87
20.67
60,98 16.4
4.89
6.36
21.52
FastGPT
1.5940.32
1.64 +0.67
0.29+ o.
2.72+40.08
1.47
+ eo
4.43
FastGPT-M
23.87
310.38
29.87 29
32,89
12.89.18.52
$5.49 15.49.7.87
0.67 00.55
16.22
26.50
DNA-GPT
57.54
69.91
19.4-9
97.32 76
31,2415.75
65.16 11
60.06
93.58.11.20 1.22
92.53 3.34
66.54 9..0...
0..20
44..6499.19
4
Likelihood
96.16
98.79110
90.90
99.29 as
92.761o
99. 99.13
96.17
Låkelihood-M
98.03--0.26
99.22 0.20
93.10
00.07
93.47 11114
99.54=0.10
Log-Rank
96. 55 50.3
98. 95.
90.08 1.
99. 09.36:0.13
92.01 20.20
99 99.244..11
96.03
Log-Rank-M
98.14
99.20
92.86
99,54
91.3911.0s
99,53
96.78
Entropy
14.19_1.62
80.49
73. 73.26 1..48
00.17
86.58400.6
95.944..33
AUROC
Entropy-M
82.99 82.99-1.01
93.13-0.22
$1.03:1.111
91.15
88.45
96.88 +.
88.94
DetectGPT
50.81
46.40+0.17
57. 47..84
50.41+1.70
41.511+..00
17. 17.90+11.2
44.09
DelecGPPTM
80.39 11.50
80.53
1..67
94.02-10.58
62.63:1.24
2:1
FastGPT
64.63
11.6811.00
47 11.55
71.08
75.31 75.31
88.62 1.0
69.08
FastGPT-M
87.19-3.46
87.19
91.55
82.58 18.00
95.38-0.49
59.2841..0
63.48
79.91
DNA-GPT
96.97 -0.20
98.0940.47
91..47
99.87 +0.04
92.8440.71
17.8850..33
96.62
DNA-GPT-M
99.37_20.05
99.58 20.10
97.68 1..88...299
99.92.0002
96.24.0.47
99.54..
98.72
28

---

Published as a conference paper at ICLR 2026
Table 7: Performance Essay dataset. The detection models trained text generated by Dolly.
Metric
Method
GPT4AII
CharGPT
Dolly
ChaGGLM
Claude
ChatPPTtturbo
Likelihood
46.29
65.62=18.32
20.67
92.86
12.3
73.60
$2.39
Likelihood-M
89.02
44.59
57.14
97.59 =1.09
34.36
94.36 23.67
76.76
Log-Rank
02.69+11.30
79.07 +7.89
25.11+s.a5
95.71 +..05
19.16-8.22
80 09,89.1 10.75
60.44
Log- ug-Rank-V
87.70=2.c6
29.02
51.65
98.12_0.54
31.69
94.M61.99
75.42
Entrupy
2.7320.00
7.1613.15
2.29
6.88
3.91 24
13.24
6.04
TPR@FPR-1&
Entropy-M
DetectGPT
1.89
0000
0.00
42.09+44.77
13.22+44.31
0.00
0.00 0.00=0.00
34.78=s.04
0.89 20.24
43.49+3.20
40.62-00.2
0.00
0.62-+0..3.
0.15
DelectGi--M
32.89
46.09119.71
24.44 24.44
68.84
6.04
48.09
37.73
0.82
0.00110.00
0.38 20.42
0.00
0.00.10.00
0.00
FssGGPTM
27.24 27.77
28.04
39.43
55.89
0.98 0.98_0.63
0.84
25.41
DNA-GPT
58.9544.7
64.00
48. 6-.444.444
84, 84.2943.00 2.943.004
29. 24
59.02 10,002+...
57.36
DNA-GPT-M
18.70_1.78
1.
72.60 44.17
92.59 20030
44.71
2.132.211
Likelibodd
96. 96.16+0.0
98.79 98.79-0.20
90. 00.90+1.88
99 00.29:400
92.76- 00..76-0.22
99. 19.133+-00
96.17
Likelibood-M
98.63
99.48
20.71
99.62-0.00
20.75
99.70.20.1 0.11
Log-Rank
96.5510.11
98. 20.13
90.08111
00.3610.11
92.01
99.2410.1 1...1
96.03
Log- Mag-Rank-V M
98.55
99,40
93.78 93.78
49.56=0.09
92.81 +2.81
99.68
97.29
Entropy
74.19+1.u2
-0.3s
73.26+1144
80.11
86. =0...
95 90.944
83.93
AUROC
Entropy-M
DetectGPT
50.81
83.09
20.09
46. 46.40 46.40=2.77
93.15
57 17.48
81.05 11.19
50.41
91.26 20.2620.22
41.54:0.60
88.42-10.52
17.90 17.9011.25
96.88 2.0.00
44.09
88.97
DetectGPT-M
93.62
93.95
90.01
97.82
81.4219.50
92.20
91.50
35.37+1.68
32.32 -1.70
62.83+1..68
28.92+1.61
24.69=0.60
01.38++0.07
FastGPT-M
88.35-00.s
88.35
89.67 1.113
91.55 20.28
95.27 20.38
$9.68 10.68-11.54
$4.61 22.30
79.85
DNA-GPT
94.5010.00
93.
95.91
95.0410.15
89.35
9:3.81
93.76
DNA-GPT-M
08.23_0.21
1G
98.01 20.33
0..10
94.63.20.40
00.17
Table 8: Performance on Essay dataset.
The detection models are trained on text generated by
Claude.
Metric
Method
GPT4All
CharGP
Dolly
CharGLM
Claude
CharGiPT-turbo
avg
Likellhood
68.58 16.20
2s
20.67 20.67-110.79
92 86 24.86
12:31
73 22. 14.00 us
52.37
Likelibood-M
86.74_3.37
90.09 2..50
50.07
98.08 10.881..0
34.00.6.00
95.78
75.79
Log-Rank
62.69418.30
79.07+7.90
25. 11.114
95.71+2.00
19. 19.20=s..20
80.80
60.44
Log-Rank-M
89.20-2.5a
54,42
95.00.3.50
37.82
94,80
76.57
Entropy
2.73++0.09
7.16+3.17
2.29+1.36
3.88+3.05
3.91 +2222
13.2447.00
6.04
Entropy-M
12.16:0..s8
10.74144.12
30.9425.62
16.80
39.69
23.23
@PRRFPR-1
DetectGPT
0.00 oo
0.00
0.00 00
0.00
0.84 61
2.36 52
0.53
DeT
44.62417.01
38.71 23..27
24.73
74.06+11.999
3.91 +2.14
29.114-24.44 24.44
FastGPT
1.59
1.64.20.67
0.29
2.72
3.47
16,89 n.
4.43
F-
27.47
28.04
39.57
56.47
0.98
0.84
25.56
DNA
0.50
0.31 #0.11
0.67
0.00
0.13 11
0.53 ao
DNA-GPT-M
12.7622.00
13.16
14,03
12.14.1.1 78
13.69
13.33
13.19
Likelihood
96. 0.300
98.794.
90.90
99.29 20.29
92.76 02.76.0.22
99.13
LikelihoodMM
98.52-0.24
99.45 00.00
94.32++0.90 0..95...
99.63440.00
94.38 94.38+00.42
99.66 99.66+0.11
97.66
Log-Rank
96.55
98. 08.9511.11
90.08
99.36.0.13
92. 01
99 00.2211..11
96.03
Lag-Rank-M
98.47-1..20
93.15
99 09.25
92.93.0.4a
99.66.0..1 10
Entropy
74. 11
89.49.1..0
73.26.1144
84. 10.77
86. 66.68 20.66
96. 00.944
83.93
AUROC
Entropy-M
DetectGPT
50.15
82.36-=1.16
53.53+
92.90=0.22
80.6441..12
28.0447.27
90.8820.6
19.25+1..8
88.62+0.48
51.21=s.50
56.3 56.31.455
96.91
88.72
50.75
DetectGPT-M
86.96
87.5427.67
35.22.15.50
96.46
71.40
80.33 80.33 11..18
84.65
FasGGPT
64.63_1.00
67.68
47
47.1741.5a
71.08
75.31
88.62.0
69.08
FastGPT-M
88.45
89.73-1.25
91.61
95.38+0.47
59.77
54. 64.76+2..9
79.95
DNA-GPT
85.85 15
39.61
53.93-11.4
39.19
53. 53.0121.47
1..33-1..00
44.87
DNA-GPT-M
76.26_1.33
76.25
76.3811.33
75.98
76.7411.96
76.30_1.79
76.32
29

---

Published as a conference paper at ICLR 2026
Table 9: Performance DetectRL. The detection models are trained on text generated by ChatGPT
and Mhogle-PPaMM
Metric
Method
DetectRL (Triinig Text: ChaGPT)
DetectRL (Training Text: Google-PaLMM) PaLM)
Llama-2-70h
ChaiGPT
Google-Pal
Avg.
1lama-2-70b
ChaiGP
Google-Pal M
Avg.
Likelihood
38.37 24.92
10.21-1.00 1.40
:6:2.41
24.15
32.32.. as
25. 25.06 40.39
24.72
Likellhood-M
45.61
12.1442.66
33.18
30.31
42.94-4.14
9.91+3.a7
35.48+22.70
29.44
Log-Rank Rank
42.06-0.84
12.44-1.71
22. 22.84
25.78
42.05
12.41+1.72
22.84=1.28
25.77
Log- Log-Rank-M
50.66:1.43
12.73+1.65
41.41-2.66
34,93
50.58_1.a8
13.00
41.09:4.07
34,89
Entropy
2.03
0.2512.16
6.95.0.75
2.03
0.25 16
6.95
3,07
P
Entropy-M
DetectGPT
3. 3.29
2.13+0.80
5.36
0.27=0.20
2.79
9.27+0.87
3.82
3,89
2.87
1.22
6.77
0.27
3.86
9.37=00.93
3.96
4,50
DM
25.29 110.05
1.
14.17-11
15.71
22.00
4.57
24.94
17.17
FasGPPT
21.3
3.7811.20
20.85
11.3612.01
3.78
5.02
6.72
Fa
27.71 1:5.63
1342218.91
17.68 11
19.60
12.41 10.09
6.18
20.10
12.90
DNA-GPT
31.03
11.05_1.69
26. 26.40
22.83
41.7111.39
29.49
38 38.84.1 18.8441110
36.68
DNA-GPT-M
411611.63
12.53
33.57_a.15
29.09
47.10
22.7211.50
40.54.1..o0
36.79
Likelihood
78.58 10.41
66.61
71.422...8
72.2
78.57
1..00
66.61
71.42 o.
72.20
Likelihoud-M
78.15-44
67.0614.19
73.40
72.87
87.44
73.70
81.58 10.90
80.91
Log-Rank
79.67
65,85
70.66:10.44
72.06
79.6
65.85
70.66
72.06
Log-Rank-M
10.43
15.00
84.44_0.55 20.50
10
75.6110.53
84.63
Entropy
66.21_a..8
03.09 1.05
700.73...99
63.24
21110.8
13.0911.05
60. 00.73_u..1
63.34
AUROC
Entropy-M
DetectGPT
49.21-2.91
68.61
49.64-0.88
66.83:20.55
67.93
67.79
19.85
68.91 :0.885
49.78-40.00
66.8610.95
56.81+1.41
67.94:21.o4
67.90
51.40
DetectGPT-M
73.50+0.15
62.9344.69
11.00-11..00
77.77=4.00
60.34+3.57
76.40+1.co
FasGGPT
07.72-1.02
68.50-1.22
56. 68.08 1.21
60.97
67.72-1.uu 1
18.50
56 08 =8
60.97
FastGPTM
71.60+6.86
61.26+6.62
66.05
66.30
62. 30.330+0044
51.87+1.a5
68.88.+1.00
1.00
61.03
DNA-GPT
72.53=1110
66.07
68.35=20.98
68.98
79.00
72.27
77.96:2.04
76.41
DNA-GPT-M
15.37
66.1921.40
01.77_00.7
80.09 1.22
71.09:1.12
77.15:1.02
Table 10: Performance on Reuters dataset. The detection models are trained on text generated by
GPT4AIL.
Metric
Method
GPT4A11
ChaiGPT
Dolly
ChaiGi.M
Clande
CharGPT-turbo
Avg.
Likelihood
19.47422.4
80.89-2.11
12.44 1.38
94.36-1.1
18 18.891
90 90.22+1..2
$2.71
Likelihood-M
61.4211.74
88.44
35.5612.86
95.24
32.3615.03
92.76
67.63
Log-Rank
29.91 27
1..62
97.33 15.20
84
21.5843.55
93.1621.07
$7.73
Log-Rank-M
73.82 73.82
89.5611.77 78
12.1.
96.71
96.71_1.00
1.002
35,47
94.49 1o.02
71.39
6.18
0.04
13.07
0.22
0.00
0.22
3.29
Emtropy-M
17.42.2..8
0.36.10.30
12.3612.8G
00.8
0.00 Do
0.40 20.0
5.25
TPR 1%
DetectGPTT
0.001.0.0
0.00
0.00
0.00
0. 0.44-20.10
0.041.0.9
0.08
DetectGPT-M
40.89
15.33
46.40
40.00
2.40
6.40
25.24
FaSIGPT
3.56+3.08
0.04++0.09
12.18+6.70
0.09
0.09
0.04+0.09
2.67
FastGPT-M
61.6917.18
21.78 1.
65.24
31.78 29.
1.38
1.51
30.56
DNA-GPT
85.20
92. 28.18-.. 58.9
47.49
06.93
79.24444.95
96.29 96.29+3.55
86.29
DNA-GPT-M
47.51 17.51:1..1
98.40
81.29
99.87 10
89.07 89.07 33.67
99.24
94.23
Likelihood
75.19 1.39
M7. 07.55_2
58.77 11.76
99.62
86. 0.020
98 422 0.25
86.00
Likelihood-M
93.74
98.42 1.00000000
77.05
99.61
90.68
98.78
93.05
Log-Rank
1.
0.332
+2.08
0.
65.68400.67
98 0..24
Lag-Rank-M
95.50
1...8
98.60
76.60
99.64 00.4410.00
90.45 90.45
98.99 18.99....1
93,30
Entropy
72.48
35.35
61.92.+1.55
50.96-1.65
23. 23.76+11.0
17 77.55-+0.92
43.67
AUROC
Entropy-M
DetectGPT
75.62
1.
34.84 2.
67. 18 1.00
77.25
40.09+1.07
6..97
61.
66.6621.112 1.12
58. 01.01 08.01:11.75
27
20 42
44.18
58.41
DetectGPT-M
87.58
78.194-2.35
86.29411.18
89.73
58.40-41.64
65.72.41.90
77.65
FastGPT
1..50
39, 50.56
82.15=00.47
23.221 21.122
11.31+0.50
11.29
47.39
FastGPT-M
96.4610.31
90.21
96.23
92.36.0074
66.98
56.2811.60 11.80
83,09
DNA-GPT
99.5140.11 14
99.72-0.07
98.4140.221
89.85_0..5
99.211.0.1
99. 0.00:0006
DNA-GPT-M
99.80 19.80.10.00
99.88 L.
98.39 10.19
99.94 99.94.0.00
99.53
99.89 10.000
99.57
30

---

Published as a conference paper at ICLR 2026
Table 11: Performance on Reuters dataset. The detection models trained text generated by ChatGPT.
Metric
Method
GPT4AIl
ChatGT
Dolly
CharGLM
Claude
CharGPT-turbo
Ave.
Likelihood
19: 29.7812..2
81.07
12. 53 21.331..5
91.36
19. 1.
90.31:1.31
52.91
Likelihoud-M
59,73
88.96
35.91
96.00-2..14
26.71 26.71 +0.99
93.24
66.76
Rank
29, 29.9613..2 z8
86 $6.22 11.87
70
97.33_g.c -0.0
1
93.20
Log-Rank-M
63.91
90.62-2.38
34.58
98.13.0.40
29.73
94.53
68.59
Entropy
0.09
2.45 2.49
2.04
1.69
4.36
9.561
3.37
TPR@FFR-19
Entropy-M
DeteetGPT
0.00 oo
7.07+33.06
17.47
0.00
13.604-2.29
0.00++.00
9.02=3.21
0.00+0.00
18.09
0.44:00.00
33,29
0.01.:0.00 0.00
16.42
0.08
DetectGPT-M
22.76:-25.e6
47.91 47.91
11699
23.64:22.60
23.64
8.27 8.27
71.24
30.92
FastGPT
0.31+0.28
2.01+0.96
0.0140.00
3.16+1.08
142=0.67
23,51+4.00
5.08
FastGPT-M
11.04
17.07 47.07:
61.51::9.54
24
20.992
1.29 2:0 ne
27.24
DNA-GPT
29.82
78 492.51
15.64 15.64_12.02
12.02
83.47 114.87
21.96
21.96118.00
82,22
50.48
DNA-GPT-M
15.80
96.7611.1e
59.33
99.29
99.29
61.91
61.91
97.51
83.60
Likelihood
75.19+1.39
+0.35
68.77+1..0 47.70
90. 62-0.11
86,46++0.r0
98 08.422+0.25
Likelihood-M
93.97 93.97
98.68
20.68
79.54 1:112
99,70 99,70.0.22
90.39
20..9
98,94
93.54
Log-Rank
78.39+1.28
97.7T+0.52
58.22
99. 99.61-0..
65.68+0.07
98. 08.67+0..
86.39
Log-Rank-M
93.1111.37
98.6910.25 25
1.:15
29.75
11.05
99,03
Entropy
27.52
1..6
38 88.08-4 :32
49.04 49.04-1.67
76. 7
82, 12.455:1:0 25.5220.222
56.33
Entrupy-M
$5.30
80,07 1.999
$6.54
69.75 69.75
83.33 _1.333_100a
90.46
72.58
AUROC
Detec1GPT
7..62+1.20
57.18+1.91
77.25
61.97 90
58.01 +1
20.42
58.41
De
11.60=11.69
25.66 25.37
=12.90
118.17
75.78 29.43
1. 28
FasiGPT
23.50+1.s0
60. 00.44400.54
17.50+40.47
66. 7.-82
58. +0.899
88.71 +.0.44
52.61
FastGPT-M
96.25=0.a8
80.97=0.74
96,0440..3
92.12++0.70
66.72=1.11
56 56.01+1.78
82.86
DNA-GPT
97.34
99.17+0.50
95.82.40.22
9T. 27.21
99. 20:20
98.06
DNA-GPT-M
99.42+0.18
99.78 99.78+0.02
97.31+0.24
99.89 00.10
98.78 08.78-00.24
09.82++0.12
99.16
Table 12: Performance on Reuters dataset. The detection models are trained on text generated by ChatGPT-turbo.
Metric
Method
GPT4AIl
CharGPT
Dolly
CharGLM
Claude
CharGPT-turbo
Avg.
Likelihood
19.82+2.17
81.0742.06
12.53+1.35
94.4441.10
19.42 33.427
00.27
$2.93
Likelibood-M
66.62::5.21
90.13:1.15
38.62=2.74
15.96:11.9
29.60
93.91
69.14
Log-Rank
29.96+8.22
86.22+1.87
15.20+1.70
97.33+0.64
24.58+3.95
93.20+1.18
$7.75
Log-Rank-M
60.18:18.59
90.27
33.07
98.2220.40
27.29
94.00
67.17
Entropy
0.09
2.49+1122
2.04-0.57
1.6940.55
4.36+1.81
9.60 9.60+2..4
3.38
Entropy-M
5.11-22.70
16.18241.91
12.27=1.551
7.69
17.42
31.69 31.6916.00
15.06
TPR&FFR-1S
DetectGPT
0.00
0.0010.00
0.00=0.00
0.0011..0
0.6240.53
9.21-12.65
1.64
DetectGPT-M
6.22-3.90
26.71
2.49
4.04
4.18
11677-1400 114.38
17.39
FusiGPT
20.23
2.04
0.04
3.16
1.42
23.51
5.08
F-
0.00
0.22
0.04
0.53
0.621.
7.38
1.47
2.0041.29
+1.94
1.69-1.21
5.51 5.51
1.9641..0
5.24
DNA-GPT-M
5.82
6.44
3.56
6.49
3.78
6.67 -667-0.84
5,46
Likelihood
75.20
97.55
58.77 58.77
1.777
99. 60
86.46.1.
98. 42..2....00
86.00
Likelihood-M
94.7940.60
98.72+
79.93
99.72+0.10
90.83+0.63
98.96
93.82
18.39
97.77 1..32
2..03
99.6111.11
85.68
98.65 2.024
Lag-Rank-M
92.21
98.63+
76.27 1.24
99.73+0.21
+0.89
98.99 +0.27
92.48
Entropy
27.5241.24
64.65 65
38.0841.32
49.0441..7
76. 26.04411.0
82.45.10.92
56.33
AUROC
Entropy-M
Detect(PP
24.38
54.11+3.557
42.82.1..1
1..38
22.75:0.60
$5.94-1.82
38, 38.0310..0
+2.68
41.99
83.14+
79.5821.00
89.91
41.59 19
71.89
DetectGPT-M
47.47
89.36-44.32
59.50=5.37
71.41+7.62
73.92+a.27
96.53
78.32
FusiGPT
23.50
1.
60.4410.54
17.55
17.55_0.47
66.79
58.691.0.89 1.0.88
58.69
88.71 1..11..0
$2.61
FastGPT-M
12.73=1.55.
35.9342.31
9.43-0..s
36,
50.1842..00
76.22 7..28=1.01
36.83
GFT
45.62
63.85.1100
35.9641
71.2411.14
43.56
70.63
DNA-GPT-M
79.05++1.18
87.32
64.13-1.27
91.42+0..4
67.14:11.48
89,37
79.74
31

---

Published as a conference paper at ICLR 2026
Table 13: Performance on Reuters dataset. The detection models are trained on text generated by
ChatGLM.
Metric
GPT4AIl
ChaGPT
Doily
Claude
CharGPT-turho
Avg
Likelihood
19
81.07 +2.00
2.49 ass
1.10
19. 19.42
90.36
52.93
Likelihoud-M
41,4219112
26.84.2.44
31.47 12
98.58 10.23
19.97
91.56 1
61.79
Log-Rank
29. 96.13.232
86 86.2211.87
15.20
97 17.33_0.64
21.5513.35
93. 93.20.2..13
57.75
Log-Rank-M
62.4014.00
90.49
33.82
98.22.0.47
30.44_6.61
94,1310.77 76
68.25
Entropy
4..01
0.36
10.4911.75
0.44
0.58 11-16
1.38 a1
3.02
Entropy-M
6.13
17.20
13.11
9.78
18.76-2.64
33.87
16.47
1FPR-1
DetecrGPT
0.00..0
0.00
0.001..00
0.00+0.00
0.44
0.04
0.08
PeM
40.53
14.18+7.07
45,7342.50
38.98
2.18=0.68
4.47
24.51
FastGPT
0.31 00:25
2. 2.01::0.80
0.04.
11.00
1.42
2-.51
5,08
F-stGPT-M
56.04
17.07 17.07
61.51
26.67
+13.24
0 1.89944.00
1,29
27.
DNA-GPT
27.96118.0
66 661.411
16,00-12.44
16,00
85, 85.51
20. 20.49.11..0
80. 80.40.13..0
49.53
22.89
94,93 1.99
56.31 1.31lg9.10
98.98 20.18
15.40
96.53
Likelihood
75. 1.99
97. 40.33
58.77+1.77 1.77
99 62-0.11
86, 0.
98. 2..422..22
86,00
Likellhood-M
87.15+9.72
98.44:0.45
77.92++1.74
99,95 +0.00
87,99 +1118
98.69 +00
91.69
Log-Rank
78.3911.20
97.77 10.32
22,2222 1
99 61 0..0. 0.19
85, 18.6881..00
98. 10.22
86.39
Log-Rank-M
93.39 20.39
98.68 20.24
76.11 1:661
99.75 99.75
89.70 89.70.0.41
98,99
92.77
Entropy
18.76
40.53
$6.16
49.
33.61 2.00
45.45
AUROC
DeteciGPT
Entropy-M
75.62+1.20
54.3013.43
57.18 57.18 1.91
79.38 1.30
77.25 27.25...00
46
61.97 10.000
12.00
83.03 10.44
58.01 1,75
20.42 11222.000
1.
58.41
DetectGPT-M
87.1710.76
77.46
8..1411.14
89.36
57. 1.55
64.40
77.06
FasiGPT
23.50+1.89
60.44.0.54
17.55
66.
68.69+0.89
88,71
52.61
FastGPT-M
06.27:uu.31
89,98 20.74
96.07 tu.as
92.13
66.74-11.10
56 05-205221.4
82.87
DNA-GPT
97. 10.044
98 28.944+0.29
95. 06.56-0 05.56+00.7 +0.67
99. 29 09.17
96. 98.95++0.46
99. 22 0...22++.222
97.85
DNA-GPT-M
99,3310115
99.72.1000
97.15.10.21
99,82.20.10
98.68
99.77.10.12
99.08
Table 14: Performance Reuters dataset. The detection models trained text generated by
Dolly.
Metric
Method
GPT4AIl
ChaiGPT
Dolly
ChaiGLM
Claude
CharGPT-turbo
Avg.
Likelihood
19.78
81.07
12.40
91.44_1110
19.38 1.
90.27 00.27.1.00 11.07
$2.89
Likelihoud-M
59,96.25.45
88.58
35.42
95.91
31.96-16.22
92.93.0.77
67.46
Rank
6.62
17.24134.48
10.49 19.42
19.42
4.93 19.81
18.58 1.7
12.88
Lan-Rank-M
66.7677.01
1.54
25.42+4.26
20.72
31.78
+0.30
Entropy
6.18
0.04
13.07 13.07 11.76
0.22
0.00
0.22
3.29
TPR@FRR-19 1%
Entropy-M
DetectGPT
0.00-
2.40++0.74
0.00 no
7.29+5.90
0.0040.00
9.91+-1.09
0.00+0.00
3.16-=2.01
0.41+0.40
9,24
16.134
0,01+
8.02
DeMMctGPT.M
42.93
37.20
39.69 +1.9:199.11
51.73
6.27--:220
31.56 us
34,90
FisiGPT
3. 3.56+9.08
0.01++0.0
12. 18.46.0
0.09
0.09
0.04+
2.67
FastGPT-M
61.6917.18
21.78
65.24:1..12
31.78
1.38
1.51 20.58
30156
DNA
78.711s.00
91.47.7.33
100011.000 10.40
76
94.80 ...
DNA-GPTM
93.24
98,09 1.31
79.07 17.
99.87
10.27
85,20 16.00.6.00
98.31 1.....1.00
92.30
Likelihood
1..1941.50
97.55 +0.59
58.7771.77
62-00.1
86.45 86.45++.100
98.
Likelihoud-M
93.42
18.45.0.29
77.41-1100
99.67 10.18
90.57 10..01
98.78 1.0
93.05
Log-Rank Rank
32.84
21.28-138.11
21.28
43.51.to.4
20. 00.22:: 22
28. 30
77 1:1.....000
27,82
L
94.1810.7
98.71
76.52
99.73
89.98 10.
99.02
93.02
Entropy
72.48 24
35.35
61.92+1.32
50.96_. 06- 1.67
23.76+11005
17.55 2..00.
AUROC
Entrupy-M
DetearGP
75.62+1.20
49.8012.00
56.16
57. 57.1841.01
77 77.25+4..0 40.60
52.47
53,09 116.
61 61.97 97.97
56.78 31.30
58.01
58.33
20.42
58.41
54.44
DetectGPT-M
80.34-21.91
73.22
$1.9911.41
91.04_66.24
17.53
66.30 95
75.05
FasIGPT
16.50+1..39
39.56+0.55
82.45-00.47 4.47
1.82
41.31 41.31+0.80 +0.89
11.29+0.40
47.39
FastGPT-M
96.47+0.30
90.23+0.78
96.24++0.37
00.37
67.04=1.07
56.34+
83.12
DNA-GPT
99. 19
99. 99.711....0
98.90
99. 83
99. 99.21:.01e
99. 19.80-2..oo
99.45
DNA-GPT-M
99.66100119
99.84_0.11
08.81100.22
99.91_0.110
10.47.0..30
99.86
32

---

Published as a conference paper at ICLR 2026
Table 15: Performance on Reuters dataset. The detection models are trained text generated by
Claude.
Metric
Method
GPT4AII
CharGPT
ChaGGT-turbo
ChatGLM
StableI
Claude
Avg.
Likelihood
19.82-2.17
81.07=2.05
12.53
9..44
19.42-8.17
90.36
52.94
Likelibood-M
65.18
84.84
32.13+2.79
91.78-11.51
4..58
91.47 +1.54
65.83
Log-Rand
29.96_3.20
86.2221.87
15.20
97.33-20.44
24.58-3.35
03.2011.15
57.75
Log- oog-Rank-M
71.3344.000
89.82
37,60
97.07
34.8410.56
94.36.0.87
70.84
Entropy
0.09+0.11
2.49+1.26
2.04-0.57
1.69+0.54
4.36-+1.81
9.60-2.04
Entropy-M
5.51 22.06
17.4245.02
13.24
7.91
18.00
34,09 14.9228.2
16.03
TPR HPR-1%
DetectGPT
0.00
0.00
0.00-6.o0
0.00++.00
0.44+0.40
0.04+00.0
0.08
DelectGPT-M
39.91
51.60.92..1 14
28.80.120.74
57.47 18
23.02
68.53
FasGGPT
0.3110.22
2.04
0.04 on
16.661..88
1.442
23.51 4.15
5.08
PastGPT-M
59,96410.88
33.1 +12.....
56.09
42.44 42.44-27.14
8.62--15.0
19.04
36,64
DNA-GPT
3.61+1.82
6.58
2.18
1.78_0.95
2.44+2.03
=.20
4.97
DNA-GPT-M
6.67 22.96
7.16 7.16_3.18
4.22
7.51
5.38 22.87
7.16 2..17
6.35
Likelihood
13.19_1.30
07
58.77
99.62.10.10
86.45_.070
98.422 25
Likelibeod-M
91.1242.66
47.69+0.40
69.45+3.66
98.3 08.384-0.57 0.57
90.57 90.57+0.60
98.54 0..43
90.96
Log-Rank Rank
78.40=1.25
97.77
58.22
99.61 20.19
85.68=0.67
98.67 1.0.4
86.39
Log-Rank-M
95.06 64
98.59 1...0...
76.38 499
20,
90.36 68
98.98 2.
Entropy
27.52-1.24
6-1.6511.66
38, 38.08+ 1.
19 19.01+1.57
76.21-1.00
82 05+00.92
56.35
AUROC
Entropy-M
DetectGPT
75.62-1.20
53.47
79.33
57.18+1.91
77 77.25+0..0
55.92.11.77
68.50
+0.97
83.03
-1.75
90.09 10.94
20.42+11.07
71.72
DetectGPT-M
91.23-15.89
94.13
81.29
94.63-25.95
70.99
96,97 -6.97-11.02
88.21
FasGPT
23.50_1.30
60.44.0.54
17.55
66.79
58.69
88,71
52.61
FastGPTMM
96.53.0.651
91.64
94,46-22.87
93.63+33.88
=1.74-10.00
63.82+117.64
DNA-GPT
6..77=1.29
78. 78.38 78.38
51.85++1.20
82 82.10g0.73
65. 65.30=0.ee
81.6-4
71.39
DNA-GPT-M
28.84
83.32
68.1318.55
85.53_14.38
72.95
84.29 14.001
78.84
Table 16: Performance on TruthfulQA dataset. The detection models are trained on generated by GPT4,
Metric
Method
GPT4
ChatLiTT-turoo
ChatGLM
Dolly
ChaiGPT
StableLM
Avg.
Likelihood
38.45
41.67+1.51
73.5447.88
17.74
52.01 10.78
50. 1444.09
45.59
Likelihood-E
29.17:411.02
56.89
75.91
52.17-42.62
42.04441.17
14.79:10.29
51.83
Log-Rank
40.17+4..4
39.7747.50
83.22+4.08
16.45+65.00
54.50+2.00
59.26+2.20
Lan-Rank-E
1.
4..39
90.55
14.48
83.57
79.26 2..52
70.16
Entropy
24.3014.47
38.39
60.48_15.22
18.3816.5
38.0219.91
32 32.29114.70
35.31
TPROIPR-14
DesecGPPT
Entropy-E
21.66:47.04
3..94
78.44.0.05
05.4.2
84.68
60.82++6.2
52.70-13.55
13.75
78.87=9..1
52.4147.71
69.52+11.82
39.49
67.35
38.46
DetectGPT-E
46.30+22.0
82.31+4.44
94.85+00.92
59.52
86.91+3.64
84.14-2.63 -2.65
75.67
FasGGPT
21.2014.54
47.15
66.61 66.6116.47
20.63
52.58
19.9214.27
43.01
FisIGP'TEE
4.
44.64
$9.80
49.0642.22
83.80-4.005
76.32-a.07
DNAGPT
10.37
15.6211..8
30.59 1.
8.28 12.87
10.7445.30
22.04
17.94
DNAGPT
8.0822.07
15.68
20.39
11,52.6677
21.47
13.994..07
15.19
Likelihood
84.67
91.93-1.330
97.08 10.
79.28 As
95.65 1.65....0
94.17 1.1.00.0
90.47
Likeliboud-E
86.61
92.72
97.14.0.00
83.70
9..20
94,37 94,37
91.46
Log-Rank
82.35-40.50
00.60+0.50
75.08+0.70 03.03
+0.40
94.0944..55
89.57
Log-Rank-E
84.16+0
93.54
97.56+00466
82.14
96.36=0068
95.10-0.61
91.48
Entropy
79. 40.
92. 19.40.3u
96 02 02.40.44
80.5 20.50:2..0
94.044...s0
91.30
88.
AUROC
DetectGPT
Entropy-1 E
85.48
7..73111.00
86.86-10.70
95.17
97.451..97
92. 20..0
72.25
84.57
92.8441.0w
96.83
95.42
86.70.10..8
92.49
DetectGI'TEE
70.03310.00
10.3811 1.
97.23
78.97 78.97
93.8211.07
91.37 00.42
86.96
FastGPT
82.61+1.20
00.90++..0
96. 20.20
81 81.63++..7
94.38+0.00
91.8440.67
89.62
FastGPT-E
82.80
94.26 2s
97.68 1.8....00 uss
84.02-20.90
94.84 1.08
DNAGPT
77.49+1..0
64.6441..2
00.5
67. 7.000+
84. 84.15+1..0
83.46
80.17
DNAGPT
83.92.10.38
90.18
92.9610.50
79.8111.07
92.16120.66
90.90
88.32
33

---

Published as a conference paper at ICLR 2026
Table 17: Performance on short texts on Essay, The detection models are trained on text generated by GPT4AII.
Metric
Method
GPT4AIl
CharGPT
Dolly
Cha1GLM
Claude
CharGPT-turbo
avg
Likelihood
19.8645.65
40.93-4.86
11.69+2.98
58.75-8.78
15.38+
23.47+44.8
28.35
Likelibood-E
+0.67
45.91
14.99 44.68
74.51 38
18.98
27.24
Log-Rank
15.85423.2
36, 36.49-6.97
9.98+
55.38=s.11
11.33+3.00
19.07
24.72
Log-Rank-E
33.30
44.18+4.07
13.27 +3.17
12.41
+7.60+1.81
24.32-2.44
34,16
Entropy
2..31
1.62:2.03
1.43
1.70
3.07
3.4721..81
2.51
TPR 1%
DetectGP'
Entropy-E
8.25-42.34
1.96-0.42
13.42_2.70
5.11+11.2
7.1643..8 60
2.86-1.17
18. 18.37
3.26-11.79
9.73-14.81
2.89+1.79
3.11+1.88
8.58-22.9
10.95
3.20
DeiectGPT-E
23.92++7.45
41.96-6..5
15.32
53,44-2.22
22.36-25.78
30,49
31.25
FastGPT
5.2812.94
11.02=1.41
3.96
14.202e.18
7.42422.0
6,27
8.03
FastGPT-E
13.7119.14
20.89
3.78
27.50
15.73=1..00
12.84
16.58
DNAGPT
6.02211.00
20.04
20.04_4.02
10.02
35. 35.98
6.84
11.11
15.34
DNAGPT
43.8541.25
23.87
16.09
49.78
8.09
13.38 2..8822.000
20.84
Likelihood
84.8420.81
93.57 93.57=0.68
83.34+1.51
96 96.31-0.44
81 $1.26:11.0 2266:..02
89. 89.30.2
88.11
Likeliboed-E
86.95+0.80
86.95 +0.88
93.65 +0.ra
1.22
97.04-0.322
83.43 0.
89,59 =0.87
89.14
Log-Rank
82.90
92 29 20.81
81.1821.11
95.97 95.97
77 77.5810.99
87 18.3 8:3
86.29
Log-Rank-E
85.88
92.86.1 78
83.27 1.1.00
81.40 97.01.0.400
88,28
88.12
Entropy
58.8641.57
72.56 06.56_1..0 0.03
62.13go.86
11.71
67. 17.00811.13
73 85
66.87
Entropy-E
62.02.41.48
74.75
65.11
71.53
70.74_1.11
74.98
69.86
AUROC
DetectGPP
78.67 .66
84.93_o.at
76.56.0.97
20.40.0.75
20.27
2..74
81.54 96
DetectGPT-E
86.13-411.27
02.12.10.78
42.57
96.33-0..3
83.40 23.40-00.00
88.57 -
88.19
FastGPT
79.78
85.87
81.15
91.2221.00
82.6220.55
80
83.45
FastGPT-E
4-0772
+0.69
+0
95.26++0778
88.08+0.001
0.88
DNAGPT
79.59
86.99
16.19_11118
79.45
90.86g0.80
76. 76.84
83 18.48...08
82.87
DNAGPT
83.46+0.91
88.99 1.03
83.06+1..30
93.40+0.66
80.65
85.84 1.02
85.90
Table 18: Enhancement results more detectors in the Essay dataset. The detection models
trained on text generated by GPT4AII.
Method
GPT4AIl
ChatGPT
Dolly
CharGLM
Claude
CharGPT-ttrbo
Avg.
RepreGuard
94.66-0.95
97.35-0.28
90. 40.80
91.95+0.77
47.51
43.42
77.55
RepreCuard-M
95.46 -0.80
99.55 0.18
0.18
90.55 0.70
99.95
47.1841.47
43.12
79.30
Binoculars
96.33
98.50 98.50-0.15
88 38.57=1.66
90.57
87.21
98.84
94.85
Binoculars-M
00.13
98.65 0.19
90.19 1.38
07.68812 66.8..444
86.80.10.4
98.82
94,91
Lastde
09.54_0.08
09.72 00.7220.08
97.38 20.38
99. 09.98.10.01
75.98
91.16.20.72
93.96
Lastde-M
99.68 10.07
99.77 0..07
97.87 00.35
99.9910.01
76.21 11.29
90.9610.75
94.08
FourierGPT
91.70+16.06
90.18419.03
03.74112.07
98, 2..22
44,90 18
42.11
76.81
FourierGPT-M
97.10
95.27
97.64 3.119
99.44 10.58
41.1416.61
41.0816.90
78.61
Table 19: Enhancement results on more detectors in the Reuters dataset. The detection models are trained on text generated by GPT4AII.
Method
GPT4All
ChatGPT
Dolly
ChatGLM
Claude
ChatGPT-turbo
Avg.
RepreGuard
97.21
98.32
8.24
97.26 27
21.81 20.02
44.3241.0 1.80
61.19
RepreGuard-M
98.33
97.87
48.1246..04
97.00
29.08
50.59
70.16
Binoculars
80.9611.11 97.9910.30
61.25.1.77
99.80
83.23 1.233...00
98. 98.70.1..2
86.99
Binoculars-M
90.90
98,49 19
74.10
99,8610.04
86.37
98.72.t0.32
91.41
Lastde
99.21
99.67
94.25 44.2544..o
99.83
83.27 20.49
99.09
95.
Lastde-M
99.55
99.68 1.0.0...0
96,09 10.35
99.82.10.05
85.64 1..59
99.00.10.1
96.63
FourierGPT
99. 20..5
96. 23.
99 20.41
98. 98.45 25
56,82 10.58
49. 49.8410.89
83.36
FourierGPT-M
99.36
98.29 20.72
99.29 20.27
98.48
55.134 10.81
49.88 1.12
83.40
Table 20:
Enhancement results on more detectors in the DetectRL dataset. The detection models are trained on text generated by GPT4AII. Note that DetectRL, lacks paired data for RepreGuard; therefore, this method not compared.
Method
Llama-2-708
ChatGPT
Google-PaLM
Avg.
Binoculars
79.10
66.5540.80
73.85
73.
Binoculars-M
81.22+0.39
67.43
77.80
75.49
Lastde
78.36
51.934t0.51
69.04 69.04410.90
66,45
Lastde-M
78.70
52.55+0.443
71.06-0.77
67.44
FourierGPT
58. 18.11, 7.29
50.57
13.63
59.99 18.33
56.23
FourierGPT-M
64.67 48.42
52.64 15.70
64.07 17.25
60.46
34

---

Published as a conference paper at ICLR 2026
Table 21: Performance (AUROC) on perturbation texts BacckTranslation and WeepWordBug) on
DetectRL. All detectors trained on Llama-2-706 texts.
Perturbation
Method
Llama-2-70b
ChatGPT
Google-PaL.M
Avg.
Likelihood
53.8840.rF
29.91
48.00
43.93
Likelihood-M
58.85
29.71 1..6
55.80
48.12
Log-Rank
56.40.10.7
30.91 1.32
46.85-10.75
44.72
Log-Rank-4 M
62.41+0.61
32.17
59.55
51.37
Entropy
46.4311.06
32.54
41.9910.61
40.32
Entropy-M
48.99
31.64
46.1610.49
42,26
DetectGPT
20.30+0.72
10.90+0.68
16.59+0.56
15.93
DetectGPT-M
62.24
38.63
61.72+4.74
54.20
FastGPT
35.37
24.10+1.08
31.2340.67
30.23
FastGPT-M
51.87 +3.25
21.35++3.21
53.16+3.04
42.13
DNA-GPT
70.82
55.74
65.37
63.84
DNA-GPT-M
71.83+0.94
54.53+1.32
67.6340.62
64.67
Likelihood
69.62+0077
51.56-0.7z 73
62.19+1.0 .22
61.12
Likelihood-M
85.71+1.22
68.11+1.64
79.18
77.67
Log-Rank
72.7610.64
50.60
62.6441.86
62
Log-Rank-M
90.93+1.14
71.16+2.75
83,41
81.84
Entropy
65.85+0.97
63.63
58.00+1.31
62.49
Entropy-M
69.3540.95
66.54
63.95
66.61
DeepWorlBug
DetectGPT
34.3342.82
33.28 23.72
32.7212.14
33.44
DetectGPT-M
82.95+1.70
64.13
79.67 42.41
75.58
FastGPT
39.57+2.14
34.59+2.49
36.51+2.30
36.89
FastGPT-M
53.71+1.90 30.93
54.63
46.42
DNA-GPT
67.7642.07
58.74
63.6941.06
63.4
DNA-GPT-M
76.43
59.59 14.16
67.61 14.09
66.21
Performance and running time comparison with HMM-based method on Essay. detection models are traind on text generated by GPT4AII.
Table 22:
The
Detection Performance
Running Time Inference
Method
GPT4AIl
ChatGPT
Dolly
ChatGLM Claude
ChatGPT-turbo
Avg.
Train
Likelihood
96.16
98.79
90.90
99.29
92.76
99.13
96.17
13.58
61.21
Likelihood-HMo
96.39
98.87
91.24
99.33
92.91
99.17
96.32
20.64
90.63
Likelihood-M
98.58
99.47
94.59
99.54
94,82
99.72
97.79
15.01
72.67
Log-Rank
96.55
98.95
90.08
99.36
92.01
99.24
96.03
15.98
75.60
Log- Rank- HMM
96.68
98.99
90.24
99.38
92.08
99.27
96.10
21.77
103.70
Log-Rank-M
98.57
99.41
93.82
99.55
92.91
99.64
97.32
17.40
87.55
Entropy
74.19
89.49
73.26
84.11
86.58
95.94
83.93
13.26
64.49
Entropy-HMM
74.47
89.70
73.56
84.39
86.61
95.98
84.12
16.87
88.26
Entropy-M
83.52
93.28
81.11
91.44
87.96
96.75
89.01
14.69
73.66
Table 23: Performance (AUROC) TOCSIN-enhanced baselines and our method on top of TOC- SIN (suffix "-TM"). Detectors are trained on GPT4AIl texts.
Method
GPT4
CharGPT-turbo
CharGLM
Dolly
ChatGPT
StableLM
Avg.
Likelihood-T
90.43
98.66.0.15
89.50+0.r9
98.5240.55
90.466
98.44_0.9
94.33
Likelihood-TM
98.08
99.1940.11
92.8341.08
99.01
91.0611 26
99.20
96.56
Log-Rank-T
93. 00.96
08
80.90+0.58
98. 40.52
91.01+0.4s
98.57 -0.27
95.15
Rag-Rnn-TM
98.0740.35
99.10
92.32-0..11
99,01
91.4610.02
99.05
96,50
Entropy-T
76.90 76.9041.67
98.41+0.22
87, 87.2044..0
98. 1140.11
90.91+0.40
98.72-0..19
91.71
Entropy-IM
83.89
08.3440.35
87.23
98.25
89.70+0.44
89.
98.63_0.19
92.67
DeteciGPTTT
48 1.
40.69
51.. 51.4642..9
40.67-13.66
43.9947.25
27 77.044+3..4
42.13
DetectGPTTTM
95.51+2.81
93.27+9.08
79.76+14.11
97.67
70.25
93.59
88.34
FastGPT-T
53.53455.89
70.36
56, 56.26
71.83..28.44
72.06
77.26.4 36.44
66.88
FastGPT-TM
87.73+0.15
66. 1.41..2
80.65
75.3641.49
41.9141.62
28. 28.10 18.118
63.36
DNAGPT-T
98.32 0.22
97.97
96.60.0..2
98.34
13
97.93 6.183-..18 0.18
97.38
DNAGPT-TM
99.56+t.10
99.0440.18
97.70
99,24+0.11
96.30+0.40
99,06-0.19
98.48
35

---

Published as a conference paper at ICLR 2026
2amh erogy ape
Train Domain
2.00
686
144
3,47
273
627
13.7
AUROC
Jum eidiy
925
388
433
6.0
0.00
PM
9.
1.3
63
1/4
TPRO3
3.19
552
6.18
3.19
135
1.87
223
145
2314
15.15
14.51
22:42
339
13.35
14.11
Test
Domain
Domain
Entropy
DetectGPT
Figure 21: The performance improvement of the proposed method on Entropy and DetectGPT. Values greater than O indicate an enhanced effect.
Train Domain
TPR 35%
mm wiikg
AUROC
AUROC
12:72
12.13
6.36
15.23
224
-696
11.20
2373
1.03
9.72
.008
13.95
632
1:90
1.93
12:91
4.55
410h
willng
witie
DNA-GPT
Figure 22: The performance improvement of the proposed method FastGPT and DNA-GPT. Values greater than O indicate an enhanced effect.
technical content. We ensure that the use of large language models is responsible and adheres to academic and ethical standards.
36

---

Published as a conference paper at ICLR 2026
Ukelihood LikelhhoodMM
Log-Rank Lng-RankoM
Entropy Entropy-M
DetectGPT DetectGPT-M
PastGPT
DNA-GPT DNA-GPT-M
FastGIPEEM
0.4
0.20
0.32
TPRO 180
0.3
TPAug FPA-
0.05
0.08
0.0
Tan
Vit
0.02
01.
Mix
Google-PaLM
Figure 23: Detection performance concerning TPR @ FPR-1 % under different LLM mixed texts. All
detectors trained on Llama-2-700 texts.
Lkallhood
Log-Rank
Entropy Entropy-M
DetectOPT DetectGPT-M
RastGPT ResGGPTM
DNA-GPT
Ukelthocd-M
Log-RanioMt
DNA-GPT-M
0.8
0.60
TPRGFPR.1
0.0
TPR.8
0.16
0:13
Test text: Llama-2-70b
Test text: ChatGPT
Test text: Google-PaL.M
Detection performance concerning TPR EPR@FPR-II % under different paraphrasing texts (Dipper and Polish). All detectors are trained on Llama-2- 2-00
Figure 24:
Origin
wro
ChaiGPT
AUROC
Lama-2
1G0 75.0 775 30.0
72
75
81
34
64.5
$6.0
65. 70.2 725 1500
Likellh Hool
Log-Ram
Entropy
Figure 25: Ablation results on the DetectRL dataset. The y-axis represents the LLM text on which the detector was trained, and the x-axis represents the average performance across LLMs.
wrl
ChwnG?
GFTAW)
AUROC
GPT-urte
Clude
Likellhood
Log-Rank
Entropy
DetectGPT
FastGPT
DNA-GPT
Figure 26: Ablation results on the Reuters dataset. The y-axis represents the LLM text on which the detector was trained, and the x-axis represents the average performance across LLMs.
Likelihood
Log-Rank Rank
Entropy
DetectGPT
DNA-GPT
0.96
0.80
AUROC
0.88
0.86
0.76
0.88
0.68
0.89
0.64
0.750
0.80
0.735
0.992
1.0
30
20
10
30
1.0
30
Essay
DelecIRL
Figure 27: Detection performance of AUROC under different transition center to.
37

---

Published as a conference paper at ICLR 2026
Likebhood
Log-Rank
Entropy
DetectGPT
FastOPT
DNA-GPT
TPR&FPR-1
0.73
0.4
0.40
0.2
0.18
0.15
0.48
0.12
0.16
0.000
0.44
0.84
0.015
0.40
10
20
30
4.0
0
10
20
40
10
20
30
40
10
20
30
40
Essay
DelectRI
Figure 28: Detection performance TPR@FPR-I under different transition center tu-
Likelihond
Log-Rank
Entrapy
DetectGPT
RastGPT
DNA-GPT
0.6
AUROC
0.980
0.905
0.8
0.85
0.90
0.68
0.84
0.992
0.78
0.94
0.72
10 iter
20
15
10 iter
20
15
Essay
DetectRL
Figure 29: Detection performance of AUROC at different numbers of MRF layer iterations.
Likebhood
Log- Rank
Entropy
DetectGPT
FastGPT
DNA-GPT
0.9
TPR@FRR-10
0.0
0.40
0.90
0.3
0.52
0.2
0.48
0.8
0.08
0.1
0.02
0.0
10 iter
iter
iter
iter
Essay
DetectRL
Figure 30: Detection performance of TPR@TPRR different numbers of MRF layer iterations.
Rank
Log Rank-nn
Log Rank-R
100
50
30
TPR.F 1%
TPR.FFR. 1%
AUROC
20
AUROC
60
Crow-113
Crow-111
18
mm
Essay
Figure 31: Comparison with NN-based methods. The detector used is Log-Rand Ran-Rank.
Entropy
Entropy mm
Entropy
TPR8FFRR 3NC
AUROC
93
TPR
RURDC
65.0
20
LM
Crass
Essay Dataset
DatectRL Dataset
Figure 32: Comparison with NN-based methods. The detector used is Entropy.
38

---

Published as a conference paper at ICLR 2026
2010
2000
1000
1500
1500
1000
300
500
500
Naighbor Similarity
Neighbor Similarity
Neighbor Similarity
Neighbor similarity
(a) ardiv
(b) writing
(c) xsum
Figure 33: Statistical information the distance of neighbor detection scores.
UnottoodiEE
DetechOPTE
PamISPT
DNA-GPTE
ChatSPT.D
100
ALROC
C1000411
LUM
LUM
LUN
Cross LUN
Criss LLM
Criss LUM
Evsny Datsset
Rechers Datavet
Detwet Datuset
Figure 34: Comparison with Model based detectors. Detectors are trained on GPT4AIl (Essay and Reuters) and Llama-2-70h (DetectRI.).
Table 24: Running time (s) of training and inference phases.
Train
Inference
Method
Essay
Reuters
DetectRI.
Essay
Reuters
DetectRI.
Likelihood
13.58
12.77
61.21
61.05
59.34
Likelihood-M
15.01
14.19
13.10
72.67
72.38
61.66
Log-Rank
15.98
14.38
14.61
75.60
72.99
66.20
Log-Rank-M
17.40
15.81
16.29
87.55
72.06
82.21
Entropy
13.26
13.79
64.49
63.69
63.19
Entropy-M
14.69
14.38
15.61
73.66
72.80
72.63
DetectGPT
204.32
216.36
370.44
924.63
982.55
1672.85
DetectGPT-M
206.44
218.73
373.48
929.46
984.70
1682.78
FastGPT
60.21
58.67
52.97
279.50
272.18
240.20
FastGPT-M
63.00
61.47
55.76
286.44
284.75
254.85
DNA-GPT
469.10
532.02
267.84
2113.65
2398.61
1207.18
DNA-GPT-M
471.42
534.47
271.11
2125.17
2405.37
1221.74
39


Reviews:
[{"review_id": "IYvaNfp5B6", "reviewer": "Reviewer_LQNk", "summary": "This work observes the impacts of randomness (during text generation) on the metric-based LLM-generated text detectors, a specific type of detection that relies on statistical scores computed from token-wise probabilities. To alleviate this challenge, a Markov-informed score calibration method was proposed and a plug-and-play module was designed to improve the detection performance of existing metric-based detectors. Experiments were conducted to verify some claims mentioned in this work.", "questions": "Please see Weakness part, eg. the vague description and definition of neighbor similarity, experimental settings etc. \nIn addition to the weakness part, another question is, The presentation mostly relies on figures, why not provide precisely the numerical results? (It often seems hard to tell the exact number and comparision results given the figures and bars etc).", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. This work identified and analyzed randomness issues during token generation which might influence the detection performance of LLM-generated text detectors, which makes sense and the perspective appears new.\n\n2. A Markov-informed score strategy was formulated and served as a plug-and-play for existing fake text detectors. \n\n3. Experiments on certain datasets were done to validate some claims proposed in this work.", "weaknesses": "1. Unclear presentation and lack of clarity. The definition and introduction of neighbor similarity is not clear both in the writing part and the illustration part. Particulary in Fig.2 and Fig.3, much important information is missing. E.g., how to compute the detection scores, what kind of distances being used, why there are two variables in the horizontal axis (e.g. position, and log-rank score, which variable do the numerical values 0.0 to 0.8 refer to?) \n\n2. Though some theorems were provided, the assumptions are quite strong to be useful in practical cases, e.g. Theorem 1 was based on a single-layer transformer model, which makes it difficult to generalize to LLMs, it is suggested to elaborate on the scope and guidance of these theoretical studies.\n\n3. Unclear descriptions of the experimental settings. For the experimental comparisons, it is suggested to clearly present the threat models, being a white-box detection or black-box one, if black-box, what is the proxy model being used etc, the settings should clear to be reproducible. \n\n4. From Table 2, the advantages of the proposed module does not seem significant, particulary by integrating with FastGPT and DNA-GPT, please give some explainations. Besides, More benchmark datasets and baselines should be included.  For benchmark dataset, it is suggested to include experiments on datasets e.g., PubMedQA, in the black-box setting, and experiments on short-text detection are encouraged. Also, more recent metric-based baselines should be discussed and compared, e.g. ref 1 and ref 2, etc. \n\nref1: Xu et al, Training-free LLM-generated Text Detection by Mining Token Probability Sequences, ICLR 2025.\n\nref2: Wu et al, MoSEs: Uncertainty-Aware AI-Generated Text Detection via Mixture of Stylistics Experts with Conditional Thresholds, EMNLP 2025.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nmfm06c0Nk", "reviewer": "Reviewer_FKz3", "summary": "The essential idea behind this paper is a good one. Broadly, what it does is take a token-level score based discriminator between human and machine generated text, where the final decision is based on averaging the token level scores, and replace that final averaging step with a Markov Random Field based approach. Essentially, instead of averaging the token level scores, the upgraded detector studies local patterns in the scores. This method can be bolted on top of many existing detectors.\n\nAn attempt is made to justify the effectiveness of this method in terms of mitigating randomness due to the fact that the process of generating machine text is usually stochastic. The authors provide empirical evidence for the effectiveness of their algorithm against a range of baselines.", "questions": "Figure 2 is supposed to demonstrate that there is a substantial correlation between the log-likelihood score of a token and the log-likelihood score of the token's nearest neighbour. Certainly the graph shows some effect, but I find it hard to assess the strength of the correlation. Could you give us a clearer visualisation? For example, it would be useful to also include tokens at distance 100, so one could see a stark difference between the distance between the log-likelihood scores of nearest neighbours and distant neighbours. \n\nOn the first line of page 2 you ascribe log-rank to Mitchell et al, which I think is wrong. Probably it should be the same reference that you have for log-likelihood and entropy, although I'm not certain.\n\nI don't think Fast-DetectGPT has a significant compute overhead as stated on page 3, they collect all of the required info from a single forward pass through the text. \n\nI don't understand the point you are making in the following paragraph. Isn't the same true of your method, that having computed some number for each text you then use a threshold to divide into likely human and likely machine based? 'Detection. These methods all employ threshold-based detection mechanisms, whose effectiveness relies heavily on the accuracy of their calculated scores. As previously discussed, two factors compromise this accuracy: (1) the inherent randomness of LLM-generated text introduces bias\ninto score calculation, and (2) direct score aggregation fails to mitigate this bias. As a result, their detection performance is often unsatisfactory.", "limitations": "", "rating": 2, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "The basic idea of the approach is sensible and works.\n\nThe analysis (Figure 2) of how the differences between the log-likelihood scores of pairs of tokens drawn from the text are correlated with the distance between the tokens is interesting.\n\nTable 2 is very compelling in showing the uplift in performance when replacing 'averaging' scores from a detector with applying the authors Markov Random Field approach.", "weaknesses": "1. I do not rate the discussion of the current state of the art very highly, either in its breadth (there is much state of the art work which is missed, including many detectors which do look at local patterns in things like log-likelihood rather than just raw averages) or its accuracy. For example, there is a claim in the abstract and on page 2 that the weaknesses of token based discriminators between human and machine text stem from the randomness present in sampling algorithms for machine text. This is repeated on page 3: 'However, the detection error based on a single text may be large,because the randomness inherent in the LLM sampling mechanism may cause the MGT to deviatefrom these methods’ underlying assumptions, e.g., Log-Rank assumes that the generated tokenshave high rankings. In contrast, DetectGPT, Fast-DetectGPT, and DNA-GPT incorporate multipleperturbed (i.e., s′) or regenerated (i.e.,˜s andˆs) samples, which mitigates the errors caused byrandomness.' I think this is a fundamental mischaracterization of why DetectGPT and its successors were effective, they do not mitigate the randomness present in language model decoding strategies. Instead, they mitigate a fundamentally different issue, that the expected statistical properties of different types of text are different -  that poetry for example should have a higher inherent uncertainty about the next token than python code. \n2. In the discussion of score calculation (p3) there is a claim that aggregating a score (such as log-probability) over a sequence is problematic because there is randomness in the process of text generating. But surely averaging over a number of tokens is a reasonable way to deal with this randomness? There is an implicit claim being made that, if instead of aggregating log likelihood scores, one were to process the log likelihood scores to the authors algorithm, the effects of randomness in the generation process of machine text would be mitigated. No evidence is presented for this claim and I suspect it is wrong. (I'm not saying the author's text-detection algorithm is ineffective, I'm saying I don't believe the justification for its effectiveness).\n3. Theorem 1 gives a theoretical proof of correlations between attention scores. The authors write 'The following\ntheorem will reveal the relationship between attention scores, which in turn help us understand the\nrelationship between detection scores of context tokens.' I am unconvinced that Theorem 1 is useful in understanding anything about correlations between log-likelihoods of tokens generated in a sequence, for example. I don't think that Theorem 1 contributes understanding to the current approach.\n3. There is already work in the literature which seeks to exploit patterns in statistics such as log-likelihood, as opposed to just raw averages. For example, [Detecting Subtle Differences between Human and Model Languages Using Spectrum of Relative Likelihood](https://aclanthology.org/2024.emnlp-main.564/) (Xu et al., EMNLP 2024)], Xu, Yihuai, et al. \"Training-free LLM-generated Text Detection by Mining Token Probability Sequences.\" The Thirteenth International Conference on Learning Representations. . These are just two examples of which I'm aware, there are probably many more. I am not confident that the authors have done a good literature review and I don't think they have compared their approach to a broad enough set of baselines or the current state of the art (I think all of the comparators are at least eighteen months old, in a fast moving field). What the authors do is upgrade raw average of quantities like log-likelihood to instead look at local patterns in log likelihood, so it is very poor that other papers which have the same overall aim are not included in the baselines.\n4. The Markov random field approach is complicated relative to a simpler Markov chain approach. I would have liked to see the two methods compared.\n5. I strongly disagree with much of the commentary assessing the current state of the field. For example, the authors write 'Our analysis reveals that they share a threshold-based detection criterion, with only minor differences, such as the inclusion of auxiliary data (e.g., perturbed texts).' I find this claim odd, the idea of DetectGPT which moved us from asking 'is the log-likelihood high' to 'is the log-likelihood higher than other texts conveying the same meaning' was revolutionary both conceptually and in terms of performance. The authors' method also uses a threshold-based detection criterion.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "WSnM6Ldbd5", "reviewer": "Reviewer_kDth", "summary": "This paper addresses the issue that token-level detection scores in metric-based LLM-generated text detectors are susceptible to randomness, bias, and instability introduced by the LLM sampling process. To mitigate this, the authors propose a lightweight MRF (Markov Random Field) calibration module that models inter-token dependencies and positional weighting. Using Mean-Field Approximation, the method smooths and stabilizes detection scores, thus improving the reliability of existing statistical detection approaches.", "questions": "See Weaknesses.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The paper clearly identifies the root cause of score bias in metric-based detectors, namely, randomness introduced by the LLM generation process.\n- The proposed method is conceptually simple, computationally efficient, and effective.\n- The experiments are broad and thorough, including challenging setups such as **DetectRL**, and report diagnostic metrics such as **TPR@FPR-1%** in addition to AUROC.", "weaknesses": "- Although the proposed method is intuitive and effective, there is concern about the practical significance of its improvement for statistical detection methods. As shown in Table 2, all metric-based detectors still perform poorly on the challenging DetectRL benchmark, far below the level required for real-world applications.\n- The evaluated detectors are somewhat outdated. Incorporating more advanced methods such as Binoculars [1] and RepreGuard [2] could better showcase the effectiveness of the proposed approach.\n- The proposed MRF module, while effective at mitigating random noise caused by the stochastic sampling process in LLM-generated texts, may not generalize well to adversarial perturbation attacks, such as random character insertion, token shuffling, or deletion. Moreover, I noticed that in the DetectRL setup, the authors only evaluate paraphrasing-based attacks, without considering perturbation-style adversarial attacks. Therefore, it is unclear whether the proposed method is fragile under such conditions. If this is the case, the authors should acknowledge this limitation and discuss potential solutions, which would strengthen the manuscript.\n- The paper lacks comparison with other enhanced metric-based approaches, such as TOCSIN [3].\n\n[1] Spotting LLMs With Binoculars: Zero-Shot Detection of Machine-Generated Text, ICML 2024\n\n[2] RepreGuard: Detecting LLM-Generated Text by Revealing Hidden Representation Patterns, TACL 2025\n\n[3] Zero-Shot Detection of LLM-Generated Text using Token Cohesiveness, EMNLP 2024", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "TugVBesBWe", "reviewer": "Reviewer_Qk3v", "summary": "The authors make an important contribution to zero-shot detection of machine-generated text (MGT). Building on two well-substantiated phenomena—(i) adjacent tokens tend to have similar detection scores, and (ii) detection scores exhibit randomness with typically higher values at the beginning of a sequence—the paper proposes a lightweight calibration method for metric-based MGT detectors. The approach is backed by strong theoretical analysis and extensive empirical validation. The exposition is clear, the methodology is sound, and each claim is convincingly supported by evidence.", "questions": "1. In multilingual settings, does your theory still hold?\n2. Could you include an analysis of **Binoculars**, a SOTA zero-shot detection baseline?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "1. The paper is very well written and logically coherent, with polished and visually appealing figures and tables.\n2. The empirical results are strong and substantiate the authors’ theoretical claims.\n3. The appendix is exceptionally well organized (I particularly appreciate its structure--the table of contents makes the appendix easy to navigate).", "weaknesses": "This paper, in my view, has no particularly obvious weaknesses, and I am casting a clear accept vote. A few minor improvements could further enhance the paper’s quality, though they are not required:\n\n1. **Analyze failure modes.** In Figure 4, I observe performance drops in certain domains. Could the authors provide an empirical analysis of the underlying causes of these degradations?\n2. **Include more attack methods.** The current evaluation considers only paraphrasing, a common attack. Extending the analysis to additional attacks—such as back-translation and synonym substitution—would further strengthen the contribution.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)