D&R: Recovery-based AI-Generated Text Detection via a Single Black-box LLM Call
Authors: Yuxia Sun
Ran Zhang
Aoxiang Sun
Xu Li
Zitao Liu
Jingcai Guo
Venue: ICLR 2026 Poster (2026)
Keywords: AI-generated Text Detection
Large Language Models
Training-free Methods
Black-box Detection
Recovery-based Detection
Robustness
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Large language models (LLMs) generate increasingly human-like text, raising concerns about misinformation and authenticity. Detecting AI-generated text remains challenging: existing methods often underperform, especially on short texts, require probability access unavailable in real-world black-box settings, incur high costs from multiple calls, or fail to generalize across models. 
We propose Disrupt-and-Recover (D\&R), a recovery-based detection framework grounded in posterior concentration. D\&R disrupts text via model-free Within-Chunk Shuffling, performs a single black-box LLM recovery, and measures semantic–structural recovery similarity as a proxy for concentration. This design ensures efficiency, black-box practicality, and is theoretically supported under the concentration assumption. Extensive experiments across four datasets and six source models show that D\&R achieves state-of-the-art performance, with AUROC 0.96 on long texts and 0.87 on short texts, surpassing the strongest baseline by +0.08 and +0.14. D\&R further remains robust under source–recovery mismatch and model variation. Our code and data is available at https://github.com/Yuxia-Sun/D-R.

Published as a conference paper at ICLR 2026
D&R: RECOVERY-BASED AI-GENERATED TEXT DE- TECTION VIA A SINGLE BLACK-BOX LLM CALL
Yuxia Sun', Ran Zhang' Aoxiang Sun", Xu Li', Zitao Jingeai Guo "College of Information Science and Technology. Jinan University, Guangzhou, China "College of Information and Computational Science, Jilin University, China
@Guangdong Institute of Smart Education, Jínan University, Guangzhou, China
'Department of Computing/LSGr The Hong Kong Polytechnic University, Hong Kong SAR tyxsun@email. jnu. edu. en, wwren@stu2024, jnu. edu. en, sunax24 is jlu www..uuuuuu....ee...oo...ee..uu. edu.cm, lixul 0ee000044ssusse jnn. .edu.ed liuzitacl jnu. edu. cn, je-jingcai guoêpo yu.tpplly.ee.. ed. hk
ABSTRACT
Large language models (LLMMs) generate increasingly human-like text, raising concerns about misinformation and authenticity. Detecting Al-generated text remains challenging: existing methods often underperform, especially short texts, require probability access unavailable in real-world black-box settings, in- cur high costs from multiple calls, fail to generalize across models. We propose Disrupt-and-Recove (D&R), a recovery-based detection framework grounded in posterior concentration. D&R disrupts text via model-free Within-Chunk Shuffling, performs single black-box LLM recovery, and measures seman- tic-structural recovery similarity as proxy for concentration. This design en- sures efficiency, black-box practicality, and is theoretically supported under the concentration assumption. Extensive experiments across four datasets and six source models show that D&R achieves state-of-the-art performance, with AU- ROC 0.96 on long texts and 0.87 on short texts, surpassing the strongest base- line by +0.08 and +0.14. D&R further remains robust under source-recover, mismatch and model variation. Our code and data is available at https: //github. com Yuwiiiiuuna-na-...
INTRODUCTION
Large language models (LLMs) have rapidly advanced generate human-like text across domains such as education, news, scientific writing, and online communication. While these advances create tremendous opportunities, they also raise serious concerns about misinformation, academic integrity, and content authenticity, making reliable Al-generated text detection increasingly crucial. However, this task remains highly challenging. Real-world applications require detectors that can efficiently scale to large volumes of text with minimal overhead, for example by reducing LLM calls. They must remain robust to evolving and diverse source models while operating in black-box settings without probability access. They must also handle varied text lengths, with short texts being par- ticularly difficult. These challenges underscore the need for detection framework that not only accurate but also efficient, black-bor practical, generalizable, and robust.
Despite recent progress, the performance of cxisting AI-text detectors remains far from satisfactory. common long-text settings. Likelihood- and entropy- based methods (Gehrmann et al. 2019 Hashimoto et al. 2019) rely on white-box access to model probabilitics, making them impractical
for black-box settings. Perturbation- and continuation-basee methods (Bao et al. 2024 Yang al., 2024) may improve accuracy, and rewriting baariting--bsed methods (Mao et al.) 2024 Park et al. 2025 avoid probability access, but all require multiple model calls, incurring high computationa showing instability (particularly on short texts). Supervised classifiers (OpenAI 2019) lack gener- alization and require costly labels, while watermarking detectors (Zhao et 2024) heavily depend
and
Jinncaa Guo is the corresponding author.

---

Published as a conference paper at ICLR 2026
Tong
shuf
T rec
Within-Chunk Shuffling
Single-cal call recovery
Semantic & Structural
Similarity (Trer Twyg
Tery from
deepseek
(F1, t, p)
Classifier
Tany from Human
Al- Al-generated Text
Human-writte Text
this stuefy we suncy and campane vanous techniquues teeaturee onfance monce without additional innotaated real approohhe primartly spaliing
work restew and comn pawe fifrent techn quees awadatde the interture
Original Tong
improve traiiing results acquirnng additional and
presens ng
This goot mostly achieved apphying trnstation-sreeeene
mg
greensting systhens
coeoting
ques survey
tralving
zvalabble fteesture without different anterteed
technnquue
Shuffled Toud
from vericse etharse. cnnotution sserving trache upp hes data trnn formattte setthctic selasets gr marly to applying ng coisiig These genersingg
world
greating by by Eate pentheticall ectreved Thes
tiks resuis worli
vntitional the
grssendin assfery trensforre medien more date to seaiity
in this wtiyy we compa and surnery varioue techniques in the rnte thar
this work we reseew strevent techriques wodiadre in liteoturee to compone results without additinal anroctated ditta and improve training asquiring real- amoid goal mortly oelveedd by consting dama os appluing
Recovered Twe
crhance traring paffor munce without rezu ring adcitional annotated real world
cata These apprectess primsrlly inutte applying aneettstoonspreeevnn
tronsfomatios to cesting sotoscts or generscing syichetic data.
annotation pr ese neiii tonssoor nations to cxisting data more.
Similarity
(F1. p) 0.98; 0.99; 0.98
(FI. O. 90; 0.76; 0.88
Prediction
Torta
Human
Tars
Figure 1: Illustration of D&R. Top: pipeline overview. Bottom: Al vs. Human examples. In the Shuffleed Tahur, individual chunks are highlighted with alternating solid and dashed underlines. Al text is recovered with fewer errors/higher similarity (green), whereas Human text shows more errors/lower similarity (red). The curves below each column schematically show recovery outcomes across examples: recoveries from Al-generated text concentrate more sharply around Tarig, while those from writeewritten text more dispersed.
on model providers. Consequently, no existing method simultaneously delivers high performance while satisfying the demands of efficiency, black-box practicality, generalizability, and robustness.
To address these limitations, we propose framework grounded in the observation of posterior concentration: when text disrupted in way consistent with LLM pretraining biases, Al-generated text yields LLM-based recoveries that con- centrate more sharply around the original text Tong. whereas wurtte- text produces more dispersed recoveries. D&R follows three key steps: (i) apply model-free disruption, Within-Chunk Shuffling (WCS), which aligns with pretraining objectives and constrains recovery to a reduced can- didate space; (ii) perform single black-box recovery call, avoiding the inefficiency of multi-call methods; and (ii) compute semantic and structural recovery similaritics between the recovered and original text, which serve as observable proxies for posterior concentration. These similarities then passed to a lightweight binary classifier to output the final prediction. As illustrated in Fig- ure I AI text (left) recovers with higher similarity and more concentrated outcomes near Torig while Human text (right) shows lower similarity and more dispersed recoveries. Building on this concentration assumption, we establish the theoretical foundation of D&R. We then validate its ef- fectiveness, robustness, and usability through extensive experiments across diverse datasets, source models, and scenarios.
ciirppt-andRecooed (D&R), a recovery-based detection
This paper makes the following four contributions:
We introduce D&R, novel detection framework that employs model-free disruption, Within-Chunk Shuffling (WCS), conceptually aligned with the inductive biases of LLM pretraining, and ensures efficiency through single black-box recovery call.
We propose the Concentration Assumption and design semantic-structun recovery simi- larity metrics as faithful proxies for posterior concentration, providing the theoretical ratio- nale for D&R.
We conduct extensive experiments against eleven representative baselines across diverse datasets and source models, showing that D&R achieves state-of-the-at detection and con- sistently surpasses the strongest baseline (RAIDAR) by a significant margin.
We further show that D&R remains robust and practical in challenging scenarios, including short texts, source-recovery model mismatch, and rocovery-model variation.
2

---

Published as a conference paper at ICLR 2026
2 RELATED WORK
Zero-shot detectors. Zero-shot detectors avoid large labeled datasets and instead exploit unsu- pervised signals such as probabilities or perturbations. Likelihood- and entropy-based methods (Hashimoto et al. 2019; Gehrmann et al. 2019) depend on model probability distributions, making them inherently white-box detectors. To address these limitations, recent works propose estimating
blxck-box logits via proxy model tuning (Zng et al. 2024). utilizing qual-model scoring (Hans)
al. 2024), or analyzing intrinsic features by pre-trained models (Yu et al. 2024). Perturbation- based approaches such as DetectGPT (Mitchell et al.) 2023) analyze the log- log-likelihood curvature
of perturbed passages, with the state-of-the-art variant Fast- Fast-DerectGPT (Bao al., 2024) improv- ing both accuracy and efficiency. NPR (Su et al. 2023) also leverages paraphrasing but measures residual signals, and is less effective than Fast- DetectGT.. Continuation-base methods such as
DNA-GPT (Ynng et al. (2024) truncate the text and regenerate the suffix for comparison. Rewriting- based RAIDAR (Mao et al. 2024) generates paraphrased versions entire passages and measures consistency via edit distances between versions, but it requires multiple model calls, depends on a specific paraphraser, and is vulnerable to prompt-level manipulations. Among these, RAIDAR conoommaiioonccoiistneee--e
most relevant our D&R, as both rely on sistency under transformations such as paraphrasing or shuffling-rcoover, recovery.. In contrast to existing generative methods (e.g.. perturbation-, continuation-, and rewriting- -bsed ones), D&R achieves detection with only single model call.
textual con-
Non-zero-shot detectors. Non-zero-shon detectors rely on supervised discriminative models trained with large labeled datasets. Representative examples include RoBERTa-base classifiers (Liu et al., 2019), and the OpenAl Text Classifier (OpenAl 2019), alongside recent frameworks utilizing multi- level contrastive learning (Guo et al. 2024). stylistic alignment (Chen et al. (025), or out-of- distribution detection on human texts (Zeng et al. 2025). These approaches can achieve strong in-domain accuracy but generalize poorly to unseen generation models and require costly labeling and frequent retraining as LLMs evolve. Another line of work explores watermarking (Zhao et al.,
2024 Kirchenbauer et al. 2023), which embeds detectable signatures during generation. However, watermarking depends on model providers and is unsuitable for post-hoc detection.
3 METHOD
Our D&R method follows the pipeline shown Algorithm [ First, we introduce a semantic- preserving disruption, Within-Chunk Shuffling. which aligns with LLM pretraining objectives by constraining the recovery problem to a locally permuted candidate space. Second, we perform a single LLM call recover the text. Next, we compute both semantic and structural similarities between the recovered and source texts, and use these similarities as observable recoverability met- rics. Finally, we train binary classifier on the recoverability metries of labeled Al-generated and human-written texts, and apply it to obtain detection results.
Algorithm D&R Pipeline
1: Input: Original text Tongg black-box LLM M
2: Output: Prediction y (Human, Al]
3: for each chunk 6; in Torig do
4: ca +- Shuffle (oonffe(Tokes(c))
b Apply Within-Chunk Shuffling
5: end for
6: Tanaf +- Join((ctuu))
b Obtain disruption result Single-call recovery
7: Tree t- M.Recover(T
8: Fi + SemanticSim/ ( Tree)
Compute semantic similarity
9: (T.p) StructuralSim Torig Tree)
Compute structural similarity
10: + (aassifie([F11....
Predict label
return
Intuitively, recovery outcomes for Al-generated text within this constrained space tend to be highly concentrated, whereas numan-written text yields more dispersed results due to the diversity of writ- ing processes. This concentration gap be characterized by the notion of posterior concentration,
3

---

Published as a conference paper at ICLR 2026
which provides the theoretical rationale behind our method and is, in practice, approximated by recovery similarity metrics.
A key design in D&R is the disruption step. which determines the nature of the subsequent recov- cry task. We adopt Within-Chuee Shuffling (WCS), where the original text Torig segmented into chunks by punctuation marks, and tokens within each chunk are randomly permuted while preserv- ing chunk order. This disruption requires no model calls and can be implemented with a simple random shuffling function.
The advantage of WCS is that it constrains recovery to locally permuted candidate space rather than the unconstrained generative space, closely aligning with pretraining objectives that emphasize predicting local token orderings. As a result, recovery under WCS becomes almost effortless for the LLM, akin recalling the original token order, leading recovered texts that lic very close the source. In distributional terms, Al-generated text tends to yield recovery outcomes that are highly concentrated near the original text, i.e., exhibiting strong posterior concentration, whereas human- written text produces more dispersed recoveries due to greater variability in writing processes.
Formally, as Algorithm [aaritthmmshnne shows, shows, we segment Torig into chunks by punctuation, apply a random per- mutation to the tokens within each chunk, and then join the shuffled chunks to obtain the disrupted text Tatufs which is used as the input for the subsequent recovery step.
3.1 RECOVERY WITH SINGLE LLM CALL
After disruption, the shuffled text Tahut is passed to a large language model for recovery. We perform this step with a single LLM call, where the model is prompted to restore token order and reconstruct a coherent version of the original text Tre- A typical recovery prompt is:
The following text has its tokens shuffled within spans. Please restore the correct word order without adding or removing words: [INPUT].
This single-call design is both more efficient than multi-call approaches and well aligned with LLM pretraining priors, as predicting local token order is a task for which pretrained models are already highly competent. In practice, recovery can be performed either (i) via API calls to black-box LLMs (c.g.. Dee)Seek-v3), or (ii) via local inference with smaller models (c.g., Mistral 7B). Importantly, D&R achieves strong performance in both settings, demonstrating robustness and cost- effectiveness, property we further validate in our Recovery-Mode Independence experiments (see Section 4.3). Formally, given disrupted input Tahut and recovery model M, the recovered text obtained in Algorithm
3.2 RECOVERABILITY METRICS
Given original text Torig and its recovered counterpart Tree quantify recoverability using two complementary forms of recovery similarity: semantic and structural.
Semantic similarity. We adopt BERTScore (Zhang et al. 2020), which measures token-level seman- tic overlap by comparing contextual embeddings from a pre-trained transformer seert-baseunncann Devlin et al. 2019). Let and denote the number of tokens in Tonig and Trec respectively; {x; ym
and {yz 1= their contextual embeddings; and cos(:.) .) the cosine similarity. Semantic similarity is defined by the F1 score calculated from BScore's precision and recall:
1 max cos( Fl
2PR P R
Precision (P) max cos(24 W;),
Recall (R)
Structural similarity. We measure word-order consistency using Kendall's (Kendall 1938 Chen et al. 2023) and Spearman's a (Spearman) 1904 Guo et al. 2025). two rank-based correlation coefficients applied to token orderings. When m + n or tokens repeat, we first construct a one- to-one alignment A
j+) S [m] in] (e.g., via Subsequence (LCS) with left-to-right stable matching). and then compute ranks 1 = i and 8; = jk for k = 1, 1,.... where C and D denote the numbers of concordant and discordant pairs among the
Longest Common
4

---

Published as a conference paper at ICLR 2026
aligned indices.
C- (() ==
6 6E 8k)2
((2-
Semantic similarity captures fidelity of meaning, while structural similarity assesses reconstruction of word order. Together, higher values indicate the recovered text stays closer to the source both semantically and structurally. Thus, these complementary metrics provide observable signals of recoverability.
Sanity check We conducted a lightweight evaluation of our metrics on the ML-Arriv-PPapen dataset (arXiv.org submitters 2024) by sampling 1,000 Al-generated and 1,000 human-written texts. For each text, we computed recovery similarity with three metries (BERTScore FI, Kendall's т, and Spearman's p) and plotted their distributions in Figure Al-generated texts consistently ex- hibit higher average similarity scores than human-writted texts, revealing clear distributional gaps across all metries. Thus, our recoverubility metrics are effective for distinguishing Al Al-generated from Human--rillen text.
BERTScore F1
Kendall's
Spearman's
3.0
Density
Density
0.5
0.0
0.2
0.4
0.6
0.8
1.0
0.0
0.5
1.0
-0.5
0.0
0.5
Lo
Similarity
Similanty
Similarity
Figure 2: Distributions of recovery similarity scores 1,000 ML-ArXiv-Paper samples. AI- generated texts show a clear trend toward higher scores than human-writter texts across metrics: BERTScore Fl, Kendall's т, and Spearman's p.
We conducted another lightweight evaluation on the ML-ArXiv- Paperss dataset (arXiv.org submitters] 2024), varying the temperature of the recovery model to control out- put concentration, where the temperature is decoding hyperparameter in the inference API (lower values yield more concentrated outputs, while higher values yield more dispersed ones). As shown in Figure B recovery similarity scores across all metries decrease temperature increases, demon- strating a positive correlation with posterior concentration. This confirms that our recoverubility metrics provide observable proxies for posterior concentration.
Sanity check 2.
Kendil''s
Spearman's
0.32
0.750
0.55
0.0
0.735
0.44
Simaamy
Sindlant antaa
Simsanty
0.76
0.50
0.24
0.690
0.78
0.72
0.625
0.70
0.7
Temperature
Tomperature
Tomperature
Figure 3: Recovery similarity scores 1,000 ML-ArXiv-Papers samples across recovery-model temperature settings. Scores track posterior concentration: lower temperatures yield higher concen- tration and similarity, whereas higher temperatures reduce both across all metrics.

---

Published as a conference paper at ICLR 2026
3.3 THEORETICAL ANALYSIS AND PROOF
3.3.1 THEORETICAL RATIONALE
Concentration Assumption: Following disruption that preserves semantics while respecting the inductive biases of LLM pretraining (e.g., Within-Chunk Shuffling), the distribution of LLM-based recovery outputs for Al-generated text is more concentrated in the vicinity of the original text, whereas the distribution for human-written text is more dispersed.
Crucially, since posterior concentration is distributional property that cannot be directly observed in single-call recovery, D&R indirectly estimates it from single recovery sample Tre by comput- ing its similarity S to the original text Torig. We prove below that Recovery similarity is faithful proxy for posterior concentration, yielding a non-trivinn gap between Al-and Homan-written texts.
SETUP
Let M be the recovery model, Torig the original text, Tatut its WCS-disrupted version, and Tree M(- Taauu) recovered sample. Define distance d(s, )) 2 0 (e.g., normalized Kendall distance) when texts match.
and bounded similarity - [0. 1] with
The posterior is (r, -cconcentttt if Pr(d(TTrig Tree) S r) 1- Assume S is continuous in d with modulus of continuity w(),, ie.. ((Torgg u) 2 w(d(Tangg ui), Vu, with (0) and w con-decrea (e.g., w(t) Lt).
Theorem 1 (Posterior concentration = high recovery similarity). If the recovery posterior is (r, 6) concentrated, then with probability at least 1 1- (Tanig Tre) 2 1 1-w(r), and consequently,
E [TS(T Tro))] 2 (1 5) - w()))
Proof. Define A = (Tre doTon Tea) I r). By posterior concentration, Pr(A) 2 8. For Tre E A, the continuity of S gives S > 111--h (r). For Troe & A, we only know S 2 0. Hence E[S] 2 (1 - (()))) 2 (1 (1-w() ((r)((r)(
Theorem 2 (Non-trivial gap under Concentration Assumption). Let T and T-Human denote AI-
generated and human-written texts. Suppose their recovery posteriors are (r 8 and (rH,ôн) concentrated, respectively. Assume there exists dg > 0 and c > O such that the expected similarity
for human text satisfies: E[S(TTummnn T TTHuman]] < (1 5u) - (r.))), and (1 (1-6A)(1 w(rx)) 2
(1 8H (1 w(TH)) ) + 2e. Furthermore, assume the compatibility condition åh 2 60 6н
[-w(re) holds and (r S w(TH). Then
LES TAA 2 B[S(T
Humany
} t
arigt
orig
Proof. By Theorem 1, 1, > (1-5A)(1 wr by the assumption, H[SHumau] < (1-66)(1-
w(TH)) ). Therefore, [ H[SHum!ul 2 (1 oH) w(TH)) + (1 8o) (1- w(HH))
(1 (T ÓH) + 2c 2 E. 0
Consequences for Metrics. - Kendall r: 1- 2d, so (r) 2r. -Spearmnn p: If at most fraction r of ranks are perturbed, then 1 - p I cer, hence w(r) cer. BERTScore FI: WCS preserves token sets; embedding drift under local permutations is bounded by Lyem?, hence (() Lyem r.
Takeaway. Theorem 1 shows that posterior concentration entails high recovery similarity: as r + and 8 0, S 1. Theorem 2 shows that under the Concentration Assumption, AI texts achieve strictly higher expected recovery similarity than human texts by margin c. Thus recovery similar- ity is a faithful proxy for posterior concentration, providing the theoretical foundation for D&R. We provide a detailed discussion on the validity of the assumptions underlying Theorem 2 in Ap- pendix A.2
3.3.2 COMPUTATIONAL OVERHEAD.
The efficiency of D&R stems from requiring only single black- LLM call. Its time overhead TDRR = Tahume + TiLM + Timilarit- where the shuffling cost is negligible (Tshmite se 0) and the similarity scoring cost is much smaller than LLM call (Tsimilarity & TLIM), the overall cost is

---

Published as a conference paper at ICLR 2026
dominated by one call. In contrast, existing generative methods (e.g., perturbation-, continuation- or rewriting-base based) require multiple calls, performing & > queries with overhead T Thseelnee = k-TLLM+ T Textra which scales O(k T.LM). Thus, D&R lowers detection overhead to O(TLL)), providing linear efficiency gains without additional assumptions. Empirical validation of these efficiency gains provided in Appendix A.4 A.4
EXPERIMENTS
We evaluate D&R against representative baselines on long-text datasets, with ablations of recover- ability metrics, and further analyze its usability and robustness in challenging real-world scenarios including short texts, source-rees source-recovery recovery model mismatch, and recovery LLM variation, providing a comprehensive assessment of its effectiveness.
4.1 SETTINGS
Datasets and Metries. To evaluate the performance of the D&R method on paragraph-Ievel AI- generated text detection, we use six publicly available datasets spanning different text lengths and domains. Based on average text length, we group them into long texts (>800 words) and short texts
(<350 words), with dataset-wise length distributions shown in Figure [5] The long-text group in- cludes ML-ArXiv-Paper articles) (See et al., (017)) IMDB (movie reviews) (Maas et al.J 2011D. and ROCStories (five- sentence stories) (Mostafazadch et al. 2016); the short-text group includes Wikihow (instructional guides) SSentence-Transfommeee Transformers) 2020), AG-News (news headlines and summaries) (Zhang et al., 2013). and Reddit geeeerreee posts)
(research abstracts) (arXiv.org submitters, 2024). CNN-DailyMai (news
2021). For each dataset, we sam- ple 1,000 human-written texts as negatives and generate AT counterparts of comparable length via paraphrasing prompts from different source models, ensuring balanced parallel datasets. To mimic diverse real-world source models, we use six widely adopted LLMs from different providers: GPT-2 Solaiman et al. 2019), GPT-Nco-2.7B (Black et al. 202I), Owen-Turbo (Yang et al. 2025), GPT- 4.1 [ 2025). Gemini2.5-Flash (Comanici al. 2025). and Grok3 2025). Detection performance is measured with the area under the ROC curve (AUROC) (Fawcett) (006), which reflects the probability that the detector ranks an Al Al-gererte text above a human- human-written written one.
Baselines. We compare D&R against eleven representative baselines spanning all major families of Al Al-generated text detection. These include the rewriting-based RAIDAR (Mao et al.. (222),, most closely related to our method; the perturbation- based Fast-DetectGPTT (Bao et al.] (0224). the state of the art in this family; the continuation based DNA-GPT (Yang et al. 2024); the likelihood-basee method (Hashimoto et al. 2019); recent works such as Binoculars (Hans et al. 2024], DALD Zeng et al. 2024), and Text Fluoroscopy Yu et al. 2024). Finally, we compare against supervised and learnin-bbaeed detectors, including the RoBERTa classifier (OpenAI 2019). Detective (Guo al.
2024) Imitate Before Detect (Chen et al. 2025), and Human-Outlier OOD detection (Zeng et al,
2025 In the main experiments, report results against all eleven baselines for comprehensive coverage. For additional experimental analyses, we focus on the strongest baselines and report results only against RAIDAR and Fast-DetectGPT. Baseline configurations follow their original papers, unless otherwise specified.
4.2 MAIN RESULTS
Detection Performance. We compare D&R with eleven representative baselines on four long-text datasets across six source models, reporting AUROC performance in Table [ and their visualization in Figure For fairness, the same transformation model (DeepSeek-v3)) is used for RAIDAR's 's para- phrasing and D&R's 's recovery. As shown in Table D&R achieves the highest mean AUROC with the lowest variance (0. 00.0602-000351,, substantially outperforming all baselines in both accuracy and stability. Figure 4 further illustrates that D&R's 's advantage holds consistently, while baselines not only perform worse but also fluctuate with dataset and source model shifts. For instance, on ML- ArXiv-Papest when the source model changes from GPT-2 the more advanced Grok-3, RAIDAR drops from about 0.90 to 0.77, whereas D&R remains stable above 0.95. These results demonstrate that D&R is robust and effective zero-shot detector for long-text scenarios.

---

Published as a conference paper at ICLR 2026
Table 1: SD AUROC on four long-text datasets, averaged over six source models, using DeepSeek-v3 as the recovery model. The first two entries are traditional methods, while the remain- ing baselines represent recent state-of-the-art approaches from top venues (NeurIPS, ICML, ACL, EMNLP, ICLR), followed by our proposed D&R. Detailed per-dataset results are provided in Ap- pendix A.5
Datasct
RoBERTa-based
Likelihood
Dald
0OD-based
ML-ArXiv-Papen
0.6195:10.143
0.6628:10. 1667
0.783810. 1441
0.7648:10. 1323
MNi-DailMaail
0.6174+0.1156
0.5786:+:0
0.7336=0.0992
0.6203=001700
IMDB
0.611411.1273
0.6617100.108
0.6941110.130
0.8392-10.0773
ROCStories
0.7675-t0.1182
0.5852:+0.2158
0.6084:0.2515
0.9109==0.0694
Avg.
0.6539:E0.1499
0.6221:50.1633
0.7050:50.1113
0.7838-50.1375
Datasel
ImBD
Text Fluoroscopy
DeTeCtive
Binoculars
ML-ArXiv-Papert
0.7693100096
48266.10.136
0.7772.10. 1121
0.6435100 1406
CNN-DailyMail
0.8115++0.1248
0.8905::000762
0.8295:00.11
0.5333++0. 1044
1MDB
0.8424=:009557
0.8917::00021
0.8452:40.040)
0.6650=000990
ROCStories
0.7185-10.1451
0.739910.1053
0.8756.10.0917
0.5054:10.14 1487
Aug.
6.7857-50.0905
0.8372-50.0951
0.8319-00:800
0.5868E000962
Dataset
DNA-GPT
Fast- Fast-DetectGPT
RAIDAR
D&R(ours)
ML-ArXix-Paper
0.640010.1700
0.7242:10.1455
0.8611
0.9266110.034
CNN- Mail
0.5953:10.169
0.5838:10.
0.8471
0.9830:10.006.
IMDB
0.649110.1291
0.7277110.1775
0.867510000552
0,945110.0314
ROCStories
0.6231+:.2002
0.6385:t0.1855
0.9323#0.0482
0.9861=0000115
Aug.
0.6269:t0.1697
0.6685:t0.1588
0.8770+0.0057
0.9602-100051
ROCSianis
0.8
92-
0.8
0.7
AUROC
AUROC
9.6
tne
0.4
3.5
OP72
arRieed 19
(PR
Ammint.pp Space
un12
Opeen Radio
Jemiall A-Plab
UPFAve--11 70
an1
OoeerTude
GP14
Qhem
Sousee
8-10
Figure 4: AUROC scatter plot on four long-text datasets across six source models, complementing the averaged results in Table
Ablation Study. We examine the contribution of semantic and structural recovery similarities through an ablation study on four long-text datasets with advanced source models. As shown in Table 7 removing semantic similarity results in the largest performance drop (128.1%) 1%), while re- moving structural similarity also yields substantial decrease (119.8%). The full model achieves an AUROC of 0.9614, demonstrating that both forms of recovery similarity are indispensable and that their combination ensures state-of-the-art accuracy and stability. We also experimentally showed that our Within-Chunk Shuffling (WCS) is optimal compared to global or chunk-order shuffling, effectively striking an optimal balance in the recovery task difficulty maximize the concentration gap, detailed analyses for these experiments are provided in Appendix A.3.2
4.3 ANALYSIS
Short-text Robustness. Short texts are particularly challenging for Al-generated text detection, as the limited context amplifies the distributional overlap between human and machine outputs. As shown in Table 2 D&R achieves the highest mean AUROC with low variance (1.88774000888) sig- nificantly outperforming RAIDAR and Fast-DetectGPT by margins of 0.14 and 0.21, respectively. The advantage is most pronounced on earlier source models (GPT-2, GPT-Nco-2.7B), where D&R attains near-perfect AUROC scores (around 0.99), while stronger models performance declines
8

---

Published as a conference paper at ICLR 2026
for all methods but D&R still maintains clear margins. These results underscore D&R's consistent superiority on short-text detection and its resilience across both weaker and stronger generators.
Table 2: AUROC performance on three Seort-Text datasets across six source models. For each dataset, results from two earlier models (GPT-2, GPT-Nco-2.7BB and four more advanced models (Qwen-Turbo, GPT-4.1, Gemini 2.5, Grok-3) are separated by a dotted line.
Method
Dataset
Source Model
Fast-DetectGPT
RATDAR
D&R (ours)
GPT2
0.7449
0,7800
0.9904
GPT-Neo-2.7B
0.7936
0,7743
0.9987
Wikihow
Qwen-Turhy
0.5193
0.5300
0.7363
GPT4.1
0.4551
0,5700
0.7850
Gemini2.5-Flash
0.4370
0.7550
0.8517
Gro33
0.4719
0.6950
0.7727
GPT2
0.7780
0.7231
0.9886
GPT-Neo-2.7B
0.7932
0.7524
0,9982
AG-News
Qwen- Turbo
0.7542
0.6850
0.7666
GPT4.1
0.5819
0.6735
0.8202
Gemini2.5-Flash
0,6898
0.7776
0.8835
Grok3
0.6439
0.7375
0.7963
GPT2
0.7043
0.7649
0.9271
GPT-Neo-2.7B
0.7259
0.7947
0.9586
Reddit
Qwen-Turb
0.6852
0,7310
0.7502
GPT4.
0.6406
0,7429
0.8451
Gemini2.55Flaat
0.7007
0.7810
0.9007
Grok3
0.6916
0.7800
0.8672
Meani-SD
0.6561:00.129
0.7248.10.0007
0.8687-10.066
Source-model Agnosticism (Robustness under Model Mismatch). As transformation- consistency based detectors, both D&R and RAIDAR rely on a transformation model to recover paraphrase the text generated by source model. Although neither method requires explicit knowledge of the source model, performance can depend on whether the source and transformation models are the same. We therefore evaluate two cases: (i) the same-source case (src=1rx), eas- ier, pseudo-white-bon setting in which the detector can implicitly benefit from the source model's distributional biases; and (ii) the different-source case (sve*trxx) more realistic heterogeneous pairing. As shown in Table 3, across both settings, our D&R consistently outperforms RAIDAR. Moreover, under the different-source condition, D&R degrades only 0.1-3.3% degradation (mean 1.9%), whereas RAIDAR drops by 4.2-14.2%% (mean 9,4%). These results demonstrate that D&R source-agnostic: it does not rely on knowledge of the source model, remaining markedly more robust than RAIDAR under model mismatch.
Table 3: AUROC performance under same different formation model (frx) is fixed as DeepSeek-v3. For the 'Same' case (src=frx), the source model equals the transformation model; for the 'Different' case (sre=ftxx) results averaged over six diverse source models listed in Table
Pairings. The trans-
RAIDAR
D&R (owrx)
Dataset
Same (5tc=trx)
Different (sxc)frrx)
Same (s70=1rx))
Different (src/ftrx)
Ml.-ArXiv-Paper
0,9475
0.8611
19.1%
0.9590
0.9266
13.3%
CNN-DailyMail
0.9875
0.8471
114.2%
0.9943
0.9830
[1.1 %
IMDB
0.9675
0.8675
110.3%
0,9770
0.9451
13.2%
ROCStories
0.9825
0,9412
14.2%
0.9869
0.9865
10.1 %
Average
0.9712
0.8792
19.4%
0.9793
0.9603
11.9%
Recovery-model Independence (API-based vs. Local LLMs). We examine whether D&R de- pends the choice of recovery model. In addition to DeepSeek-v3 (the API-based recovery model used in the main experiments). we evaluate Mistral- Diistral-B--nnstuutt-vv Instruct-v0.3 as a locally deployed recov- ery model. As shown in Table 4. D&R maintains strong performance (mean AUROC 0.9614 0.9359), with only ~2.5% degradation when switching from large API model to a smaller local model. Importantly, D&R with Mistral-7B still outperforms RAIDAR when RAIDAD relies

---

Published as a conference paper at ICLR 2026
the larger DeepSeek-v3 as the recovery model (data omitted for brevity). These results demonstrate that D&R is robust across recovery-mon model families and scales, and remains practically deployable with smaller local models.
Table 4: AUROC performance with two Recovery Models: DeepSeek-v3 (API-based) and Mistral- 7B- 1B-I (local).
DeepSeek-v3 (API-hased)
Mistral-7B (Local)
Dataset
Source Model
D&R
RAIDAR
D&R
Qwen-Turho
0.8580
0.8375
0.8039
GPT4.1
0,9108
0.8600
0,8656
ML-ArXiv-Paper
Gemini2.5-Flaste
0,9299
0,9025
0,8972
Grok3
0.9559
0.7700
0.81177
Qwen-Turbo
0,9800
0.8300
0,9800
GPT4,
0.9908
0,9125
0.9844
CNilDailyMail
Gemini2.5-Flash
0,9901
0,9325
0,9862
Grok3
0.9856
0.8725
0.9784
Qwen-Turbo
0,9584
0.8400
0.9381
GPT4. Gemini2.5-Flash
0,9456
0.8600
0,9289
IMDB
0.9890
0.9475
0.9713
Grok3
0,9688
0.9275
0.9398
Qwen-Turbo
0.9667
0.8725
0.9522
ROCStories
Gemini2.5
GPT4.1
0,9851
0.9849
0,9150
0.9500
0,9818
0.9758
Grok3
0.9842
0.8875
0.9752
Mcan=tSD
0.9614::0.0300
0.8823=:00075
0.9359::0.0579
Further Robustness and Generalization. To thoroughly evaluate D&R's applicability, tended our experiments to two additional settings: (i) Adversarial Robustness: On the RAID benchmark (Dugan et al. 2024). D&R retains high efficacy (AUROC 0.87) and proves resilient against 11 varying attack categories, most notably paraphrasing. (ii) Multilingual Generalization: Experiments on German, Spanish, and French confirmed that D&R generalizes effectively beyond English, achieving > 0.93 AUROC on long texts. Detailed results and analyses for these experi- ments are provided in Appendix
CONCLUSION
Disrupt-and-Rent Recovve (D&R) provides an efficient, black-box practical, and theoretically grounded framework for Al-text detection, achieving state-of-the-art accuracy and robustness across diverse settings, with particularly strong gains on short texts. Beyond these empirical results, D&R high- lights posterior concentration a guiding principle, opening new directions for disruption- recovery approaches across broader modalities and detection tasks. Detecting extremely short texts remains challenging as limited context obscures the concentration gap. Future work will address this via finer-grained disruption and retrieval-augmented signals to enhance sensitivity.
ACKNOWLEDGEMENTS
We would like to thank the anonymous reviewers for their valuable feedback. This work was sup- ported by the Hong Kong RGC General Research Fund (15221123 and 15216424), the PolyU Inter- nal Fund (No. P0058468), the Huawei Gifted Fund, and the Key Laboratory of Smart Education of Guangdong Higher Education Institutes, Jinan University (2022LSY5003).
ETHICS STATEMENT
All authors confirm adherence to the ICLR Code of Ethics. This work develops a detection method for Al-generated text to support research transparency and reliability of language models. The method is designed as a technical tool to complement human judgment, and results should be inter- preted with appropriate caution.
10

---

Published as a conference paper at ICLR 2026
REPRODUCIBILITY STATEMENT
We provide an anonymous repository with source code, datasets, and a requirements file specifying software dependencies. The experimental setup is described in the main text, and dataset sources and preprocessing are documented in Appendix|A.6r the repository. These resources are intended facilitate independent verification of our findings.
REFERENCES
arXiv.org submitters, MI-arxiv dataset, 2024. URL httpLtttss///ugggggg....././aaaa
SShorten/ML-ArXiin
Guangsheng Bao, Yanbin Zhao, Zhiyang Teng, Linyi Yang, and Yue Zhang. Fast-detectGPT: Effi- cient zero-shot detection of machine- machine-generaaed text via conditional probability curvature. In The Twelfth International Conference Learning Representations, 2024.
Sid Black, Leo Gao, Phil Wang, Connor Leahy, and Stella Biderman. GPT-Neo: Large Scale Au- toregressive Language Modeling with Mesh-Tensorflow, March 2021.
Jiaqi Chen, Xiaoye Zhu, Tianyang Liu, Ying Chen, Chen Xinhui, Yiwen Yuan, Chak Tou Leong, Zuchao Li, Long Tang, Lei Zhang, et al. Imitate before detect: Aligning machine stylistic pref- erence for machine-revised text detection. In Proceedings of the AAAI Conference Artificial Intelligence, pp. 23559-23567, 2025.
Yi Chen, Rui Wang, Haiyun Jiang, Shuming Shi, and Ruifeng Xu. Exploring the use of large language models for reference-free text quality evaluation: An empirical study. In Findings of the Association for Computational Linguistics: IJCNLP-AACL 2023 (Findings), pp. 361-374. Association for Computational Linguistics, 2023.
Gheorghe Comanici, Eric Bieber, Mike Schackermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Marcel Blistein, Ori Ram, Dan Zhang. Evan Rosen, al. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capa- bilities. arXiv preprint arXiv:2507.0626/ 2025.
Jacob Devlin, Ming- Ming-Wei Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume (long and short papers), pp.
2019.
Liam Dugan, Alyssa Hwang, Filip Trhlik, Andrew Zhu, Josh Magnus Ludan, Hainiu Xu, Daphne Ippolito, and Chris Calrison-Burch. Raid: shared benchmark for robust evaluation of machine- generated text detectors. In Proceedings of the 62nd Annual Meeting of the Association for Com- putational Linguistics (Volume 1: Long Papers), pp. 12463-12492 2024.
Tom Fawcett. An introduction to roc analysis. Pattern Recognition Letters, 27(8):861-874 2006. 2006.
Sebastian Gehrmann, Hendrik Strobelt, and Alexander Rush. GLTR: Statistical detection and vi- sualization of generated text. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics: System Demonstrations. Association for Computational Linguistics,
2019.
Xun Guo, Yongxin He, Shan Zhang, Ting Zhang, Wanquan Feng, Haibin Huang, and Chongyang Ma. Detective: Detecting ai-generated text via multi-level contrastive learning. Advances in Neural Information Processing Systems, 37:88320-88347, 2024.
Yuchen Guo, Zhicheng Dou, Huy H Nguyen, Ching-Chur Chang, Saku Sugawara, and Isao Echizen. Measuring human involvement ai-generated text: case study on academic writing. arXiv preprint arXiv:2506.0355 2025.
Abhimanyu Hans, Avi Schwarzschild, Valeriaa Cherepanova, Hamid Kazemi, Aniruddha Saha, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Spotting llms with binoculars: Zero-shot detection of machine-generater text. arXiv preprint arXiv:2401.12077 2024.

---

Published as a conference paper at ICLR 2026
Tatsunori B Hashimoto, Hugh Zhang, and Percy Liang. Unifying human and statistical evaluation for natural language generation. arXiv preprint arXiv:1904.02792 2019.
M. G. Kendall. A new measure of rank correlation. Biometrika, 30(112):81 1938.
Phillip Keung, Yichao Lu, György Szarvas, and Noah A. Smith. The multilingual amazon reviews corpus. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing, 2020.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, lan Miers, and Tom Goldstein. A watermark for large language models. In Proceedings of the 40th International Conference on Machine Learning, volume 202, pp. 17061-17084, PMLR, 2023.
Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv: /907. 1692, 2019.
Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. Learning word vectors for sentiment analysis. In Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies, pp. 142-150. Association for Computational Linguistics, 2011.
Chengzhi Mao, Carl Vondrick, Hao Wang, and Junfeng Yang. Raidar: generative Al detection via rewriting. The Twelfth International Conference on Learning Representations, 2024.
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. De- tectgpt: Zero-shot machine- machine-generatee generated text detection using probability curvature. In International conference on machine learning, pp. 24950-24962. PMLR, 2023.
Nasrin Mostafazadeh, Nathanael Chambers, Xiaodong He, Devi Parikh, Dhruv Batra, Lucy Van- derwende, Pushmeet Kohli, and James Allen. corpus and evaluation framework for deeper understanding of commonsense stories. arXiv preprint arXiv:6604001696 2016.
OpenAl. Roberttabass--oppaaadedeeto Hugging Face Models, 2019.
URL https://
huuginggaac.co//rooee base aepenai-detecteo
OpenAl. Introducing gpt-4.1 in the api, 2025. URL https:// com index/
gpt 1/]
Hyeonchu Park, Byungjun Kim, and Bugeun Kim. Dart: An aigt detector using amr of rephrased text. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Asso- ciation for Computational Linguisties: Human Language Technologies (Volume 2: Short Papers),
pp. 7 710-221, 2025.
Thomas Scialom, Paul-Alexis Dray, Sylvain Lamprier, Benjamin Piwowarski, and Jacopo Staiano. Mlsum: The multilingual summarization corpus. arXiv preprint arXiv:2004. 14900, 2020.
Abigail See, Peter J. Liu, and Christopher D. Manning. Get to the point: Summarization with pointer-generator networks. In Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume Long Papers). Association for Computational Linguistics, 2017.
Sentencee-Transformerss. Wikihow dataset, 2020. URL
eettasets/senttencetrraaaass transformers htt.eoormrssswwkii..i.... wikkioww
Sentence-Transformerss Reddit-tille-oddy dataset, 2021. URL attpps://nnggingaac.cco
Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert- Voss, Jeff Wu, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, et al. Release strategies and the social impacts of language models. arXiv preprint arXiv:1908.0922 2019.
C. Spearman. The proof and measurement of association between two things. The American Journal of Psychology, 15(1):72-101, 1904.
12

---

Published as a conference paper at ICLR 2026
Jinyan Su, Terry Zhuo, Di Wang, and Preslav Nakov. DetectLLM: Leveraging log rank information for zero-shot detection machine generated text. In Findings of the Association for Computa- tional Linguistics: EMNLP 2023. Association for Computational Linguistics, 2023.
machine-generaaed
xAI. Grok-3, 2025. URL https://x.aa
An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. Qwen3 technical report. arXiv preprint arXiv:2505.003388 2025.
Xianjun Yang, Wei Cheng, Yue Wu, Linda Ruth Petzold, William Yang Wang, and Haifeng Chen. DNA-GPT: Divergent n- n-gram analysis for training-free -frenn detection of -en-rgeeeated text. In The Twelfth International Conference on Learning Representations, 2024.
Xiao Yu, Kejiang Chen, Qi Yang, Weiming Zhang, and Nenghai Yu. Text fluoroscopy: Detecting I1m- cene-geerated text through intrinsic features. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp. 11846, 2024.
Cong Zeng, Shengkun Tang, Xianjun Yang, Yuanzhou Chen, Yiyou Sun, Zhiqiang Xu, Yao Li, Haifeng Chen, Wei Cheng, and Dongkuan DK Xu. Dald: Improving bogits-based detector without logits from black-box llms. Advances in Neural Information Processing Systems, 37:54947- 54973, 2024.
Cong Zeng, Shengkun Tang. Yuanzhou Chen, Zhiqiang Shen, Wenchao Yu, Xujiang Zhao, Haifeng Chen, Wei Cheng, and Zhiqiang Xu. Human texts are outliers: Detecting Ilm- generated texts via nut-of-distribution detection, 2025.
Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q. Weinberger, and Yoav Artzi. Bertscore: Evalu- ating text generation with bert. In International Conference Learning Representations, 2020.
Xiang Zhang, Junbo Jake Zhao, and Yann LeCun. Character-level convolutional networks for text classification. In NIPS, 2015.
Xuandong Zhao, Prabhanjan Vijendra Ananth, Lei Li, and Yu-Xiang Wang. Provable robust water- marking for Al-generated text. In The Twelfth International Conference on Learning Representa- tions, 2024.
A APPENDIX
A.1 THE USE OF LARGE LANGUAGE MODELS (LLMS)
We acknowledge the use of large language models (ChatGPT and Gemini) as assistive tools in the preparation of this paper. Their role was strictly limited to language refinement, including grammar correction, sentence restructuring, and style polishing. All substantive research contri- butions-including hypothesis formulation, experimental design and execution, result analysis, and conclusions-are are solely the work of the authors.
A.2 DISCUSSION ON THE VALIDITY OF ASSUMPTIONS THEOREM 2
In this section, we provide a detailed breakdown of the assumptions underlying Theorem 2, dis- cussing the specific conditions under which they hold and the rationale behind them.
Assumption 1 (Upper Bound of Expected Similarity for Human-Written Text). There exist
5p > and e > 0 such that:
R[S(T THumma)] <1 50) w(H))
(1)
orig
When It Holds: This assumption holds the recovery distribution of human text satisfies two theoretical properties:
13

---

Published as a conference paper at ICLR 2026
1. Posterior concentration: Pr(A) 2 1 - бн, where A {d(TTrrg
Human
T.Human rH), as Tre
per Theorem 1.
2. Negligible excess similarity: For the concentrated subset, the excess similarity is negligible, i.e., a E[S A]- (1-w(rw)) of (1--wrr)); and for the deviated subset, the similarity is negligible, i.c., 3 B A = (rH)).
Human text inherently lacks the specific pretraining biases of LLMs (often exhibiting more flexible semantics and diverse structures). Consequently, even well-recovered human text can- not achieve the "exact consistency" typical of Al text (justifying the bound on a), while deviated recoveries typically result in near-zero similarity (justifying 3). The expectation decomposition E[SH = E[S A] Pr(A) + E[S Pr) Pr(A*) mathematically derives the upper bound, ensur- ing theoretical rigor.
Rationale:
Assumption (Gap in Theoretical Lower Bounds for AI-Generated Text).
(1) - (rra)) 2 (1 5 w(rH)) + 2c
(2)
When It Holds:
This assumption holds for standard LLMs (e.g.. GPT-4, Gemini) under normal generation settings (implying high probability of occurrence):
Practical condition: text is generated with standard parameters (e.g., temperature & 1.0, without random token insertion).
2. Theoretical condition: 8 I бн, TA S TH. and 2e is less than or equal to the intrinsic Al-human lower bound gap.
Rationale: LLMs are pretrained to optimize local token predictability. This objective leads to inherently stronger posterior concentration (smaller deviation radius ra and higher probability mass - 5A) compared to human text, creating a natural distributional gap.
Assumption 3 (Compatibilityy Condition).
δн 2
60
2
1 w(n))
When Holds:
This assumption holds for valid parameter tunings (providing a 100% chance
of non-empty interval):
Practical condition: is set to a small conceptual margin (e.g., 0.03-0.08), aligned with observed Al-human generation differences.
2. Theoretical condition: e < 8h (1 w(rH)). This naturally satisfied since 8μ > 0 for human text and w(TH) 0 for any reasonable radius rH 0.
Rationale: This interval serves to balance Assumptions and 2. A value for dn can always be chosen within this range (e.g., du бн 2(1-4(r=])) to strictly avoid mathematical contradictions.
Summary. The assumptions may fail only in extreme edge cases (e.g., Al text generated by non- pretrained/random models, or human text intentionally mimicking Al patterns). However, they hold universally in standard Al-text detection tasks. Our sanity checks confirm their practical applicabil- ity, while the theoretical conditions ensure high probability of occurrence in real-world scenarios.
A.3 EXTENDED EXPERIMENTAL ANALYSIS
In this section, we present comprehensive evaluations concerning adversarial robustness, the abla- tion of disruption strategies, and multilingual generalization to further validate the effectiveness of D&R.
A.3.1 ROBUSTNESS AGAINST ADVERSARIAT. ATTACKS
To evaluate the robustness of D&R against adversarial attempts to evade detection, utilized the RAID (Dugan et al. 2024). We tested D&R against 11 diverse attack types, ranging from character- level perturbations (e.g., homoglyphs) high-level semantic obfuscations (e.g., paraphrasing).
14

---

Published as a conference paper at ICLR 2026
As shown in Table D&R maintains strong performance across all attack categories. Even under Paraphrase attacks typically considered the most challenging for detection D&R maintains a strong AUROC of 0.8210. Furthermore, for character-level attacks (e.g., Homoglyph, Zero Width Space), performance remains robust (> 0.83). These results indicate that our disruption-recovery mechanism relies intrinsic posterior concentration rather than surface-level artifacts, making difficult to fool via simple perturbations.
Table 5: Robustness of D&R on the RAID Dataset (AUROC). The method maintains high detection performance across various attack types.
Attack Type
AUROC
Attack Type
AUROC
None (Clean)
0.8736
Homoglyph
0.8352
Insert Paragraphs
0.8428
Number
0.8641
Alternative Spelling
0.8564
Paraphrase
0,8210
Article Deletion
0.8627
Whitespace
0,8505
Synonym
0.8139
Upper/Lower
0.8479
Perplexity Misspelling
0.8643
Zero Width Space
0.8322
A.3.2 ABLATION STUDY OF WITHIN-CHUN SHUFFLING AND RECOVERY SIMILARITY
To verify the necessity of our Within-Chunk Shuffling (WCS) strategy, we compared it against two alternative disruption mechanisms:
Global Shuffling: Randomly shuffling all tokens in the text.
Chunk-Order Shuffling: Shuffling the order of chunks while keeping tokens within chunks intact.
Table 6 presents the results across four datasets.
Table 6: Ablation Study Results comparison (Avg. AUROC Datasets).
Disruption Method
ML-ArXiv
CNN-DM
IMDB
ROCStories
Avg.
D&R (Global Shuffling)
0.5421
0,5833
0.5612
0.5390
0.5564
D&R (Chunk-Orda) Shuffling)
0.7130
0.7544
0.7205
0.7811
0.7423
D&R (WCS-- Ours)
0.9266
0.9830
0.9451
0.9861
0.9602
The severe disruption destroys all semantic context, making recovery impossible for both Al and Human texts. Since both fail be recovered, they become indistinguishable, dropping performance to random guessing (~-0.55).
Global Shuffling:
Chunk-Order Shuffling: Preserving internal token order makes the task trivial, allowing both AI and Human texts to recovered with high fidelity. This "ceiling effect" causes their recoverability scores converge, significantly reducing discriminability.
WCS (Ours): WCS proves to be the optimal disruption strategy. It disrupts local token order to challenge the model while preserving semantic anchors, thereby maximizing the observable "concentration gap" between AI and Human text.
A.3.3 MULTILINGUAL GENERALIZATION
To demonstrate that D&R not limited English, we extended our experiments to German (DE), Spanish (ES), and French (FR). We utilized the MLSUM (Scialom al.) 2020) dataset for long texts and the Amazon (Keung et al. 2020) reviews dataset for short texts, averaging results across diverse source models.
As detailed in Table g D&R achieves consistently high performance across all tested languages (AUROC 0.93 for long texts). Even challenging short texts, it maintains robust performance (> 0.83). This confirms that the principle of posterior concentration not an artifact of English- centric training but holds across different languages.
15

---

Published as a conference paper at ICLR 2026
Table Ablation study of D&R by removing Semantic or Structural Recovery Similarity.
Datasct
Source Model
w/o SemanticSim
w/o StructuralSim
D&R
Qwen-Turba
0.6529
0.7342
0.8580
GPT4.1
0.6616
0.7268
0,9108
ML-ArXix-Paperr Pappeess
Demini2.5-PFas
0.7029
0.7311
0,9299
Grok3
0.7272
0.761
0.9559
Qwen-Tutee Turbo
0.6567
0.7465
0,9800
GPT4,1
0.6627
0.7151
0.9908
CNN-DuilyMail
Gemini2.5-Flast
0.6955
0.7731
0,9901
Grok3
0.6653
0.7072
0.9856
Qwen-Turke Turbo GPT4.1 Gemini2.5-FHan
0.7112
0.8560
0.9584
0.7011
0.8551
0.9456
IMDB
0.7013
0,8806
0.9890
Gruk3
0.7159
0.8716
0.9688
Qwen-Turbo
0.6581
0.7158
0.9667
GPT4.1
0.6561
0.7410
0.9851
ROCStories
Gemini2.5-Flast
0,8022
0.7910
0.9849
Grok3
0.6796
0.7256
0.9842
Average
0.6906 128.1%
0.7707 419.8%
0.9614
Table 8: Multilingual Performance (Avg. AUROC) on long (MLSUM) and short (Amazon) texts.
Language
Long Text (MLSUM)
Short Text (Amazon)
German (DE)
0.9306
0.8313
Spanish (ES)
0,9556
0,8604
French (FR)
0.9377
0.8592
Overall Avg
0~9.4
0.85
A.4 EFFICIENCY COMPARISON
To quantify the practical benefits of our single-call framework, compared the average latency and estimated cost of D&R against RAIDAR, the most competitive baseline which requires multiple generation calls.
As shown in Table 9 D&R drastically reduces computational overhead. Specifically, the single- call design lowers the average latency from 15 seconds to 2 seconds per sample and reduces the estimated API cost from $5 to $0.2 per 1,000 samples. This confirms that D&R is not only accurate but also highly efficient for large-scale deployment.
Table 9; Efficiency comparison between the multi-call baseline (RAIDAR) and single-call method (D&R). Cost is estimated per 1,000 samples.
Method
Avg Latency (s)
Est. Cost ($/1k samples)
Calls per Sample
RAIDAR
15
$5
5 calls
D&R (Ours)
2
$0.2
1 call
A.5 ADDITIONAL RESULTS
In this section, we present comprehensive performance data to supplement the main experimen- tal results. Tables I0
I2 and 13 provide the detailed AUROC breakdown four long-text datasets, namely ML-ArXiv-EI ArXiv-Paaesss CNll IMDB, and ROCStories, respectively. This table expands upon the summarized results in the main text, demonstrating D&R's 's consistent supe- riority across diverse source models and text domains, Table reports the TPR scores at fixed FPR threshold of % and %.
16

---

Published as a conference paper at ICLR 2026
Table 10: AUROC on ML-ArXiv-Papers datasets across six source models.
MI-AAxii-PPpers
Source Model
RoBERTa
Likelihood
DNA-GPT
Fast-Detect
RAIDAR
Dald
GPT2
0,9333
0.9206
0.8679
0.9489
0.9033
0,9432
GPT-Neo-2.7B
0.6245
0.8193
0.8334
0.8933
0,9786
Qwen-Turbo
0.5137
0.7112
0.6309
0.8038
0.8375
0.72.10
GPT4.
0,5406
0,5352
0.4966
0.5878
0.8600
0.6326
Gemini2.5-Flast
0.5613
0,4703
0.4826
0.6115
0.9025
0.7477
Grok3
0.5441
0.5206
0.4882
0.5596
0.7700
0.6798
Source Model
OOD
ImBD
Binoculars
Text-Flu
DeTeCtive
D&R((uur))
GPT2
0,9608
0.6944
0.7856
0.9772
0,9433
0.9660
GPT-Neo-2.7B
0.8483
0.6103
0.9701
0.8283
Qwen-Turho
0.7935
0.8192
0.7821
0.7980
0.758
0.8580
GPT4.
0.6995
0.8259
0.5500
0.8286
0.7666
0.9108
Gemini2.5
0.6156
0.8220
0.5699
0.7817
0.6416
0,9299
Grok3
0.6712
0.8439
0.4248
0.6038
0.7250
0.9559
Table 11: AUROC four CNN-DailyMai datasets across six source models.
CNN-DailyMail
Source Model
RoBERTa
Likelihood
DNA-GPT
Fast-Detect
RAIDAR
Dald
GPT2
0,9392
0.8234
0.9126
0.8760
0.8367
0.8662
GPT-Neo-2.7B
0.6084
0.5390
0.7041
0.8760
0.8367
0.8486
Qwen-Turbo
0.5705
0.6163
0.5618
0.5675
0.8300
0.6876
GPT4.
0,5212
0.4796
0.4625
0.4240
0.9125
0.6441
Gemini2.5-Flash
0.5288
0.5339
0.4531
0.5419
0.9325
0.6741
Grok3
0.5363
0.4799
0.4778
0.4249
0.8725
0.6808
Source Model
OOD
ImBD
Binoculars
Text-Flu
DeTeCtive
D&R(ours))
GPI2
0.9000
0.7303
0.6822
0.9509
0.9000
0.9734
GPT-Neo-2,7B
0.7666
0.6284
0.5993
0.9495
0.7666
0.9734
Qwen-Turho
0.6346
0.7485
0.5519
0.7617
0.6346
0.9800
GPT4.1
0.8726
0.8852
0.4004
0.8876
0.8726
0,9908
Gemini2.5-Flash
0.9131
0.9592
0.5471
0.8606
0.9131
0.9901
Grok3
0.8900
0.9175
0.4186
0.9324
0.8900
0,9856
Table 12: AUROC on four IMDB datasets across six source models.
IMDB
Source Model
RoBERTa
Likelihood
DNA-GPT
Fast-Detect
RAIDAR
Dald
GPT2
0.8579
0.8340
0.8314
0.9034
0.7833
0.9257
GPT-Nco-2.7B
0,7000
0.7867
0.8290
0.8115
0.8467
0.7451
Qwen-Turbo
0.5156
0.5901
0,5841
0,8400
0,5509
GPT4.1
0.5465
0.6174
0.5267
0.6257
0.8600
0.6072
Gemini2.5-Flast
0.5309
0.5398
0.5601
0.7422
0.9475
0.6834
Grok3
0.5178
0.6027
0.5633
0.6975
0.9275
0.6525
Source Model
OOD
ImBD
Binoculars
Text-Flu
DeTeCtive
D&R(ourrs)
GPT2
0.9646
0.7780
0.761
0.7888
0.9183
0.9036
GPT-Nco-2.7B
0.8336
0.6828
0.7523
0.8357
0,8150
0.9056
Owen-Turbo
0.8428
0.8739
0,5431
0,8155
0,9584
GPT4.
0.8319
0.8493
0.5756
0.9040
0.809
0.9456
Gemini2.5-Plam
0.7389
0.9442
0.7051
0.9403
0,3650
0.9890
Grok3
0.8234
0.9261
0.9388
0.8483
0.9688
17

---

Published as a conference paper at ICLR 2026
Table 13: AUROC on ROCStories datasets across six source models.
ROCStories
Source Model
RoBERTa
Likelihood
DNA-GPT
Fast-Detect
RAIDAR
Dald
GPT2
0.8563
0.8833
0.9199
0.8655
0.9856
0.8915
GPT-Neo-2.7D
0.8918
0.8533
0.8811
0.8862
0.9833
0.9613
Qwen-Turho
0.6254
0.5385
0.5312
0.5625
0.8725
0,5025
GPT4.1
0.6710
0.4999
0,5132
0.5105
0.9150
0,4411
Gemini2.5-Flash
0.7476
0.2809
0,4066
0.4888
0,9500
0.4229
Grok3
0.7131
0.4553
0.4866
0.5175
0.8875
0,4311
Source Model
OOD
ImBD
Binoculars
Text-Flu
DeTeCtive
D&R(ours)
GPI2
0.9956
0.4360
0.4381
0.6024
0,9691
0.9970
GPT-Neo-2.70
0.9982
0.6708
0.7982
0.6152
0.9883
0.9988
Qwen-Turho
0.8448
0.7582
0.4974
0.8257
0.7533
0.9667
GPT4.1
0.8689
0.7774
0.4225
0.8129
0.8316
0,9851
Gemini2.5-Flam
0.8833
0.8575
0,4501
0.7432
0.8916
0.9849
Grok3
0.8745
0.8110
0.4261
0.8400
0.8199
0.9842
Table 14: TPR (%) at Fixed FPR Thresholds. Detailed performance breakdown across different source models for both long and short text settings.
Dataset
Metric
Qwen
GPT
Gemini
Grok
TPR 1%FPR
74.8
81.8
90.8
79.5
Long Text
T 5%FPR
85.4
89.8
93.8
94.6
TPR @ 1 %PFR
49.8
57.6
53.8
47.9
Short Text
TPR PPFF
64.7
73.6
70.6
69.8
A.6 DATASET DETAILS
ML-ArXiv-Papee This dataset consists of abstracts from research papers in the computer science domain, particularly in machine learning, sourced from the ArXiv platform. The text characterized by its professional language, rigorous structure, and strong logical coherence, representing a formal academic writing style.
CNN-DailyMail. Comprising news articles from CNN and Daily Mail, this dataset is rich in factual statements and coherent narrative structures. The text is of high quality and written in accessible language, making it common benchmark for news summarization and text generation research.
IMDB. The IMDB dataset contains a large collection of wsir-written movie reviews. These texts are highly subjective, feature rich linguistic expression, and convey strong sentimental polarity and personalized styles.
ROCStories.
This dataset is composed of five-sentence stories centered around everyday life sce- narios. These texts exhibit clear narrative structures and causal relationships, embodying the char- acteristics of short, darvative-driven text.
Wikihow. This dataset contains texts extracted from "How-to" guides on wikiHow. The content concise, presented in formal style, and typically structured as clear, step-by-step instructions.
AG-News. Consisting of news headlines and short descriptions, this dataset exemplifies the style of short news text. It is highly condensed, formally structured, and logically coherent.
Reddit. This dataset collection of user-generated post titles and summaries from the Reddit platform. The language is colloquial and diverse in style, with free and irregular structure that reflects the nature social media communication.
18

---

Published as a conference paper at ICLR 2026
Long-tex datasets
Short-texx datasets
1200
1200
1000
1000
Average text length
800
800
600
600
400
400
200
200
ML-ArXiv CNN-Daily
IMDB
ROCStories
Wikihow
Agnews
Reddit
Figure 5: Average-text-length distributions for the long- and short-text datasets.
19


Reviews:
[{"review_id": "PiPv0mpBfB", "reviewer": "Reviewer_W6d8", "summary": "This paper provides a new framework for detecting AI-generated texts, called D&R. D&R consists of two distinct functionalities: Disruption, which permutes the given text while preserving the core semantics, and Recovery, which attempts to regenerate the original text using an LLM. The authors argued that such D&R procedure can capture distributional differences between human text and AI-generated texts, due to posterior concentration of reproduced texts. Using a preliminary analysis and a short theoretical analysis, they attempted to support their claims. And with an experiment, they showed that D&R outperforms previous benchmarks and shows robust performance regardless of source models and datasets even if the model calls LLMs just one time.", "questions": "## Question A. Clarity\n\nA1. Does the assumption of Theorem 2 hold anytime? It seems the assumptions hold based on sanity check results, but I think theoretical analysis should provide clear interpretation when the assumption holds. Though the current mathematical formula is clear and easy to follow, assumptions make me raise some questions about the chance of those cases.\n\nA2. It seems that the authors used DeepSeek-v3 for the main results (before changing the transformation model). Is this correct? I'm asking this because it is not clearly stated before line 377.\n\n## Question B. Similarity to [1]\n\nB1. Two papers (this paper and [1]) both argue that rewriting of given text can reveal the identity of source because AI and human writing is different. Also, both paper attempt to measure semantic similarity. Though I understand there exist several differences between them, could the authors clearly state them in the paper to help the readers understand? Other than the repetitive calls used in [1] and disruption procedure used in this paper, the approach of semantic measurement seems different. How does such difference affect the result?\n\nB2. Compare to [1], it seems that disruption procedure can possibly generate semantically unsimilar text. For example, \"A loves B\" has different semantics to \"B loves A\". Therefore the permutation might introduce semantic differences, when I read this paper with the perspective of meaning representation methods. So, can we strictly say that those disruption actually \"preserves\" the semantics? I understand that the method provides semantically similar texts in general and the example is very special case. Though, I think this should be clearly noted in the paper, as the current version claims that D&R can preserve semantics (without any warning or limitation statements).\n\nB3. Similar to B2, in the context of meaning representation field, researchers have been said that pragmatic similarity (e.g., BERTScore) can be easily affected by external contexts other than the internal semantics (so it might be improper to model the semantic similarity between them; see [2]). For example, \"I love you\" and \"I don't hate you\" could be semantically similar in terms of pragmatics but the semantic representation might differ. Although I understand that the disruption technique seldom introduces such changes, as there exists a chance of such unwanted effects, I think this should be warned to the readers. \n\n[2] K. Ki et al., Inspecting Soundness of AMR Similarity Metrics in terms of Equivalence and Inequivalence, *SEM2024", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- Suggest a new method that uses a single LLM call\n- Providing a sufficient analysis that strengthen their argument\n- Providing a sufficient experimental result showing robustness and high-performance of their model", "weaknesses": "- Need more clarity. It is not clearly stated whether assumptions in Theorem 2 holds theoretically; the assumption \"seems\" to hold based on the empirical analysis shown in Figure 2. Also, the usage of translation model is not clearly stated before starting the experiment. \n- Another similar work [1] is missing, which calls LLMs just twice. Although the authors made single-LLM-call detector, as the reproduction concept and the underlying assumption is similar, the authors should discuss the similarity between their work and [1].\n\n[1] H. Park, et al., DART: An AIGT Detector using AMR of Rephrased Text, NAACL 2025", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YhQ5nEXiFX", "reviewer": "Reviewer_Ly38", "summary": "D&R proposes a framework for AI-generated text detection grounded in a posterior concentration hypothesis.", "questions": "The novelty rests on Within-Chunk Shuffling and using recovery similarity as a proxy for posterior concentration.\n\nThe method still trains a classifier on recovery features [F1,τ,ρ]. It is supervised calibration on labeled AI and compared with human data. Please define what zero-shot is and what is trained.\n\n D&R is another transformation-consistency detector. Please clarify what the novelty is. \n\nHuman texts that are locally formulaic can recover with high concentration, and AI texts prompted can recover poorly. Please add counterexamples.\n\nPlease add details about how variance over draws affects false decisions.\n\nPlease add robustness tests to punctuation-free text, micro-edits inside tokens, and code-mixed text.\n\nLLMs often “fix” grammar, normalize quotes, or expand contractions automatically, even with the prompt. Please add alternative prompts and instruction styles experiments.\n\nAdd sensitivity to the alignment algorithm and ties.\n\nDetectors can learn prompt artifacts rather than authorship. Please add prompts and cross-prompt and cross-domain OOD experiments where the calibration classifier never sees those prompts.\n\nAdd token-level cost and latency in RAIDAR and Fast-DetectGPT and a throughput plot across lengths. Include results with small local recoverers at realistic speeds.\n\nAdd precision/recall@policy thresholds, especially on short texts.\n\nAdd an ablation study to justify WCS as the best disruption.\n\nUse BERTScore for embedding-free semantics as an ablation study.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "The novelty is within-Chunk Shuffling and using recovery similarity as a proxy for posterior concentration.", "weaknesses": "Please check the questions", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "lRdN8I3N2Y", "reviewer": "Reviewer_2bsN", "summary": "This paper proposes Disrupt-and-Recover (D&R), a novel AI text detection framework that disrupts text through Within-Chunk Shuffling performs a single black-box LLM recovery, and measures semantic-structural similarity between recovered and original text to detect AI-generated content.", "questions": "How does the performance compare to other more recent and advanced detectors?\n\nWhat is the performance when facing adversarial attacks?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. Proposes a novel recovery-based detection paradigm that achieves efficient detection through Within-Chunk Shuffling and a single black-box recovery\n2. Cleverly exploits the posterior concentration property of AI-generated text\n3. Clear theoretical motivation with well-explained connection to LLM pretraining biases", "weaknesses": "1. Lacks comparison with the latest detectors (Text Fluoroscopy, Binoculars, ImBD)\n2. Lacks consideration of robustness against attacks: e.g., paraphrasing attacks. \n3. The robustness described in the paper is more like generalization capability, such as whether it can effectively generalize to short texts, rather than robustness against adversarial attacks\n4. Limited performance on extremely short texts (<50 words)", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "0WuywjcW0w", "reviewer": "Reviewer_H47X", "summary": "This paper introduces a new framework called Disrupt-and-Recover (D&R) for detecting AI-generated text in an efficient, practical, and theoretically grounded manner. The proposed D&R method is based on the principle of posterior concentration, which posits that AI-generated text tends to be more predictable and internally consistent than human-written text. The framework works in three steps: \n\n1. Disruption: The original text is perturbed through a model-free Within-Chunk Shuffling (WCS) that randomly shuffles words within punctuation-separated chunks while preserving meaning.\n\n2. Recovery: A single black-box LLM call is used to reconstruct (recover) the original text.\n\n3. Similarity Measurement: The similarity between the recovered and original text is computed using both semantic (BERTScore F1) and structural metrics (Kendall’s τ and Spearman’s ρ). High similarity indicates strong concentration, implying AI-generated origin; low similarity suggests human-written text.\n\nThe authors provide theoretical analysis proving that recovery similarity acts as a faithful proxy for posterior concentration, forming the foundation of D&R. They also show that D&R has linear computational efficiency, as it only requires one LLM call compared to multiple calls in previous methods.", "questions": "See Weakness.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The paper introduces a novel Disrupt-and-Recover (D&R) paradigm based on the posterior concentration principle, offering a new theoretical foundation for distinguishing AI-generated text from human-written text. Unlike heuristic or probabilistic methods, D&R provides a mathematically justified rationale linking recovery similarity to concentration properties of language models.\n\n2. D&R achieves strong detection performance with just one black-box LLM call, making it computationally efficient and cost-effective. In contrast, most prior methods (e.g., RAIDAR, Fast-DetectGPT) require multiple API calls or white-box access to model probabilities, which are impractical in real-world applications.\n\n3. Across diverse benchmarks, D&R achieves state-of-the-art results, with AUROC scores of 0.96 on long texts and 0.87 on short texts, outperforming strong baselines like RAIDAR and Fast-DetectGPT by large margins (+0.08 to +0.14). This demonstrates not only higher accuracy but also lower variance and greater stability across datasets.", "weaknesses": "1. The method proposed in this paper is simple. Therefore, I am a bit concerned about the robustness on texts with adversarial attacks such as content paraphrase and swap since within-chunk shuffling is considered as the main technical contribution. I would suggest testing and comparing this method with baselines on RAID dataset[1], which includes different kinds of adversarial attacks.\n\n2. Some recent baselines are not included such as DALD [2]. Moreover, although this method is a zero-shot methods, it would also be interesting to see how it compares with the training-based methods such as DeTeCtive[3] and OOD-based methods[4] (or at least include some discussion about training-based methods).\n\n3. Ablation of Within-Chunk Shuffling contribution is missing. \n\n4. All experiments are conducted on English content. The effectiveness on multilingual setting is not validated.\n\nI would be happy to increase my score if the author can address my concerns.\n\n\n[1] Dugan L, Hwang A, Trhlik F, et al. Raid: A shared benchmark for robust evaluation of machine-generated text detectors[J]. arXiv preprint arXiv:2405.07940, 2024.\n\n[2] Zeng C, Tang S, Yang X, et al. Dald: Improving logits-based detector without logits from black-box llms[J]. Advances in Neural Information Processing Systems, 2024, 37: 54947-54973.\n\n[3] Guo X, He Y, Zhang S, et al. Detective: Detecting ai-generated text via multi-level contrastive learning[J]. Advances in Neural Information Processing Systems, 2024, 37: 88320-88347.\n\n[4] Zeng C, Tang S, Chen Y, et al. Human Texts Are Outliers: Detecting LLM-generated Texts via Out-of-distribution Detection[J]. arXiv preprint arXiv:2510.08602, 2025.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)