HLD: Approximate Hierarchical Linguistic Distribution Modeling for LLM-Generated Text Detection
Authors: Rui Guo
Weibin Zeng
Fuzhang Wu
Yan Kong
sicheng shen
Yanjun Wu
Weiming Dong
Venue: ICLR 2026 Poster (2026)
Keywords: Machine-Generated Text Detection; Large language model; Model distribution estimation; Trustworthy AI
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: The widespread deployment of large language models (LLMs) has made the reliable detection of AI-generated text a crucial task. However, existing zero-shot detectors typically rely on proxy models to approximate probability distributions of unknown source models at a single token level. Such approaches limit detection effectiveness and make the results highly sensitive to the choice of proxy models. In contrast, supervised classifiers are often detected as black boxes, sacrificing interpretability in the detection process. To address these limitations, we propose a novel detection framework that identifies LLM-generated text by approximating **H**ierarchical **L**inguistic **D**istributions--**HLD-Detector**. Specifically, we leverage n-grams to capture the feature distribution of human-written and machine-generated text across the word, syntactic, and semantic levels, and perform LLM-generated text detection by comparing these distributions under the Bayesian theory. 
By progressively modeling the linguistic distribution from shallow-level (token/word), then medium-level (syntactic), and ultimately high-level (semantic representations), our method mitigates the shortcomings of previous single feature level detectors, improving both robustness and overall performance. Additionally, HLD-Detector requires only a small amount of offline corpus for distribution estimation, instead of relying on online approximation with large proxy models, resulting in significantly lower computational overhead. Extensive experiments have verified the superiority of our method in detection tasks such as multi-llm and multi-domain scenarios, achieving the current SOTA performance.

Published as a conference paper at ICLR 2026
HLD: APPROXIMATE HIERARCHICAL LINGUISTIC DIS- TRIBUTION MODELING FOR LLM-GENERATED TEXT DETECTION
Rui Guol.2; Weibin Zeng", Fuzhang Wu'!, Yan Kong', Sicheng Shen', Yanjun Wu!, Weiming Dong' "Intitute of Software, Chinese Academy of Sciences #Zhengzhou University
*Institute Automation, Chinese Academy of Sciences
guorui2002@gs zzu mru.edd..cm en, {zengweibin, fuzhang)@iscas, en
ABSTRACT
The widespread deployment of large language models (LLMs) has made the liable detection of Al-generated text a crucial task. However, existing zero-shot detectors typically rely on proxy models approximate probability distributions of unknown source models at single token level. Such approaches limit de- tection effectiveness and make the results highly sensitive the choice of proxy models. In contrast, supervised classifiers are often detected as black boxes, sac- rificing interpretabilityy the detection process. To address these limitations, we propose a novel detection framework that identifies LLM-ggnerated text by approximating Hicrarchical Linguistic
Haarrbutionn-HLL-Deeeeeee cally, we leverage n-grams to capture the feature distribution of human-written and machine machine-generated text across the word, syntactic, and semantic levels, and perform LLM- -eM-ggeerdted text detection by comparing these distributions under the Bayesian theory. By progressively modeling the linguistic distribution from shallow-level (token/word), then medium-level (syntactic), and ultimately high- level (semantic representations), our method mitigates the shortcomings of previ- ous single feature level detection, improving both robustness and overall perfor- mance. Additionally, HLD-Detector requires only a small amount of offline cor- pus for distribution estimation, instead of relying on online approximation with large proxy models, resulting in significantly lower computational overhead. Ex- tensive experiments have verified the superiority of our method detection tasks such as multi-llm and multi-domain scenarios, achieving the current SOTA per- formance.
Specifi-
INTRODUCTION
Large language models (LLMs) have achieved remarkable breakthroughs in recent years (Guo al. 2025 Achiam et al.) 2023). Their powerful text generation capabilities are transforming content creation, yet they also introduce serious risks: automatically fabricated news (Hu al.) 2025), academic misconduct (Perkins) 2023), and other forms of misuse threaten the stability of social trust systems and information ecosystems (Weidinger et al.) 2021 Lee al.) 2024). Against this backdrop, developing accurate, efficient, and reliable Al-generated text detection technologies has become a critical and urgent task (Wu et al., 2025 Abdali et al., 2024)..
To address this challenge, the community has explored diverse detection methods (as illustrated in Fig. D. An effective approach involves fine-tuning pretrained models for detection (Abassy al. 2024 Bahad et al., 2024 Hee Lee & Jang 2024). Under this paradigm, input text is transformed digh-dimmnsional neural representations and subjected to classification. While this strategy can
* "Equal contribution
CCorreponndig author
We release code atttss//ggthtt..o.///forrr/llaba

---

Published as a conference paper at ICLR 2026
achieve strong performance specific datasets, it fundamentally relies on learning neural represen- tations to fit the training data distribution. Therefore, when the test data distribution deviates from the training data, detection performance will deteriorate significantly. Moreover, the detector's decisions entirely depend on the model's internal hidden states, which are difficult to interpret as concrete features, the resulting predictions offer limited interpretability.
Another line of research focuses on zero-shot detection (Mitchell et al. 2023: Bao et al. 2023 Hans et al., 2024 Bao et al. 2025), which exploits the tendency of LLMs to prefer high-probability tokens over the greater variability of human writing. While interpretable, this framework depends on shallow token-level distributions that are easily disrupted by synonym perturbations, limiting the robustness of the detector. In addition. it also typically relies on surrogate models to approximate the token probability distribution of the source model. However, the popular commercial models such as GPT (Achiam et al., 2023) and Gemini (Team et al. (223) are black-box, making it difficult for proxy models to capture their true distributions, which in turn degrade the detection performance. Moreover, surrogate inference is often computationally costly, adding significant latency.
In our view, LLMs exhibit remarkable text genera- tion capabilities, producing outputs that are highly similar to human. As a result, distinguishing be- tween machine-generein written text (HWT)) based on a single feature is chal- lenging. Prior work indicates that MGT exhibits characteristic patterns in word choice and syntac- tic structure (Chawla, 2024; Durward & Thomson 2024]: Wang et al. (2025) further report LLMs have more rigid semantic behavior, suggesting system- atic differences in semantic representations. These observations motivate us to move beyond any sin- gle feature hierarchy (such as token probabilities or neural embeddings alone) and develop a hicrarchical modeling of linguistic distributions.
Pre. ticket Chelitur
text (MGT) and human-
Ar troied Mood
Chorlter
Overfiting Tendeccy
Zere-thor Nathods
Entegretesiiity
Compuiatied
Blak bad--bx Unovaliebl
-- 00
Durn button Everact
Soora
Compare
High trhesery
Inteppendbeity
Fige
Motivated by this insight, we propose a novel LLM-generated text detection framework (HLD- Detector) that captures the differences between hi- erarchical linguistic distributions of MGT and HWT.
Figure I: Comparison of different methods for Al-generated text detection.
Specifically, HLD progressively models the feature distributions from shallow word level to medium syntactic level (including part-of-speech and dependency) and ultimately high semantic level. At the word level, it captures the basic distribution differences to achieve effective classification. At the syntactic level, it reveals more general distributional patterns through deeper structures, strength- ening the detector's 's generalization ability. Finally, at the highest semantic level, it encodes content into embedding representations, and compare the distribution differences representations fur- ther enhance detection robustness under adversarial scenarios. As shown in Fig. 2 the hierarchical linguistic features demonstrate clear distributional divergence between the two sources, validating the efficacy of our HLDD design.
Word
Syntactic/POS)
Syntactic/Dep)
Semantic
-00
Log www.ooo hale
Humen
Figure 2: Density distributions of the Hierarchical Linguistic feature Log- Log-Likelihood Ratios (Zwords Zposs Zdep, Zsemantic) for Al-generated (yellow) and fluman-writter (blue) text.
To estimate hierarchical linguistic feature distributions between MGT and HWT. employ an n- n-gram model (Shannon 1948), which aims to avoid the challenges of aligning distributions from black-box generators and allow efficient inference. Estimating the full probability distribution for ei-
2

---

Published as a conference paper at ICLR 2026
ther source is computationally intractable, required data grows exponentially with content length. Focusing on distributional differences, we assumee a Markovian property and truncate the context to length k. Although this approximation does not capture the full-context distribution, it suffices for comparing the distributions of the two sources, and can be reliably estimated from only a few samples.
Eventually, supported by Bayesian theory, HLD calculates the log- log-likelihood ratios between MGT and HWT across the above hierarchical linguistic distributions, obtained via n-grams and inputs these ratios into a classifier for Al-generated content detection. In summary, our contributions are as follows:
1. We propose HLD-Detector, framework that systematically models the hierarchical lin- guistic distribution differences between MGT and HWT. By progressively capturing fea- tures from shallow lexical, to medium syntactic, and high-level semantic representations, our method substantially improves detection performance, generalization, and robustness.
2. To avoid distribution alignment challenges from black-box models and the high cost of proxy-model-based inference, we leverage n-grams with a Markov assumption to estimate MGT and HWT distributions from limited samples and significantly speeding up inference.
3. We conduct comprehensive Al-generated text detection tasks on the DetectRL (Wu et al., (024) dataset. Our HLD significantly outperforms existing baselines, demonstrating the effectiveness of hierarchical linguistic distribution modeling and n-gram based distribution estimation.
2 METHOD
Task Definition. This task aims to determine whether given text is machine-generated (MGT) or human-written (HWT), which we formulate as a binary classification problem. Our approach founded on the observation that LLMs generate text via maximum likelihood sampling, their outputs follow distinct distributions from HWT across hierarchical linguistic features, including word, syntactic, and semantic aspects(Muñoz- HLD is designed to characterize input text through diverse set of hierarchical linguistic features, and modeling the distributional discrepancies between HWT and MGT along these dimensions to achieve reliable classification. Formally, let X = (#1 . denotes text sequence of length n, Y E (0, 1} be the class label (HWT vs. MGT). We first transform the into feature sequences at different linguistic levels, formulated
al. 2024). Motivated by this observation,
In)
= o J2,
where { denotes a linguistic transformation function, corresponding respectively to word- level, syntactic-level (part-of-speedde dependency), and semantic-level.
Then, for each linguistic sequence F, (Vj E [4]), the classification rule is defined as:
y 1. if P
P(Y=UFF) F
0. otherwise.
where 7 E (0, 1) is decision threshold. By Bayes' theorem and the chain rule, the likelihood ratio can be decomposed into conditional probability ratio over the feature tokens fa under the distribution of different classes Y.
P(Y FJ) P(Y = 0 F2) P(F, Y = P) 0) Ih P(f = 0, f'
P(F, Y 1111(((---- =) Th P(ʃ Y 1, ..c................ fi-) &
(2)
Markov Approximation. Equation] indicates that LLM-generated text can be identified by com- paring the likelihood ratio (LR) of feature distributions between MGT and HWT. Instead of relying on surrogate models to acquire the distributions typically employed by zero-shot detectors (Mitchell ct al. 2023 Bao et al. 2023), we derive them directly from the text samples through n n-gram statis- tics (Shannon 1948). This reduces the complexity of aligning distributions from black-box L.MSs
3

---

Published as a conference paper at ICLR 2026
Sliding Window
Semantic DataStore
.")
(C))
B(C))
Valuen Slaak
Constructoon
dii
.1i
Slmiiriity Calcuration
Encoder
Human
MGT
Estmation
Tokenizer
LLR,(X)
log P
Murr(ay
logg Rwwf(a Ci)
Parset
(weed, pas, dep, semancic)
XGboost
Essmation
Human N-gram Tables
N-gram Tables
B.id Databwse
Construction
lext X datect
Al Branch
Text Detect
Peueeit LG)
Paultt ())
Prutfor CC)
Prale, GG)
Smooth
Human
Human
Faylxx C))
Papfit (C)
Figure 3: Architecture our HLD method. The input text is segmented with a sliding window, and for each context-token pair, log-likelihood ratio (LLR) is computed by contrasting probabilities under AI- and human-authored databases. This comparison is performed at hierarchical levels: word, syntactic, and semantic. Finally, the resulting LLRs aggregated by XGBoost classifier for the final decision.
and supporting efficient inference. However, evaluating P(f Y, fe) over the full context is com- putationally expensive for n-grams. Based on the Markov chain assumption, distant linguistic tokens (fi...., fi-k-1) are expected to have limited influence on ft. Therefore, we approximate
P(R Y = 1, P(A Y f2) P(f: Y = 0, fika-i)
P(R Y = 1,
which allows n-grams to be learned more easily via only a small amount of training data. Further- more, keep numerical stability and eliminate length effects of LR, take the logarithm and normalize by sequence length n. and the decision rule becomes:
PHWT(Sa fi-ksi-) = =226)
log
(3)
PMGT (fe fi-ki--)
where I(() is the indicator function, denotes the log likelihood ratio and is the decision threshold.
2.1 HIERARCHICAL LINGUISTIC DISTRIBUTION MODELING
In this subsection, we present the modeling process of HLD across hicrarchical linguistic feature levels. Fig. 3 shows the architecture of HLD.
Word Distribution Modeling. Fast-DetectGPT (Bao et al. 2023 posits that human and LLM differs in word selection based preceding context and uses conditional probability curvature to estimate this discrepancy. Motivated by this idea, we begin by distinguishing MGT and HWT through modeling the word-level distribution differences of the two sources. Specifically, transform the samples via w into word sequences Fwont = @wanl We then tokenize these words and build n-gram language models for both MGT and HWT sources. In detection phase, HLD leverages these distributions and applies smoothing and back-off strategies to quantify the discrepancy between Proerd (fa fi-ki-z) and Puorr((a fi-ks-1) for the evaluated text:
first
Cr(f--m-1 Cy Py f(-A11-1),
if ( O,
(4)
otherwise.
where (f(-kkks-11, f.) denotes the occurrence that sequence fi-ks-1 is followed by fa under word distribution of Y. (ft-kett)1)) denotes the total occurrences of fi-ksi- in Y's word-level distribu- tion, 5 is the smoothing factor (set 10-6), and [V] represents the vocabulary size. The resulting
4

---

Published as a conference paper at ICLR 2026
word-level conditional probabilities are subsequently converted into the log ratio Zword according to Eq for the final classification.
Syntactic Distribution Modeling. As prior work reveals that Al-generated text exhibits character-
istic patterns at deeper syntactic levels (Fröhling & Zubiaga 2021), we further incorporate syntactic general structural regularities and improve the generalization of HLD. We map the training sequences X into part-of-speech (POS) tag sequences FPOs = pos X) and de-
features to capture
pendency (Dep) relation sequences FDep = @De (X) 3 We then model the distributions over these "POS" and "Dep" sequences analogously the word distribution, using separate n-gram models for each feature type. During inference, we estimate the conditional probabilities f (fr fi-ksi-)
and PP (ff fi-k1-1) under the respective syntactic distributions for an input text, and derive the corresponding distributional differences Zpos and Deep at syntactic-level.
Semantic Distribution Modeling, Considering the vulnerability of word- and syntactic-level fea- tures to adversarial paraphrasing, draw inspiration from Dipper (Krishna al., 2023 which constructs a semantic retrieval database for attack defense. Accordingly, We transcend token se- quences and formalize the conditional probability distribution P(s: fe-ksi-) in the continuous semantic space. A direct parametric estimation of this distribution P(: P(-Ifi-kss1) is intractable due the high dimensionality. Inspired by Kernel Density Estimation (KDE Terrell & Scott (1992). we propose non parametric approach to estimate these probabilities. Specifically, we first transform text samples X into sequences of context-target embedding pairs via a pre-trained encoder, denoted as Fsemantic @semuntic (X)). Each pair consists of contextual embedding fi-k:i- and a corre- sponding target embedding fi. The database Deemantic is constructed offline by processing a corpus for each class Y and storing the resulting context-target embedding pairs. In the detection phase, given a query pair (Ji-As-1,, Si), we retrieve M nearest context neighbors (fi-ket-1,m.)> 1.m.y) and their associated average target embeddings (J from the database Dysmamtiic, The conditional prob- ability is estimated via probabilistic interpolation over these neighbors, following the law of total probability:
poomandic (fs fi-
Σ P(fl fi P(m fi- m==
(5)
In this formulation, both the neighbor weight distribution P(m fi-ki--) and the conditional target probability P(Js I._ are distributions estimated from cosine similarities using softmax kernels. For instance, the neighbor weight distribution is calculated as:
(poosimffi-sssa fi kes l.m.) Tax) P(ml fi-ki--1) Σ5 exp(sim((f-kirr k:t fo- - T/ex)
(6)
where sim(...) denotes the cosine similarity and Tax a temperature parameter (set to 0.1). The conditional target probability is computed analogously, based on the cosine similarity between the query target embedding f; and the retrieved average target embedding fi,m, for each neighbor.
2.2 CLASSIFICATION VIA XGBOOST
To fully utilize the hierarchical linguistic distribution differences of MGT and HWT, we addi- tionally train XGBoost Chen & Guestrin (2016) classifier on these differences. Let Z
R2 denote the differences, the classifier so(Z) = - T.(Z)
Wixxical Apos Dep: Zuemantic] then learned using XGBoost:
P(Y Z) (ff( 8 arg min E(Y 2)) +0)+500 (((),
where o-)) is the logistic function, T. are regression trees, C is the binary cross-entropy loss, and ! regularizes tree complexity.
"See details at http://///aa...a/aaaaa/aaaaaaaaa
"See details htcpp:///ppac..o//aagg///////// http:////ooogg.ooaaaaaaa/aaaaaae
5

---

Published as a conference paper at ICLR 2026
Table 1: Performance comparison of all detectors in multi-LLM and multi-domain assessment, with results reported as AUROC (%) The best and second-bes, scores in each column are highlighted in bold and underlined, respectively. denote the zero-shot methods. Results for other metric are provided in Appendix B.1
Multi-LLM
Multi-Domain
Detector
GPT-3.5
Claude
PaLM-2
Llama-2
Avg.
Arxiv
XSum
Writing
Review
Avg.
LRR*
61.61
43.30
71.17
83.65
64.93
70.54
50.09
64.65
76.61
65,47
DetectGPTT
43,46
32.86
26.72
36.71
34,94
22.15
12.21
58.95
44,43
34.44
Binoculars
88.14
55.15
93.30
96.64
83.31
84.03
77.39
94.38
90.00
86.45
Fast-DeteerGPT*
65.56
30.01
65.99
76.79
59.59
43.69
39.19
74.21
77.02
58.53
DNA-GPT
61.87
48.88
71.48
75.22
64.36
$5.85
72.18
66.27
69.84
66.04
Lastde++
69.21
41.51
73.75
80.18
66.16
67.07
57.73
69.32
72.40
66.63
RADAR
94.58
81,15
95.10
96.80
91,91
95.04
99.78
79.34
89.63
90,95
Ghostbuster
91.81
84.99
81.77
89.57
87.04
91.74
93.34
83.88
86.06
88.76
RAIDAR
86.58
87.71
90.43
89.19
88 48
94,94
96. 11
85.45
93.94
92.61
DPIC
99.39
93.99
95.53
98.08
96.75
99.02
98.81
97.65
97.54
Roberta-base
99.47
98.52
96.61
98.36
98.24
100.00
99.75
96.94
99.05
98.94
ILD(OOurs)
99.74
99.48
97.87
99.38
99.12
99.45
99.41
99.68
99.84
99.60
EXPERIMENTS
3.1 SETTINGS
Benchmark and Evaluation. ensure comprehensive and fair evaluation, we conducted the experiments on DetectRL benchmark (Wu et al.) 2024). DetectRL is specifically designed for eval- uating LLL-ggenrrted text detectors in real-world scenarios, featuring diverse high-risk domains (e.g., arXiv abstracts, XSum news), mainstream LLMs (e.g., GPT-3.5-turbo, Claude), and well- designed adversarial attacks (e.g.. paraphrase, perturbation). This makes it an ideal platform for assessing the overall capabilities of our method. We strictly adhere to its established evaluation pro- tocol. each domain, we evaluate on a predefined balanced test set of 1,000 human-written and 1,000 machine-generatee
texts. For supervised training, construct balanced training set from the DetectRL training corpus, consisting of 1,800 human-written and 1,800 AI Al-generated texts. We adopt AUROC and F1-score bility independent of a specific threshold, while the F1 Fc-score reflects the practical balance between precision and recall.
evaluation metrics. AUROC measures the overall ranking capa-
Baselines. For extensive evaluation, we compare our method against two categories of repre- sentative baselines: (i) Zero-shot Methods: including LRR (Su al., 2023). DetectGPT (Mitchell
et al. 2023), Binoculars (Hans et al.) 2024). Fast-DetectGPT (Bao et al.) 2023), DNA-GPT (Yang
2024). and Lastde++ (Xu al.) 2025); (ii) Supervised Methods: including RADAR (Hu
et al. 2023). GhostBuster (Verma et al., 2024), RAIDAR (Mao et al., 2024). DPIC (Yu et al. (024).
and RoBERTa Classifier (Liu al. 2019). More details about the baselines are provided in the
Appendix A.2
3.2 MAIN RESULT
Overall Performance. As shown in Table [ our proposed HLD achieves state-of-the-art perfor- mance on both multi-LLM and multi-doman detection tasks. In the multi-LLM settings, HLD obtains an average AUROC of 99.12%, surpassing the second-best method (RoBERTa-base) by an absolute margin of 0.88 percentage points. In contrast, zero-shot methods achieve an average AUROC around 60% and exhibit significant fluctuations across different source models, exempli- fied by DetectGPT's poor performance PaLM-2 (26.72% AUROC), Our method avoids these inconsistencies by directly analyzing the output text, leading to more reliable results across differ- generators. In the multi-domain evaluation, HLD remains either the best or very close to the best in all domains. While RoBERTa- Dasseaa-base shows slight advantage on "Arxiv" and "Xsum", HLD achieves the highest average AUROC of 99.60%, outperforming all baselines overall.
Generalization Analysis. Table reports results under two transfer settings. In the cross-doman setting (trained Arxiv and tested XSum, Writing, and Review), all detectors are affected by

---

Published as a conference paper at ICLR 2026
Generalization results of detectors. The left block reports cross-domain generalization, and the right block reports cross-model generalization. Best and second-best results in each column are marked in bold and underlined. * denote the zero-shot methods. Complete results across all domains and models are provided in Tablepann Table T0
Table 2:
Train on Arxiv
Train on GPT-3.5
Detector: Eval XSum
Writing
Review
Avg.
Claude
PaLM-2
Llama-2
Avg.
LRR*
40.88
38.44
55.81
45.04
24.70
61.79
75.34
53.94
Fast- DetectGPT*
23.71
59.67
60.17
47.85
12.96
59.56
69.93
47.48
GhostBuster
85.81
75.18
69.70
76.90
61.83
77.43
83.66
74.31
RAIDAR
87.96
72.38
82.72
81.02
76.73
69.38
77.57
74.56
DPIC
75.99
72.77
83.51
77.42
87.01
83.21
95.60
88.61
Roberta-base
89.43
72.89
81.81
81,38
90.90
88.43
96.46
91.93
HLD(Ours)
88.89
79.40
91.54
86.61
90.42
89.31
97.65
92.46
domain shift; however, our method consistently achieves the best or second-best AUROC across datasets, with an average of 86.61 %, significantly outperforming the next best baseline RoBERTa- base (81.35 (8..3%)). In the cross-model setting (trained on GPT-3.5 and tested on Claude, PaL.M2, and LLaMA-2), our method again ranks first with an average AUROC of 92.46%. Cross-domain evalu- ation is particularly challenging due to large discrepancies in vocabulary distributions. Leveraging both syntactic and semantic layer distribution, our approach moves beyond shallow text patterns and captures machine- generated signals that transfer across domains. For cross moosl generaliza- tion, since different LLMs share common generation mechanisms, their outputs are more similar to each other than to human writing. Our framework explicitly measures whether text aligns more with the shared statistical distribution of Al generations or with the distribution of human writing, enabling robust capture of Al-specific regularities. The complete results in the Appendix ?? demon- strate that our method maintains strong generalization across all domain and model combinations, with smaller performance drops compared baselines. Furthermore, to validate the effectiveness of HLD on the latest generation of LLMs. we extended our evaluation to include cutting-edge models such as GPT-5, DeepSeek-RIAn (Guo et al.) 2025) Liu al. 2024b), and Claude-3.5. As detailed in Appendix B. HLD maintains state-of-the-arr overall average performance on these new models.
machine-generated
Robustness Analysis. In real-world applications, users may employ various strategies evade detection. We conduct experiments under three attack scenarios to evaluate the robustness of our method, with results reported in Table 3 For baselines that require training, models are trained on the Direct dataset before being evaluated on the attack test sets. Our method again ranks first in average performance with an AUROC of 97.85% outperforming the second- best method (DPIC) by an absolute margin of 4.82 percentage points. Crucially, under the most challenging paraphrase attacks, where the performance of all baselines drops significantly. HLD maintains high AUROC of 97.04%, demonstrating HLDD's stability and reliability in adversarial environments. This outstanding robustness stems from the inherent advantages of our hierarchical distribution design, which proves highly robust against shallow modifications by modeling deeper linguistic structures that remain stable even when surface-level words are altered. Moreover, by integrating evidence from every single token across the entire text, our method's s final judgment inherently resilient localized modifications.
Ablation Study. To investigate the contribution of each feature component (Word, POS, Dep, Se- mantic), we conducted an ablation study, training on the Arxiv dataset and testing across all domains, with results shown in Table 4 We can notice that removing any single feature dimension leads to performance drop. Notably, removing word features (-Word) causes the most significant harm to out-of-domain generalization, with the AUROC on the "Review" domain dropping from 91.45% to 84.43%. Similarly, removing syntactic (-POS, -Dependency) also results a general performance decline. This clearly demonstrates that our designed word, syntactic, and semantic feature dimensions are all effective and complementary.
semantic (-Semantic) features
Interpretability. We conducted a qualitative case study by visualizing the log-likelihood ratio (L.LR) of each token heatmap. As shown in Figure 4 for abstract from the Arxiv test set,

---

Published as a conference paper at ICLR 2026
Table 3: Adversarial robustness of all detectors. We report performance on original data (Direct) and against three attack scenarios, Best and second best results in each column are marked in bold and underlined. denote the zero-shot methods.
Direct
Paraphrase
Perturbation
Data Mixing
Avg.
Detector
AUROC
F1
AUROC
F1
AUROC
F1
AUROC
F1
AUROC
F1
LRR#
85.83
77.40
63.99
55.20
45.91
29.27
66.12
53.81
65.46
54.92
DetectGPT
52.84
40.90
31.79
16.89
18.21
00.00
26,28
00.00
32.28
14.45
Binoculars*
94.87
89.73
88.34
81.56
76.89
69.34
89.12
83.67
87.31
81.08
Fast- GPte
79.56
72.45
70.12
62.89
49.56
41.23
67.23
59.78
66.62
59.09
DNA-GPT=
88.01
80.78
65.61
54,94
40.45
02.73
62,14
50.89
64.05
47.34
RADAR
92.19
76.01
57.87
59.98
90.24
76.26
96.31
80.31
84.15
73.14
Ghostbuster
88.48
80.22
62.70
66.69
87.05
79.30
88.77
80.69
81.75
76.73
RAIDAR
91.15
82.72
66.40
59.97
91.40
83.37
88.35
80.08
84.33
76.54
DPIC
89.69
76.84
55.25
99.65
96.82
97.62
88.04
93.03
82.45
Roberta-base
95.68
90.06
73.00
73.35
98.40
94,23
93.82
87.19
90.23
86.21
HLD((Uurs)
98.91
96.39
97.04
93.05
98.77
95.80
96.69
91.89
97.85
94.28
Table 4: Ablation study on the contribution of each component. The model is trained on the Arxiv dataset and evaluated across all four domains.
Arxiv
XSum
Writing
Review
Configuration
AUROC
AUROC
AUROC
AUROC
HLD (all)
99.45
97.31
88.89
81.47
79.40
71.90
91.54
83.90
-Word
98.89
95.80
87.57
79.61
77.80
69.34
84,43
79.68
-POS
99.15
96.63
85.45
78.91
75.21
72.99
88.10
81.41
Dep 99.19
96.89
87.16
80.87
75.58
68.30
90.05
81.49
Semantic
99.10
96.41
88.29
80.98
76.24
68.11
87.31
80.26
yellow background indicates the model deems a token more AI-like, while blue suggests it is more human-like. The analysis reveals that our method identifies "formulaic" academic phrases such as "valuable insights," "findings contribute to," and "demonstrate the reliability" as Al-like. This case study provides visual evidence that our model's saccision-making process transparent and relies on discernibee linguistic patterns rather than rumning as unexplainable "black box."
Impact of N-gram Context Length. Figure 5a presents our analysis of the n-gram context length k, revealing that near-optimal performance is attained with remarkably short context lengths, specif- ically for & between and 5. The figure clearly contrasts the robustness of our hierarchical features. While the performance at the word-level deteriorates sharply k increases, underscoring its vul- nerability to data sparsity, the syntactic and semantic level exhibit exceptional stability. Notably, the syntactic feature sustains near-perfect AUROC across a wide range of k (from 2 to 10). This result strongly validates our hicrarchical design, demonstrating that abstract linguistic signals are only more robust but also significantly more efficient for discriminating between numan-written and machine-generated text than volatile shallow-level patterns.
Impact of Text Length. The length of critically affects detection performance, with longer texts yielding richer reliable signals to differentiate numan-written and machine generated content. Figure [5 shows that all methods benefit from increased text length. Remarkably, our method HLD significantly outperforms both the supervised (RoBERTa-basse and zero-shot (Fast-DetectGPPT) baselines on short texts (<50 words), achieving over 80% AUC, which is critical for real-world application like social media analysis. Moreover, the performance of HLD saturates at a high level (around 99% AUROC) once the text length exceeds approximately 150 words. These results bene- fits from hierarchical token-by-toker distribution analysis, making HLD exhibit strong adaptability and superior performance across texts of varying lengths.
machine-generated
Impact of Data Scale. The relationship between model performance and the library size used to construct the databases are presented in Figure [5c] The experiment indicates that model perfor- mance improves rapidly with increasing data, achieving over 95% AUROC with only 20k words
8

---

Published as a conference paper at ICLR 2026
Feature: ngram
Pi
artide
invesligatas
the refibility
determining lng
the
direction of
Inc incident
dPuu
#Prinoo
in
fully
contained
and
par Tial
contsined
events
attnbuuted
to quaei
eisstic
rcatterigg
Piel
the
super
Comm
Pede
delecctor
the
Super
kam
#elo
#Mian Piie
water
cher
#eenko
PPY
desector
located
Japan
and
des gesigned
detectt
fromt
anddgcing
frum
the
aRoe #Roructin
the
rection
aut
Interaction
specticaly
focum
File
Imarrcciooss
their disticct
sgnature
detecto
sophissicted
reconstruction
algorthim
staristical
techniques
evallsoee
direction
contained
methoinilgyy
proviiin
acainery
desction
differeen
types
enhancing
understanding ng
procertes
Indings
#n/0no
astronomy
have
imstication
desection
and
cha acteriatioon
nephysical
SOurces
Figure 4: Word-level attribution visualization for an Al-generated abstract from the Arxiv test set. Tokens are colored by their log-liielihood ratio (LLR): yellow for AI-like and blue for human-like See Appendix f analyses at other feature granularities.
and plateauing at roughly 100k words. This demonstrates that our model is highly data-efficient and attains strong performance without massive data, which is an important advantage for rapid deployment in specific domains.
Impart of M-gram Contest Length [k] AUROc
Text Length vo AUROC
Library Sice AUROC and Accoracy
KAROC
12
300 302
28
136
WWtndd Caarm
100%
200000
(a) Impact of N-gram Context Length k on AUROC.
(b) Impact of Text Length on AU- (c) Impact of Library Size on Per- ROC.
formance.
Figure 5: Analysis of the impact of key hyperparameters and data conditions on detector perfor- mance. (a) Discriminative signals are effectively captured with k < 5. (b) HLD consistently outper- forms baselines across all text lengths. (c) HLD demonstrates high data efficiency, achieving strong
performance with relatively small library size.
Evaluation on Non-English Dataset. To demonstrate effectiveness of HLD beyond English, test approach and the baselines the Chinese and Russian datasets from the M4 benchmark (Wang et al. 2024), and the Korean dataset from KatFishNet (Park et al. 2025)
As shown in Figure (6) HLD attains the highest detection per- formance across all three languages, attaining AUROC scores of 98.41%, %, 95.84%, and 84.97%, respectively. Notably, HLD exhibits marked superiority over the two baseline methods (RoBERTa and Dest-DeteetGPTT.. When compared to RoBERTa, HLD outperforms it by margins of 4.32% on Chinese, 10.55% on Russian, and 8.99% on Korean, validating that the statistical features captured by our approach are effective across diverse linguistic contexts.
Performance Compariaon on Offferent LengusperrAuROCI
Cansanto
Performance of our method on the Chinese dataset.
Figure 6:
Efficiency Analysis. Beyond detection accuracy, efficiency is important for practical use. We evaluate inference latency and peak GPU memory on 100 test sam- ples using single NVIDIA A800 (80GB). As summarized in Table Our framework achieves an inference time of 5.24 seconds and a memory footprint of 2644 MiB, while Fast-DetectGPT and RAIDAR incur significantly higher costs, they rely on proxy models for inference. Importantly,

---

Published as a conference paper at ICLR 2026
HLD preserves the SOTA performance reported in earlier sections, but requiring lower computa- tional budget, making it more practical for real-world deployment.
Table 5: Efficiency comparison of different detection methods. We report the average inference time (per document) and peak GPU memory usage the test set.
Metric
Ours
RoBERTa-base
Fast-DetectGPT
RAIDAR
Total Time (8)
5.24
2.14
35.13
3264.8
GPU Memory Usage (MiB)
2644
1056
36154
23594
4 CONCLUSION
We presented HLD, a hierarchical linguistic distribution framework for detecting ILM-generated text. By modeling word, syntactic, and semantic distributions with log likelihood ratios, HLD achieves strong performance across domains, models, and adversarial settings, while offering inter- pretability and efficiency advantages over www--ooodddeeee detectors. The method shows particu- lar strength short texts, requires modest data and computational resources, and provides intuitive visual explanations.
EHICS STATEMENT
This work explores hierarchical linguistic distribution modeling for detecting I.LM- -LM--geeerated text. While efféctive in experiments, the method is not foolproof and may be circumvented by para- phrasing or more advanced models. Its outputs should be regarded as probabilistic signals rather than conclusive proof, and never the sole basis for high-stakes decisions; careful human oversight remains essential. We further caution against misuse for surveillance or censorship, and recommend responsible deployment that respects privacy and academic freedom.
REPRODUCIBILITY STATEMENT
To ensure the reproducibility of our study, provide implementation details and specific parameter settings of our method in Section C.T Moreover, all datasets used in this research are publicly available and have been employed prior work in the field.
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Mervat Abassy, Kareem Elozeiri, Alexander Aziz, Minh Ngoc Ta, Raj Vardhan Tomar, Bimar- sha Adhikari, Saad El Dine Ahmed, Yuxia Wang. Osama Mohammed Afzal, Zhuohan Xie, et al. Lim-detectaive: tool for fine-grained machine- machine-generatel text detection. arXiv preprint arXiv:2408.00 042844 2024.
Sara Abdali, Richard Anarfi, CJ Barberan, and Jia He. Decoding the ai pen: Techniques and chal- lenges in detecting ai-generated text. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 6428 6436, 2024.
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Iige Akkaya, Florencia Leoni Ale- man, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, al. Gpt-4 technical report. arXiv preprint arXiv:2303.08772 2023.
Sankalp Bahad, Yash Bhaskar, and Parameswari Krishnamurthy. Fine-tuning language models for ai vs human generated text detection. Pruceedings of the 18th International Workshop on Semantic Evaluation (SemEval-20224, pp. 918-921, 2024.
Guangsheng Bao, Yanbin Zhao, Zhiyang Teng, Linyi Yang, and Yue Zhang. Fast-detectgpt: Effi cient zero-shot detection of -eccineegenerated text via conditional probability curvature. In The Twelfth International Conference on Learning Representutions, 2023.
Guangsheng Bao, Yanbin Zhao, Juncai He, and Yue Zhang. Glimpse: Enabling white-box methods to use proprietary models for zero-shot llm-generated text detection, 2025.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. volume 33, pp. 1877-1901, 2020.
Dalmeet Singh Chawla. Is chatgpt corrupting peer review? telltale words hint at ai use. Nature, 628 (8008):483-44) 2024.
Tianqi Chen and Carlos Guestrin. Xgboost: A scalable tree boosting system. In Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining, pp. 785-794, 2016.
Yixin Cheng, Hongeheng Guo, Yangming Li, and Leonid Sigal. Revealing weaknesses in text wa- termarking through oof--information rewrite attacks. Forty-second Internatioona Conference on Machine Learning, 2025. URL. httttpps://ppeerevieeeee net. forum? i fd:3gg
Liam Dugan, Alyssa Hwang, Filip Trhlik, Andrew Zhu, Josh Magnus Ludan, Hainiu Xu, Daphne Ippolito, and Chris Callison-Burch. RAID: A shared benchmark for robust evaluation of machine- generated text detectors. In Lun-Wa Ku, Andre Martins, and Vivek Srikumar (eds.), Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), pp. 12463-12492, Bangkok, Thailand, August 2024. Association for Computational Lin- URL
guistics. doi: 10. 1tw.18666/11122222alllooooo acl acl-long. 674/
org 2024.
Matthew Durward and Christopher Thomson. Evaluating vocabulary usage in LLMs. In Ekaterina Kochmar, Marie Bexte, Jill Burstein, Andrea Horbach, Ronja Laarmann-Quante, Anaïs Tack, Victoria Yaneva, and Zheng Yuan (eds.), Proceedings of the 19th Workshop on Innovative Use of NLP for Building Educational Applications (BEA 2024), pp. 266 266-282, Mexico City, Mex- ico, June 2024. Association for Computational Linguisties. URL https: pittps://aclanthon arg/2023 bea- 1.227
Angela Fan, Mike Lewis. and Yann Dauphin. Hierarchical neural story generation. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), pp. 889-898. 2018.
Leon Fröhling and Arkaitz Zubiaga. Feature-based detection of automated language models: tack- ling gpt-2, gpt-3 and grover. PeerJ Computer Science, 7:e443, 2021.
11

---

Published as a conference paper at ICLR 2026
Jiachen Fu, Chun-Le Guo, and Chongyi Li. DetectanylIm: Towards generalizable and robust de- tection of machine- generated machine-generated text across domains and models. In Proceedings of the 33rd ACM International Conference Multimedia, pp. 11229-112333 2025.
Matthias Gallé, Jos Rozen, Germán Kruszewski, and Hady Elsahar. Unsupervised and distributional detection of machine- text. arXiv preprint arXiv:2111.02881 2021.
Sebastian Gehrmann, Hendrik Strobelt, and Alexander Rush. Gltr: Statistical detection and visual- ization of generated text. In ACL (System Demonstrations), 2019.
Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song. Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. Deepseek-rl: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501. 12948, 2025.
Abhimanyu Hans, Avi Schwarzschild, Valeriaa Cherepanova, Hamid Kazemi, Aniruddha Saha, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Spotting Ilms with binoculars: Zero-shot detection of machine- generated text, 2024.
machine-generated
Xinlei He, Xinyue Shen, Zeyuan Chen, Michael Backes, and Yang Zhang. Mgthench: Benchmark- ing machine- generated on Computer and Communications Security, pp. 2251-2265, 2024.
maahine-generated text detection. In Proceedings of the 2024 on ACM SIGSAC Conference
Dong Hee Lee and Beakcheol Jang. Enhancing machine-generatee text detection: Adversarial fine- tuning of pre-trained language models. IEEE Access, 12:65333-65340, 2024. doi: 10.1 SICESS.2024.33966
Jordan Hoffmann, Sebastian Borgeaud, Arthur Mensch, Elena Buchatskaya, Trevor Cai, Eliza Rutherford, Diego de Las Casas, Lisa Anne Hendricks, Johannes Welbl, Aidan Clark, et al. Train- ing compute-optimal large language models. arXiv preprint arXiv:2203. 15556, 2022.
Ari Holtzman, Jan Buys, Maxwell Du, Ari Forbes, and Yejin Choi. The curious case of neural text degeneration. In International Conference Learning Representations, 2020.
Abe Hou, Jingyu Zhang. Tianxing He, Yichen Wang, Yung-Sung Chuang. Hongwei Wang, Lingfeng Shen, Benjamin Van Durme, Daniel Khashabi, and Yulia Tsvetkov. SemStamp: A semantic wa- termark with paraphrastic robustness for text generation. In Kevin Duh, Helena Gomez, and Steven Bethard (eds.), Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies ( (Volume 1: Long Pa- pers). pp. 4067-4082, Mexico City, Mexico, June 2024, Association for Computational Linguis- tics. doi: 10. 8653/v www.o//......ooo.....a 226.. URL http::://aeeeatthcoorrooooo naacl-long 2267]
Beizhe Hu, Qiang Sheng, Juan Cao, Yang Li, and Danding Wang. Lim-generated fake news induces truth decay in news ecosystem: A case study on neural news recommendation. In Proceedings of the 48th International ACM SIGIR Conference on Research and Development in Information Retrieval, pp. 435 445, 2025.
Xiaomeng Hu, Pin-Yu Chen, and Tsung-Yi Ho. RADAR: robust ai-text detection via adversarial learning. In Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA. USA, December 10 16, 2023, 2023.
Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. Scaling laws for neural language models. arXiv preprint arXiv:2001.0836) 2020.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Daniel Katz, Florian Tramèr, and Tom Goldstein. A watermark for large language models. In ICML, 2023.
Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. Paraphrasing evades detectors of ai- ai-generated text, but retrieval is an effective defense. Advances in Neural Information Processing Systems, 00227469-77000 2023.
12

---

Published as a conference paper at ICLR 2026
Donghyeok Lee, Christina Todorova, and Alireza Dehghani. Ethical risks and future direction in building trust for large language models application under the eu ai act. In Proceedings of the 2024 Conference Human Centred Artificial Siltigence-Educattonn and Practice, pp. 41-46, 2024.
Yafu Li, Qintong Li, Leyang Cui, Wei Bi, Zhilin Wang, Longyue Wang, Linyi Yang, Shuming Shi, and Yue Zhang. MAGE: Machine-generatee text detection in the wild. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar (eds.), Proceedings of the 62nd Annual Meeting of the Association for Compulational Linguistics (Volume 1: Long Papers), pp. 36-53, Bangkok, Thailand, Au- gust 2024, Association for Computational Linguistics. doi: 10. 1/202//1/0224acl-looo 37
URL
attps://aclanthonn wwgp://oooo.og//////e 2024 200.2/.4///00222222222
Aiwei Liu, Leyi Pan, Xuming Hu, Shuang Li, Lijie Wen, Irwin King, and Philip S. Yu. An unforge- able publicly verifiable watermark for large language models. In The Twelfth International Con- ference on Learning Representations. 2024a. URL
net forum?
(d=gMM.QwKDY33)
Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. Deepseek-v3 technical report. arXiv preprint 1:X1::2412.19437, 2024b.
Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach. arXiv preprini arXiv: 1692, 2019.
Chengzhi Mao, Carl Vondrick, Hao Wang, and Junfeng Yang. Raidar: generative Al detection via rewriting. In The Tweifth International Conference on Learning Representations, 2024. URL
https::/cppeneviiet http:/wwwwwweeeeeeeeeeeee -ntttt/ooruurmc--ce222uueu
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D) Manning, and Chelsea Finn. De- tectgpt: Zero-shot machine- -eeerrtte text detection using probability curvature. In International conference on machine learning, pp. 24950-24962. PMLR, 2023.
Alberto Muñoz-Ortiz, Carlos Gómez-Rodríguez and David Vilares. Contrasting linguistic patterns in human and -lm-genertted news text. Artificial Intelligence Review, 57(10):265, 2024.
Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. volume 35, pp. 20730-2774440 2022.
Shinwoo Park, Shubin Kim, Do-Kyung Kim, and Yo-Sub Han. Katfishnet: Detecting Im-generated korean text through linguistic feature analysis. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), pp. 21189-21222, 2025.
Mike Perkins. Academic integrity considerations of large language models in the post-pandemic era: Chatgpt and beyond. Journal of University Teaching and Learning Practice, 20(2):1-244 2023.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners, 2019.
Claude E Shannon. A mathematical theory of communication. The Bell system technical journal, 27(3):379 423, 1948.
Jinyan Su, Terry Zhuo, Di Wang, and Preslav Nakov. Detectllm: Leveraging log rank information for zero-shot detection of machine-generaan text. In Findings of the Association for Computational Linguistics: EMNLP 2023, pp.
2023.
Gemini Team, Rohan Anil, Sebastian Borgeaud, Caan-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, et al. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312. /805, 2023.
George R Terrell and David W Scott. Variable kernel density estimation. The Annals of Statistics, pp. 1236-1265, 1992.
13

---

Published as a conference paper at ICLR 2026
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXtv:2302.13971, 2023.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. volume 30, 2017.
Vivek Verma, Eve Fleisig, Nicholas Tomlin, and Dan Klein. Ghostbuster: Detecting text ghost- written by large language models. Kevin Duh, Helena Gomez, and Steven Bethard (eds.), Proceedings of the 2024 Conference of the North American Chapter of the Association for Com- putational Linguistics: Human Language Technologies (Volume Long Papers), pp. 1702-1717, Mexico City, Mexico, June 2024. Association for Computational Linguistics. doi: 10.18653/v1/ 2024 naacl-long.95, URL httpss:/aalaatthlll... hataaaaaaanttttooooeee org/ / 2024. nwwci- -oogllloonn...o 957
Ye Wang, Yaling Deng, Ge Wang, Tong Li, Hongjiang Xiao, and Yuan Zhang. The fluency-based se- mantic network of Iims differs from humans. Computers Human Behavior: Artificial Humans, 3:100103, 2025.
Yuxia Wang, Jonibek Mansurov, Petar Ivanov, et al. M4: Multi-generator, multi multi-domain, and multi- lingual black-box machine-generated text detection. In EACL, 2024.
Jason Wei, Maarten Bosma, Vincent Y Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M Dai, and Quoc V Le. Finetuned language models are zero-shot learners. arXiv preprint arXiv:2109.01652, 2021.
Laura Weidinger, John Mellor, Maribeth Rauh, Conor Griffin, Jonathan Uesato, Po-Sen Huang, Myra Cheng, Mía Glaese, Borja Balle, Atoosa Kasirzadeh, al. Ethical and social risks of harm from language models. arXiv preprint arXiv:21/2.043550 2021.
Junchao Wu, Runzhe Zhan, Derek Wong, Shu Yang. Xinyi Yang, Yulin Yuan, and Lidia Chao. Detectrl: Benchmarking -lnegenea text detection in real-world scenarios. Advances in Neural Information Processing Systems, 37: 170116990000000. 2024.
Junchao Wu, Shu Yang, Runzhe Zhan, Yulin Yuan, Lidia Sam Chao, and Derek Fai Wong. A survey on llm-generated text detection: Necessity, methods, and future directions. Computational Linguistics, 51(1):275-338 2025.
Yihuai Xu, Yongwei Wang. Yifei Bi, Huangsen Cao. Zhouhan Lin, Yu Zhao, and Fei Wu. Training- free I.LM--geerated text detection by mining token probability sequences. In The Thirteenth International Conference on Learning Representations, 2025. URL http:httsss//ppeeeeeeee net / wwwoorumiiivoooooo jowki
Annepaka Yadagiri, Lavanya Shree, Suraiya Parween, Anushka Raj. Shreya Maurya, and Partha Pakray. Detecting ai-generated text with pre-trained models using linguistic features. In Proceed- ings of the 2 International Conference Natural Language Processing (ICON), pp. 188-196,
2024.
Xianjun Yang. Wei Cheng, Yue Wu, Linda Ruth Petzold, William Yang Wang, and Haifeng Chen. DNA-GPT: Divergent n-gram analysis for training-free detection of -eT-ggnerated text. In The Twelfth International Conference on Learning Representations, 2024. URL https: //openreview. wtt./formmmme (ot.ormmmddxxlyxxxpp
Xiao Yu, Yuang Qi, Kejiang Chen, Guoqiang Chen, Xi Yang. Pengyuan Zhu, Xiuwei Shang, Weiming Zhang, and Nenghai Yu. Dpic: Decoupling prompt and intrinsic char- acteristics for Ilm generated text detection. In A. Globerson, I. Mackey, D. Bel- grave, A. Fan, U. Paquet, J. Tomezak, and C. Zhang (eds.), Advances in Neural In- formation Processing Systems, volume 37, pp. 16194-16212. Curran Associates, Inc., 2024. URL http::::/ppooeeeesss..eeeee/eeee www.eeurrssscpppppppeeeeeee
httpeerriilleeeppp///222. file/ 2122//88600012222200334444000000 .pff
14

---

Published as a conference paper at ICLR 2026
A
A.1
RELATED WORK
Machine Text Generation. Modern large language models (LLMs) are predominantly autoregres- sive Transformers trained with next-token prediction on large text corpora (Vaswani et al. 2017] Radford et al.) 2019; Brown et al.] 2020). Given a tokenized sequence Tı.T, the model parameter- ized by learns the conditional distribution po( sice)) by minimizing the cross-entropy (negative ogglikelihood)
T
(l) = Σ
log (ate Tet)).
Scaling data, parameters, and compute follows well-documented scaling laws, which guide compute-optimal training and harlysstpping strategies (Kaplan et al., [220 Hoffmann et al. 2022). Decoder-only models (e.g., GPT-2/33 ( et al. [2019] Brown et al., 2020) and their open coun- terparts (e.g., LLaMA, Deepseek) (oouvron et al. 2023] Liu et al. (024b) have therefore become the dominant architecture for open-ended text generation (Achiam al. (023). At generation time, decoding strategy shapes the output distribution and style: while beam search can induce repetition and degeneration, stochastic methods such top-k (Fan al., (2018) and nucleus (top-p) sampling (Holtzman et al. (222)) improve diversity and fluency. Beyond -ikimuum-iikelhoodd pretraining, in- struction tuning and reinforcement learning from human feedback (RLHF) further align the model's conditional distribution with human preferences. improving helpfulness and safety while altering likelihood patterns later exploited by detectors (Wei et al.) 2021 Ouyang et al. 2022).
Detect Machine-Generann Text. We categorize prior work on LLM-ggnerrted text detection into watermarking, supervised classifiers, and zero/low-shot statistical methods.
Model-time watermarking perturbs decoding to embed a verifiable statistical signal. The green-list scheme of (Kirchenbauer et al., 2023) biases a keyed token subset and enables simple hypothesis test without model access, establishing a widely used baseline. (Hou et al. 2024) proposed a robust sentence-level semantic watermarking algorithm and (Liu et al. (2224a) proposed unforgeable pub- licly verifiable watermark. However, recent work (Cheng et al. 2025) achieves successful attacks across various watermarking algorithms. Beyond specific attacks, watermarks also face challenges such reduced text quality and barriers practical deployment.
Supervised classifiers formulate detection as a binary classification problem, training models on extensive datasets of both human and prcchnne-generate text. A common strategy is to fine- tune pre-trained language models such as RoBERTa(Liu et al.] 2019)) with an added classifica- tion head. Some methods focus on engineering linguistic features (e.g., sentence length, repetition (atterns)GGale et al.) 2021 Yadagiri et al. (024)). Additionally, Ghostbuster (Verma et al. 2024) extracts features from models and trains classifier identify Al-generated content. DPIC al. 2024) and RAIDAR et al. 2024) use large models to regencrate the text and analyze features for detection. As a result, these detectors typically achieve strong performance when the source of machine-generater text is represented in training data. However, a critical and widely acknowledged limitation of supervised methods is their lack of generalizability (Li al., 2024) and interpretability.
Zero-shot detectors avoid task-specific training. GLTR(Gehrmann et al. 2019) visualizes token- rank statisties to aid detection. DetectGPT@Mitchelll et | (023) proposes a curvature test over model's log- probabiiyyyy surface; Fust-DetecrGPT(Baa et al.) 2023) replaces perturbation sam- pling with conditional cunditionll-roobbbiiiy curvature, cutting cost dramatically. Binoculars(Hang et al. 2024) scores passages via paired-model contrast. More recently, (Bao et al. 2025) aims to estimate full distributions based on partial observations from API-based models, and Lastde++ (Xu et al. 2025) identifies MGT by mining token probability sequences. Despite these advances, zero-shot methods continue to face challenges of low accuracy and unstable performance in certain scenarios.
A.2 DETAILS OF THE BASELINES
LRR (Su et al.
2023) leverages log-rank information to distinguish between human and machine- generated text. The core idea is that the distribution of word ranks in a text produced by a large language model (LLM) will have different statistical properties than text written by human.
15

---

Published as a conference paper at ICLR 2026
DetectGPT (iichell et al. 2023 is zero-shot method based the hypothesis that LLM- generated text lies in areas of negative curvature the model's 's log- proobabbily function. It com- pares the log probability of original text with perturbations, using significant differences to indicate machine generation. The TS-small model is used as the perturbation model, with the number of perturbations set to 10.
Fast-DetectGPT (Bao et al. 2023) optimizes DetectGPT by replacing multiple perturbations with more efficient sampling strategy, improving speed and detection accuracy. We directly adopt the settings from DetectRL, using GPT-Neo-2.7B as the scoring model and GPT-J-6B as reference model.
Binoculars (Hans et al. 2024) is a zero-shot detector with a low false positive rate, using two pre- trained models: an observer and a performer. It compares the perplexity of the text evaluated by the observer and the cross gross-perplexity of the performer's predictions to identify Al-generated text. GPT-Neo-2.7B is used for computing perplexity, while GPT-J-6B is employed for calculating cross- perplexity.
DNA-GPT (Divergent N-Gram Analysis) (Yang et al. 2024p truncates text and uses an LLM to regenerate the remainder. It analyzes the divergence between the original and generated text using n-gram analysis, revealing differences between human and machine-generatee text. We use GPT- 4o-mini continuation tool. The default settings are truncation rate of r 0.5 and 10 rewrites.
Lastde++ (u et al. 2025) treats Token Probability Sequences (TPS) as time series, analyzing local dynamics. It finds that human text exhibits abrupt fluctuations in token probabilities, while LLM- generated text is smoother and more predictable. By default, we use GPT-J-6B as the scoring model.
RADAR (Robust AI-text Detection via Adversarial leaRning) (Hu et al. 2023) trains a paraphraser and a detector in an adversarial setup, making the detector robust to paraphrasing attacks and more effective in identifying Al-generated text. We directly the official RADAR-Vicunas
model.
Ghostbuster (Verma et al., 2024) detects text from black-box LLMs by passing the document through weaker, publicly available models. It extracts features and trains a classifier to identify Al-generated content, making it practical for real-world scenarios. Following the original work, we extract token probabilities from four models: unigram and a trigram model trained the Brown Corpus, alongside GPT-3 ada and davinci. Features are generated by structured search combining these probability vectors with predefined operations. A Logistic Regression classifier is then trained on the selected features to make the final prediction.
RAIDAR R (geneRative AI Detection viA Rewriting) (Mao al. 2024) detects AI text by comparing its edit distance after being rewritten by an LLM. Al text shows smaller edit distance compared to human text. The details of our implementation are shown in the Table
Table 6: Implementation details for the Raidar baseline
(Mao et al. 2024
Component
Specification
Feature Generation
Rewriting LLM
GPT-3.5-Turbo
Distance Metric
Normalized Levenshtein Score
Invariance Prompts
1. 'Help me polish this:"
2. 'Rewrite this for me:
3. 'Refine this for please:'
Equivariance T-Prompts
1. 'Write this in the opposite meaning:*
2. 'Rewrite Expand this:'
Equivariance T -Prompts
1. 'Write this in the opposite meaning:*
2. 'Rewrite to Concise this:"
Classifier
Logistic Regression or XGBoost
DPIC (Decoupling Prompt and Intrinsic Characteristics) (Yu et al. 2024) detects black-box model text by reconstructing the prompt and comparing the original text with new text generated from it.
16

---

Published as a conference paper at ICLR 2026
This isolates the generative model's "fingerprint.. The full replication details are provided in Table
Table Replication details for the DPIC baseline, following the original work Yu et al. 2024
Parameter
Specification
Model Architecture
Encoder
RoBERTa (weights frozen) et al. 2019
Classifier
3-layer MLP
Training Strategy
Optimizer
Adam
Learning Rate
10-3
Epochs
Loss Function
Binary Cross-Entropy (BCE)
Model Selection
Highest AUROC on validation set
Roberta-base (Liu al. 2019) serves baseline for supervised AI text detectors. Fine-tuned on human and Al-generated text, it provides strong benchmark for evaluating detection methods. The training parameters are as follows: the learning rate set to 1e-6 with the Adam optimizer and weight decay of le le=1; the number of training epochs is 5, with an early stopping strategy that halts training when the score on the validation set decreases.
B
B. SUPPLEMENTARY MAIN RESULTS
Table Performance comparison of evaluated detectors across four large language models and four distinet text domains. We report F1 scores (in %). The best and second-best scores in each column are highlighted bold and underlined. respectively. *denote the zero-shot methods.
Large Language Models
Text Domains
Detector
GPT-3.5
Claude
PaLM-2
Llama-2
Avg.
Arxiv
XSum
Writing
Review
Avg.
LRR*
52.12
18.91
65.51
75.51
53.01
61.34
38.38
53.09
68.99
55.45
DetectGPT
26.27
12.56
00.00
20.40
14.81
00.00
00.00
50.83
35.25
21.52
Binoculars*
82.50
39.35
88.20
92.30
75.59
76.77
72.18
79.73
84.32
78.25
59.55
00.00
57.58
69.08
46.55
24.46
28.39
67.84
71.62
48.08
DNA-GPT*
55.04
25.67
60.77
62.89
$1.09
22.07
65,30
65.05
62.06
$3.62
Lasile++
77.07
67.45
77.72
81.33
75.89
75.84
72.35
75.94
77.87
75.50
RADAR
68.94
49.42
82.67
81.26
70.57
61.59
91.68
54.19
75.28
70.69
Ghostbuster
83,70
75.37
73.59
81.26
78.48
84.14
86.60
76.70
78.10
RAIDAR
82.36
80.36
82.69
81.45
81.72
87.98
88.89
80.37
88.06
86.33
DPIC
96.61
86.27
87.58
87.81
89.57
94.31
95.39
85.52
91.79
91.75
Roberta-huse
97.11
93.54
90.34
94.08
93.77
100.00
98.80
90.78
95.93
96.38
HLD((Ours)
98.40
97.01
93.06
97.09
96.39
97.31
97.29
98.11
98.70
97.85
Overall Performance (fl score). Table reports the Fl scores (%) of twelve detectors evaluated on four LLMs (GPT-3.5, Claude, PaLM-2, Llama-2) and four domains (ArXiv, XSum, Writing, Review). Our proposed method, HLD, achieves the highest mean Fl both across models (96.39%)
and across domains (97.85% 85%%.. Relative to the strongest non-HLD baseline (RoBERTa-base), HLD improves the averages by +2.62 points across models (96.39 vs. 93.77) and +1.47 points across domains (97.85 vs. 96.38), Importantly, HLD is the only detector that consistently exceeds 93% Fl across all four models (98 00197.00/93.0/97..00 ing model sources. On the domain side, while RoBERTa-base achieves strong results on ArXiv and XSum, it degrades substantially Writing (9).78)) In contrast, HLD maintains balanced performance across domains, obtaining the best scores on Writing (98. 1%) and Review (98.70%) while remaining competitive ArXiv and XSum. Overall, HLD attains the strongest average per-
demonstrating stable performance under vary-
17

---

Published as a conference paper at ICLR 2026
formance with reduced variance, highlighting its robustness across heterogeneous models and text domains.
Table 9: Cross-domain generalization performance of detectors, measured by AUROC (in %). Each block shows results for model trained specific source domain and evaluated the others. For readability, the table is in two parts. The best and second-bes. scores are highlighted in bold and underlined, respectively. "denote the zero-shot methods.
Train on Arxiv
Train on XSum
Detector, Eval-1
XSum
Writing
Review
Avg.
Arxiv
Writing
Review
Avg.
LRR*
40.88
38.44
55.81
45.04
57.45
39.08
55.81
50.78
Fast- DetectGPT*
23.71
59.67
60.17
47.85
28.43
62.99
63.08
51.50
GhostBuster
85.81
75.18
69.70
76.90
86.32
63.27
68.57
72.72
RAIDAR
87.96
72.38
82.72
81.02
85.06
60.24
64.73
70.01
DPIC
75.99
72.77
83.51
77.42
89.36
87.03
88.54
88.31
Roberta-base
89.43
72.89
81.81
81.38
89.56
78.08
76.28
81.31
HLD(Ours)
88.89
79.40
91.54
86.61
90.34
86.86
89.92
89.04
Train on Writing
Train on Review
Detector, Eval
Arxiv
XSum
Review
Avg.
Arxiv
XSum
Writing
Avg.
LRR
61.14
46.31
67.98
58.48
61.49
47.02
57.12
55.21
Dest-DetectGPTM*
34.81
33.06
68.30
45.39
40.70
37.66
68.25
48.87
GhostBuster
85.12
87.26
75.71
82.70
79.23
85.23
84.47
82.98
RAIDAR
77.09
62.08
86.73
75.30
77.41
69.90
78.81
75.37
DPIC
87.87
83.11
94.55
88.51
88.44
80.60
94.04
87.69
Roberta-base
86.69
78.95
95,41
87.02
77.60
79.03
95,50
84.04
HLu(Ourr)
87.94
93.82
95.79
92.52
89.42
93.65
96.42
93.16
Complete generalization results. Tables 10 report the full AUROC (%) results under cross- domain and cross-model transfer settings. the cross-domain case, detectors are trained on one source domain Sieii/XSum//witing/RReeea the moosll case, training performed on one source LLM GGPT-335/Clludd//all. Mttp/PaaaLMM//Laaaaaaaa and evaluation on the others. The results show that although all methods are affected by distribu- tion shifts, HLD consistently achieves the highest averages across all source domains, for instance reaching 86.61% % when trained on ArXiv compared to 81.31% % for RoBERTa-base, and delivering particularly strong gains when trained on Writing and Review, with averages of 92.52% and 93. 16%. Similarly, in the cross-model setting HLD again outperforms all baselines for every source LLM, achieving 92.46% (GPT-3.5), 95. 14% (Claude), 97.28% (PaLM-2), and 96.72% (Llama-2). Overall, the complete tables corroborate the main-text findings: HID maintains consistently strong detection ability across diverse source-target combinations and exhibits smaller performance drops than the strongest baseline, underscoring robustness in both cross-domain and cross-model transfer sce- narios.
and evaluated on the remaining domains, while in
Evaluations Latest Models. To verify the effectiveness of HLD on the latest generation of Large Language Models, we followed the DetectRL et al. 2024) setting and extended our evaluation include cutting-edge models such as GPT-5, DeepSeek RI/V3, and Claude-3.5. As shown in Ta- ble II when trained and tested on the same new model, HLD demonstrates exceptional adaptability. consistently achieves near-perfect detection scores (e-g., 99.63% AUROC on DeepSeek-RI and 99.54% on GPT-5), significantly outperforming zero-shot baselines and surpassing the strong super- vised method RoBERTa and DPIC. This indicates that HLD can effectively capture the generative signatures of even the most modern LLMs. A more challenging and practical scenario is detecting text from new models using detectors trained only on older models. We simulated this by training on data generated by GPT-3.5 and testing data from newer targets. HLD maintains high detection capability across all new models, achieving the highest average AUROC of 92.84%. Notably, on GPT-5, HLD retains an F1 score of 88.03%, outperforming RoBERTa by nearly 8 points. This
18

---

Published as a conference paper at ICLR 2026
Cross-model generalization performance of all detectors, measured by AUROC (in %). Each block shows results for model trained on specific source model and evaluated on the others. For readability, the table in two parts. The best and second-best scores are highlighted in bold and underlined, respectively. denote the zero-shot methods.
Table 10:
Train on GPT-3.5
Train on Claude
Detector, Eval
Claude
PaLM-2
Llama-2
Avg.
GPT-3.5
PaLM-2
Llama-2
Avg.
LRRR
24.70
61.79
75.34
53,94
45.73
57.66
72.67
58.69
Fast- DetectGPT*
12.96
59.56
69.93
47.48
00.19
00.00
01.18
00.46
GhostBuster
61.83
77.43
83.66
74.31
71.39
79.99
78.00
76.46
RAIDAR
76.73
69.38
77.57
74.56
78.75
76.71
76.80
77.42
DPIC
87.01
83.21
95.60
88.61
98.80
84.51
93.84
92.38
Roberta-base
90.90
88,43
96.46
91.93
98.33
91.63
95.20
95.05
HLD(Ours)
90.42
89.31
97.65
92.46
98.86
90.80
95.77
95.14
Train on PaLM-2
Train on Llama-2
Detector. Eval
GPT-3.5
Claude
Llama-2
Avg.
GPT-3.5
Claude
PaLM-2
Avg.
LRRR
52.36
26.23
75.58
51.39
52.14
25.25
62.23
46.54
Fast- D
55.77
08.20
68.43
44.13
56.28
08.65
57.74
40.89
GhostBuster
79.48
79.49
85.30
81.42
84.51
76.78
81.73
81.01
RAIDAR
75.26
76.19
83.49
78.31
86.86
77.46
86.43
83.58
DPIC
99.28
89.17
98.54
95.66
99.24
86.61
90.33
92.06
Roberta-base
98.76
93,39
98.26
96.80
98.39
91.69
93.06
94.38
HLD(Ours) 99.61
93.64
98.60
97.28
99.71
94.78
95.66
96.72
Table 11: Comprehensive performance comparison of the latest models. The top section presents methods evaluated under in-model (in-domain) or zero-shot settings. The bottom section presents detectors trained GPT-3.55 (cross-model) evaluated the target LLMs. Best and second-best scores in each column within each section are highlighted in bold and underlined, respectively. denotes zero-shot methods.
DeepSeek-Ri
GPT-S
Clande-3.5
Quen3-Max
GPT-4
DrepSeek-V3
Avg.
Detector
AUROC
AUROC
AUROC
Fl
AUROC
F1
ALROC
AUROC
AUROC
In-Model/
Settings
Fos-DeesaaGP
Binocular*
82.13
87.63
69.92
39.10
76.04
96.75
91.14
92.78
92.09
83.29
90.08
Fasides
65.57
68.70
83.46
74:02
$8.40
77.94
94.18
$6.47
88.55
77.38
86.88
77.62
84.51
77.02
RAIDAR
93.79
87.21
88.96
$1.01
90.64
84.38
90.03
$1.64
91.25
82.89
92.54
85.11
91.20
83.71
DPIC
99.22
95.90
98.78
95.
97.03
92.41
98.
92.98
99.54
95.67
99.53
94.73
98.73
94.50
97.63
98.04
34.01
50.00
94.71
99.05
(Ques)
Cruss-model (Trained on GPT-335)
RAIDAR
85.06
80.56
86.61
78.90
91 91.44
85.64
87. 97.26
$1.16
90.87
84.69
90.35
85.59
88.77
82.76
DPIC
83.65
80.82
90.70
83:95
96.85
92.22
92:95
$7.19
96.64
92.64
90.97
86.98
91.96
87.40
RoRERTa-bose
77.04
68.23
88.64
80.55
96.89
92.47
01.
M6
06.43
90.65
88.60
84.17
89.83
83.73
(Ours)
95.70
94.25
90.41
firms that HLD learns intrinsic invariants of Al Al-generated text that persist across model generations, rather than overfitting to the specific artifacts of older models like GPT-3.5.
Additional visualizations. the main text we presented one representative visualization of token- 7b 7c provide additional examples using different hierarchy views, including POS n-gram, dependency n-gram, and semantic repre- sentations. The color scheme follows the same convention: yellow indicates tokens judged more AI-like, whereas blue denotes more human-like tokens. These supplementary figures further illus- trate that method consistently highlights formulaic expressions and structural patterns charac- teristic machine- generateegeee text, while assigning more human-like scores to contextually varied domain-specifie tokens. Together, these results reinforce the interpretability of detector and
level log-likelihood ratios (LLR). For completeness, Figures 7a
19

---

Published as a conference paper at ICLR 2026
Feoture: pos_ngrs ngrram
the refiabiity
detemmniing
direction
Indident
contained
concained
everts
atributed
quart
ckaffic
starteiing
QEL
Super
Cimiollande
detector
The
Kamiolaande
moter
Cherankow
detectir
located
Aguan
necttincs
From
SCUrcES
anulycrr
cérierwel
preciaon
soptoetionee
Incrrntmaatonn
Aigestheme
both
concaree
and
concained
everts
Our
resurs
demonssaane
the
relate
methodo ogy
providiig
valuablle
insights
Into
Ihe
accuracy
neustio
direction
Intemmiration
different
opess
events
and
entenncnng
cur
understonding
nout lind
properties
Endings
contiibtt
astronomry
immolicatonn
(a) Attributions using part-of speech n- n-gram (poSngram) features.
dep, nggaan
This
ertirle
Inserigeom the milabiityy
Seteminiin
the
disection
InsiCeen
Iulyy
conteieed
and
pertally
conmaieed
eventt
atriiuuted
quati
ebbrtic
soamening
GEL
the
Super
Camiolande
denector
The
Super
Kaminkande
water
Jspan
designed
neutrincs
obsained
Spodifcclly
Focus
GEL
Interactions
chanacter 20d
distinct
detector
Wei
cemploy
suptrniionaal
reccentruucion
und
sedee Apuan
Lacth
conterad
partaity
contameed
evants
demonettace
methodorogy nag
prowedding
inoughte
accurncy
Pypee
anhancing
mng
Internetione
There
contributt
and
charocteriaation
neuatio
sourres
(b) Attributions using dependency n-gram (depngram) features.
Mare Harmin Like
More All
Feature: semantic
art cie invetigatree the relabiiity determiing the direction Incident trinc
fully contanned and
partoaly conta red
Puents antributed
quas-
scatte Tig
super
super Kamfolance
chereniov detecoorocated
Japan
designed
Redetecor
prediton
rourstruding the druttion of noutt iirraciooa apeail cally
Eocuo
intoructoon which
charesle lood
their
ditinc signatare
derrcctor we englity suplesiiattd necornnaaiion digerilaro
end untistial
uedin Muallate the
performanc
disclter recorntaation
both
Iully contered and partualyy contamed events
ourreultt demonetute
relabiityy methodalogy provd ng valusble
ireghts accumoy
type
wnthrriing wnoteneencingg
contritute
impt
devection
(c) Attributions using semantic features.
Figure 7: Visualization of feature attributions for text detection. The model highlights text portions identifies as more human-like (blue) or AI-like (orange) based on (a) part-of-speech, (b) dependency, and (c) semantic features.
demonstrate that its predictions are grounded in observable linguistic cues across multiple represen- tational layers.
20

---

Published as a conference paper at ICLR 2026
Table 12: Performance of three-category classification (Human vs. GPT-5 vs. DeepSeek-RI), We report Precision (%) and Recall (%) for each source category. The proposed HLD pipeline utilizes a cascade of binary classifiers (AI vs. Human followed by Source Identification). Best scores are highlighted in bold.
Source Category
Metric
Detector
Human
GPT-5
DeepSeek-RI
RoBERTa-base
99.26
79.21
77.98
Precision
HLD (Ours)
99.21
93.93
95.28
RoBERTa-base
100.00
76.20
78.60
Recall
HLD (Ours)
100.00
94.40
92.90
Extension to Source Attribution. While main experiments focus the binary distinction between machine-gesd machine-generated and human-written text, identifying the specific source model (Model Attribution) is increasingly important for content tracking. To evaluate HLD's capability in this fine-grained task, we implemented a cascaded classification pipeline. Specifically, we constructed three-category detection framework targeting Human, GPT-5, and DeepSeek-R1. The pipeline consists of two stages: (i) a binary Human vs. AI detector, followed by (ii) GPT-5 vs. DeepSeek- RI source identifier for samples predicted as AI. As shown Table [2] HLD achieves remarkable performance across all three categories. While the baseline RoBERTs la-base struggles to distinguish between the two LLMs (dropping to 76-79% precision and recall for GPT-5 and DeepSeek- RI), HLD maintains high accuracy, achieving over 93% Precision and Recall for both specific AI sources. This result demonstrates that our hierarchical linguistic features capture not only the general discrepancy between human and AI text but also the subtle, model-specific fingerprints inherent to different LLM architectures.
B.2 RESULTS ON THE OTHER BENCHMARKS.
Evaluation on the MGTbench. To provide a comprehensive and impartial evaluation of our pro- posed HLD (Ours) method, we further conduct extensive experiments on the MGTBench (He et al.) 2024) framework. MGTBench a holistic benchmark designed specifically for assessing the perfor- mance of machine-generated text (MGT) detectors against wide array of powerful Large Language Models (LLMs) and diverse text corpora. Our experimental setup strictly follows the protocol es- tablished in the MGTBench paper. We perform our evaluation its three core datasets: Essay, WP (Wriping and Reuters. On these datasets, we assess HLD's capability to detect text generated by six distinct LLMs ALMs-namely ChatGLM, Dolly, ChatGPT-turbo, GPT4AII, StableLM, and Claude. The performance is directly compared against the extensive suite of baseline methods included in MGTBench, such Log-Likelihhod, GLTR, and DetectGPT. The detailed results presented in Table [3] The data clearly demonstrates that our HLD method achieves remarkably consistent and superior performance across all datasets and LLMs. In the vast majority of test sce- narios, the scores for HLD (highlighted in bold) significantly outperform those of all other baseline methods. This underscores the effectiveness, robustness, and strong generalization capability of our approach across various text styles and underlying model architectures.
Evaluation on the MIRAGE benchmark. To verify HLD's robustness on more recent datasets, we extended our evaluation to the MIRAGE benchmark (Fu et al. 2023). which encompasses 17 advanced models (e.g., GPT-4o, Claude-3.5) across five domains. Crucially, we evaluated the HLD model trained solely on DetectRL. directly on MIRAGE without any fine-tuning. As shown in Table [4] despite the distribution shift, HLD outperforms recent state-of-the-at method De- LeL et al. 2025) across both evaluation settings. HLD achieves AUROC of 96.95 % on the SIG subset and improves the TPR@ 5% (detection rate at low false positive) by approximately 9% compared to the previous best result (86.64% 77.70%). This empirically confirms that HLD effectively captures intrinsic linguistic properties that exhibit strong generalization across diverse contexts spanning range of domains and models.
21

---

Published as a conference paper at ICLR 2026
Table 13: Comparison of HLD (Ours) with baseline methods from the MGTBench evaluation suite. We report Fl -cores for each detector. The best and second-best performing methods for each model and dataset are highlighted in bold and underlined, respectively.
Dataset
Method
ChatGLM
Dolly
ChatGPT-turbo
GPT4AIl
StableLM
Claude
Log-Likelihood
0.970
0.866
0.968
0.923
0.665
0.834
Rank
0.740
0.737
0,915
0.843
0,667
0.772
Log-Rank
0,983
0.865
0,966
0.923
0.692
0.814
Entropy
0,806
0.683
0.874
0.699
0.566
0.771
GLTR
0,988
0.848
0,954
0,925
0.756
0.806
LRR
0.982
0.810
0.925
0.904
0.748
0.746
NPR
0.956
0.865
0.218
0.927
0.740
0.238
Essay
DetectGPT
0,891
0.844
0.227
0.908
0.704
0.236
GPTZero
0,923
0.880
0,980
0.943
0.486
0.870
ConDA
0,668
0.069
0.000
0.260
0.663
0.664
OpenAI-D
0.921
0.724
0.353
0.863
0.774
0.009
ChatGPT-D
0.923
0.630
0.742
0.815
0.491
0.057
HLD(Ours)
0.982
0.914
0.978
0.955
0.934
0.988
Log-Likelihood
0,980
0.794
0.841
0.934
0.786
0.773
Rank
0,840
0.760
0.797
0.781
0.709
Log-Rank
0.985
0.807
0.819
0.929
0.832
0.751
Entropy
0,800
0.662
0.770
0.766
0.644
0.731
GLTR
0,983
0.766
0.800
0.935
0.861
0.733
LRR
0,980
0.774
0.728
0.930
0.875
0.656
NPR
0,970
0.801
0.352
0.905
0.764
0.521
WP
DetectGPT
0.812
0.719
0.608
0.808
0.695
0.517
GPTZero
0.980
0.732
0.980
1.000
0.148
0.818
ConDA
0.585
0.039
0.075
0.674
0.667
0.000
OpenAI-D
0.980
0.776
0.093
0.948
0.937
0.029
ChatGPT-D
0.880
0.528
0,352
0.795
0.616
0.044
HLD(Ours)
0.997
0.847
0.988
0.974
0.892
0.958
Log- Likelihoihod
0,972
0.381
0.926
0.697
0.659
0.798
Rank
0.650
0.413
0.847
0.665
0.635
0.648
Log-Rank
0.990
0.373
0.944
0.735
0.701
0.785
Entropy
0.477
0.553
0.703
0.668
0.620
0.694
GLTR
0.987
0.556
0.946
0.742
0.750
0.772
LRR
0.992
0.590
0.948
0.796
0.766
0.715
NPR
0,950
0.790
0.284
0.843
0.751
0.560
Reuters
DetectGPT
0.866
0.782
0,270
0.821
0.756
0.558
GPTZero
0,980
0.485
0,936
0.980
0.611
0.750
ConDA
0.664
0.137
0.000
0.667
0.000
0.667
OpenAI-D
0.985
0.713
0.954
0.900
0.903
0,000
ChatGPT-D
0.968
0.650
0.931
0.898
0.617
0.019
HI.((Ours)
0.997
0.951
0.992
1.000
0.977
0.995
Evaluation against Commercial Detectors. We extended our evaluation to compare HLD with two commercial black-box detectors: GPTZero and ZeroGPT. Experiments were conducted on 2,000 samples randomly drawn from the RAID (Dugan et al.) 2024) dataset, covering Open- source and Closed-source models under different decoding strategies. Table 15 reports the Aceu- racy @ FPR=5%. The results indicate that HLD remains highly competitive with commercial tools. While GPTZero shows a slight advantage on Open-source Chat models (98.4% vs. 92.5%), HLD significantly outperforms both commercial detectors Non-chat models. Specifically, Open- source Non-chat models with penalty decoding, HLD achieves 46.7% accuracy compared to 4.8% for GPTZero and 0.3% for ZeroGPT. Furthermore, HLD performs best Closed-soures Non-chat models (74.1%), validating the effectiveness of our hierarchical distribution modeling in handling diverse generative behaviors.
22

---

Published as a conference paper at ICLR 2026
Table 14: Performance comparison on MIRAGE-DIG and MIRAGE-SIG datasets. We report AU- ROC and TPR 55% scores. The best scores in each column are highlighted in bold. denotes zero-shot methods.
MIRAGE-DIG
MIRAGE-SIG
Detector
AUROC
@5%
AUROC
@
DNA-GPT
57.33
7.76
57.59
8.13
Rest-DetcctGPT
77.68
43.10
77.06
42.00
ImBD
85.97
40.65
86.12
41.83
DeLectAnyLLM
95.25
77.70
95.26
77.22
HLD (Ours)
96.72
86.64
96.95
86.80
Table 15:
Performance comparison under different settings (Open/Closed source, Chat/Non-chat models, and Penalty strategies). We report detection accuracy. The best score is highlighted in bold.
Open-source Models
Closed-source Models
Chat Models (Llama-c, Mistral-c, MPT-c)
Non-chat Models (Mistral, MPT, GPT-2) (ChatGPT, GPT-4, Cohere)
Chat Models
Non-chat Models (Cohere, GPT-3)
Strategy Penalty x
Sampling
X
X
GPTZero
98.4
82.5
9.4
4.8
88.5
53.4
ZeroGPT
97.7
72.5
16.0
0.3
65.8
72.7
HLD (Ours)
92.5
88.9
33.1
46.7
83.7
74.1
B.3 FURTHER ANALYSIS OF HLD.
Analysis of n-gram Database. To quantitatively analyze the statistical differences between AI and human text generation, first constructed conditional probability distributions for next-token prediction from wordngram databases, representing both AI and human corpora. We then com- puted the Kullback-Leibler (KL) Divergence for all shared contexts to measure the dissimilarity between these two sets of distributions (figure ( The resulting analysis, visualized in the figure, reveals a distinctly bimodal distribution KL Divergence values. This structure is characterized by peak zero, indicating large number of contexts where Al and human predictions show high agreement, and second, prominent peak at a high KL. value (20 nats), which signifies frequent and drastic disagreements between the models. We conclude that these moments of high divergence are the core statistical phenomenon that our detection model leverages; while Al can often mimic human-like predictions, it is these systematic points of disagreement that provide a robust and un- ambiguous signal, making reliable detection possible. This finding was consistently observed across all feature databases, confirming robustness.
Statistical Significance of Components. To verify that the performance contributions of our hierar- chical features are not due to random variance, we conducted rigorous statistical test, We repeated the ablation experiments 5 times on the XSum dataset and reported the average results with standard deviations. As shown in Table [6] removing any single feature dimension (Word, POS, Dependency, or Semantic) leads to consistent decrease in AUROC. Crucially, we computed the p-values for the performance differences between the full HLD model and each variant. The results indicate that all p-values substantially lower than the standard significance level of 0.05 (specifically, all < 0.005). This statistically confirms that every linguistic level in our framework makes significant and necessary contribution to the detector's overall performance.
23

---

Published as a conference paper at ICLR 2026
Divergence Distribution between Al Human Language Models (Database: word gard_ggrmm
Comparison Drection juu [| Haro DMoa
32.91221
0.30
0.05
5
20
Divergence (mats)
Figure 8: Distribution of KL Divergence between AI and Human language models based on the wordngram database.
Table 16: Statistical significance analysis of ablation studies on the XSum dataset. The experiments were repeated five times to report the mean AUROC (#: standard deviation). The p-values are calculated between the full HLD model and each ablated variant. All differences are statistically significant (p < 0.01).
Configuration
AUROC (%)
p-value (ys. Full)
HLD (AlI)
89.07 + 0.39
Word
87.80 0.33
4.60 10-3
POS
85.58 + 0.25
4.03 10-6
Dep
86.79 + 0.35
6.37 x 10-1
Semantic
88.21 + 0.29
3.75 x 10-4
C
C.1 IMPLEMENTATION DETAILS OF HLD
C.I.1 ALGORITHM OF HLD
We formalize our proposed HLD framework in Algorithm The method first builds hierarchical lin- guistic distribution databases and then trains a classifier on features derived from the lig-iiolddoood ratios between human and AI text.
C.1.2 HYPERPARAMETERS AND CONFIGURATION OF HLD
At the word and syntactic levels, we employ n-gram models, setting the context order to k = 5. At the semantic level, estimate the probability of 2-word target vector given 4-word context vector encoded by (al-MiLL-L- The neighbor search and indexing are accelerated using faiss-gpu The specific components and hyperparameters for each level are detailed in Table 17
interpolating from the M = 4 nearest neighbors.
The training pipeline uses a 50/50 data split: the first half for distribution estimation (building the statistical databases for MGT and HWT), and the second half for classifier training. We train an XGBoost classifier, optimizing its hyperparameters with Optuna to maximize AUROC over 60
"See details wtwpttpss//wwwwbbbbt .ne
'See details at https:://itthbb.oo http://hhhbbb.cmmmaaacaeeeerreea acsbookresearcc/aaaas
'eee details httppp:///ppuuaa.rrgg
24

---

Published as a conference paper at ICLR 2026
Algorithm Hierarchical Linguistic Distribution Modeling (HLD)
Require: Human text corpus D Al text corpus DAr-
Require: Set linguistic levels J {word, pos, dep, semantic).
Require: Context length parameter (n-gram order) k.
Ensure: Trained XGBoost classifier MMg.
1: procedure BUILDDATABASES(D: AI J.k
2: TB + 0
b Initialize set of distribution datahases
3: for each linguistic level J do
4:
BB f EstimateDistribution// (Dr D, B BssimaeeDistrbuttoo(PPrr.. B- B [B,, BJ,AI}
D D.g. D.g.,, N-gram tables or Semantic DataStore
5:
6:
end for 8: return B
9:
end procedure
10: function EXTRACTFFAATUREVCCTORR B, J)
11:
Z 7-1
D Vector for aggregated log-likelihood ratios
for each linguistic level j I do
13:
F, f- (X(
> Transform text X to feature sequence for level
n Fjl
15:
LLR, -1
Sequence of Log-Likelihood Ratios (LLRs)
for i = -
17:
+ (Ji-k.... -ic......;i.))) fi-1)
D Context for feature fi
Ри < P(jaa Y H, R,H
19:
PAI + P(file, Al, BB (AA)
20:
Append log(pAr) - log(pH) to LLR,
21:
end for
22:
2j f mean LLR;)
D Calculate the final feature for level
23:
Z Z + 2j
Concatenate the final feature vector
24:
end for
return
26:
end function
27:
procedure TRAINANDPREDICTT Durain Vuain)
28:
B BuildDatabases (D Dimin, H1 AImin,AA, J. .k)
29:
Aicatures <- [ExtractFeature Vector X, BB J] X E D Pmain)
30:
Mg XGBoost,fit/ X )raain)
31:
32:
Zne ExtraatFFeatureVectoof new, B,J)
33:
P(Y = Z &- a (Mo Znow))
Predict probability for new text
return P(Y Al[Znew)
35:
end procedure
trials, summarized in Table 18 All experiments were conducted single NVIDIA A800 GPU (80GB).
Table 17: Key hyperparameters for HLD's feature streams.
Hierarchical Level
Hyperparameters & Components
Word
5; Tokenizer: all c11-MiniMM-L6-22
Syntactic
= 5; Parser: spaCy (en_core.web.sm)
Semantic
Context: words, Target: 2 words
Neighbors (M): 4; Encoder: all-WiniLM-16-v2
Indexing: faiss-qpu with nprobe=8
25

---

Published as a conference paper at ICLR 2026
Table 18: XGBoost classifier hyperparameter tuning configuration.
Hyperparameter
Search Space
estimators learning rate max .dppth min srinchild_mog weight subsample
Integer in [400, 1200
Log-uniform in [10 0.15]
Integer in [4, 10)
Log-uniform in [0.1, 8.0)
Uniform in [0.6, 1.0)
colsample.
Uniform in [0.6, 1.0)
Table 19: Adversarial Attack Methods in the DetectRL. Benchmark
Attack Category
Specifie Method
Description
DIPPER Paraphrascr Krishna et al. 2023
Rewrites text using an advanced paraphrasing model to alter phrasing while preserving meaning.
Paraphrase Attacks
Back-translation
Translates text another language and back to English (e.g., using an APD) change sentence
Polishing using LLMs
Uses a second LLM to refine or "polish" initial LLM-gennrraed text, simulating ing process.
edit-
Character-level (DodBWu)))
Introduces small, adversarial typos spellings into the
Perturbation Attacks
Word-level (TextFooler)
Replaces key words with synonyms that mantically similar but confuse detectors.
Sentence-level (TextBugger)
Implements subtle modifications the sentence level disrupt linguistic patters..
Multi-LLM Mixing
Creates single document by combining sen- tences generated from multiple different M.
Data Mixing
LLM-Centerl Mixing
Simulates Al Al-assisted writing by replacing a quar- in -.--eerrrtted with sentences from human- written text.
C.2
DETAILS OF DATA
The DetectRL (Wu et al. 2024) benchmark constructed using combination of numan-writter texts from high-risk domains and texts generated by powerful, commonly-used Large Language Models (LLMs)..
Human- Human-Written Text. To ensure real-world relevance, the human-writte texts collected from four distinct domains where LLMs are prone to be misused. A critical aspect of the data collection process
avoid potential contamination from L.M-ggeerated content. Therefore, all selected human-written data was published before the public release of ChatGPT. The domains are: (i) Academic Writing: Scientific abstracts were soureed from the arXiv Archive (specifically, data from 2002-2017). (ii) News Writing: News articles were taken from the XSum dataset. (iii) Creative Writing: Fictional stories were collected from the Writing Prompts dataset. (iiii) Social Media: User reviews were sourced from the Yelp Reviews dataset.
LLM-Generated Text. To create text that closely resembles what found in real-world applica- tions, the benchmark employed four powerful and widely-used LLMs for text generation:GPT-355 turbo, -----onn Claude-instant, Llama-2-70b. The text generation was performed through interactive chat sessions with each model. The prompts were designed to align with the human- written data from each domain, such as providing a paper title to generate an academic abstract or using the first sentence of human review have the LLM continue the text.
Adversarial Attack Methods. To move beyond simple classification and assess the true resilience of detectors, DetectRL incorporates
adversarial attack framework. These attacks simulate the real-world tactics that a malicious or privacy-conscinn user might employ to evade detection. The framework is designed to probe for weaknesses across spectrum of potential vul-
26

---

Published as a conference paper at ICLR 2026
nerabilities, from prompt-level manipulation to post-generation text alterations. Table 19 provides detailed summary of the adversarial methods used to challenge the detectors.
C.3 USE OF LARGE LANGUAGE MODELS
We employed large language models (LLMs) solely general-purpose writing assistants to refine the manuscript. Specifically, LLMs were used to correct grammar, enhance clarity, and improve phrasing in certain sentences. The models did not contribute the research design, problem for- mulation, method development, experimentation, analysis, or overall scientific contributions. Their role was strictly limited to surface-level editing and presentation improvements of the paper.
27


Reviews:
[{"review_id": "564NTYzcwo", "reviewer": "Reviewer_jiri", "summary": "This paper introduces HLD-Detector, a hierarchical linguistic distribution framework for detecting machine-generated text. Instead of relying on proxy-model probabilities or opaque neural classifiers, the method explicitly models word-level, syntactic, and semantic distribution differences using n-gram statistics and a KDE-based semantic estimator, then combines them via an XGBoost classifier. Experiments on DetectRL show strong performance across multi-LLM, multi-domain, transfer, and adversarial settings, with notable efficiency and interpretability advantages. Ablations confirm the complementary roles of each linguistic layer.", "questions": "Now commercial detectors are widely used, is the proposed HLD method comparable to these detectors, e.g. GPT-Zero and ZeroGPT?", "limitations": "", "rating": 2, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper has a good motivation, whose hybrid design combining interpretable distribution modeling with supervised fusion, bridging the gap between zero-shot methods and black-box supervised classifiers.\n\nThe paper is also easy to follow.", "weaknesses": "1. Although the authors cited top-tier recent LLMs like DeepSeek-r1, unfortunately empirical evaluations cover early LLMs like Claude,PaLM-2, and LLaMA-2. As a paper in late 2025, I think it is necessary for an AI text detector to include latest LLMs, including: Qwen3, DeepSeek-V3/R1, GPT4, et cetera.\n\n2. Besides, I am curious why Roberta-base, the simplest baseline, outperforms nearly all other methods in Table 3. Is that a fair comparison? I guess the reason is that the training corpus that is used for training Roberta is a strong one, hinting potential unfairness.\n\n3. Unfortunately, the method is confined to English. I think more languages could be included to improve the generality of the proposed method.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "1DM0tXg8QS", "reviewer": "Reviewer_KXqA", "summary": "This paper proposes a new model for detecting machine generated texts, called HLD-detector. HLD-detector uses word-level differences, syntactic-level differences, and semantic embeddings as its features, and adopts kNN database for estimate density of those features. With XGBoost classifier, the authors claimed that their model achieved highest performance in multi-LLM setting and multi-domain setting. Also, they claimed HLD-detector showed robust performance on cross-domain, cross-model, and diverse attack scenarios. An ablation study showed that those proposed features work well in detecting MGTs. In addition to these experiments, the authors suggested other experimental results such as interpretability, impact of n-gram or text length, impact of data scale, Chinese MGTs, and efficiency of their methods, to emphasize their contribution.", "questions": "## Question A. Source models\n\nA1. The naturalness of text generated by source models might affect the result. Recent advances in language modeling proceeds to generate more human-like texts, and this continuously introduces challenges in MGT detection. Although DetectRL can reveal the performance and possibility of detecting MGTs, a reader might ask whether these models can be successfully applicable to recent models. I understand that the authors tried to claim that their model could be applied to recent models with cross-model tests, I recommend adding one more experiments showing whether the proposed model could be successfully detect GPT-4 or Claude 3.5, even if they were trained on previous version of those families.\nA1-1. In the same vein, the table might show a kind of ceiling effect: All performance scores were near 100. What if we ran the same experiment on more complex or difficult datasets?\n\nA2. Usually, we don't know source models exactly. When discriminating MGTs from HWTs, a user could not know which source model is a possible source of given text. So, models like RAIDAR or [2] attempted to expand the problem into multi-class classification problem instead of a binary-class problem. Could this model be extended to those cases easily?\n\n## Question B. N-grams and semantics.\n\nB1. As a researcher also working on semantic representations, claiming \"N-grams\" have \"high-level semantics\" seems inappropriate. This is because N-gram and its semantic embedding only mirror its pragmatic context, rather than the deep semantics (such as events or participants), and N-gram often cannot model long-distance dependencies. And, this is why [1] and [2] attempted to adopt higher-level of semantic representations in detecting MGTs. Why didn't the authors consider such high-level semantic representations?\n\nB2. Authors noted that the designed features contributed to the performance, in Table 4. But the score seems not much differ, especially on XSum. This makes me raise two following questions.\nB2-1. Are the differences statistically significant? Could we claim that the difference was not produced by chance (i.e., Type I error)?\nB2-2. Why do the features behave differently across domains? Do the authors have any other explanations on that? Answering this might provide some valuable insights to the readers also.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- Kernel density estimation methods for MGT detection, using a simple component of a text, n-gram.\n- Multi-dimensional experiments that reveals the actual applicability of HLD-detector.", "weaknesses": "- Though the authors attempted to follow DetectRL benchmark, the source models seem outdated. Because recent models learned more human-like wordings and phrases, recently researchers thought that the syntactic-level features might not suitable to detect MGTs. Refer to [1] and [2]. Also see Question A.\n\n[1] Z. Kim, et al. Threads of Subtlety: Detecting Machine-Generated Texts Through Discourse Motifs. arXiv preprint arXiv:2402.10586 (2024).\n[2] H. Park et al., DART : An AIGT Detector using AMR of Rephrased Text, NAACL 2025", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zrx3P2OStq", "reviewer": "Reviewer_xXfd", "summary": "The author proposes HLD-Detector: the novel hierarchical linguistic distribution comparison framework that explicitly models differences across three levels—word, syntax, and semantics—using Bayesian likelihood ratio. This framework simultaneously improves detection accuracy, robustness, interpretability, and efficiency.", "questions": "1.Based on the experimental results in Table 3, HLD still appears to be \"vulnerable\" to domain drift.  Are there any online/offline mechanisms that can improve its robustness? Have you explored which of the three levels of linguistic features might be most affected by domain shift?\n\n2.Some more implementation details of HLD are missing, like the hyperparameters smoothing factor $\\delta$ , $\\tau_{ctx}$ , etc.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The authors systematically and fully support his hypothesis through comprehensive experiments: \nHLD-Detector leads across all benchmarks for DetectRL, including multi-LM and multi-domain.\nThe SOTA performance of cross-domain/cross-model and attack resistance, validates its robustness; Significantly reduced performance demonstrates the contribution of linguistic feature at each level of its design; In addition, multiple heatmaps allow direct viewing of AI trace phrases/structures.", "weaknesses": "1. With the evolution of generative models, the effectiveness of HLD has not been explored when LLM commonly adopts non-maximum likelihood sampling strategies (such as models after RL).\n\n2. While HLD offers advantages in accuracy and interpretability, there is still room for improvement in computational efficiency compared to RoBERTa-base.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "qDa20KbWHg", "reviewer": "Reviewer_DEUM", "summary": "The authors propose a novel and effective AI text detection method that models the differences between \"Human-Written Text (HWT)\" and \"Machine-Generated Text (MGT)\" as hierarchical linguistic distributions across layers (lexical/morphological → syntactic → semantic). At each layer, they compute features using approximate n-grams, and finally use XGBoost to fuse the four-dimensional features for binary classification.", "questions": "How does the method perform on more recent LLMs like GPT-5?\n\nHow does the method handle mixed text (partially human-written, partially AI-generated)?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. Excellent motivation: Zero-shot detection mostly relies on proxy models' token probabilities, which is fragile and computationally expensive; while purely supervised classifiers are accurate, they suffer from weak interpretability and poor generalization. Therefore, the authors cleverly combine perspectives from both approaches.\n2. Comprehensive and detailed method comparison\n3. Does not rely on source model probabilities, avoiding API access and proxy mismatch issues\n4. Provides time efficiency analysis at the end, which is essential in realistic development", "weaknesses": "1. Limited LLMs in comparison, and the GPT-3.5 model is already outdated - should add newer models. I understand that adding new models might require extensive experiments, that's fine - the authors could just conduct small-scale experiments to demonstrate effectiveness would be fine.\n2. In Table 1, the authors distinguish between zero-shot and supervised detectors. Table 2 and subsequent tables should also make this distinction, for example, using an asterisk to denote zero-shot methods, etc.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)