Learn-to-Distance: Distance Learning for Detecting LLM-Generated Text
Authors: Hongyi Zhou
Jin Zhu
Kai Ye
Ying Yang
Erhan Xu
Chengchun Shi
Venue: ICLR 2026 Poster (2026)
Keywords: LLM detection
Rewrite-based detection
Learning distance
Prompt robust
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: Learning rewritten-text distance is all you need for detecting LLM-generated text.

Abstract: Modern large language models (LLMs) such as GPT, Claude, and Gemini have transformed the way we learn, work, and communicate. Yet, their ability to produce highly human-like text raises serious concerns about misinformation and academic integrity, making it an urgent need for reliable algorithms to detect LLM-generated content. In this paper, we start by presenting a geometric approach to demystify rewrite-based detection algorithms, revealing their underlying rationale and demonstrating their generalization ability. Building on this insight, we introduce a novel rewrite-based detection algorithm that adaptively learns the distance between the original and rewritten text. Theoretically, we demonstrate that employing an adaptively learned distance function is more effective for detection than using a fixed distance. Empirically, we conduct extensive experiments with over 100 settings, and find that our approach demonstrates superior performance over baseline algorithms in the majority of scenarios. In particular, it achieves relative improvements from 54.3% to 75.4% over the strongest baseline across different target LLMs (e.g., GPT, Claude, and Gemini). A python implementation of our proposal is publicly available at https://github.com/Mamba413/L2D.

Published as a conference paper at ICLR 2026
LEARN-TO-DISTANCE DISTANCE LEARNING FOR DE- TECTING
TEXT
Hongyi Zhou"1, 1, Jin Zhu"?, Kai Ye Ying Yang', Erhan Xu Chengchun Shit 'Tsinghua University, Universiiy of Birmingham 3 LLondon School of Economics and Political Science
ABSTRACT
Modern large language models (LLMs) such as GPT, Claude, and Gemini have transformed the way learn, work, and communicate. Yet, their ability to pro- duce highly human-like text raises serious concerns about misinformation and aca- demic integrity, making it an urgent need for reliable algorithms to detect LLM- generated content. In this paper, we start by presenting a geometric approach to demystify rewrite-based based detection algorithms,, revealing their underlying rationale and demonstrating their generalization ability. Building on this insight, we intro- duce novel rewrite-based detection algorithm that adaptively learns the distance between the original and rewritten text. Theoretically, we demonstrate that em- ploying an adaptively learned distance function is more effective for detection than using fixed distance. Empirically, we conduct extensive experiments with over 100 settings, and find that our approach demonstrates superior performance over baseline algorithms in the majority of scenarios. In partieular, it achieves relative improvements from 54.3% to 75.4% over the strongest baseline across different target LLMs (e.g.. GPT, Claude, and Gemini). A python implementation of our proposal is publicly available at httpt::t///gt.. //ops::/gittt tig.ithubbb.... com/ Mamba 13/1.2D
INTRODUCTION
The past few years have witnessed the emergence and rapid development of large language models (LLMs) such as GPT (Hurst et al.] (0024). DeepSeck (Liu et al. (022)). Claude (Anthropic) 2024).
Gemini (Comanici et al. 2025]. Grok (xAl 2025) and Qwen (Yang al. 2025). Their impact is everywhere, from education, academia and software development to healthcare and everyday life (Arora & Arora 2023 Chan & Hu 2023 Hou al. 2024). On one side of the coin, LLMs can support users with conversational question answering. help students learn more effectively, draft emails, write computer code, prepare presentation slides and more. On the other side, their ability to closely mimic Humann-witten text also raises serious concerns, including the generation of biased or harmful content, the spread of misinformation the news ecosystem, and the challenges related
to authorship attribution and intellectual property (Dave et al. 2023 Fang et al. 2024 Messeri &
Crockett 2024, Mahajan et al. 2025 Laurito et al. 2025).
Addressing these concerns requires effective algorithms to distinguish between Humann-ritten and LLM-generated text, which has become an active and popular research direction in recent literature (see Crothers et al.] [023 Wu et al. [025 for reviews). Existing works either actively detect LLM- generated text, by embedding watermarks into LLM -egnrrated text during the design of the model (see e.g., Aaronson & Kirchner 2023; Christ et al.) 2024 Dathathri al. 2024 Giboulot & Furon,
2024 Wouters| 2024, Wu et al. 2024; Golooich & Moitral 2024; Li et al.) 2025). or passively, without any prior knowledge of the watermarking process. This paper focuses the latter category of passive detection algorithms. We review these algorithms below.
'Hongyi Zhou and Jin Zhu contributed equally to this paper and are listed in alphabetical order. 1 *Corrsponning author: e. x 8 se ac. ukk c. shi 781 se ac. uk

---

Published as a conference paper at ICLR 2026
1.1 RELATED WORKS
Most existing passive detection algorithms fall into the following two categories: (i) zero-shot meth- ods and (ii) machine learning (ML)-based approaches, depending on whether they rely external data for training the detector. Within each category, methods can be further classified into three subtypes: (1) logits- (2) rewrite-based, and (3) other approaches. This yields a total of combinations.
Zero-shot detection. Zero-shot methods use only the observed text and surrogate LLM for detec- tion, without utilizing any additional dataset for training. They compute a statistical measure from the observed text determine whether was authored by a human an LLM. The underlying ra- tionale is that human-writted text tends to produce statistics that differ (either larger or smaller) from those of -.--generated text, and this difference can be exploited for detection (Gehrmann et al.) 2019). Based on the type of statistical measure employed, these methods can be further categorized into three subtypes:
1. Logits-based methods construct the statistic using the logits of tokens computed by the surrogate
LLM across the observed text (see c.g., Mitchell et al. 2023 Su et al. 2023 Bao et al. 2024 Hans et al., 2024 Xu et al. (025).
2.
newrite-based methods define the statistic as a suitable distance between the observed text and its rewritten (or regenerated) version (Zhu et al. 2023] Nguyen-Sov al.) [0244] Yang al. 2024 Sun & Lv 2025). A similar principle has also been adopted for detecting maahine-generatte
images (Wang et al. 2023 Qi et al. 2026).
3. Beyond logits or rewrite-based distances, other statistics have been introduced, including the intrinsic dimensionality of the observed text (Tulchinskii et al. (203)). its latent representation patterns (Chen al.) (2025b), N-gram distributions (Solaiman al. 2019) and maximum mean discrepancy (Zhang et al. 2024 Song et al.) 2025).
ML-based detection. ML-based methods leverage external human- and LLM-authored text to en- hance the detection power of zero-shot methods. A primary approach is to formulate the detection task as classification problem and utilize external data to train the classifier. Similar to zero-shot methods, ML-based approaches can also be categorized into three subtypes:
1. Logits-based methods fine-tune the surrogate LLM's logits to improve the classification accuracy. Various LLMs have been employed in the literature, including RoBERTa (Solaiman et al.) 2019 Guo et al. 2023), BERT (Ippolito et al., 22200) DistilBERT (Mitrović et al.) (203)), and reward models for aligning LLMs with human feedback (Lee et al. 2024). Recent works have extended these methods to more challenging scenarios, including handling adversarial attacks (Hu al.,
2023 Koike et al. 2024| Sadasivan et al.) 2025). short texts such as tweets and reviews (Tin al. 2024). black-box settings under diverse prompts (Zeng et al. 2024 Chen al.) 2025a). and accommodating statistical inference (Zhou et al. 2026).
Rewrite-bassee methods either use the distance between the observed text and rewritten version as input feature for training the classifier (Mao et al. 2024 Yu et al. 2024b Huang et al. 2025 Park et al. 2025), or apply ML to fine-tune the the rewriting model itself to improve the detection accuracy (Hao et al. 2025).
3. Other methods extract features beyond logits or rewrite-based distances, and then apply ML al- gorithms to these features for classification. Examples of features being utilized range from clas- sical N- N-grams and term -iveerr document frequency widely used in natural language processing (Solaiman et al., 2019), more complex representations such as various combina- tions of features constructed based on token probabilities (Verma et al.) 2024). cross-entropy loss between the text and a surrogate LLM (Guo et al., (024a)), hidden latent representations (Yu et al., (024a) and features learned via multi-level contrastive learning (Guo et al. 2024b), and even classification probabilities of fine-tuned LLMs (Abburi et al. 2023
1.2 CONTRIBUTIONS
Our proposal falls under the category of ML-based, rewrite-basee detection. We study commonly encountered setting in practice, where LLM-authored text is generated using prompts that are unob- served by the detector. Our main contributions are follows:
2

---

Published as a conference paper at ICLR 2026
Human Text
LUM rewrite Text
Pronpt Shift
Reconstruction error
ectionnoon
d1
Ractommmatioo Uisortuttor
LLM Text Spans
d.s.
Revermmacion GRIStuSoo
Figure I: The rationale behind rewrite-based methods: the brown dot represents a human-authored text after embedding, while the two green dots represent its projection onto the LLM subspace and an LLM-ggnnrated text produced from an unobserved prompt, respectively. From left to right, the purple dots denote the reconstructions of the first green dot, the brown dot and the second green dot. As illustrated, d1 >> d2, indicating that the reconstruction error for human text larger than that for LLM-generated text, which aligns with Proposition Additionally, d1 d3 suggests that rewrite- based methods remain robust to prompt-induced distribution shifts, as formalized in Proposition! 2
Methodologically. we develop a new rewrite-based method for detecting LLM-generated text. Unlike existing approaches that primarily employ fixed distance to compare the original text with its rewritten version. we propose to adaptively learn this distance via ML. Our proposal better discriminates between LLM- and human- authored text (see Figure 2 for a graphical illustration), leading to substantial performance gains.
Theoretically, we develop geometric approach to demystify the rationale behind rewrite-based methods (see Figure [ for illustration and Proposition [ for the detailed statement). We next show that these methods generalize well to unobserved prompts (Proposition 2 Finally, we demonstrate the rationale for learning a distance function rather than relying fixed distance (Proposition 3).
Empirically, we conduct comprehensive experiments across 24 datasets, target language models, and 3 types of unseen prompts, covering over 100 settings. Our results show that: (i) our approach outperforms 12 -tate-of-the-art methods, achieving average relative improvements of 41.5% to 75.4% the strongest baseline across different target L.LMs baseline (Sections 4. and (ii) our approach is more robust than existing methods under adversarial attacks (Section 4.3p (iii learning the distance function provides substantial benefits, with an average relative improvement of 96% over using fixed distance (see the ablation study in Section
REWRITE-BASED METHODS: BUILDING INTUITION
In this section, we present a geometric framework for understanding rewrite-based detection meth- ods, revealing their underlying rationale and demonstrating their robustness to unseen prompts.
Let denote the target text under detection. We study the problem of determining whether X authored by suspected target LLM, by human. newrite-based methods straightforward to describe: they first prompt the target LLM to rephrase the original text and then measure the discrepancy between the original text X and the LLM's reconstruction (denoted by R(X)) under a distance metric These methods rely on the observation that, compared to human- text, machine-genen text should be closer to its reconstruction (Mao al.) 2024 Yang et al. 2024) In the following, we will formally prove this assertion from geometric perspective.
Building intuition. We begin with some notations and hypotheses. Let (X denote measurable space of texts (after embedding).
Assumption 1. Assume X' is a Hilbert space with inner product (., 1) induced norm ||, and metric d' (x. y) l yl for any x, y E X.
3

---

Published as a conference paper at ICLR 2026
This assumption is reasonable since texts typically mapped into a vector space where each token represented by a scalar (Mikolov et al. 2013). and padding is commonly applied to ensure all texts share the same dimensionality.
Let H. and M denote the subspaces corresponding to texts authored by humans and the target LLM, respectively. We use p and q represent their respective probability distributions. We also define the projection operator II onto M,
[l(()) = arg min d" (2. v), yEM
(1)
which projects a given text r E X' to its closest point in M, produced by the target LLM. Assumption 2. is the projection of p under II, i.e., if X then (X ~
Assumption 2 is our key hypothesis, which reflects the geometric relationship between human- and LLM-authored text. Intuitively, implies that all L-L---enrrated texts can be viewed as a projection of human-written text onto specific subspace. This assumption is reasonable because (i) LLMs are trained on massive corpora of human-authored text with the objective of approximating the distribution of human language; (ii) LLM's 's output space is constrained by the model's architecture and learned parameters, and thus different from the human text space. Therefore, the mapping projection: transformation that
from human text to LLM-ggnerated text can be interpreted preserves semantic meanings while restricting outputs to the region defined by the model.
Assumption 3. For any numan-written text x E H. R(x)) has the same probability distribution function to R(IIM(z)).
Here, for fixed text we allow its reconstruction R(x) to be random. This is because LLM outputs are typically stochastic due to the use of a nonzero temperature during inference. Assumption essentially requires the reconstructions of human- text and its projection (1)(2) to share the same distribution. This holds when the reconstruction can be written as
R(x) = M +.,
(2)
for some random eπror e that lies on the space of M. Equation Dssatiss that the rewriting process can viewed as a two-step procedure: first, the input text is projected onto the L.M subspace, and then small perturbation is added to the projected text, while preserving the projected text's semantic meaning.
Proposition 1. Under Assumptions 1 andd we have
Ex-p [d' (X, R())) 2 Ex-g (XX,R(())))
with equality and only if p is supported on M.
Proposition formally establishes the validity of rewrite-based methods, and proves that human- written text's reconstruction error (the distance between text and its reconstruction) is on average larger than that of A.LM-generater text. The equality holds only under the idealized scenario where the LLM's output space perfectly replicates the human text space.
Intuitively, this result follows because reconstructions always lie within the LLM subspace M, whereas human-aur -uthorrd text may lie farther away from M. [ a graphical illustra- tion: the reconstruction error for human text (d1) is clearly larger than that for LLM-generated text (d2).
Generalization to unseen prompts. In practice, I.LM-generaeed text is often produced under variety of writing prompts (e.g., "polish this paragraph" or "help me rephrase"). The presence of such prompts induces a distributional shift: the resulting LLM-generated text longer follows the original distribution q, but instead depends on the specific prompt, which we denote by qprompt- This shift is illustrated in Figure where the prompt alters the location of the generated text in the embedding space.
cowrite-based methods generalize effectively to such shifts, provided that the perturbation in equation 2 does not substantially distort the semantic meaning (z). We formalize this intuition in the following proposition.
4

---

Published as a conference paper at ICLR 2026
Fest-DetectGPT with known prompt
Fast- Dett-DetectGPT
Fix Distance
Learned Distance
50
Human
Frequency
15-
15
12
40 LLM
10
10
0-
Reconstruction Error Figure 2: Histograms comparing the statistics constructed by Fast-DetectGPT (a state-of-the-art logits-based detector) and the reconstruction errors of rewrite-based methods between human- written and LLM-rewritten news text. The first two panels show that Fast-DetectGPP effectively distinguishes human- from LLM-authored text only when the prompt to produce LLM-gennrated text is known. The last two panels show that the proposed learned distance provides much clearer separation than using fixed distance.
Statistics
Statistics
Reconstruction Error
Assume equation 2 holds. Let > O denote some positive constant such that |e| S almost surely. Then under Assumption
Proposition 2.
we have
Ex~p (X, R(X)) - XE "poosp d (X R(X))] -
Proposition provides a lower bound to quantify the difference in reconstruction error between human- and LLM-authored text. The bound depends two factors: (i) the average gap between human and L----rrerrtted text, characterized by the norm the projection Ex Ex-pl X M (ii) the magnitude of the perturbation
Figure D offers graphical illustration: despite the shift introduced by the prompt, as long as e re- mains small, the reconstruction error for human text (dj) still be substantially larger than that for LLM-generated text (dz). In practice, minimizing requires careful design of the rewriting prompt preserve the input text's semantic meaning. This be achieved through prompt engineering or by adaptively learning the rewrite model (Hao et al. 2025).
3 ADAPTIVE DISTANCE LEARNING
Limitations of existing approaches. We begin by discussing the limitations of existing logits-based and rewrite-based detection methods better motivate our proposed approach:
Logit-based methods, such as DetectGPT (Mitchell et al. 2023) and Fast- Dest-DetectGPT (Bao et al.) 2024). construct the detection statistics using the log- peg-obbbbbilty log g(x) the text. However, their performance tends to degrade when the text generated under unseen prompts (see the first two panels of Figure 2 for illustration). This arises because the true conditional distribution log q(x prompt) differs from the marginal distribution log ((x) used by the detector, leading to the misspecification of the detection statistic.
The effectiveness of rewrite-based methods relies on choosing an appropriate distance function to distinguish human- from LLM-authored text, and the optimal distance function may differ largely from standard Euclidean distance due to the complex geometry of text embeddings. Nonetheless, existing rewrite-bate methods often use fixed, hand-crafted distance. such as N N-gram- based dis- tance (Yagg et al. 2024). Levenshtein distance (Mao et al.) (024). and negative BERTScore or BARTScore (Zhang et al. 2019 Yuan et al. (021), which may not generalize well across target language models, datasets or unobserved prompts.
To elaborate on the second point, we provide a proposition below to mathematically characterize the form of the optimal distance function.
Proposition 3. Consider the class of distance functions whose range is bounded between 0 to and some positive constant M O. Within this function class, and under mild regularity conditions (see Appendix any distance function dops satisfying
0. both X and Y E MM;
dope(X,Y) (X,Y)
M,
one of X or Y E M and the other E H M
5

---

Published as a conference paper at ICLR 2026
Text Rewriting
Distance Learning
Decision Rule
Threshold
X1
Average distance r
X +
X K
Pre-trained distance dø
Figure 3: Workflow of the proposal. Our method adaptively learn distance metric measure the discrepancy between human and LLM-generated texts for detection.
maximizes the gap in the reconstruction error
Ex~p (ooppd(Xp (((,)((()))
Ex Ex~ggamn Augpor [d(,,((X)) R(X))]
Proposition 3 shows that the optimal distance function should assign the smallest possible distance (zero) when both the input and rewritten text are generated with the LLM, and the largest distance M when one is LLM-generated and the other is human- written. Crucially, this optimal distance depends on the target LLM to be detected, since different LLMs induce different generative subspaces M. However, existing rewrite-basee detectors rely entirely fixed distance functions (e.g., editing distance, embedding similarity). As a result, a distance that works well for one model may perform poorly with another, limiting their ability generalize across different LLMs.
Our proposal. Motivated by the aforementioned limitations, we adopt the rewrite-based approach, and propose adaptively learn the distance function improve the detection performance. More specifically, assume we have access to a human-authon corpus Dr, and an LLM-generated corpus Dm. both of which are readily available in practice. For instance, Dn, can be obtained by web- scraping Wikipedia, while Dm can be constructed by prompting the target LLM (e.g., GPT, Gemini, or Grok). We next learn the distance function d. parameterized by some parameter o, that maximizes the discrepancy between the reconstructions errors:
Ex~D, [dX,, R())) Ex=Dm.
In our implementation, parameterize the distance function via
de (X1, = log (x1) log Pa X2)
(3)
len(X X,) len X2)
where P& is a language model parameterized by & and len(-) computes the number of tokens of the
input text. It is straightforward to show that de in equation 3 satisfies the property of (pseudo)-
distance: (i) It is non-negative; (ii) It equals zero whenever X1 X2; (iii) It satisfies the triangle inequality.
Our choice of equutionn 3 jis also motivated by the form of the optimal distance function dups in Propo- sition 3 can be viewed as a soft relaxation of dogt which is binary and involves hard indicators, making the objective function continuous and the optimization tractable. Notably, when py assigns any X .M probability proportional len(( for some 0 < the distance between any two texts produced by the LLM will be exactly zero. To the contrary, when Ps assigns very low probability to human-written text, the resulting distance between human- and LLM-authored text will be large.
Our above discussion also highlights the need to adaptively lear the language model Pe as opposed to using a fixed model. The ideal pa should: (i) assign low probability to human-authored text; (ii) assign probability more uniformly across tokens for L.L---geeertedd text. This differs from conventional LLMs, which aim to produce coherent, human-like text and therefore tend to assign high probability to human-authored text. Empirically, as demonstrated in the last two panels of Figure 2 the learned distance more effectively distinguishes between human- and LLM-aathored text compared to a fixed distance. Our experiments in Sacciio/4.4aalss show that, the learned distance function yields substantial improvements over using the initial pre-trained LLM.
To solve the optimization, we initialize Ps with a pre- pra-trained LLM and fine-tune a small subset of its parameters to facilitate the computation. This can be done by updating only the final layer

---

Published as a conference paper at ICLR 2026
employing low-rank adaptation (LoRA, Hu et al. 2022). Furthermore, since the rewritten text (XX) is stochastic, we mitigate its randomness by generating multiple reconstructions. Given a text X, we obtain K reconstructions X1 X....., X K. and estimate the reconstruction error as the average: K Ex- d(x, Xg). We classify X LLM-generated if this value is smaller than a predetermined threshold, and as human-authored otherwise. We summarize our procedure in Figure
EXPERIMENTS
We conduct extensive experiments to evaluate the effectiveness of our approach. To save space, we defer additional implementation details to Appendix D Our empirical study designed to answer the following three questions:
1. How does our method perform compared to state-of-the-art approaches under different prompts?
How robust is our method under adversarial attacks?
3. To what extent does learning the distance improve the detection accuracy?
To answer the first question, we compare our method, denoted as L.D (short for learn-to-distance). against 12 representative baseline detectors in Sections 4.1 and covering both zero-shot (left) and ML-based methods (right):
Likelihood (Gehrmann et al. 2019)
RoBERTa (Solaiman et al.
2019
Intrinsic dimension estimation (IDE, Tulchin- skii et al. 2023)
RADAR (Hu al.
2023
RADIAR (Mao al. 2024
Log rank ratio (LRR, Su et al. 2023
AdaDetectGPT (ADGPT, Zhou al. 2025)
Fast-Detectie DetectGPT (FDGPT, Bao et al.
2024
Imitate before detection (JmBD, Chen et al. 2025a)
BARTScore (Zhu et 2023
Binoculars HHns al. 2024
Learning rewriting (L2R, Hao al. 2025
We also employ 24 datasets and consider commonly used target LLMs such Llama-3-70B
Instruct (Dubey et al., (2024). Claude-3.5, GPT series (GPT-3.5 Turbo and GPT-4o, OpenAl APT Hurst al. 2024). and Gemini models (Gemini 1.5 Pro and Gemini 2.5 Flash, Team et al. 2024
2022
Comanici et al.) 2025) for generating LLM-written text.
To answer the second and third questions, we further consider settings under paraphrasing and de- coherence attacks in Section 4.3 and compare against variant of our approach that uses the initial pre-trained model Po without fine-tuning as the distance function in Section 4.4
Throughout, we have taken care to ensure fairness in all experimental comparisons. Specif- ically: (i) Both the baseline methods and our algorithm use the same base model, the rewrite and/or scoring model to maintain consistency. (ii) For each input text, we use the same set of rewritten texts across rewrite-based algorithms to ensure fair comparison. (iii) For algorithms such as ImBD that involve fine-tuning, we use the same optimization hyperparameters (e.g., number of epochs, learning rate) as ours across all cases to ensure fairness in training.
Finally, the area under the curve (AUC) is used as the metric for evaluation.
4.1 EXPERIMENTS ON DIVERSE DATASETS
We first evaluate method the dataset released by Hao al. 2025 which consists of human- written text from 21 domains, including academic writing, business, code, sports and religion. For each human- written sample, four L.-M-generated versions were created using Llama-3-7085 Instruct, Gemini 1.5 Pro, GPT-3.5 Turbo and GPT-4o, respectively, yielding total of 84 settings. Refer Hao et al. 2025) for the detailed prompts used to produce these LLM-generated texts.
https://gi http://gttttuu...m..aa.aaa www..o////aaaacco 1/12r_aatt

---

Published as a conference paper at ICLR 2026
Table 1: AUC scores of various detectors for detecting text generated by GPT-3.5 Turbo. The
highest scores are highlighted in cyan the second best in orange The last two columns show the percentage absolute gain (AG) and relative gain (RG) over the best baseline. With baseline score
and our score the absolute gain is (y- ()))) x 100%, and the relative gain is (y-x)) /1
2) X 100%.
Dataset
Likelihood
IDE
BARTScooe
FDGPT
Binocolans
RoBERTa
RADAR
ADGPT
RAIDAR
LmBD
1.0
AG (5)
RG
AcademicReseande
0.582
0.557
0.571
0
0.532
0.510
0.718
0.544
0,812
0.919
0.948
AnCulture
0.529
0.539 0.508
0.620
0.556
0.530
0.605
0.618
0.589
0.618
0.732
0.835
10.285
38.4
Busiieess
0.532
01563
0.574
0.639
0.657
0.656
0.564
0.587
0.518
0.704
0.861
0.914
5.314
38.1
Code
0.677
0.530
0.601
0.551
0.556
0.565
0.525
0.702
0.575
0.539
0.771
0.906
13:443
58.8
EducationMaeriial
0.561
0.813
0.705
0.808
0.785
0.707
0.708
0.547
0.557
0.961
0.996
0.513
Futatiineent
0.601
01645
0.725
0.866
0.305
0.745
0.750
0.887
0.510
0.875
0
0.982
Envirunmental
0.672
0.66
0.608
0.854
0.830
0.770
0.600
0.647
0.569
0.850
0.932
0.984
5.201
76.7
0.546
01008
0.77
0.507
0.750
0.956
3.086
6896
FeodCrvine
0.569
0.534
0.524
0.625
0.562
0.576
0.569
0.735
0.969
10.073
Govemment Public
0.572
0.692
0612
0.639
0.531
0.748
0.923
L.951
20.1
LegalDDcument
0.740
0.509
0.807
0.677
0.741
0.701
0.59h
0.819
0.503
0.595
0.991
0.991
0.250
29.2
CreratureCeateeW.iiii
0.541
(1520)
0.705
0.645
0.024
0.550
0.637
01306
0.655
0.784
0,992
01596
0.516
45.9
MidSicaTTest
0.553
0.564
0.518
0.591
0.620
0.600
0.919
0.679
0.586
0.654
0.754
0.878
7.374
29.9
NewsArticle
0.655
0.674 0.656
0.555
0.513
0,506
0.626
0.561
0.616
0.785
0.893
0.968
7.488
70.0
CnlineContee Contest
0,539
(1.25
0.512
0,711
0.054
BM632
0.59
0.504
0.541
0.745
01844
0.950
10,630
68.2
PeracnaCoommmiint
0.555
0.521
0.515
0.602
0.541
0.547
0.576
0.581
0.555
0.653
0.755
0.922
16,660
68.0
ProductRevigww
0.625
0.628
0.553
0.803
0.575
0.611
0.591
0.329
0.728
0.971
9.107
75.7
Religions
0.741
0.662
0.884
0.543
0.579
0.648
0,12
Sports
0.510
0.522
0.592
0.527
0.664
0.821
Technical Writing
0.504
0.559
0.569
0.594
0.537
0.916
0.739
0.919
081R
0.944
0.994
5.020
89.4
TravelTourisa
0.550
0.538
0.511
0.600
0.550
0.525
0.531
0.741
0.503
0.824
0.917
0.989
7.243
87.0
Avenae
0.593
0.580
0.000
0.080
0.639
0,618
0.395
0.701
0.551
0.745
0
0.548
5.789
52.5
Sid
0.066
0.001
0.080
0.113
0.095
0.078
0.066
0.112
0.042
0.099
0.082
0.047
Appendix B can be seen that our method achieves the best performance across nearly all combinations of datasets and target models. We focus on comparison against four baselines: (i) FDGPT, a training-free logits-based zero-shot approach; (ii) ADGPT and (iii) ImBD, both MIL-based variants of FDGPT. We include them because, similar to our algorithm, these methods require training. Note that ImBD typically ranks second overall and is the strongest among logits-based approaches; (iv) L2R, a rewrite-based method that also employs ML but learns the rewrite model rather than the distance function. We make two observations:
Results are reported in Tables I B1 and Tables B2 B5
1. First, our approach consistently achieves substantially larger AUC scores than FDGPT. Notice that, in Tables D BT and [3] the training and testing data differ in terms of models or data contexts, which reduces the inherent advantage of ML-based approaches over zero-shot methods such as FDGPT. Even under these shifts, our method continues to achieve the best performance in most cases. This comparison highlights our algorithm's 's robustmess distributional shiftss between the training and testing data, as well as its effectiveness relative to zero-shot methods.
2. Second, as shown in Tables I (16 19 out of 21), and the relative gain can reach up to 89.4% (see the rightmost column). This comparison highlights the advantage of rewrite-basse based methods over logits-based methods.
B2 and B3 our approach outperforms ImBD on most datasets
3. Third, since L2R does not provide public code, we directly compare against the reported results in their paper. Table B5 shows that method outperforms L2R on 20 out of 21 datasets, and often by a large margin. This comparison suggests that, compared with learning to rewrite, learning a distance function is more effective for rewrite- based detection.
4.2 EXPERIMENTS UNDER DIFFERENT PROMPTS
Next, following Chen al. (025a), we examine three scenarios that use different types of unseen prompts to generate LLM text: (i) rewrite, where the LLM rewrites auman-authore text while preserving its semantic meaning; (ii) expand, where the LLM elaborates on the text according to a style randomly selected from various options (e.g.. formal, literary); and (iii) polish, where the LLM refines the text based on the randomly chosen style.
We also consider three widely used benchmark datasets (Bao et al.) 2024 Chen et al. 2025a): (i) Wiki, which consists of Wikipedia-style question answering data (Rajpurkar et al. 2016); (ii) Story, which focuses story generation (Fan et al., 2018); and (iii) News, which is concerned with news summarization (Narayan et al. 2018).
We further generate LLM-authored text using three recent and popular proprietary models: (i) GPT- 4o: (ii) Claude-3.5 3.5-Haiku and (iii) Gemini-2.. 2omini-2.5-FFo 2.5--Fash. This yields a total of 27 settings. Details on how these texts were generated are provided in Appendix D
8

---

Published as a conference paper at ICLR 2026
Table 2: AUC scores across datasets, models, and tasks; best method highlighted in cyan second best in orange The last rows show the absoluate gain and relative gain of our approach over the best baseline in percentage. On Claude-3.5, GPT-40, and Gemini-2.5, the average absolute gain are 3.83%. 2.57%, 0.58%, and relative gain are 75.40%, 65.74%, 54.35%
3.5
GPT-40
Gemini
Daraset
Method
rewrite
polish
expand
Avg.
rewrite
polish
expand
Avg.
rewrite
polish
expand
Avg.
Likelibond
0.598
0.604
0.645
0.587
0.539
0.566
0.594
0.579
0.732
0.635
LRR
0.594
0.626
0.636
0.619
0.633
0.620
0.559
0.604
0,656
0.601
0.717
0.658
Binoculars
0.555
0.634
0.709
0.633
0.535
0.567
0.631
0.578
0.507
0.632
0.589
0.576
IDE
0.606
0.686
0.726
0.673
0.577
0.736
0.696
0.670
0.608
0.672
0.716
0.665
FDGPT
0,524
0.610
0.686
0.607
0.508
0.561
0.641
0.570
0.507
0.617
0.586
0.570
BARTScore
0.728
0.549
0.576
0.567
0.606
0.671
0.615
News
RoBERTa
0.544
0.524
0.546
0,538
0.509
0.532
0.568
0.536
0.501
0,566
0.567
0.545
RADAR
0.744
0.805
0.912
0.966
0.994
0.911
0.807
0.858
0.920
0.862
ADGPT
0,518
0.616
0.569
0.567
0.617
0.644
0.561
0.608
0,514
0.543
0.502
0.520
RAIDAR
0.934
0.919
0.942
0.932
0.882
0.900
0.866
0.882
0.800
0.948
0.921
0.890
ImBD
0.920
0.915
0.986
0.940
0.866
0.978
0.985
0.943
0.877
0,952
0,966
0.932
L2D
1,000
0.989
1,000
0.996
0.994
1,000
1,000
0.998
1,000
1,000
1,000
1.000
Gain (%)
1.4
4.8
3.4
6.8
Rel. Gain (%)
100.0
86.6
100.0
94.0
94.7
100.0
100.0
96.3
100.0
100.0
100.0
100.0
Likeliboud
0.519
0.532
0.562
0.538
0,546
0.553
0.649
0.583
0,505
0.512
0.533
0.517
LRR
0.532
0.508
0.540
0.527
0.541
0.612
0.695
0.616
0.522
0.508
0.536
0.522
Binoculars
0.608
0.667
0.762
0.679
0.619
0.717
0.862
0.733
0.571
0.768
0.793
0.711
IDE
0.565
0.621
0.613
0.600
0.584
0.712
0.682
0.659
0,573
0.642
0.699
0.638
FDGPT
0.587
0.646
0.597
0.712
0.867
0.725
0.557
0.748
0.791
0.699
BARTScore
0,760
0.634
0.520
0.638
0,785
0.592
0.529
0.635
0.605
0.590
0.615
0.603
Wiki
RoBERTa
0.635
0.659
0.759
0.684
U.565
0.590
0.522
0.559
0.638
0.740
0.782
0.720
RADAR
0.533
0.507
0.620
0.553
0.541
0.814
0.933
0.763
0.550
0.564
0.680
0.598
ADGPT
0.518
0.616
0.569
0.567
0.617
0.644
0.561
0.608
0.514
0.543
0.502
0.520
RAIDAR
0.889
0.900
0.920
0,903
0.845
0.871
0.851
0.856
0.848
0.927
0,950
0,908
LmBD
0.952
0.954
0.976
0.961
0.875
0.967
0.986
0.943
0.874
0,964
0.956
0.931
L2D
0,955
0.942
0.953
0.950
0,963
0.987
0.993
0.981
0,988
Abs. Gain (%)
0.2
8.8
1,9
0.6
3,8
10.9
1.8
3.2
5.3
Rel. Gain (%)
5.0
70.6
59.1
45.8
66.4
86.3
49.6
72.6
76.9
Likelihood
0.502
0.532
0.587
0.541
0.623
0.740
0.814
0.725
0.512
0.656
0.702
0.623
LRR
0.556
0.739
0.679
0.504
0.563
0.632
0.566
Binoculars
0.595
0.663
0.755
0.671
0.674
0.739
0.806
0.740
0.624
0.832
0.927
0.794
0.616
0.610
0.632
0.619
0,575
0.650
0.673
0.633
0.580
0.579
0.609
0.589
FDGPT
0,571
0.635
0.745
0.650
0.655
0.735
0.808
0.733
0.603
0.000
0.918
0.507
BARTScore
0.767
0.706
0.566
0.680
U.724
0.754
0.685
0.721
0.708
0.733
0.674
D.7U5
Story
RoBERTa
0.588
0.586
0.660
0.611
0,540
0.504
0.539
0.527
0.571
0.569
0.657
0.599
RADAR
0.597
0.614
0,510
0,574
0.507
0.756
0.827
0.697
0.560
0.513
0.619
0.564
ADGPT
0.755
0.789
0.617
0.698
0.657
0.729
0.692
0.658
0.693
RAIDAR
0
0.767
0.847
0.825
0.831
0.872
0.831
0.845
0.848
0.866
0.907
0.874
ImBD
0.954
0.905
0.976
0.945
0.933
0.985
0.964
0.961
0.979
0.990
0,993
0.987
L2D
0.999
0.955
0.995
0.983
0.982
0.997
0,980
0,986
0.984
0,999
0,997
0,993
Abs. Gain (%)
4.3
3.0
1.9
3.8
4.9
1.2
1.6
2.6
0.4
0.9
0.4
0.6
Rel. Gain (%)
97.8
53.0
81.2
79.4
44.8
65.4
21.4
87.1
62.4
46.4
Table presents the AUC scores for all detectors across the 27 combinations of datasets, target mod- els, and types of prompts. Our method achieves the best performance in nearly all cases, whereas ImBD (logits-based) or RAIDAR (rewrite-based) works the second best. The relative gain over these best baselines is 70.11% 1% on average, which again highlights (i) the advantage of based methods over logits-based methods in settings with unseen prompts; and (ii) the effectiveness of learning an adaptive distance function over using a fixed distance in rewrite-basse approaches.
4.3 EXPERIMENTS AGAINST ADVERSARIAL ATTACK
Following Bao et al. 2024)) we further evaluate the robustness of our method against two types of adversarial attacks: (i) Rephrasing, where the I.L.-written text is further paraphrased by a T5-based paraphraser before detection; (ii) Decoherence, where in each LLM --M-gnnertted sentence containing more than 20 words, two adjacent words are randomly swapped. Both attacks are designed to reduce the coherence of LLM ----eeeeerteed text and have been shown degrade the detection accuracy of existing detectors (Bao et al. 2024).
We conduct experiments on the same three datasets used in Section 4.2 resulting in total of six settings. For comparison, we focus on ImBD and RAIDAR, as they achieve the second best perfor- mance these datasets.
9

---

Published as a conference paper at ICLR 2026
News
Wiki
Story
AUC (Poraphrrasin)))
2.00
0,983
2.40
0.90
RAIDAR
ImaD
L20
RAIDAR
ImD
L20
RAIDAR
Im80
L20
AUC (Desoherence))
0.00
0.00
0.5
6.70
RAIDAR
In8D
L20
Ini8
L20
RAIDAR
Im8D
L2D
RAIDAR
ImBD
L2D
No Attack
With Altack
Figure 4: AUCs of ImBD, RAIDAR and our approach under paraphrasing (top panels) and decoher- ence (bottom panels). Each column represents dataset. For each method, two bars are plotted: the lighter one indicates AUC without attack, and the darker one indicates AUC under attack. The best method under attack is highlighted with bold bar edge, and its AUC value is displayed above the bar.
Figure reports the AUC scores with and without adversarial attacks. While RAIDAR achieves comparable or superior AUCs on Story and Wiki in the absence of attacks, its AUC drops substan- tially under attacks, failing maintain its lead. Similarly, ImBD's AUC declines considerably Wiki under the rephrasing attack. In contrast, our method remains robust: its AUC either increases or remains unchanged on News. and only slightly decreases on other datasets, achieving the best performance in each setting. This highlights the resilience of our approach to adversarial attacks and demonstrates its potential for reliable deployment in real-world scenarios.
4.4 ABLATION STUDY
We conduct an ablation study to compare against a version of our approach that uses the initial language model P& construct the distance (FD, denoting fixed distance). We consider the same settings to Section 4.2 and report the AUCs Table Our method consistently outperforms FD, with average improvement of 97.1%. These results clearly demonstrate the advantage of learning the distance metric over fixing the distance.
DISCUSSION
This paper studies the detection of LLM-ggnnrraed text. Our theoretical analysis offers geometric insights demonstrate the effectiveness rewrite-based approaches (Proposition [ and their bustness to unseen prompts (Proposition Methodologically, we beyond existing rewrite-based methods by adaptively learning the distance function, which theoretically grounded (Proposition 3) and delivers substantial empirical gains over both fixed-distance approaches (Section 4.4) and state-of-the-ae detectors (Sections and while maintaining robustness against adversarial
attacks (Section 4.3)
To conclude this paper, we remark that in our theoretical analysis, the assumptions were intentionally simplified (and thus stronger) to build geometric intuition behind these approaches. In Appendix A we have offered a more complex version of our theories under less restrictive assumptions. Finally, although our method achieves state-of-the-art detection accuracy in most settings, its computational cost remains relatively high and comparable to existing rewrite-bars based algorithms (e.g.. RAIDAR), due to the need to generate multiple rewrites (see Appendix for detailed runtime results). This represents a potential limitation. We also note that asynchronous rewriting and distance computation using vL.LM backend improve computational efficiency for practical deployment.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGEMENT
Hongyi Zhou and Ying Yang's research was partially supported by NSFC 12271286. The authors thank the anonymous referees and the chair for their insightful and constructive comments, providing significant improvement the initial paper.
ETHICS STATEMENT
The research presented this paper adheres to the ICLR Code of Ethics (attps://iclr.or publicc/Coee0ffhhiccc in all respects.
REPRODUCIBILITY STATEMENT
We have made substantial efforts to ensure the reproducibility of this paper. The assumptions of our method are declared in Section [2] and the proofs of the theoretical results are provided in Ap- pendix A The implementation details of our approach (e.g., the choice of hyperparameters) are described in Appendix C Additionally, the experimental setup and data generation procedures are explained in Section 4 and Appendix [ Together, these descriptions provide sufficient information for others to reproduce both our theoretical and empirical results.
REFERENCES
Scott Aaronson and H Kirchner. Watermarking of large language models. In Large Language Models and Transformers Workshop at Simons Institute for the Theory of Computing, 2023.
Harika Abburi, Kalyani Roy. Michael Suesserman, Nirmala Pudota, Balaji Veeramani, Edward Bowen, and Sanmitra Bhattacharya. A simple yet efficient ensemble approach for Al-generated text detection. In Sebastian Gehrmann, Alex Wang, João Sedoc, Elizabeth Clark, Kaustubh Dhole, Khyathi Raghavi Chandu, Enrico Santus, and Hooman Sedghamiz (eds.), Proceedings of the Third Workshop Natural Language Generation, Evaluation, and Metrics (GEM), pp. 413 421, Singapore, December 2023. Association for Computational Linguistics. URL https: http:p::///aalaattooooo.c.oooo
Anthropic. Claude 3: Next-generation ai models. 2024.
claude
Anmol Arora and Ananya Arora. The promise of large language models in health care. The Lancet, 401(10377):641, 2023.
Sanjeev Arora et al. Intrinsic dimension estimation for robust detection of ai-generated texts, 2023.
URL htttps://aaxi...rrrrrrr ab3// 04723 arXiv preprint.
Guangsheng Bao, Yanbin Zhao, Zhiyang Teng, Linyi Yang, and Yue Zhang. Fast-detectGPT: Efficient zero-shot detection of machine-generated text via conditional probability curvature. In The Twelfth International Conference on Learning Representations, 2024. URL https:
Cecilia Ka Yuk Chan and Wenjie Hu. Students' voices on generative ai: Perceptions, benefits, and challenges in higher education. International Journal of Educational Technology in Higher Education, 20(1): (033),43, 2023.
Jiaqi Chen, Xiaoye Zhu, Tianyang Liu, Ying Chen, Chen Xinhui, Yiwen Yuan, Chak Tou Leong, Zuchao Li, Long Tang, Lei Zhang, et al. Imitate before detect: Aligning machine stylistic pref- erence for machine-revised text detection. In Proceedings of the AAAI Conference Artificial Intelligence, volume 39, pp. 23559-23561 2025a.
Xin Chen, Junchao Wu, Shu Yang, Runzhe Zhan, Zeyu Wu, Ziyang Luo, Di Wang. Min Yang, Lidia S. Chao, and Derek F. Wong. RepreGuard: Detecting LLM-generated text by revealing hidden representation patterns. Transactions of the Association for Computational Linguistics, 2025b. //tp 13152
Accepted at TACL 2025.

---

Published as a conference paper at ICLR 2026
Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. In The Thirty Seventh Anmual Conference on Learning Theory, pp. 1125-1139 PMLR, 2024.
Gheorghe Comanici, Eric Bieber, Mike Schackermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Marcel Blistein, Ori Ram, Dan Zhang, Evan Rosen, al. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capa- bilities. arXiv preprint arXiv:2507.0626/ 2025.
Evan N Crothers, Nathalie Japkowicz, and Herna L Viktor. Machine-generated text: A comprehen- sive survey of threat models and detection methods. IEEE Access, 11:70977-71002, 2023.
Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, et al. Scalable water- marking for identifying large language model outputs. Nature, 634((8035)811-822) 2024.
Tirth Dave, Sai Anirudh Athaluri, and Satyam Singh. Chatgpt in medicine: an overview of its applications, advantages, limitations, future prospects, and ethical considerations. Frontiers in artificial intelligence, 6:1 6:1 169595, 2023.
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang. Angela Fan, et al. The Ilama 3 herd of models. arXiv e-prints, pp. arXiv-2407 2024.
Angela Fan, Mike Lewis, and Yann Dauphin. Hierarchical neural story generation. In Iryna Gurevych and Yusuke Miyao (eds.), Proceedings of the 56th Annual Meeting of the Associa- tion for Computational Linguistics (Volume 1: Long Papers), pp. 889-898, Melbourne, Aus- tralia, July 2018. Association for Computational Linguistics. doi: 10.18653/11/P18-1000 1082. URL
Xiao Fang. Shangkun Che, Minjia Mao, Hongzhe Zhang, Ming Zhao, and Xiaohang Zhao. Bias of ai-generated content: an examination of news produced by large language models. Scientific Reports, 14(1):5224, 2024.
Sebastian Gehrmann, Hendrik Strobelt, and Alexander M Rush. Gltr: Statistical detection and visualization of generated text. arXiv preprint arXiv: 04043, 2019.
Eva Giboulot and Teddy Furon. Watermax: breaking the LLM watermark ditectability-robusteee quality trade-off. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. URL htRpppttts://pppeete
Noah Golowich and Ankur Moitra. Edit distance robust watermarks via indexing pseudorandom codes. In The eighth Annual Conference on Neural Information Processing Systems, 2024.
URL httttp:://pppeeeieeeeeee http:/.eet/forrteeeeo forum? id 2d=5745k5557
Biyang Guo, Xin Zhang, Ziyuan Wang, Minqi Jiang, Jinran Nie, Yuxuan Ding, Jianwei Yue, and Yu- peng Wu. How close is chatgpt to human experts? comparison corpus, evaluation, and detection. arXiv preprint 2xXXi:2301.0799. 2023.
Hanxi Guo, Siyuan Cheng, Xiaolong Jin, Zhuo Zhang, Kaiyuan Zhang, Guanhong Tao, Guangyu Shen, and Xiangyu Zhang. Biscope: Ai-generated text detection by checking memorization of preceding tokens. Advances in Neural Information Processing Systems, 37:104065-104099 2024a.
Xun Guo, Shan Zhang, Yongxin He, Ting Zhang, Wanquan Feng, Haibin Huang, and Chongyang Ma. Detective: Detecting ai- di-generated text via lulti-level contrastive learning. In A. Glober- son, L. Mackey, D. Belgrave, Fan, U. Paquet, J. Tomezak, and C. Zhang (eds.), Advances in Neural Information Processing Systems, volume 37, pp. 88320-88333 88347, Curran Associates, Inc., 2024b. URL htt.:tttts///prceeeeeeee ngs. neuri ps c wwappperrrfleeeeeeeeeeeee 8c7 77:77c2228 c2 8b Paw.eaaaaaeeeeeeeeeeeeee .d
File/a
Abhimanyu Hans, Avi Schwarzschild, Valeriaa Cherepanova, Hamid Kazemi, Aniruddha Saha, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Spotting llms with binoculars: Zero-shot detection of machine-generated text. arXiv preprint arXiv:2401.12077 2024.
12

---

Published as a conference paper at ICLR 2026
Wei Hao, Ran Li, Weiliang Zhao, Junfeng Yang, and Chengzhi Mao. Learning to rewrite: Gener- alized LLM -ee-raageeeeeddde text detection. In Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Mohammad Taher Pilehvar (eds.), Proceedings of the 63rd Annual Meeting of the Association for Computational Linguisties ( /Volume I: Long Pupers), pp. -434,, Vienna, Austria, July 2025. Association for Computational Linguistics. ISBN 979-8-89176-251-00
doi: 1188533/1120000
acl-long.322.
long. 322/
Xinyi Hou, Yanjie Zhao, Yue Liu, Zhou Yang, Kailong Wang, Li Li, Xiapu Luo, David Lo, John Grundy, and Haoyu Wang- Large language models for software engineering: A systematic litera- ture review. ACM Transactions on Software Engineering and Methodology, 33(8):1-79, 2024.
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models. International Confer- ence on Learning Reprexentations, I 12))3, 2022.
Xiaomeng Hu, Pin-X Yu Chen, and Tsung-Yt Yi Ho. Radar: Robust ai-text detection via adversarial learning. Advances in neural information processing systems, 36:15077-15095, 2023,
Yifei Huang, Jiuxin Cao, Hanyu Luo, Xin Guan, and Bo Liu. Magret: Machine-generatee text detec- tion with rewritten texts. In Proceedings of the 31st International Conference on Computational Linguistics, pp. 8336-8348 2025.
Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Os- trow, Akila Welihinda, Alan Hayes, Alec Radford, et al. Gpt-4o system card. arXiv preprint AKKi:22100.21277 2024.
Daphne Ippolito, Daniel Duckworth, Chris Dallison-Burch and Douglas Eck. Automatic detec- tion of generated text is easiest when humans are fooled. In Dan Jurafsky, Joyce Chai, Natalie Schluter, and Joel Tetreault (eds.). Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp. 1808-1822, Online, July 2020. Association for Computational URL https::/ach anthoo ogy ogy.org/
Linguistics. doi: 10. 2t0.5/3//11222222ammma.aa ar2.0.m.mmai..11..
Ryuto Koike, Masahiro Kaneko, and Naoaki Okazaki. Outfox: LLM-generated essay detection through in-context learning with adversarially generated examples. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 21258-21266, 2024.
Walter Laurito, Benjamin Davis, Peli Grietzer, Tomáš Gavenčiak, Ada Böhm, and Jan Kulveit. Ai-ai bias: Large language models favor communications generated by large language mod- els. Proceedings of the National Academy of Sciences, 122(31))2241569712,, 2025. doi: pnas.
10.1073/pnas 2415697122 URLhttpe http://wwwwp.... pnas
2415697122
Hyunseok Lee, Jihoon Tack, and Jinwoo Shin. Remodetect: Reward models recognize aligned LLM's generations. In The Thirty-eighth Anmual Conference on Neural Information Processing Systems, 2024.
Elizaveta Levina and Peter Bickel. Maximum likelihood estimation of intrinsic dimension. Advances in neural information processing systems, 17, 2004.
Xiang Li, Feng Ruan, Huiyuan Wang, Qi Long, and Weijie Su. Robust detection of watermarks for large language models under human edits. Journal of the Royal Statistical Society: Series (Accept), 2025.
Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. Deepseek-v3 technical report. arXiv preprint arX1v:2412.19437, 2024.
Arjun Mahajan, Ziad Obermeyer, Roxana Daneshjou, Jenna Lester, and Dylan Powell. Cognitive bias in clinical large language models. npj Digital Medicine, 8(1):428, 2025.
Chengzhi Mao, Carl Vondrick, Hao Wang, and Junfeng Yang. Raidar: generative AI detection via rewriting. In The Tweifth International Conference on Learning Representations, 2024. URL
https://openreet net fotp:
13

---

Published as a conference paper at ICLR 2026
Lisa Messeri and Molly J Crockett. Artificial intelligence and illusions of understanding in scientific research. Nature, 627(8002):49-588 58, 2024.
Tomas Mikolov, Ilya Sutskever, Kai Chen, Greg Corrado, and Jeff Dean. Distributed representa- tions of words and phrases and their compositionality. Advances in neural information processing systems, 26, 2013.
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. De- tectgpt: Zero-shot machine-generaan text detection using probability curvature. In International Conference on Machine Learning, pp. 24950-24963 PMLR, 2023.
Sandra Mitrović, Davide Andreoletti, and Omran Ayoub. Chatgpt or human? detect and explain. explaining decisions of machine learning model for detecting short chatgpt-generated text. arXiv preprint arXiv:2301.1385) 2023.
Shashi Narayan, Shay B. Cohen, and Mirella Lapata. Don't give me the details, just the summary! topic-aware convolutional neural networks for extreme summarization. ArXiv, abs/ 0bs/1800 1808 008.08745, 2018.
Hoang-Quoe Nguyen-Son, Minh-Son Dao, and Koji Zettsu. Simllm: Detecting sentences gener- ated by large language models using similarity between the generation and its re-generation. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp. 22340-22353 2024.
OpenAI. Chatgpt. https://chatt www.ooeeea........ com December 2022. Accessed: April 28, 2025.
Hyeonchu Park, Byungjun Kim, and Bugeun Kim. DART: An AIGT detector using AMR of rephrased text. In Luis Chiruzzo, Alan Ritter, and Lu Wang (eds.), Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Lin- guistics: Human Language Technologies (Volume 2: Short Papers), pp. 710-721, April 2025. doi: 10.18653/v1/2025.nem hww.2/202..aaasssooroaoaaaa -..
Xinyi Qi. Kai Ye, Chengchun Shi, Hongyi Zhou, and Jin Zhu. A differenceeinnddiffeeeeee approach to detecting ai-generated images. 2026.
Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, and Percy Liang. SQuAD: 100,000+ questions for machine comprehension of text. In Jian Su, Kevin Duh, and Xavier Carreras (eds.), Pro- ceedings of the 2016 Conference on Empirical Methody Natural Language Processing, pp- 2383-2392, Austin, Texas, November 2016. Association for Computational Linguistics.
Matthew Renze. The effect of sampling temperature on problem solving large language models. In Findings of the association for computational linguistics: EMNLP 2024, pp. 7346-7356 2024.
Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can Al-generated text be reliably detected? stress testing Al text detectors under var- ious attacks. Transactions on Machine Learning Research, 2025. ISSN 2835-8856. URL https://gpenreviev..nt net www.omiiddoooeseeee.
Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert- Voss, Jeff Wu, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, et al. Release strategies and the social impacts of language models. arXiv preprint 1eXiv:1908.0020000 2019.
Yiliao Song, Zhenqiao Yuan, Shuhai Zhang, Zhen Fang, Jun Yu, and Feng Liu. Deep kernel relative test for machine--enerateer text detection. In The Thirteenth International Conference Learning Representations 2025. URL /tttps://operreeee
net (ttprrummiiiiiifoooo
Jinyan Su, Terry Yue Zhuo, Di Wang, and Preslav Nakov. Detectlim: Leveraging log rank informa- tion for zero-shot detection of machine-generated text. arXiv preprint arXiv:2306.0554p 2023.
Jingtao Sun and Zhanglong Lv. Zero-shot detection of llm-generated text via text reorder. Neuro- computing, 631:129829, 2025.
14

---

Published as a conference paper at ICLR 2026
Gemini Team, Petko Georgiev, Ving lan Lei, Ryan Burnell, Libin Bai, Anmol Gulati, Garrett Tanzer, Damien Vincent, Zhufeng Pan, Shibo Wang, et al. Gemini 1.5: Unlocking multimodal under- standing across millions of tokens of context. arXiv preprint wrXiv:2403.055.00 2024.
Yuchuan Tian, Hanting Chen, Xutao Wang. Zheyuan Bai, QINGHUA ZHANG, Ruifeng Li, Chao Xu, and Yunhe Wang. Multiscale positive-unlabeled detection of Al-generated texts. In The Twelfth International Conference on Learning Representations, 2024. URL https: 7 //openzeview.o wwt. http://oooonnaaaSlslp0....
Eduard Tulchinskii, Kristian Kuznetsov, Laida Kushnareva, Daniil Cherniavski, Sergey Nikolenko, Evgeny Burnaev, Serguei Barannikov, and Irina Piontkovskaya. Intrinsic dimension estimation for robust detection of ai-generated texts. Advances in Neural Information Processing Systems, 36:39257-39276, 2023.
Vivek Verma, Eve Fleisig, Nicholas Tomlin, and Dan Klein. Ghostbuster: Detecting text ghost- written by large language models. Kevin Duh, Helena Gomez, and Steven Bethard (eds.), Proceedings of the 2024 Conference of the North American Chapter of the Association for Com- putational Linguistics: Human Language Technologies (Volume Long Papers), pp. 1702-1717, Mexico City, Mexico, June 2024. Association for Computational Linguistics. doi: 10. 18 2024 man.a--ln...... URL https: BBtLtps//acaaathoooooo www.attolannttoooac..o org/ 2024 naaci -aneci--ee -long. 957
Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang, Hezhen Hu, Hong Chen, and Houqiang Li. Dire for diffusion-generater image detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 22445-22455, 2023.
Bram Wouters. Optimizing watermarks for large language models. In Proceedings of the 41st International Conference on Machine Learning, ICMI'224 2024.
Junchao Wu, Shu Yang, Runzhe Zhan, Yulin Yuan, Lidia Sam Chao, and Derek Fai Wong. A survey LLM-generated text detection: Necessity, methods, and future directions. Computational Linguistics, pp. 1-66, 2025.
Yihan WU, Zhengmian Hu, Junfeng Guo, Hongyang Zhang, and Heng Huang. A resilient and accessible distribution distriuution-preeerving watermark for large language models. In Proceedings of the 41st International Conference on Machine Learning, ICML'24 24, 2024.
xAI. Grok (version 4). https://grok. x. ai. 2025. Large language model, accessed July 9, 2025.
Yihuai Xu, Yongwei Wang, Yifei Bi, Huangsen Cao, Zhouhan Lin, Yu Zhao, and Fei Wu. Training- free LLM--geneated text detection by mining token probability sequences. In The Thirteenth International Conference on Learning Representations, 2025. htttth::://ppeeeeeeeoo net/ Sttt//ooummiddvooAlee jowKi
An Yang, Anfeng Li, Baosong Yang. Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. Qwen3 technical report. arXiv preprint arXiv:2505.09388, 2025.
Xianjun Yang, Wei Cheng, Yue Wu, Linda Ruth Petzold, William Yang Wang, and Haifeng Chen. DNA-GPT: Divergent n-gram analysis for training-free detection of GPT-generated text. In The Twelfth International Conference on Learning Representations, 2024. URL https: 7 //openeevew..oo www.:/eee/ooooooooo cortsttfoummmma www.mmiddddaxiieee.e.a
Xiao Yu, Kejiang Chen, Qi Yang, Weiming Zhang, and Nenghai Yu. Text fluoroscopy: Detect- ing LLM-generated text through intrinsic features. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen (eds.), Proceedings of the 2024 Conference on Empirical Methods Natu- ral Language Processing, pp. 15838-15846 Miami, Florida, USA, November 2024a. Associ- ation for Computational Linguistics. doi: 1188633/11/222..oml main.885. URL https:
//aclannthology.orr////02 emn 1 p-mmppmmi.. 8857
15

---

Published as a conference paper at ICLR 2026
Xiao Yu, Yuang Qi. Kejiang Chen, Guoqiang Chen, Xi Yang. Pengyuan Zhu, Xiuwei Shang. Weiming Zhang, and Nenghai Yu. DPIC: Decoupling prompt and intrinsic char- acteristics for LLM generated text detection. In A. Globerson, L. Mackey, D. Bel- grave, A. Fan, U. Paquet, J. Tomezak, and C. 7hang (eds.), Advances in Neural In- formation Processing Systems, volume 37, pp. 16194-16212. Curran Associates, Inc., files/paper/2022/ Paper Conference. pddf
2024b. URL htttps:/prroceeddgs..e.ee httprr/iss...ppeeeeeeee////////p
Weizhe Yuan, Graham Neubig, and Pengfei Liu. Bartscore: Evaluating generated text as text gener- ation. Advances in neural information processing systems, 34:27263-27277 2021.
Cong Zeng, Shengkun Tang, Xianjun Yang, Yuanzhou Chen, Yiyou Sun, zhiqiang xu, Yao Li, Haifeng Chen, Wei Cheng, and Dongkuan Xu. DLAD: Improving logits-based based detector with- out logits from black-box LLMs. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. URL http:ttts://opeeeeeee eww..wwww....................... net. formm? htw.mmmmdddheesssSSSSSS
Shuhai Zhang, Yiliao Song, Jiahao Yang, Yuanqing Li, Bo Han, and Mingkui Tan. Detect- ing gennertte texts by multi-population aware optimization for maximum mean dis- crepancy. In The Twelfth International Conference on Learning Representations, 2024. URL
htttps://openrewe wtt.eeeeeneeeoormmlee33333ee forum??66+3EKKaa33n
net
Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q Weinberger, and Yoav Artzi. Bertscore: Evaluat- ing text generation with bert. International Conference on Learning Representations, 2019.
Hongyi Zhou, Jin Zhu, Pingfan Su, Kai Ye, Ying Yang, Shakeel A O B Gavioli-Akilagun, and Chengehun Shi. Adadetectgpt: Adaptive detection of LLM-generated text with statistical guaran- tees. In The Thirty-Ninth Annual Conference on Neural Information Processing Systems, 2025.
Hongyi Zhou, Jin Zhu, Ying Yang, and Chengchun Shi. Detecting LLM-ggnnrated text with perfor- mance guarantees. arXiv preprint arXiv:2601.06586. 2026.
Biru Zhu, Lifan Yuan, Ganqu Cui, Yangyi Chen, Chong Fu, Bingxiang He, Yangdong Deng, Zhiyuan Liu, Maosong Sun, and Ming Gu. Beat LLMs at their own game: Zero-shot LLM- generated text detection via querying ChatGPT. In Proceedings of the 2023 Conference Em- pirical Methods in Natural Language Processing, pp. 7470-7483, 2023.
16

---

Published as a conference paper at ICLR 2026
A PROOFS AND ADDITIONAL THEORETICAL RESULTS
Proof of Proposition | well-defined. Then for any X' and E M, have
We further assume M is closed convex set so that the projection operator
(a - ( (l S..
Taking y = R(x), directly follows that
d' (x)) d' (a, R(x) - (x) +Ix(x))
d' Mm (2)) 2(x (z),, R(x) [m)(2)) + (R(x) IM(())
2 d' (I), R(x)) for all X.
Taking expectation on both sides with respect to X p. we obtain Ex~p {d' (x, R(X))) 2 Ex-p {d" (XI, ( ))} Ex-p {dr (II (XI))(X)))
where the last equality follows from Assumption 3 Finally, Assumption yields that
Ex-p {d (
((II = Ex~q (X, RX)))
Thus, the conclusion of Proposition |
follows.
Proof of Proposition 2 According to the definition of projection operator II and the fact that R(X) is supported on M, it is obvious that
d' ("X,R((X)
d' (M,
Furthermore, the distribution of Oprompt is also supported on M. Therefore, combining equation equation 2
we obtain
E x Aprampe d (X, R(X))
= Ex Ex-apt [d (II(X),
Ex exroomompe
(M))) + +e]
= Ex Exraprompa le| <.
(5)
Combining inequality equation 4 Iandd equation 5 the conclusion of Proposition 2 follows.
Additional Results. The geometric assumptions in Section 2 were intentionally simplified to make our propositions interpretable. fact, these assumptions could be relaxed to more realistic setting. Specifically, only assume
(i) Human- and -ggerrtee text lie on two nonlinear manifolds H and M C X, with their intrinsic dimensions dy > dmi
(ii) Rewriting satisfies EEd (R(x), x)] S Eo for any æ e MM and some small 0 Eo 1, whereas suP d' (æ1, x22 =
(iii) Human-written text distribution p is absolutely continuous with respect to some d, dimensiioall volume measure ya H. with bounded density.
Notice that (i) relaxes the linearity condition in Assumption 2 and does not assume that M is
projection or subspace of H. Meanwhile, the assumption d, > dm is well supported by empirical findings (Arora et 2023) which demonstrate that human text typically has intrinsic dimension of - 10, whereas LLM L-M-enerrtted text has a dimension of only 6 8 (Figure I(c), Arora et al. 2023).
Furthermore, (ii) only requires that, for L.LM-generaedd text, its reconstruction error is average small relative to the maximum distance in the space. It does not require the error to be almost surely small in the additive noise model, nor does require equivalence in Assumption 3. In our empirical study, we find the ratio of this expected reconstruction error to the maximum distance is consistently very small across multiple datasets (see Table Al).
Under these realistic assumptions, we obtain the following proposition:
Proposition. Let k. == dn dm- Under Assumptions (i)- for human text X and an LLM- generated text Y, the inequality
E Ex (d" (X, (X,X)) Ed ld'(Y, Y)]
17

---

Published as a conference paper at ICLR 2026
Table A1: Ratio of average reconstruction emror of L..M-generated text the maximum distance across different combinations of datasets and LLMs.
Dataset
GPr-3-Turbo
GPT-4o
Gemini- 1.S-Pro
Llama-3-70B
AcudemicRescarrh
0.065
0.074
0.074
0.059
ArtCulture
0,140
0.152
0.085
0.072
Business
0.114
0.073
0.048
0.078
Code
0.127
0.093
0.088
0.092
EducationMMatrial
0.031
0.050
0.076
0.026
Entertainment
0.071
0.072
0.050
0.037
Environmental
0.057
0,060
0.034
0.052
Finance
0.084
0.139
0.042
0.053
FoodCusine
0.140
0.104
0.178
0.062
GovernmentPublic
0.112
0.097
0.047
0.054
LegalDocument
0.129
0.285
0.084
0.154
LiteratureCreativeWe Writing
0.060
0.070
0.037
0.048
Medical'Text
0.163
0.169
0.069
0.107
Newslrticle
0.100
0.075
0.037
0.076
OnlineContent
0.138
0.207
0.049
PersonalCommunicttion
0.094
0.093
0.137
0.068
ProductReview
0.132
0.114
0.083
0.064
Religious
0.153
0.129
0.096
Sports
0.139
0.107
0.095
TechnicalWrrttng
0.082
0.083
0.043
TravelTourism
0.063
0.057
0.029
0.050
holds with probability at least O(=ii,, where the expectations on both sides average out fluctua- tions in the rewriting process.
Remark 1: Given that empirical results suggest is approximately 1.5 or 2 (Arora et al. 2023 the probability proves that the reconstruction error for human- wwitten text is, average, larger than that for LLM- generated text.
O can be very close to given that eo sufficiently small, which in turn
Remark 2: The proof of the proposition relies leveraging the assumption that M has strietly lower intrinsic dimension than H. Consequently, its ş e-neighborhood overlaps with at most an O(e*) fraction of the human-text manifold. As result, only small proportion of human-wen wartten text lie within the neighboordo of M; most human text lie farther away, leading to the a larger reconstruction error.
Proof: Formally, for = O, we denote the En tube (w.rt. d²) around M as (M) = fz E x: d' M) E
Classical tube formulas imply
O as as 4. Hence, under the bounded density assumption in (iii), d' some constant C. Therefore, with probability at least O(ei),
Px dx M) < co} - CC = O
(6)
xx) [d (X, X)] Ey EV (Y, Y) 2 d'XX, - >
The proof is hence completed.
Proof of Proposition 3: Given that d is bounded between 0 and some positive constant M, we have Ex<pld [d(X, R(X) .M and Ex-qpare [d(X, R(X) ] 2 0. Therefore, the reconstruction error is upper bounded by M. In what follows, we prove that by choosing d = dopt= we can achieve this upper bound.
To prove this, we assume (i) - (iii) hold. As commented earlier, these assumptions are mild and are supported by empirical observations. Under these assumptions, letting the value of eo in equation approach 0, it follows that
Px MM- 0.
18

---

Published as a conference paper at ICLR 2026
Additionally, notice that the rewrite R(X) always lies in MM, it follows that
E Ex- X R(X) E Exx=ppdope (X ((X)(X {HM)) M.
Additionally, since is supported on M, it follows that
Ex Ex-quon oppt (X, [[X)]=]] =
Thus, under distance dapt, the reconstruction error achieves the upper bound, which completes the proof.
B ADDITIONAL IMPLEMENTATION DETAILS AND NUMERICAL EXPERIMENTS
We first provide an outline of our algorithm, which can be summarized into the following four steps:
1. Collect a dataset of human-authored text (denoted by Di,) and prompt the target LLM (e.g., GPT-40) obtain an L.MM-generatd dataset (denoted by D..)
For each text X E D U Dm, prompt an open-source lightweight LLM (specified below) to rewrite it K times, and denoted the K reconstructions by X1,'.. Xx.
Learn distance function dæ that maximizes the difference in reconstruction errors between Di. and D.::
K de do (X, Xx)
K 1
max E Ex-DH
EXxDD
Σ
(x,
K
k=1
k=1
where do(X,, X2) architecture will be detailed below.
p po (X1)/ -log Pog (x2) and ps is language model whose
4. Given input text X, obtain its reconstructions X,,... Xx. If
K
Σ
dx,
K k=1
exceeds a predefined threshold, classify X as human-authored.
Table B1: AUC scores of various detectors for detecting text generated by GPT-4o.
Dataser
Lielihood
L.R
IDF
BARTSeae
FDGPT
Binoculars
RoBERTa
RADAR
ADGIPT
RAIDAR
ImBD
1.20)
AG (5)
RG (5)
RcusemicReseunch
0.527
0.503
0.557
0,651
0.648
0.539
0.166
0.631
0.512
0.821
0.941
0.977
3.562
60.5
AnCalture
0.518
0.570
(1.c0)
0.605
0.660
0.871
Business
0.506
0.779
0.599
0.02
0.605
Maberitionmtterill
0.643
0.754
0.734
0.583
0.952
0.996
Entertuineent
0.691
0.699
0.585
0.845
0.326
0.818
0.668
0.793
0.525
0.855
0.982
0.993
1.039
5R.6
kuvironmmntal
0.750
(1638
0.585
0.883
0.348
0.818
0.622
0.571
0.16
0.861
0.879
0.985
9.983
N7.1
Finance
0.630
0.641
0.503
0.824
0.753
0.726
0612
0.573
0.526
0.709
0.882
0.978
9.595
R1.1
RoodCusine
0.635
0.542
0.535
0.783
0719
0,699
0.588
0.507
0.512
0.703
0.915
0.969
5.476
64.1
GovemmentPPli
0.559
0.570
0.536
0.685
0.723
0.716
0.570
0.57%
0.552
0.677
0.909
0.941
3.565
39.1
LegalDoeumest
0.523
0.630
0.203
0.534
0.540
0.772
MedicalTest
0.506
NewsArtile
0.512
0.578
0.603
0.515
0.784
0.517
0.785
OnlineContent
0.554
0.570
0.513
0.700
0711
0.554
0.577
0.574
0.526
0.657
0.799
0.956
15.681
7k
PerscnalC Communcction
0.539
(1520)
0.000
0.571
0.023
0.616
0.511
01518
0.515
0.595
0.570
01873
20.351
61.7
ProdeeRRoview
0.682
0.670
0.512
0.804
0.740
0.751
0.583
0.544
0.538
0.691
0.893
0.977
8.195
75.4
Religious
0.666
(1593
0.566
0,802
0.521
11,009
0.555
07703
0.557
0.725
11369
0.590
2,025
66:1
Speets
0.564
0.511 0.515
0.565
0.641
0.644
0.507
0.556
0.506
0.681
0.828
0.903
7.534
43.
TechmicalWttingg
0.501
0.000
0.629
0.560
0.339
0.851
76.9
TonveTourisn
0.560
74.6
Avenag
0.581
0.532
50.3
0.093
0.013
19

---

Published as a conference paper at ICLR 2026
Table B2: AUC scores of various detectors for detecting text generated by Llama-3-70B-Imm Instrruct....
Tarasct
Liklihood
[RR
IDF
BARTSeor
FDCPT
Rinorulars
RoBERTa
RADAR
ATXiPT
RAIDAR
ImBh
1.20)
AC (8)
RG (8)
RessemicReseonch
0.656
0.597
0.522
0.625
0.793
0.756
0.528
0.718
0,314
0.634
0.950
0.986
0.596
29.8
AnCuluure
0.643
0.635
0.643
0.680
0.829
018335
0.538
0.586
0.626
0.630
0,902
0.545
4.302
43.7
Basiness
0.756
0.735
0.599
0.709
0.540
0.546
0.513
0.517
0.628
0.722
0.957
0.965
0.760
17.9
Code
0.554
0.31
0.574
0.620
0.765
0.761
0.556
0.621
0.561
0.725
0.886
0.951
6,421
56.5
EdheratooMatrrall
0.541
0.583
0.919
0.565
0.538
0.627
Entertammeen
0.23
0.815
0.387
0.980
0.778
03022
0,862
0.500
0.699
100.0
Pnvironmeutal
0.94
0.38
0.537
0.977
0:953
0.388
0,02
0.115
0.719
0.773
0,900
1.781
63.5
Finance
0.786
0.767
0.512
0.896
0.900
0.901
0.691
0.597
0.565
0.720
0.977
0.995
1,828
80.2
PsodCusine
0.800
(1088
0.569
0.827
0.854
0.843
0.356
0.542
0.551
0.629
0,978
0.599
2.111
96.0
Giveemmss Public
0.731
0.712
0615
0.718
0.571
0.870
0.572
0.571
0.564
0.634
0.961
0.972
1.057
27.3
LegaiDocumene
0.503
0.662
0.589
0.763
0.884
0.576
0.517
0.696
0.607
0.720
0,990
0.972
0
(1824
0.525
0.10
0.910
1.509
0.6%%
0.789
0.504
0.717
0.991
0.592
0.114
12.5
MedicalTest
0.761
0.679
0.571
0.648
0.509
0.706
0.552
0.621
0.521
0.635
0.914
0.937
2.262
26.6
NewsAridle
0.688
0.826
0.649
0.629
2.115
OnlineContent
0.780
0.732
0,850
0.915
0.644
0611
0.717
Perscoull Communication
0.691
0A225 0.540
0.6UT
0.700
0.761
0.535
0,522
0.596
0.718
0,838
0,550
11.199
699.3
ProduetReview
0.873
0.769 0.545
0.80
0.82
0.583
0.546
0.544
0.622
0,981
0.996
1.366
78.7
Religious
0.599
0.505 0.506
0.927
0.740
0.724
0.559
0.814
0.617
0.729
0.995
0.943
Sports
0.609
(1600
0.667
0.506
0.799
0.788
0.522
0.573
0.558
0.720
0
(.939
Technica
0.664
0.614
0.501
0.721
0.24
0.817
0.585
0.764
0.556
0.720
0.974
0.998
2.368
91.7
TravelLouriaan
0.664
0.614
0.501
0.721
0.824
0.817
0.555
0.764
0,510
0.634
0,982
0.996
1,346
75.4
Avergy
0.736
0.681
0 0.563
0.756
0.853
0.847
0.591
0.688
0.567
0.678
0.959
0.976
1,716
41.5
Sid
0.113
0.089
0.045
0.125
0.044
0.065
0.078
0.121
0.041
0.045
0.041
0.022
In our experiments, the training and testing data differ in terms of models or data contexts. Specifi- cally, in Tables] and BB] we train the distance function on text generated by GPT-4 and evaluate its and
performance to detect GPT-3.5- Turbo, and vice versa. In Table B3] we train the distance function on GPT-generated text but test on text produced by Gemini. Thus, in all three tables, the training and testing models are either completely different or belong to the same family but correspond to different versions.
Moreover, all reported results therein are obtained via cross-fitting: we use one category of data (e.g.. Story in Table 2 for testing and other categories (e-g.. News and Wiki) for training. Consequently, the test data differ in content and domain from the training data.
Table [eorrts the average AUC and runtime of our method compared with RAIDAR, a state-of- the-art rewrite-based detector, in the setting of detecting text generated by --rrb.5-Turbo (same to Table D. As shown, our runtime is very close to that of RAIDAR with only a slight increase while achieving substantial improvement in AUC. In addition, the reported runtime does not use vLLM backend; incorporating vLLM could further reduce computational cost.
Table B3: AUC scores of various detectors for detecting text generated by Gemini 1,5 Pro.
Dataser
Likelhood
LRR
IDF
BARTSeo
FDGPT Binoculars RoBERTa
RADAR
ADGPPT
RAIDAR
InBD
1.20
AG (5)
RG (5)
AcudemicRescunc
0.956
0.783
0.685
0.515
0.992
0.989
0.724
0.787
0.541
0.794
0.989
0.995
0.353
43.8
AnChlture
0.507
0.975
0.862
0.506
0.664
0.577
0.913
0.955
Business
0.791
0.784
0.703
0.872
0.985
20.5
0.567
0.618
0.805
0342
0.585
0.599
0.677
0.820
0.979
13.736
86.9
Malerilionmeeeiall
0.988
0.980
0/607
0.871
1000
1.000
0.889
0.911
0.50
0.968
Entertaineent
0.955
0.966
0.689
0.860
1.000
1,000
0.625
0.911
0.863
0.927
1,000
1.000
0.020
80.0
Euvironmental
0.722
(1931
0.506
0,775
0.998
0.997
0.532
0.625
0.530
0.891
0.887
0.997
Finance
0.930
0.573
0.548
0.745
0.991
0.903
0.620
0.583
0.590
0.829
0.903
0.998
0.577
78.
FoodCusine
0.704
0.608
0.566
0.552
0.901
0.895
0.573
0.594
0.572
0.791
0.992
0.986
GovemmentPobis
0.913
0.871
0.508
0.555
0.981
0.960
0.758
0.517
0.601
0.623
0.995
0.988
LegalDoeument
0.578
0.644
0.998
0.917
0.615
0.685
0.983
0.162
100LO
0.964
0.905
0.739
0.530
0.976
81.6
Medica/Test
0.954
0.855
0.775
0.556
0.984
0.965
0.822
0.505
0.608
0.685
0.961
0.963
NewsAriele
0.91
0.705
0.62
0.617
0.987
0.991
0.538
0.926
0810
0827
0.938
0.999
0.018
10.7
Onlin:Content
0.791
0.728
0.524
0.500
0.51
0.94]
0.568
0.636
0.702
0.786
0.834
0.973
2.207
44.6
Personal Communcction
0.813
(1678
0.582
0.559
0.570
0.871
0.682
0.632
0.59%
0.782
0.591
(1550
7.778
661.7
ProdietRoview
0.888
0.730
0.541
0.589
0.959
0.958
0.509
0.661
0.629
0.765
0.900
0.095
0.505
40.4
Religious
0.558
(1551
0.613
0.850
0.573
B.856
03554
01305
0.737
0.854
0.961
0.996
3,477
89.1
Spoets
0.811
0.667
0.785
0.790
0.934
0.929
0.772
0.560
0.597
0.694
0.808
0.965
3.110
47.3
TechmicalWttingg
0.929
0.785
0.751
0.656
0.999
0.986
0.735
0.556
0.927
0.969
LO052
98.5
TonveTouriso
0.929
0.656
0.986
0.788
0.532
63.2
Avarage
0.856
0.785
0.663
0:957
0.720
0.643
0.784
0.936
0.987
2,592
65.5
0.134
0.110
0.106
0.125
0.054
0.126
0.143
0.105
0.114
0.097
0.016
20

---

Published as a conference paper at ICLR 2026
Table B4: AUCs across combinations of datasets, models, and prompt types, with the best method highlighted in cyan. The average absolute gain is 35.6%. The average relative gain over FD is 96.0%.
Clande-3.5
GPT-4o
Gemini
Dataset Method
polish expand
Avg. rewrite polish expand Avg.
polish expand Avg.
0.541
0.539
0.576
0.552
0,525
0,515
0.579
0.540
0.576
0.613
0.645
0.611
News
L2D
1,000
0.989
1,000
0.996
0.994
1,000
1.000
0.998
1,000
1,000
1,000
1.000
0,532
0.589
Wiki
L.D
0.955
0.942
0.953
0.950
0.963
0.987
0.993
0.981
0,983
0.982
0.988
0.984
FD
0.612
0.647
0,728
0.662
0.683
0.821
0.892
0.799
0.641
0.800
0.856
0.766
Story
1.D
0.999
0.955
0.995
0.983
0.982
0.997
0.980
0.985
0.984
0.999
0.997
0.993
Table B5: Comparison between learning rewriting (1.2R) and proposal. As L.2R does provides their implementations, we paste the results of Table in Hao et al. (2025) into the Table. We can see that our proposal surpasses L2R in 20 datasets,
Method
Acndemicceeeunch EducationMaterial FoodCasine Medicallext
ProductReview
TravefTburism
ArtCllture
0.7857
0,9689
0.9885
0.9906
0,9007
0.9083
0.9948
0.9933
0.9204
Method
Entertainnentt
GovenmentPublic NewsArticle
Religious
LiteaturCrreiivWWWiingg
Environmental
LegalDocument
1.21>
0.9993
0.9620
0.99W
0.9636
0.9917
0.9902
0.98
Method
OnlineContent
Sports
Code
Finance
Business
Personaloommusicuaie
Technica/Writing
L2D
0.9666
0,9308
0.9551
0.9912
0,9562
0.9334
0.9943
Table B6: Comparison of average AUC and runtime between RAIDAR and our method. Absolute AUC gain is computed as (AUC AUCRAIDAR) 100% and relative AUC gain computed as
(AUCouss AUCRAIDAR ) AUCRAIDAR) 100%.
Method AUC
Runtime (s)
Gain (Abs. & Rel.)
RAIDAR
0.762
6.348
L.2D
0.941
6.468
17.90% 75.2%
400
80
70
0.950
Runtime (s)
350
VRAM (GB)
AUC
0.925
300
50
0.900
40
30
0.875
200
20
K
Figure B1: AUC, runtime for training, and memory usage during training when K increases.
It is well known that varying the sampling temperature produces different outputs from LLMs, and adjusting temperature is a commonly used strategy real-world LLM usage (Renze 2024). In practice, when collecting text from an LLM, the specific temperature setting is typically unknown. therefore important to evaluate whether our method remains robust when training and test data generated with different temperatures.
Following the same data generation process described Section 4.3 we extend the setting to in- clude six temperature values: {0.01, 0.2, 0.4, 0.6, 0.8, 1.0J. For evaluation, we partition the datasets into training and testing splits based on temperature. Specifically, one split uses {0.2, 0.6, 0.8) for training and f0.01, 0.4, 1.0) for testing, and the roles reversed in the other split. This design mimics realistic scenarios where data collected at one set of temperatures are used to detect text generated at unseen temperatures.
21

---

Published as a conference paper at ICLR 2026
As shown in Figure B2 method achieves performance nearly identical to the where training and test data share the same temperature. These results highlight the robustness of our approach under temperature variation.
News
Wiki
Story
1.00
0.95
AUC
0.90
0.85
0.80
0.0
0.2
0.4
0.6
0.8
1.0
0.2
0.4
0.6
0.8
1.0
0.0
0.4
0.6
0.8
1.0
Temperature
Temperature
Temperature
Figure B2: AUCs under varying temperatures. Each column corresponds to dataset. Dashed lines indicate performance when training and test data generated with the same temperature.
C IMPLEMENTATION
Prompt for rewriting. The prompt set as: You are a rewriting expert and you would rewrite the text without missing the original details. Return ONLY the rewritten version. Do not explain changes, do not give multiple options, and do not add commentary. Original text:.
To generate rewritten texts, we employ an sourcs model available on HuggingFace, i.e., google/ poogle/gemma- -t... We recommend using instruction fine-tuned variant, as it is more likely to produce faithful rewrite. In addition, the model should contain least a billion parameters, since smaller models often fail to generate reliable rewrite. Choosing open-source LLM does not require access to proprietary models like ChatGPT and Grok, making our approach being affordable and accessibility. We set the max new tokens as the 1.2 times of the number of tokens in X, and the min new tokens as the 0.8 times of the number tokens in X.
Rewrite times K. The parameter K plays critical role in balancing computational cost and detec- tion performance. Increasing K improves the accuracy of estimating т, but at the expense of longer training time-since probabilities memory requirements during backpropagation. Figure [BT illustrates the trade-off: while larger K generally improves performance, the gains diminish beyond small values, whereas the runtime and memory usage grow roughly linearly. Notably, as long as K 1, the AUC remains strong. Moti- vated by this observation, adopt modest choice of K 4 throughout all experiments, striking a balance between accuracy and efficiency.
..ti).....P...
... P& X x) must all be computed and higher GPU
Fine-tuning setting. In specific fine-tuning, set the distance function (x. X2) log (X1)/ien(XX))
log P (k 1, This normalization accounts for text length, longer text expected to correspond to smaller log-likeli rogliiklihood. Without loss of generality, we set Pg as the model used for generating the rewritten text. We fine-tune the model, employ LoRA (Hu et al., (2022) implemented the peft library, with rank parameter set to 8, lora_alpha set to 32, and lora_dropout set to 0.1, and the other parameters use the default settings.
where (en(X;) is the number of tokens X;
D EXPERIMENTS: DETAILS
This section describes the experimental setup in detail. It is worth noting that throughout all exper- iments, we use AUC as the evaluation metric, and the relative gain over the strongest bascline is computed as: (Our AUC StrongestBaaeline's AUC)/(1.0 StrongestBaseline's AUC).
22

---

Published as a conference paper at ICLR 2026
D.1 EXPERIMENTAL SETUP ON DIVERSE DATASETS
Setup for learning-basse methods. For fairness, we follow consistent training protocol across training-based detectors. Specifically, for each method, we train on 10 out of the 21 datasets and evaluate on the remaining ones. We then repeat the process by swapping the training and test splits, ensuring that no evaluation data leaks into training and guaranteeing a fair comparison. For RoBERTa and RADAR, since only pre-trained checkpoints are publicly available, we directly use the models released on HuggingFaceil] This setup also enables reasonable comparison with L2R, which uses 70% of each dataset for training and the remainder for testing. In contrast, our method trains on fewer datasets and the evaluation datasets are out of domains yet still achieves better per- formance, highlighting the effectiveness of learning procedure.
Setup for zero-shot methods. For zero-shot detectors, we employ the same open-source LLMs as surrogate models to compute their statistical measures. These include Likelihood, IDE, and LRR. Notice that, the implementation of IDE provide two method for estimating intrinsic dimension, one based on persistence homology and another is based on maximum likelihood estimation (Levina & Bickel 2004). Since the former requires large amount of time computing, likelihood estimation in the experiments. For Binoculars and FDGPT, which require both a sampling model and scoring model, as the sampling model. For BARTScore, which also involves rewriting, we align its rewriting step with our own method while using the pre-trained BARTScore model from HuggingFace compute distances.
maximum
ps the scoring model and use its corresponding base model
D.2 EXPERIMENTAL SETUP DIFFERENT PROMPTS
Data generation. We generate machine- gennrrttd texts with three state-of-the-art LLMs: GPT- 4o, Claude-3.5-Haiku, and Gemini-2.55Flass They specific version are: gpt 1pt-44-2224-000 -0--46088,6--- Saaude-----haiku-2000
We next describe the specific system prompts and user prompts that are used for generating texts. First, for the rewrite task, the system prompt is:
System Prompt on Rewrite
You are professional rewriting expert and you can help paraphrase this paragraph in English without missing the original details. Please keep the length the rewritten text similar to the original text.
For the polish task, the system prompt is:
System Prompt on Polish
You are a professional polishing expert and you can help polish this paragraph.
For the expand task, the system prompt is:
System Prompt on Expand
You are a professional writing expert and you can help expand this paragraph.
For Gemini- 2.5 -- and Claude -- Haiku, we additionally append the instruction in
the system prompt:
23

---

Published as a conference paper at ICLR 2026
Return ONLY the rewrittee//oliishdeeeepprre version. Do not explain changes, do not give multiple options, and do not add commentary.
This ensures the output is strictly aligned with the assigned task.
The prompt depends the task. For rewriting, it takes the form: Please rewrite: (a human t. For the expansion task, one of several predefined style prompt is selected (e.g,, "Expand but not extend the pazagraph in oral style" "Expand but not extend the paragraph in a literary style"). For polishing, prompt similarly chosen from predefined se (e.g., "Help me refine paragraph with lyrical touch. Enhance the flow and imagery, making the words sing together perfect harmony").
fo
Given these settings, each LLM generates texts from human-written texts randomly sampled from one of source datasets. In the generation process, we set the temperature parameter of LLM as 0.8. This process is repeated 100 times on one source dataset and one task, yielding a dataset of 100 machine-generater and 100 human-written texts. With three tasks, three LLMs, and three data sources, we obtain total of 27 evaluation datasets.
Setup of Baselines. Baseline setups largely follow the procedure Section D.1 with slight mod- ifications to the training data. For instance, when evaluating performance the News dataset, the Wiki and Story datasets are used for training. The process is repeated analogously when evaluating on the Wiki or Story datasets.
D.3 EXPERIMENTAL SETUP FOR ADVERSARIAL ATTACKS AND ABLATION
To evaluate the robustness of our approach against adversarial attacks, we adopt the attacks in Bao al. 22244. In particular, for the rephrasing attack, we use the T5-based paraphraser available on HuggingFace to paraphrase text generated by Claude-3.5 prior to detection.
In the ablation study, both FD and our method rely on the exact same rewritten texts to compute distance. This setup reflects the contribution of our adaptive distance learning procedure.
E DECLARATION: LLM USAGE
In preparing this paper, the LLM was used only for writing and editing, and it does not impact the core methodology.
json
ht http:///hth...ooo//////////////a
json
24


Reviews:
[{"review_id": "oKAiCYLTap", "reviewer": "Reviewer_7oJT", "summary": "This paper proposes a fine-tuning approach for pre-trained LLMs that aims to maximize the divergence in reconstruction errors between human-rewritten and LLM-rewritten text. The method is grounded in the assumption that LLM-generated texts form a subset of human-written texts, and that this relationship persists in their semantic projections—thus justifying the adopted distance-learning strategy. Evaluated through extensive experiments, the method is shown to outperform existing baselines. The primary contribution of this work is a novel perspective on modeling the divergence between LLM-generated and human-written text, coupled with comprehensive empirical validation of the method's effectiveness.", "questions": "My questions and comments have been stated in the detailed comments.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The paper presents a well-structured categorization of existing methods for detecting human-written and LLM-generated text, help building a clear roadmap and contextualizing its own research direction.\n\n2. It introduces a novel perspective centered on maximizing the discrepancy between human-written and machine-generated text, which is supported by well-motivated theoretical assumptions.\n\n3. The method's effectiveness is validated through extensive experiments, which include comparisons against a wide range of baselines across multiple datasets.", "weaknesses": "1. The paper mentions that \"adaptively learn a distance function\" to enhance detection performance, but the implementation of this adaptive learning process is not clearly described. \n\n2. The pre-trained LLMs used in the experiments are not explicitly identified, making it difficult to assess the experimental setup with confidence. Given the importance of model selection in evaluating the contribution of the work, such implementation details should be unambiguously stated.\n\n3. There is an apparent discrepancy between the reported \"relative gain\" (e.g., claims of 100% improvement) and the modest absolute improvements observed in the AUC scores. Although the calculation method is provided in the appendix, the presentation in the main text can be misleading. Highlighting large relative gains derived from small absolute baselines may overstate the practical advancement and requires clearer contextualization to avoid confusion.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LlYV2XTOCa", "reviewer": "Reviewer_oNqV", "summary": "This paper addresses the prompt-robust detection of LLM-generated text, a realistic and challenging setting where the prompts used to produce the text are unobserved. The authors propose a geometric interpretation of rewrite-based detection methods, proving why reconstruction errors differ between human and machine text (Proposition 1) and remain robust to prompt-induced distribution shifts (Proposition 2). Building on this, they introduce a machine-learning-based rewrite detector that learns a distance function via fine-tuning a language model, rather than relying on fixed metrics like BERTScore or Levenshtein distance. Extensive experiments across 24 datasets, 7 LLMs, and 3 prompt types show relative AUC improvements of 45–62% over the strongest baselines, with strong resistance to adversarial paraphrasing and decoherence attacks.", "questions": "Although this is a well-motivated paper that advances in prompt-robust LLM detection, I still have a few questions that I would truly appreciate if the authors could kindly address during the rebuttal:\n- The experiments convincingly demonstrate robustness to paraphrasing and decoherence attacks. Could the authors kindly comment on how the method might behave under stronger semantic-preserving perturbations (e.g., back-translation, style transfer), or whether they foresee any limitations under such conditions?\n- While the average AUC gains are impressive, the tables do not include variance or confidence intervals. Would it be possible for the authors to share whether these results were averaged over multiple random seeds, and how stable the improvements are across runs?\n- Finally, since the approach requires multiple rewritings and fine-tuning, could the authors give a sense of the computational cost? For example, how much GPU time is typically needed?", "limitations": "", "rating": 8, "confidence": 2, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "- Introduces a clear geometric interpretation of rewrite-based detectors, offering theoretical insight that previous empirical works lacked.\n- The learned-distance formulation bridges theory and implementation elegantly, and the optimization is compatible with LoRA-style fine-tuning for scalability.\n- Evaluated on > 100 settings (24 datasets, 7 LLMs, 3 prompt types, 2 attacks) with consistent superiority over 11 baselines.\n- Addresses the realistic \"unseen-prompt\" condition that undermines most prior detectors, and demonstrates resilience under paraphrasing/decoherence.", "weaknesses": "- The Hilbert-space and projection assumptions (Assumptions 1–3) are strong, but empirical verification of these geometric hypotheses is limited.\n- The authors mention small declines on certain datasets but do not analyze why the learned distance struggles there.\n- Because the detector is trained using LLM-generated corpora, it may implicitly learn stylistic or semantic regularities specific to those generation distributions. Discussing how well the method generalizes beyond the seven tested generators (e.g., to unseen LLM families) would strengthen the paper.\n- Fine-tuning a surrogate model to learn the distance is non-trivial; runtime and parameter-efficiency trade-offs are not quantified.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "H1K3e3bGA9", "reviewer": "Reviewer_pN4E", "summary": "This paper proposes a prompt-robust detection framework for LLM-generated text based on a geometric understanding of rewrite-based methods. The authors show that human-written texts exhibit larger reconstruction errors than LLM-generated ones, and that this difference remains stable even under unseen prompts. Building on this insight, they introduce a method that learns an adaptive distance function between an input text and its rewritten version using a fine-tuned language model, rather than relying on fixed distances such as BLEU or BERTScore. Experiments across many datasets and several LLMs demonstrate improvement over baselines.", "questions": "1. The theoretical framework relies on strong geometric assumptions (e.g., LLM text as a projection of human text). Have you empirically verified or tested how well these assumptions hold in practice?\n\n2. How well does the learned distance function transfer to new or unseen LLMs without re–fine-tuning?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The paper is well organized and easy to follow\n2. Important and timely topic\n3. prompt robustness is very important for these trained llm-text classifiers.", "weaknesses": "1. My major concern lies in the geometric assumptions underpinning the theory, which are elegant but often unrealistic in practice. The framework assumes that LLM-generated text is a linear projection of human-written text onto an “LLM subspace” (Assumption 2) and that rewriting behaves equivalently on human and LLM-like inputs (Assumption 3). However, real-world text generation is highly nonlinear and context-dependent, and rewriting can amplify stylistic or semantic differences depending on prompts, temperature, and decoding randomness. The additive noise model  R(x) = \\Pi_M(x) + e  also oversimplifies rewriting dynamics, as  e may not be small or confined to the same subspace. Consequently, the theoretical claims (Propositions 1–2) serve more as conceptual heuristics than as formal guarantees of robustness.\n\n2. From a practical standpoint, the proposed approach faces several deployment challenges. First, it requires direct access to the target LLM for rewriting, which may not always be feasible in real-world . This dependency makes the method less suitable for general-purpose detection across unknown or evolving models. Second, the approach involves fine-tuning a distance model to adapt to each target LLM’s text distribution. This fine-tuning step also risks overfitting when the available training data are limited in domain diversity or prompt variety, potentially reducing generalization to unseen contexts. Finally, the paper offers little analysis on scalability and runtime efficiency, especially for long documents or large-scale batch detection scenarios where repeated rewriting and distance computation could become prohibitively expensive. These constraints limit the method’s immediate practicality despite its strong empirical performance.\n\n3. In my understanding, your method requires fine-tuning the detector for each target LLM. Given this, is it fair to directly compare your approach with previous rewrite-based or other detection methods that operate in a zero-shot or non–fine-tuned setting? How do you ensure that the comparison across methods remains fair and consistent?\n\nIn general, I would consider this a borderline paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "u8Jhd3n4Qu", "reviewer": "Reviewer_J3u5", "summary": "This paper proposes a new rewrite-based detection algorithm for the detection problem of LLM generated text. The author first analyzes the principle and robustness of rewriting detection algorithms from a geometric perspective, and then proposes a new method for adaptive learning text rewriting distance.", "questions": "1. What are the detailed training settings (loss function, optimizer, learning rate, batch size, training steps)?\n\n2. Does Figure 2 involve an unfair comparison between a trained detector and zero-shot baselines?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. Clear theoretical insight:\nThe geometric analysis (Propositions 1 & 2) provides an explanation for why rewrite-based approaches remain robust in unseen prompt scenarios.\n\n2. Extensive experimentation:\nThe experiments are comprehensive — 27 settings across 3 datasets, 3 prompt types, and multiple target models (Claude-3.5, GPT-4o, Gemini-2.5) — showing consistent improvements.\n\n3. Adversarial robustness:\nThe evaluation under paraphrasing and decoherence attacks demonstrates the proposed method’s strong robustness.", "weaknesses": "1. Questionable novelty of “Prompt-robust detection”:\nThe notion of prompt-robustness largely overlaps with prior work on generalization detection, where detectors are expected to perform under unknown prompts or semantic variations. Many existing zero-shot methods (e.g., DetectGPT, Fast-DetectGPT) are already prompt-agnostic, so it’s unclear whether the proposed notion is truly new.\n\n2. Fairness of comparison (Figure 2):\nThe proposed method requires training, whereas Fast-DetectGPT is a zero-shot detector. Comparing them directly may be unfair since the proposed approach has access to additional supervision and compute.\n\n3. Lack of implementation details:\nThe paper is vague about key training aspects, such as the architecture of the distance module, learning rate, optimization steps, dataset scale, or fine-tuning hyperparameters. This limits reproducibility.\n\n4. High computational cost:\nThe method involves multiple LLM queries — one for rewriting and another for distance computation — which can be prohibitively expensive in large-scale or real-time scenarios.\n\n5. Misleading improvement reporting:\nThe “relative gain” metric (e.g., “average improvements of 45.3%–62.5%”) can exaggerate the results. For example, when AUROC improves from 0.951 to 0.987, the absolute gain is minor (~0.036), yet the table reports a 72.9% “relative gain.” Reporting absolute AUC improvements would be more transparent and standard.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)